Privacy Policy

De-Posit – Privacy Policy

Effective Date: 1 June 2026

Welcome to De‑Posit. Your privacy matters to us. This Privacy Policy explains how we collect, use, store, share, and protect your Personal Information when you use the De‑Posit Platform.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

1. WHO WE ARE

De‑Posit (Pty) Ltd Registration Number: 2025/830257/07 (in this Privacy Policy referred to as “De‑Posit”, “we”, “us”, “our”).

We provide a modern alternative to traditional rental deposits through our Billing Authorisation Service.

2. INFORMATION WE COLLECT

We collect various categories of Personal Information in order to provide, verify, and improve ourservices, conduct pre‑approval and eligibility assessments, comply with legal obligations, and protect the integrity of the De‑Posit platform. The information we collect falls into the following categories:

2.1. Information You Provide to Us

We collect Personal Information that you provide directly to us when you apply for pre‑approval, complete your profile, submit documents, communicate with us, or use our services. This includes:

• Identity Information, such as your full name, identity number, date of birth, and contact details.
• Financial and Employment Information, including income, expenses, employment details, bank account information, and supporting documents such as bank statements and proof of address.
• Lease and Rental Information, including details of your current or prospective lease, rental amounts, and related documentation.
• Any other information you voluntarily provide during the application, verification, or claims process.

2.2. Information From Landlords or Agents

We may receive limited Personal Information from landlords or agents in the context of a referral or pre‑approval request. This may include:

• Your name and contact details, provided solely for the purpose of initiating a pre‑approval assessment with your consent.
• Rental History Information, such as previous rental payments, arrears, lease details, inspection reports, and claims‑related documentation.

2.3. Information Collected Automatically

When you access or use the De‑Posit platform, we automatically collect certain technical and usage information, including:

• IP address, device identifiers, and device information
• Browser type, operating system, and system configuration
• Usage data, such as pages viewed, features used, and interaction logs
• Cookies and tracking technologies used to improve functionality, security, and user experience

2.4. Information From Third Parties

We may obtain Personal Information about you from third‑party sources where lawful and necessary to provide our services. These sources include:

• Registered credit bureaus, from which we may obtain credit information such as payment profile data, default listings, credit history, and other information lawfully provided. We may access this information on a continuous basis for the duration of your relationship with De‑Posit and in multiple formats, including PDF, XML, batch files, and raw data strings.
• Tenant profiling networks (such as TPN), which may provide rental history, payment behaviour, and risk‑related information.
• Payment processors, which may provide transaction and verification information.
• Fraud prevention databases, used to verify identity and prevent unlawful activity.
• Public records, including information available from government or regulatory sources.

3. HOW WE USE YOUR INFORMATION

We use your Personal Information to provide and improve our services, assess eligibility, comply with legal obligations, and protect the integrity of the De‑Posit platform. This includes the following purposes:

3.1. Delivering and Managing our Services

We process your Personal Information to:

• Conduct pre‑approval and eligibility assessments, including identity verification, affordability analysis, and credit‑bureau enquiries.
• Verify your identity and financial information to ensure accuracy and prevent fraud.
• Create, manage, and maintain Billing Authorisations, including processing payments and debit orders.
• Facilitate claims, assess supporting documentation, and recover Permitted Charges where applicable.
• Communicate with you, as well as with landlords and agents where necessary, via email, SMS, WhatsApp, telephone, or in‑platform notifications for verification, onboarding, service updates, and eligibility monitoring.
• Perform ongoing monitoring, including continuous access to credit‑bureau information for the duration of your relationship with De‑Posit.
• Assess risk and make automated decisions, using risk‑scoring models that analyse credit‑bureau data, rental history, affordability indicators, and other relevant information.

3.2. Complying With Legal and Regulatory Obligations

We process Personal Information to:

• Comply with POPIA, the National Credit Act, and other applicable laws.
• Maintain financial and transactional records as required by law.
• Conduct fraud prevention, anti‑money‑laundering checks, and identity verification.
• Fulfil regulatory reporting obligations, including the submission of payment profile and default information to registered credit bureaus.

3.3. Improving and Securing the Platform

We use Personal Information to:

• Monitor usage patterns and platform performance.
• Enhance and personalise the user experience.
• Detect, investigate, and prevent security threats, misuse, or unauthorised access.
• Conduct internal analytics, reporting, and service optimisation.

