This Privacy Policy explains how Property Operating Systems (Pty) Ltd, trading as The PropertyOS Company (PropOS, we, us, or our), processes personal information through PropOS.
This is a privacy notice. It does not turn every use of PropOS into consent. We rely on the lawful ground that applies to each processing activity and ask for consent separately where consent is required.
Scope and Responsible Party
This Policy applies to the PropOS websites, applications, APIs, support channels, and related rental application services.
It covers information about:
- Applicants, Renters, joint applicants, company participants, directors, authorised signatories, and trustees;
- Property Professionals, agency staff, Owners, and Owner review recipients;
- references, contacts, and other people whose information is supplied for an Application;
- visitors, support contacts, and people who join the waitlist; and
- identifiable existing juristic persons where the Protection of Personal Information Act 4 of 2013 (POPIA) applies.
Property Operating Systems (Pty) Ltd is the responsible party for the personal information for which it determines the purpose and means of processing.
A Property Professional, agency, Owner, verification provider, payment provider, or other participant may be a separate responsible party for processing that it determines independently. Their own privacy terms may also apply.
This Policy is governed primarily by POPIA. The General Data Protection Regulation or another law applies only where its territorial scope and requirements cover the particular processing.
Definitions
Applicant means a natural person or juristic person applying to rent immovable property through PropOS.
Application means the information, documents, checks, declarations, signatures, payment status, and other material submitted for a Property through PropOS.
Personal information has the meaning given in POPIA and includes information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person.
Property means immovable property in South Africa offered for residential or commercial letting.
Property Professional means a person or organisation using PropOS to collect or review Applications for an Owner.
Renter means an individual who participates in an Application.
Special personal information has the meaning given in POPIA.
Information We Process
The information we process depends on your role and the functions you use.
Account and Contact Information
We may process:
- names, contact details, preferred language, and addresses;
- account identifiers, sign in and security information, roles, and workspace membership;
- communications, support requests, preferences, and consent records; and
- IP address, user agent, device, browser, and activity records used for security and audit purposes.
Applicant and Participant Information
For an individual or joint Application, we may process:
- South African identity or passport details, nationality, visa or permit information, and identity documents;
- employment, income, expenses, assets, liabilities, and financial declarations;
- bank statements, account summaries, income evidence, and affordability measures;
- current and previous addresses, rental history, references, household information, and pets;
- documents, declarations, signatures, participant roles, and completion status;
- credit screening information, fraud checks, risk signals, and provider status; and
- Application activity, payment status, submission records, review status, and decisions.
For a company or other juristic Application, we may also process:
- registered name, registration number, entity type, addresses, and contact details;
- company documents, financial information, bank statements, trading information, and references;
- director, trustee, beneficial ownership, authorised signatory, and authority information where required; and
- identity and credit screening information for participating natural persons where lawful and relevant.
Property Professional, Agency, and Owner Information
We may process:
- practitioner PPRA, FFC, and contact information;
- agency or firm details, company registration information, workspace membership, and authority;
- Owner contact and authority information;
- Properties, invitations, Applications, review activity, recommendations, and decisions; and
- lease execution, rent, platform fee, invoice, and payment information.
Property and Application Information
We may process Property addresses, descriptions, rent, deposits, lease information, application links and invitations, participant assignments, Application contents, review notes, status history, and decision records.
Payment Information
Our payment provider processes payment card or bank details required to complete a payment. PropOS does not store full payment card details. We may receive and retain payment references, amounts, payer and beneficiary information, status, failure reason, refund information, and provider records needed to reconcile the transaction.
Technical, Security, and Usage Information
We may process logs, request and response metadata, device and browser information, approximate location derived from an IP address, security events, audit records, errors, performance measurements, and product usage events.
Where session monitoring or replay is enabled, we configure it to reduce the collection of sensitive form text and media. No technical control can guarantee that every unexpected value is excluded, so access is restricted and the information is used only for authorised reliability, security, support, and product improvement purposes.
Waitlist and Marketing Information
If you join the waitlist or choose to receive updates, we process your name, email address, role, consent status, and message engagement information needed to send and manage those communications.
Where Information Comes From
We collect information:
- directly from you;
- from another authorised Application participant;
- from a Property Professional, agency, Owner, reference, or contact;
- from identity, passport, company, professional registration, bank statement, payment, fraud, and credit screening providers;
- from registered credit bureaus where a lawful instruction or consent applies;
- from official, public, or commercially available records where lawful; and
- automatically when you use the Platform.
