Privacy Policy

Draft v0.1 · 22 October 2026

This policy explains how BIG Prop Co. [registered name and company registration number] (“we”, “us”) processes personal information through the BIG Prop Co. platform, as required by the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1. Who is responsible

Each residence operator (landlord or property company) that uses the platform is the responsible party for its residents’ and staff’s information. BIG Prop Co. acts as their operator (POPIA s20–21) and processes that information only on their instructions and under a written operator agreement [attorney: confirm roles; BIG Prop Co. is also a responsible party for its own residences and for platform accounts]. For our own residences and for platform accounts, we are the responsible party.

2. Information Officer

Information Officer: [name] · Deputy: [name] · info@bigpropco.com · [physical / postal address] · [telephone]. Registered with the Information Regulator on [date].

3. What we process

• Account details: name, email, cell number, role, residence, room, password hash.
• Residence records: maintenance requests and photos, notices read, inspections, checkpoint rounds.
• Conduct reports: kept confidential. A reporter’s identity is hidden from the reported student, other students and staff, and can only be revealed by the landlord or manager for a recorded reason, with an audit log.
• Security registers: visitor names and ID numbers, vehicle registrations, keys, occurrences and patrols. Visitor ID numbers are anonymised after 12 months.
• Financial records: rent charges, payments, invoices and receipts, NSFAS funding status and remittances, leases and e-signatures (with IP address and time).
• Identity numbers: SA ID numbers are only shown in full to the landlord role and are masked elsewhere.
• Support and help-assistant messages: kept for up to 90 days for quality and abuse review.
• Technical data: session cookies (sign-in and theme preference only; no advertising trackers).

4. Why we process it (lawful basis)

• To perform the lease and accommodation agreement (s11(1)(b)).
• To comply with law: tax, FICA/financial records, health and safety, NSFAS reporting (s11(1)(c)).
• Legitimate interests in the safety and security of residents and property (s11(1)(f)).
• Consent, for optional marketing only, which you can withdraw at any time on My profile (s11(1)(a), s69).

5. Who we share it with

The residence operator’s authorised staff (by role), NSFAS and the institution (funding reconciliation), payment providers (Paystack), and our service providers. These are hosting and database (Vercel, Supabase), email (Google Workspace) and, if switched on, AI help or document-reading providers [list processors and the operator agreements in place]. We do not sell personal information.

6. Cross-border transfers

Our database and file storage are hosted in [London, United Kingdom (Supabase eu-west-2) / Vercel lhr1]. We only transfer information to countries or providers bound by laws, binding corporate rules or agreements that give protection substantially similar to POPIA (s72) [attorney: confirm basis and wording].

7. Security

We use encrypted connections, role-based access checked on the server, per-organisation data isolation, hashed passwords, private file storage served only to authorised users, and audit logs of sensitive actions (exports, identity reveals, payments). We will notify you and the Information Regulator of a security compromise as required by s22.

8. How long we keep it

Visitor ID numbers: 12 months. Assistant logs: 90 days. Financial records: 5 years (Tax Administration Act / Companies Act) [confirm]. Other residence records: for the lease period plus [period], then deleted or de-identified.

9. Your rights

You may ask for access to your information, ask us to correct or delete it, object to processing, and withdraw marketing consent. Use the Support page or email info@bigpropco.com. You may lodge a complaint with the Information Regulator (inforegulator.org.za · [current complaints email]).

10. Changes

We will post updates here and notify account holders of material changes.