Privacy Policy

De-Posit – Privacy Policy

Last Updated: 23 October 2026

Welcome to De‑Posit. Your privacy matters to us. This Privacy Policy explains how we collect, use, store, share, and protect your Personal Information when you use the De‑Posit Platform. It applies to tenants, landlords, agents and occupants, people who live at a rental property linked to a De‑Posit Billing Authorisation but do not contract with De‑Posit themselves.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

1. WHO WE ARE

De‑Posit (Pty) Ltd Registration Number: 2025/830257/07 (in this Privacy Policy referred to as “De‑Posit”, “we”, “us”, “our”).

We provide a modern alternative to traditional rental deposits through our Billing Authorisation Service.

2. INFORMATION WE COLLECT

We collect various categories of Personal Information in order to provide, verify, and improve our services, conduct pre‑approval and eligibility assessments, comply with legal obligations, and protect the integrity of the De‑Posit platform. The information we collect falls into the following categories:

2.1. Information You Provide to Us

We collect Personal Information that you provide directly to us when you apply for pre‑approval, complete your profile, submit documents, communicate with us, or use our services. This includes:

• Identity Information, such as your full name, identity number, date of birth, and contact details.
• Financial and Employment Information, including income, expenses, employment details, bank account information, and supporting documents such as bank statements and proof of address.
• Lease and Rental Information, including details of your current or prospective lease, rental amounts, and related documentation.
• Any other information you voluntarily provide during the application, verification, or claims process.

2.2. Information From Landlords or Agents

We may receive limited Personal Information from landlords or agents in the context of a referral or pre‑approval request. This may include:

• Your name and contact details, provided solely for the purpose of initiating a pre‑approval assessment with your consent.
• Rental History Information, such as previous rental payments, arrears, lease details, inspection reports, and claims‑related documentation.

2.3. Information Collected Automatically

When you access or use the De‑Posit platform, we automatically collect certain technical and usage information, including:

• IP address, device identifiers, and device information
• Browser type, operating system, and system configuration
• Usage data, such as pages viewed, features used, and interaction logs
• Cookies and tracking technologies used to improve functionality, security, and user experience

2.4. Information From Third Parties

We may obtain Personal Information about you from third‑party sources where lawful and necessary to provide our services. These sources include:

• Registered credit bureaus, from which we may obtain credit information such as payment profile data, default listings, credit history, and other information lawfully provided. We may access this information on a continuous basis for the duration of your relationship with De‑Posit and in multiple formats, including PDF, XML, batch files, and raw data strings.
• Tenant profiling networks (such as TPN), which may provide rental history, payment behaviour, and risk‑related information.
• Payment processors, which may provide transaction and verification information.
• Fraud prevention databases, used to verify identity and prevent unlawful activity.
• Public records, including information available from government or regulatory sources.

3. HOW WE USE YOUR INFORMATION

We use your Personal Information to provide and improve our services, assess eligibility, comply with legal obligations, and protect the integrity of the De‑Posit platform. This includes the following purposes:

3.1. Delivering and Managing our Services

We process your Personal Information to:

• Conduct pre‑approval and eligibility assessments, including identity verification, affordability analysis, and credit‑bureau enquiries.
• Verify your identity and financial information to ensure accuracy and prevent fraud.
• Create, manage, and maintain Billing Authorisations, including processing payments and debit orders.
• Facilitate claims, including assessing supporting documentation, paying approved claims to landlords and agents, and recovering Permitted Charges from tenants.
• Communicate with you, as well as with landlords and agents where necessary, via email, SMS, WhatsApp, telephone, or in‑platform notifications for verification, onboarding, service updates, and eligibility monitoring.
• Perform ongoing monitoring, including continuous access to credit‑bureau information for the duration of your relationship with De‑Posit.
• Assess risk and make automated decisions, using risk‑scoring models that analyse credit‑bureau data, rental history, affordability indicators, and other relevant information.

3.2. Complying With Legal and Regulatory Obligations

We process Personal Information to:

• Comply with POPIA, the National Credit Act, and other applicable laws.
• Maintain financial and transactional records as required by law.
• Conduct fraud prevention, anti‑money‑laundering checks, and identity verification.
• Fulfil regulatory reporting obligations, including the submission of payment profile and default information to registered credit bureaus.

3.3. Improving and Securing the Platform

We use Personal Information to:

• Monitor usage patterns and platform performance.
• Enhance and personalise the user experience.
• Detect, investigate, and prevent security threats, misuse, or unauthorised access.
• Conduct internal analytics, reporting, and service optimisation.

3.4. Supporting Legitimate Business Purposes

We process Personal Information for:

• Customer support and service‑related assistance.
• Dispute resolution and complaint handling.
• Internal business operations, analytics, and reporting.
• Quality assurance, training, and operational improvements.

3.5. Use of De‑Identified and Aggregated Data

We may use, process, and share de‑identified, anonymised, or aggregated data for research, analytics, product development, market insights, statistical reporting, and other commercial purposes. Such data is processed in a manner that cannot reasonably be linked back to any identifiable individual and therefore does not constitute Personal Information under POPIA.

De‑Posit will never sell or share Personal Information in identifiable form without your explicit consent or a lawful basis.

