Privacy Notice

1. What information we collect

When you enquire, book a unit or hold a lease with us, we collect:

• Identifying details — your full name, or your company name and registration number if you rent as a business.
• Contact details — email address, mobile number, an alternative number, and the name and number of an emergency contact.
• Your South African ID number or passport number, and a copy of that document.
• Your physical address, and a proof of address document such as a utility bill or bank statement.
• A portrait photograph of your face, if you choose to use facial recognition to enter the site. This is optional — see the section on site access below.
• Payment details — your chosen payment method, and where you pay by card, a secure token held by our payment provider. We never see or store your full card number, expiry date or CVV.
• Where you pay by debit order, your bank confirmation letter.
• Records of your rental — invoices, payments, statements, the units you rent, notices you give us and correspondence between us.
• Technical records created when you use the website or customer portal — your IP address, browser type and the pages you visit, kept in security and audit logs.

We collect this information directly from you. If we need it from anywhere else, we will tell you first.

2. Why we collect it

We use your personal information only for the purposes set out below.

• To decide whether to rent you a unit, and to prepare and conclude your lease agreement.
• To verify who you are, and to meet our obligations under the Financial Intelligence Centre Act and other laws that require us to identify our customers.
• To invoice you, collect rent and process refunds.
• To give you access to the site, and to keep the site and its contents secure.
• To contact you about your rental — invoices, receipts, reminders, notices and changes to your lease.
• To answer enquiries you send us.
• To keep the accounting, tax and audit records the law requires us to keep.
• To recover amounts you owe us, and to exercise or defend legal claims.

We do not sell your personal information, and we do not use it for marketing unless you have asked us to.

3. Our legal grounds for using it

POPIA allows us to process your personal information where one of the following applies. For each use above, at least one does:

• It is necessary to conclude or carry out your lease agreement with us.
• It is required of us by law — for example identity verification, and keeping tax and accounting records.
• It protects our legitimate interests or yours — for example securing the site, and recovering unpaid rent.
• You have consented. Where we rely on your consent, you may withdraw it at any time by contacting our Information Officer. Withdrawing consent does not affect anything we did before you withdrew it, and we will tell you if it means we can no longer provide part of the service.

Giving us the information marked as required on our forms is a contractual and legal requirement. If you do not provide it we will not be able to rent you a unit.

4. Site access and your photograph

Entry to the site is controlled by a facial recognition gate. A photograph of your face is biometric information, which POPIA treats as special personal information and protects more strictly than ordinary details.

• Providing a portrait photograph is optional. We will only load your photograph into the gate system if you consent, and we ask for that consent separately when you book.
• If you do not provide a photograph, you will be given a personal access PIN instead. You can enter and leave the site normally using your PIN — you do not lose access to your unit.
• Your photograph is used for one purpose only: recognising you at the gate. We do not use it to identify you anywhere else, we do not match it against any other database, and we do not share it with anyone.
• The facial recognition equipment is installed on site and operated by us. Your photograph is not sent to any third-party facial recognition service.
• You may withdraw your consent at any time by contacting our Information Officer. We will remove you from the gate system and issue you a PIN instead.
• We delete your photograph, and remove your face from the gate system, when your lease ends.

Your PIN is yours to manage. Anyone you give it to can enter the site, and entries are recorded against it, so only share it with people you are willing to give access to.

5. Who we share it with

We share your personal information only where we need to, and only with:

• The software provider that builds and hosts this system for us, who processes information on our written instructions and may not use it for their own purposes.
• Our payment provider, PayFast, to take card payments and set up recurring payments, and our bank, to process debit orders.
• Our email provider, to send you invoices, receipts and notices.
• Our accountants and auditors, and where required, SARS and other regulators.
• Attorneys, credit control and debt collection agents, where we need to recover amounts you owe.
• Law enforcement or a court, where the law requires it or where we must protect a legal right.

Everyone who handles your information on our behalf is bound by a written agreement requiring them to keep it confidential and secure, and to use it only for what we have asked them to do.

We do not share your portrait photograph with anyone. The gate equipment is on site and under our control.

6. Where your information is kept

Our servers, and the email service that sends you notices, are located in the European Union. Your personal information is therefore stored and processed outside South Africa.

POPIA permits this where the receiving country has data protection law that provides a comparable level of protection. The European Union is subject to the General Data Protection Regulation, which meets that standard, and our providers are bound by written agreements that carry our POPIA obligations through to them.

Your portrait photograph is held in the same system as your other records. The facial recognition equipment itself is on site in South Africa.

7. How long we keep it

We keep your personal information only for as long as we need it, and then delete it.

• Billing, payment and accounting records — 5 years after your lease ends, as required by tax and company law.
• Your ID or passport copy and proof of address — 5 years after your lease ends, to meet identity verification obligations.
• Your portrait photograph and your entry in the facial recognition gate — deleted when your lease ends.
• Enquiries that do not become bookings — 12 months.
• Bookings that were rejected or cancelled and never became a rental — 6 months, after which the booking and every document attached to it is deleted. We hold them this long because a booking is usually rejected over a document problem you may want to come back and fix.
• Security and audit logs — 12 months.

We keep information for longer only where a law requires it, or where it is needed for a legal claim that is still running.

8. How we protect it

We take reasonable technical and organisational steps to keep your information secure, including:

• Encrypted connections for everything sent between your device and our system.
• Encryption of sensitive fields, including your ID number and payment token, where they are stored.
• Access controls, so staff can only reach the information their role requires.
• An audit log recording who viewed or changed customer records.
• Documents such as your ID copy are never published at a public web address — they can only be retrieved by a signed-in member of staff.
• Regular security updates and vulnerability checks on the software we run.

If your personal information is accessed by someone who should not have it, and that creates a risk to you, we will notify you and the Information Regulator as soon as reasonably possible.

9. Your rights

Under POPIA you have the right to:

• Ask us to confirm whether we hold personal information about you, and to be given a copy of it.
• Ask us to correct or complete information that is inaccurate, misleading or out of date.
• Ask us to delete information we no longer have a lawful reason to keep. Note that we cannot delete records we are legally obliged to retain, such as tax records, until that period has run.
• Object to us using your information, on reasonable grounds relating to your situation.
• Withdraw consent you have given us, including consent to use your photograph at the gate.
• Complain to the Information Regulator.

To exercise any of these rights, contact our Information Officer using the details below. We will respond within a reasonable time, and we may ask you to verify your identity first so that we do not disclose your information to someone else. There is no charge for a request to correct or delete information; a request for a copy of your information may attract the fee prescribed under the Promotion of Access to Information Act.

10. Cookies and our website

Our website uses cookies that are strictly necessary for it to work — they keep you signed in and protect forms against cross-site request forgery. These cannot be switched off without breaking the site.

We do not use advertising cookies and we do not track you across other websites.

11. Contact us and complaints

Our Information Officer is responsible for how we handle your personal information. Please contact them first with any question, request or complaint:

*

• Email:
• Telephone:
• Address:

If you are not satisfied with our response, you may complain to:

• The Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• PO Box 31533, Braamfontein, Johannesburg, 2017
• Email: complaints.IR@justice.gov.za
• Website: https://inforegulator.org.za