POPIA and PAIA Notice

1. What this document is

Two Acts govern personal information in South Africa, and they do different jobs. The Protection of Personal Information Act 4 of 2013 (POPIA) says what a company may do with information about you. The Promotion of Access to Information Act 2 of 2000 (PAIA) says how you get hold of a record a company holds.

This notice covers both. It sits alongside the Privacy Policy, which describes what we collect in practice. Where that document tells you what happens, this one tells you why we are entitled to do it and what you can do about it.

The responsible party throughout is Propalot (Pty) Ltd, registration number 2026/114872/07, of 12 Fredman Drive, Sandton, 2196, South Africa.

2. The eight conditions, and how we meet them

POPIA sets eight conditions for lawful processing. Rather than assert that we comply, here is what each one means and what we actually do about it.

Accountability

A registered Information Officer is answerable for this, is named in section 11 below, and is a real person rather than a role nobody fills.

Processing limitation

We collect the minimum that runs the product, with a lawful basis for each purpose. Section 5 of the Privacy Policy lists them one at a time. Where we rely on consent, you gave it deliberately and can withdraw it in a click.

Purpose specification

Each kind of information is collected for a stated purpose and kept only as long as that purpose or the law requires. The retention periods are published rather than left to discretion.

Further processing limitation

We do not repurpose information. Your enquiry does not become marketing data. Your saved homes do not become a product sold to a bank. If we ever needed a new purpose, we would ask.

Information quality

You can correct your own details from Settings at any time, which is faster and more accurate than asking us to do it. Listing figures are yours to keep current.

Openness

This document, the Privacy Policy and the Cookie Policy are the openness condition being met. Nothing about our processing is described only in a comment in the code.

Security safeguards

Encryption in transit, hashed passwords, row level security in the database so accounts cannot read each other, scoped storage, and verified payment webhooks. Section 10 of the Privacy Policy is the detail.

Data subject participation

You may see what we hold, correct it, and have it deleted. Section 3 below sets out how, and section 4 the form a request takes.

3. Your eight rights

1. To be told that we hold information about you, and what it is.
2. To be given a copy of it, in a usable format, within 30 days.
3. To have it corrected where it is wrong, misleading, out of date or incomplete.
4. To have it deleted where we no longer have a basis to hold it. Some records survive this because the law requires them, principally payment records, and we will tell you which and why.
5. To object to processing we base on legitimate interest, on grounds relating to your situation.
6. To stop direct marketing, at any time, with immediate effect.
7. Not to be subject to a decision with a legal or similarly significant effect made by automated means alone. We do not make one, and where a system declines something a person will review it on request.
8. To complain to the Information Regulator, and to go to court. You do not need our permission and you do not need to come to us first, though we would rather you did.

4. Making a request

The quick way. Email privacy@propalot.co.za from the address on your account, say what you want, and we will do it. We do not require a form to honour a right you already have.

The formal way. PAIA provides for a written request on the prescribed form, which is Form 2 of the Regulations under section 53(1). Use it if you would rather have the statutory timetable running. Send it to the Information Officer at the address in section 11, and include:

• enough detail to identify the record you want;
• proof of who you are, so we do not hand your information to somebody else;
• the form and language you would like it in;
• an address or email address for the answer;
• if you are asking on behalf of somebody else, proof that you may.

We answer within 30 days. Where a request is genuinely complex we may extend that once by a further 30 days, and we will tell you why before the first period runs out rather than after.

If we refuse, we will say so in writing, give the ground in the Act we are relying on, and tell you how to appeal.

5. The records we hold

PAIA requires us to describe the categories of record we keep. They are:

• Account records: registration details, contact details, profile, and professional details such as an agency name and Fidelity Fund Certificate number.
• Listing records: property details, figures, photographs, descriptions, status and publication history.
• Enquiry records: the messages buyers sent, the listing each related to, and the statuses and private notes a seller added.
• Billing records: plan, subscription state, payment references, receipts. Card data is held by PayFast and not by us.
• Communication records: transactional email sent, delivery outcomes, and support correspondence.
• Technical records: request and security logs, rate limiting counters, aggregate usage measurement.
• Corporate records: the ordinary company, accounting, tax and employment records any business keeps, held under the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011 and the Basic Conditions of Employment Act 75 of 1997.

6. Records available without a request

Some things you can simply have. Your own account details, listings, enquiries, billing history and receipts are visible in the portal and can be exported from Settings without asking anyone. Published listings, the plans and prices, and these legal documents are public on the site.

7. When a request can be refused

PAIA sets out the grounds, and they are narrow. We would refuse a request that would disclose somebody else's personal information without their consent, that would reveal commercially sensitive information belonging to a third party, that is subject to legal privilege, or that would prejudice an ongoing investigation into fraud on the platform.

We would not refuse a request because it is inconvenient. If a record contains both your information and somebody else's, we redact theirs and give you yours rather than refusing the lot.

8. Fees

A request for your own personal information is free. That is what POPIA intends and we are not going to charge for it.

PAIA allows a request fee and a reproduction fee for other records. If a fee would apply we will tell you the amount before doing the work, and you can withdraw the request at that point at no cost.

9. Operators and cross-border transfer

We use operators, in POPIA terms, to process on our instruction: Supabase for the database, authentication and photograph storage; Resend for transactional email; PayFast for payment; Vercel for hosting. Each is under a written agreement to process only as instructed, to keep the information secure, and to notify us of a compromise.

Section 72 of POPIA permits a transfer outside South Africa only where the recipient is subject to comparable law or bound by agreement to a comparable standard. Where our operators run infrastructure abroad, that is the basis on which they do it.

10. The Information Regulator

The Regulator supervises both Acts and you may approach it directly.

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
inforeg@justice.gov.za
complaints.IR@justice.gov.za for a POPIA complaint
PAIAComplaints.IR@justice.gov.za for a PAIA complaint

11. The Information Officer

The Information Officer
Propalot (Pty) Ltd, registration number 2026/114872/07
12 Fredman Drive, Sandton, 2196, South Africa
privacy@propalot.co.za · +27 10 001 0001