1. Introduction

RentalRep (Pty) Ltd (“RentalRep”, “we”, “us”, or “our”) operates the RentalRep platform at rentalrep.co.za (the “Platform”). We provide a verified rental reputation service for tenants, landlords, and estate agencies in South Africa.

This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African privacy legislation.

By registering on or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the Platform.

2. Who We Are

RentalRep is the Responsible Party for the personal information processed through the Platform, as defined under POPIA.

Information Officer: Linee Sian Havinga

Contact: privacy@rentalrep.co.za

Platform: rentalrep.co.za

3. What Personal Information We Collect

3.1 Account Registration Data

• Full name
• Email address
• Phone number
• South African ID number (for identity verification)
• Role on the Platform (Tenant, Landlord, or Estate Agency)
• Suburb / location
• Profile photograph (optional)

3.2 Lease Agreement Data

• Property address
• Lease start and end dates
• Uploaded lease agreement documents (PDF)
• Names of other parties to the lease

3.3 Review and Rating Data

• Written reviews submitted by or about you
• Star ratings across category scores
• Overall reputation score (calculated by the Platform)
• Whether a review was submitted anonymously

3.4 Payment Data

• Subscription plan selected
• Payment transactions processed via PayFast

Note: We do not store your full credit card or banking details. All payment processing is handled by PayFast, a PCI-DSS compliant payment processor.

3.5 Technical and Usage Data

• IP address
• Browser type and device information
• Pages visited and features used on the Platform
• Login timestamps

4. Why We Collect Your Information (Lawful Basis)

4.1 Consent

By creating an account and submitting reviews, you consent to our collection and use of your personal information for the purposes described in this policy. You may withdraw consent at any time by requesting account deletion (see Section 8).

4.2 Contract Performance

Processing is necessary to provide the services you have requested — including verifying lease agreements, enabling review submissions, and displaying reputation scores.

4.3 Legitimate Interest

We process certain data to protect the integrity of the Platform, prevent fraudulent reviews, and improve our services. We have assessed that this interest does not override your rights and freedoms.

5. How We Use Your Information

We use your personal information for the following purposes only:

• To create and manage your account
• To verify lease agreements and prevent fraudulent reviews
• To calculate and display your reputation score
• To enable tenants, landlords, and agencies to review each other
• To send you notifications about your account, new reviews, and score changes
• To process subscription payments via PayFast
• To respond to your support queries or complaints
• To detect and prevent abuse, fraud, or violations of our Terms of Service
• To comply with legal obligations

We will not use your personal information for any purpose not listed above without first obtaining your explicit consent.

6. Who We Share Your Information With

We do not sell your personal information. We share it only in the following limited circumstances:

6.1 Other Platform Users

Your public profile (name, suburb, role, reputation score, and non-anonymous reviews) is visible to other registered users of the Platform. If you submit a review anonymously, your name will not be displayed, but the review content will be visible.

6.2 Estate Agency Subscribers

Agencies with a paid subscription may access your public reputation score and verified review history as part of their tenant screening or landlord verification service. They cannot access your SA ID number, contact details, or any data that is not on your public profile.

6.3 Service Providers

We use third-party service providers to operate the Platform:

• Supabase (database and authentication) — data hosted in EU West region
• Vercel (platform hosting) — hosted in the United States
• PayFast (payment processing) — South Africa

All service providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

6.4 Legal Requirements

We may disclose your personal information if required to do so by law, court order, or to protect the rights and safety of RentalRep, our users, or the public.

7. Cross-Border Data Transfers

Some of the third-party services we use (including Supabase and Vercel) store data outside South Africa. By using the Platform, you consent to this transfer. We take reasonable steps to ensure that any third party receiving your data provides an adequate level of protection consistent with POPIA.

8. Your Rights Under POPIA

8.1 Right to Access

You may request a copy of all personal information we hold about you. We will respond within 30 days of receiving a valid request.

8.2 Right to Correction

If any of your personal information is inaccurate or incomplete, you may request that we correct it.

8.3 Right to Deletion

You may request that we delete your account and associated personal information. We will action this within 30 days, subject to any legal obligations that require us to retain certain records.

8.4 Right to Object

You may object to the processing of your personal information where we rely on legitimate interest as our lawful basis.

8.5 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at: privacy@rentalrep.co.za

We may require you to verify your identity before actioning any request.

9. Review Retention Policy

Reviews are retained on your public profile for a period of seven (7) years from the date of publication, after which they will be archived and removed from public view. You will be notified by email prior to archival.

Lease agreement documents uploaded to the Platform are retained for the duration of your account and deleted within 90 days of account closure, unless retention is required for an ongoing dispute.

10. Data Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These measures include:

• Row-level security (RLS) on our database, ensuring users can only access their own data
• Encrypted data transmission (HTTPS/TLS)
• Authentication via Supabase Auth with email verification
• Regular access reviews for any staff or contractors with database access

Despite these measures, no system is completely secure. If you believe your account has been compromised, please contact us immediately at privacy@rentalrep.co.za.

11. Data Breach Notification

In the event of a data breach that is likely to result in harm to you, we will:

• Notify the Information Regulator as soon as reasonably possible
• Notify affected users within 72 hours of becoming aware of the breach
• Provide details of the nature of the breach, the information affected, and the steps we are taking

12. Cookies and Tracking

The Platform uses essential session cookies required for authentication and to keep you logged in. We do not currently use advertising cookies or third-party tracking cookies. If this changes, we will update this policy and notify you.

13. Children

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at privacy@rentalrep.co.za and we will delete the account promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For any privacy-related questions, requests, or complaints, please contact our Information Officer:

Email: privacy@rentalrep.co.za

Platform: rentalrep.co.za

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website: www.justice.gov.za/inforeg

Email: inforeg@justice.gov.za

This is an interim document pending formal legal review by a qualified South African attorney.