If you provide information about another person, you must have authority to do so and must tell them how the information will be used where the law requires it.
Why We Process Information
We process personal information only for a lawful and specific purpose.
Accounts and Service Delivery
We process information to:
- create and secure accounts and workspaces;
- set up Properties and invite Applicants;
- build and complete individual, joint, and company Applications;
- assign requirements to participants;
- store and reuse profile information and common documents;
- submit and preserve an Application record;
- provide status, history, support, and operational communications; and
- manage access, payments, invoices, and refunds.
This processing is generally necessary to conclude or perform an agreement with you, to take steps at your request, or to pursue the legitimate interests of providing and administering the Services.
Verification, Screening, and Review
Depending on the Application and available providers, we process information to:
- check identity documents, passports, visas, permits, company records, directors, practitioner registration, FFC details, and supporting documents;
- analyse supported bank statement information and calculate application specific affordability measures;
- request and retain references;
- obtain or process credit screening information under the instruction or consent presented for the Application;
- identify fraud checks and risk signals;
- show completeness, readiness, verification, and review status;
- help a Property Professional prepare a recommendation; and
- allow an Owner to review the material shared with them and record a decision.
The lawful ground depends on the check. It may include performance of an agreement, compliance with law, protection of legitimate interests, information made public by the data subject, or consent where required.
Using PropOS does not by itself constitute consent for credit bureau checks. Where required, the Application flow records a separate consent linked to the relevant Application and current consent document.
The prescribed provider purposes may include:
- Consumer/Entity instruction or consent for rental application assessment;
- Consumer Enquiry where applicable;
- Business/Juristic enquiry where applicable; and
- Fraud Prevention.
PropOS does not provide credit, act as a credit provider or credit bureau, calculate creditworthiness for consumer credit, grant or decline credit, or make credit granting or final tenant selection decisions.
Security, Integrity, and Legal Compliance
We process information to authenticate users, enforce permissions, prevent misuse, investigate incidents, maintain audit evidence, protect people and systems, respond to lawful requests, establish or defend legal claims, and meet legal or regulatory obligations.
Service Improvement
We use appropriately limited technical and usage information to diagnose errors, measure reliability, improve workflows, understand feature use, and support users.
We do not use raw credit bureau reports, identity documents, bank statements, verification provider outputs, or Application specific verification status and relevant summaries to train general models.
Communications and Marketing
We send transactional and service messages needed to operate your account or Application. We send marketing or beta updates where you have consented or another lawful ground permits it. You can unsubscribe from marketing messages without stopping necessary service communications.
How Application Information Is Shared
Property Professional Review
When an Application is submitted, the responsible Property Professional and authorised members of their workspace may receive the submitted Applicant and participant information, documents, status, relevant verification and screening information, financial and affordability information, references, and Application history needed for review.
Bank statement evidence disclosure. Detailed financial profile information may include statement supported balances, recurring income, monthly expenses, bounded income deposit rows, credit information, assets, liabilities, and Application specific affordability measures. This evidence is limited to authorised internal Property Professional and effective PropOS Staff or Admin review. Applicants, Owners, Owner review recipients, API clients, and impersonated Renter sessions do not receive it. The reviewer experience does not expose a general raw transaction ledger.
Owner Review
The Property Professional may share an Owner review containing the Application summary, relevant status and supporting context, affordability measures, references, recommendation, Property information, and decision controls.
The Owner does not receive raw credit bureau reports, raw verification provider payloads, or the detailed internal bank statement analysis merely because they receive an Owner review.
Other Applications
Each submitted Application is linked to its Property and authorised recipients. A different Property Professional does not receive a list of the other Properties to which an Applicant has applied merely because they use PropOS.
Foreign Financial Information
Supported foreign financial evidence remains in its source currency. Where an exchange rate is available, PropOS may also show an approximate South African rand equivalent for review context. The equivalent is informational and may change with the source or rate used.
Service Providers and Other Recipients
We may share information with:
- hosting, storage, security, observability, analytics, communication, and support providers;
- identity, passport, company, director, professional registration, document, bank statement, fraud, and credit screening providers;
- registered credit bureaus where the relevant instruction, consent, and purpose allow it;
- payment providers, banks, and financial administration providers;
- professional advisers, auditors, insurers, and contractors who need the information for an authorised purpose;
- regulators, courts, law enforcement, or public bodies where required or lawfully permitted; and
- another organisation involved in a lawful restructuring or transfer, subject to appropriate confidentiality and privacy safeguards.