3.4. Supporting Legitimate Business Purposes

We process Personal Information for:

• Customer support and service‑related assistance.
• Dispute resolution and complaint handling.
• Internal business operations, analytics, and reporting.
• Quality assurance, training, and operational improvements.

3.5. Use of De‑Identified and Aggregated Data

We may use, process, and share de‑identified, anonymised, or aggregated data for research, analytics, product development, market insights, statistical reporting, and other commercial purposes. Such data is processed in a manner that cannot reasonably be linked back to any identifiable individual and therefore does not constitute Personal Information under POPIA.

De‑Posit will never sell or share Personal Information in identifiable form without your explicit consent or a lawful basis.

4. SHARING YOUR INFORMATION

We do not sell your Personal Information. We only share Personal Information where it is necessary to deliver our services, comply with legal obligations, or support legitimate business purposes. When we share Personal Information, we do so in accordance with POPIA and with appropriate confidentiality and data‑protection safeguards in place.

We may share Personal Information with the following categories of third parties:

4.1. Landlords and Agents

We may share Personal Information with landlords and agents where necessary to:

• confirm your eligibility or pre‑approval status
• verify rental history or payment behaviour
• provide proof of cover or service confirmation
• process claims and recover Permitted Charges
• fulfil lease‑related obligations

4.2. Payment Processors

We share Personal Information with authorised payment processors for:

• debit order and card mandate verification
• payment collections and billing administration
• processing refunds or chargebacks where applicable

4.3. Credit Bureaus and Tenant Profiling Networks

We may share Personal Information with registered credit bureaus and tenant profiling networks (such as TPN) for lawful purposes, including:

• tenant screening and risk assessment
• credit checks and affordability assessments
• rental history reporting
• payment profile submissions
• default listings, where legally permitted

Credit bureaus may further share such information with third parties for lawful purposes in accordance with applicable legislation.

4.4. Service Providers

We use trusted third‑party service providers who assist us in delivering and improving our services. These may include:

• cloud hosting and data‑storage providers
• identity verification and fraud‑prevention partners
• communication and notification platforms
• technology and analytics providers

These service providers process Personal Information only on our instructions and are bound by strict confidentiality and data‑protection obligations.

4.5. Legal and Regulatory Authorities

We may disclose Personal Information to legal or regulatory authorities when required to:

• comply with applicable laws and regulations
• prevent, detect, or investigate fraud or unlawful activity
• enforce our contractual rights
• respond to lawful requests, subpoenas, or court orders

4.6. Confidentiality and Safeguards

All third parties with whom we share Personal Information are required to maintain the confidentiality and security of that information and to process it only for the specific purposes for which it was shared.

5. AUTOMATED DECIOSN-MAKING

We might use automated systems and risk‑scoring models to assess eligibility, affordability, and risk. These systems may analyse credit‑bureau data, rental history, financial information, and other relevant factors. Automated decisions may influence approval outcomes, pricing, and ongoing eligibility. You may request manual review of an automated decision by contacting us.

6. LEGAL BASIS FOR PROCESSING

We process Personal Information only where we have a lawful basis to do so under the Protection of Personal Information Act (POPIA) and other applicable laws. Depending on the context, we rely on one or more of the following legal bases:

6.1. Consent

We process Personal Information where you have provided clear and voluntary consent, including consent for pre‑approval assessments, credit‑bureau enquiries, ongoing monitoring, communication, and any other processing activities that require explicit permission.

6.2. Contractual Necessity

We process Personal Information where it is necessary to enter into, perform, or enforce a contract with you. This includes assessing eligibility, creating and managing Billing Authorisations, processing payments, facilitating claims, and delivering the De‑Posit services you request.

6.3. Legal Obligations

We process Personal Information where required to comply with applicable laws and regulatory requirements. This includes POPIA compliance, financial record‑keeping, fraud‑prevention obligations, and the submission of payment profile or default information to registered credit bureaus.

6.4. Legitimate Interests

We process Personal Information where it is necessary for our legitimate business interests and where such interests are not overridden by your rights. These interests include improving and securing our platform, conducting internal analytics, preventing fraud, resolving disputes, supporting customer service, and ensuring the integrity and lawful operation of our services.

7. DATA RETENTION

We retain Personal Information only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, including:

• providing and administering our services
• conducting pre‑approval, eligibility, and ongoing monitoring
• complying with legal, regulatory, and financial record‑keeping requirements
• resolving disputes and enforcing our contractual rights
• preventing fraud and maintaining the security and integrity of our platform

Where laws prescribe minimum retention periods, we retain Personal Information for the period required by law. Financial and transactional records are retained for at least five (5) years, or longer where required by applicable legislation.

Once Personal Information is no longer required for lawful purposes, we securely delete, de‑identify, or anonymise it in accordance with our data‑retention and destruction policies.

8. HOW WE PROTECT YOUR INFORMATION

We take the security of your Personal Information seriously and implement a combination of technical, organisational, and administrative safeguards to protect it from loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption, used to protect data in transit and at rest.
• Access controls, ensuring that only authorised personnel and service providers can access Personal Information on a need‑to‑know basis.
• Secure data‑storage practices, including the use of reputable cloud‑hosting providers with strong security certifications.
• Regular security audits and monitoring, designed to identify vulnerabilities, detect suspicious activity, and maintain the integrity of our systems.
• Third‑party compliance checks, ensuring that all service providers who process Personal Information on our behalf meet appropriate security and data‑protection standards.

While no system can ever be completely secure, we take reasonable and appropriate steps to safeguard your Personal Information in accordance with POPIA and industry best practices.

9. YOUR RIGHTS UNDER POPIA

As a data subject, you have several rights under the Protection of Personal Information Act (POPIA). You may exercise these rights at any time, subject to applicable legal and contractual limitations. These rights include:

9.1. Right of Access

You may request confirmation of whether we hold Personal Information about you and obtain a copy of such information.

9.2. Right to Correction or Update

You may request that we correct, update, or complete any Personal Information that is inaccurate, outdated, or incomplete.

9.3. Right to Deletion

You may request that we delete your Personal Information where there is no lawful basis for us to continue processing it. Deletion may not be possible where retention is required by law or necessary for contractual or legitimate business purposes.

9.4. Right to Object to Processing

You may object to the processing of your Personal Information where such processing is based on legitimate interests, or where you believe the processing is unlawful or unnecessary.

9.5. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

9.6. Right to Lodge a Complaint

You may lodge a complaint with the Information Regulator if you believe your Personal Information has been processed in a manner that violates POPIA.

Information Regulator (South Africa) Website: https://www.inforegulator.org.za (inforegulator.org.za in Bing) Email: complaints.IR@justice.gov.za

9.7. How to Exercise Your Rights

Requests to access, export, correct, update, delete, destroy, restrict, or object to the processing of your Personal Information may be submitted through the De‑Posit Platform, by emailing our customer support channel, by contacting our designated POPIA representative using the contact details in this Policy, or through any in-platform privacy request channel made available by De‑Posit.

Your request should identify the type of request being made, including whether it relates to access/export, correction, deletion/destruction, objection to processing, or withdrawal of consent where applicable.

We may require reasonable verification of your identity before disclosing, exporting, correcting, deleting, anonymising, or restricting Personal Information.

Where deletion or destruction is requested, we may delete, destroy, de-identify, anonymise, or restrict processing of the relevant Personal Information, as appropriate. We may retain records where retention is required or permitted for legal, contractual, audit, fraud-prevention, payment, dispute-resolution, credit-reporting, or regulatory purposes.

We will record and review POPIA data subject requests and communicate the action taken, or the reason for any refusal or partial fulfilment, through your registered email address or another verified communication channel.

10. COOKIES AND TRACKING

We use cookies and similar tracking technologies to improve the functionality, security, and performance of the De‑Posit platform. Cookies help us:

• enhance and personalise your user experience
• analyse usage patterns and platform performance
• remember your preferences and settings
• improve navigation and platform features

You may disable cookies through your browser settings; however, certain features of the platform may not function properly if cookies are disabled.

11. INTERNATIONAL TRANSFERS

If we transfer Personal Information outside of South Africa, we ensure that such transfers comply with POPIA and that appropriate safeguards are in place. These safeguards may include:

• transfers to countries with adequate data‑protection laws, or
• contractual protections that require the recipient to maintain the same level of data protection required under South African law

We only transfer Personal Information where it is necessary for service delivery, secure data hosting, or lawful business operations.

12. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data‑processing practices. When we make changes, we will post the updated version on our website with a revised effective date. Continued use of the De‑Posit platform after such updates constitutes acceptance of the updated Policy.

13. CONTACT US

For privacy‑related queries or requests:

De‑Posit (Pty) Ltd Email: willem@de-posit.co.za Address:337A Chappies Road, Lynnwood, Pretoria, 0081 Information Officer: Willem van der Merwe You may also contact the Information Regulator of South Africa for complaints.