Providers process information under their own lawful role or under a contract requiring them to process it for authorised purposes and protect it appropriately.
PropOS does not sell personal information or raw credit bureau reports.
Automated Processing and Human Decisions
PropOS may automate document extraction, matching, completeness checks, calculations, provider requests, status updates, and the display of fraud checks or risk signals.
These processes may influence what is shown for review, but PropOS does not make a solely automated final decision about whether an Applicant receives a Property. The Property Professional prepares the recommendation and the Owner remains responsible for the final decision.
If an automated or provider result appears incorrect, use the available correction or review route or contact support@propos.rent.
Retention
We keep personal information only for as long as there is a lawful and operational reason to keep it.
Retention depends on:
- whether an account, access period, Application, review, payment, dispute, or support matter remains active;
- the need to preserve a submitted Application, consent, decision, audit, security, or transaction record;
- legal, regulatory, tax, accounting, prescription, and evidential requirements;
- provider rules that lawfully apply to particular verification or credit information;
- the establishment, exercise, or defence of legal claims; and
- whether information can be deidentified or securely deleted.
When the purpose ends and no lawful retention ground remains, we delete, destroy, deidentify, or restrict the information as appropriate. A deletion request may therefore result in deletion of some information and lawful retention of other records.
Backups and security records may persist for a limited period before being overwritten or deleted through normal protection and recovery processes.
Storage and International Processing
PropOS's core production application and database are hosted in a South African cloud region. Some service providers may process or store limited information in other countries when they provide communications, observability, support, payment, verification, or similar services.
Where personal information is transferred outside South Africa, we use the safeguard or legal basis applicable under POPIA, which may include adequate protection in the recipient country, a binding agreement, consent where appropriate, or another permitted ground.
Provider location and routing can change. This section describes the current processing model and is not a promise that every copy of every record remains only in South Africa.
Security
We use appropriate, reasonable technical and organisational measures designed to protect personal information against loss, damage, unauthorised destruction, access, or processing. Measures include access controls, authentication, encryption where appropriate, audit records, monitoring, provider controls, and incident response.
No system or transmission method is completely secure. You must also protect your credentials and devices and promptly report suspected account misuse.
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the investigation and delay provisions in section 22 of POPIA.
Your Choices and Rights
Subject to POPIA and other applicable law, you may:
- ask whether we hold personal information about you and request access to it;
- correct or update routine account information through the relevant Profile controls;
- replace identity evidence through Profile > Documents where a verified identity fact must be updated;
- request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information;
- request destruction or deletion of a record we are no longer authorised to retain;
- object to processing on a ground permitted by law;
- withdraw consent for future processing where consent is the lawful ground, without affecting earlier lawful processing;
- unsubscribe from marketing communications; and
- complain to the Information Regulator.
For an exceptional correction or deletion request under section 24 of POPIA, use Form 2: Request for Correction or Deletion of Personal Information or Destroying or Deletion of Record of Personal Information from the Information Regulator's POPIA forms page and send the completed form and supporting evidence to compliance@propertyos.company.
We may need to verify your identity and authority before acting on a request. Rights may be limited where another person's rights, legal privilege, a statutory restriction, or a lawful retention duty applies.
Information About Children
PropOS accounts and Applications are intended for people aged 18 or older. We do not knowingly allow a child to create an Applicant account.
An adult Applicant may provide limited information about a child where it is relevant to a household or Property Application and lawful to do so. The adult must have authority to provide that information. We process it only for the relevant Application and related legal or operational purposes.
Cookies and Similar Technologies
PropOS may use cookies or similar storage needed for authentication, security, preferences, performance, and permitted analytics. Essential technologies are required for the Platform to function.
You can control some cookies through your browser. Blocking essential storage may prevent sign in or other Platform functions from working.
Changes to This Policy
We may update this Policy when our Services, providers, legal duties, or processing practices change. The Platform records the published version and publication date.
Where a change materially affects existing users, PropOS may notify you and require acceptance of the new version before protected Platform use continues. A Privacy Policy acceptance records notice of the Policy; it does not replace purpose specific consent where consent is required.
Contact and Complaints
Company: Property Operating Systems (Pty) Ltd, trading as The PropertyOS Company
Registration number: 2025/826918/07
Address: Dock Road Junction, Corner Stanley & Dock Road, V&A Waterfront, Cape Town, South Africa, 8001
Privacy and Information Officer enquiries: compliance@propertyos.company
Product support: support@propos.rent
You may also complain to the Information Regulator using the current contact and complaint channels published at inforegulator.org.za.