4. SHARING YOUR INFORMATION

We do not sell your Personal Information. We only share Personal Information where it is necessary to deliver our services, comply with legal obligations, or support legitimate business purposes. When we share Personal Information, we do so in accordance with POPIA and with appropriate confidentiality and data‑protection safeguards in place.

We may share Personal Information with the following categories of third parties:

4.1. Landlords and Agents

We may share Personal Information with landlords and agents where necessary to:

• confirm your eligibility or pre‑approval status
• verify rental history or payment behaviour
• provide confirmation of an active Billing Authorisation
• process claims and recover Permitted Charges
• fulfil lease‑related obligations

4.2. Payment Processors

We share Personal Information with authorised payment processors for:

• debit order and card mandate verification
• payment collections and billing administration
• processing refunds or chargebacks where applicable

4.3. Credit Bureaus and Tenant Profiling Networks

We may share Personal Information with registered credit bureaus and tenant profiling networks (such as TPN) for lawful purposes, including:

• tenant screening and risk assessment
• credit checks and affordability assessments
• rental history reporting
• payment profile submissions
• default listings, where legally permitted

Credit bureaus may further share such information with third parties for lawful purposes in accordance with applicable legislation. We do not share Occupant information with credit bureaus or tenant profiling networks.

4.4. Service Providers

We use trusted third‑party service providers who assist us in delivering and improving our services. These may include:

• cloud hosting and data‑storage providers
• identity verification and fraud‑prevention partners
• communication and notification platforms
• technology and analytics providers

These service providers process Personal Information only on our instructions and are bound by strict confidentiality and data‑protection obligations.

4.5. Legal and Regulatory Authorities

We may disclose Personal Information to legal or regulatory authorities when required to:

• comply with applicable laws and regulations
• prevent, detect, or investigate fraud or unlawful activity
• enforce our contractual rights
• respond to lawful requests, subpoenas, or court orders

4.6. Confidentiality and Safeguards

All third parties with whom we share Personal Information are required to maintain the confidentiality and security of that information and to process it only for the specific purposes for which it was shared.

5. AUTOMATED DECISION-MAKING

We might use automated systems and risk‑scoring models to assess eligibility, affordability, and risk. These systems may analyse credit‑bureau data, rental history, financial information, and other relevant factors. Automated decisions may influence approval outcomes, pricing, and ongoing eligibility. You may request manual review of an automated decision by contacting us. Where an Occupant later applies for De‑Posit services in their own name, their De‑Posit Score may be taken into account in that assessment.

6. LEGAL BASIS FOR PROCESSING

We process Personal Information only where we have a lawful basis to do so under the Protection of Personal Information Act (POPIA) and other applicable laws. Depending on the context, we rely on one or more of the following legal bases:

6.1. Consent

We process Personal Information where you have provided clear and voluntary consent, including consent for pre‑approval assessments, credit‑bureau enquiries, ongoing monitoring, communication, and any other processing activities that require explicit permission. In the case of Occupants, we rely on the tenant’s confirmation that the Occupant has been informed and has consented or, for an Occupant under the age of 18, on the consent of the Occupant’s parent or legal guardian.

6.2. Contractual Necessity

We process Personal Information where it is necessary to enter into, perform, or enforce a contract with you. This includes assessing eligibility, creating and managing Billing Authorisations, processing payments, facilitating claims, and delivering the De‑Posit services you request.

6.3. Legal Obligations

We process Personal Information where required to comply with applicable laws and regulatory requirements. This includes POPIA compliance, financial record‑keeping, fraud‑prevention obligations, and the submission of payment profile or default information to registered credit bureaus.

6.4. Legitimate Interests

We process Personal Information where it is necessary for our legitimate business interests and where such interests are not overridden by your rights. These interests include improving and securing our platform, conducting internal analytics, preventing fraud, resolving disputes, supporting customer service, and ensuring the integrity and lawful operation of our services.

7. OCCUPANTS

An Occupant is a person who lives at a rental property linked to a De‑Posit Billing Authorisation but is not the tenant who contracts with De‑Posit, for example a student living in a property rented by a parent. Occupants do not register on the De‑Posit Platform. This section explains how we handle their Personal Information.

What we collect. The tenant provides the Occupant’s full name, identity number and mobile number. We also record claims and Permitted Charges relating to the property during the Occupant’s occupancy.

Why we use it. We use Occupant information only to build and maintain a rental history profile for the Occupant (the “De‑Posit Score”), which may benefit the Occupant if they later apply for De‑Posit services in their own name, and to administer our services for the property. Occupants have no financial liability to De‑Posit.

Notification and consent. When providing an Occupant’s details, the tenant confirms that the Occupant has been informed and has consented. We notify Occupants aged 18 or older that their details have been provided and why. For Occupants under the age of 18, we rely on the consent of their parent or legal guardian, and only accept their details from a tenant who is their parent or legal guardian.

Sharing. We do not share Occupant information with credit bureaus or tenant profiling networks. We may share an Occupant’s name with the landlord or agent of the property where needed to administer the Billing Authorisation.

Occupants’ rights. Occupants have the rights described under “Your Rights under POPIA” below. An Occupant may object to the processing of their information at any time by contacting us, in which case we will stop using it to build their De‑Posit Score, subject to any retention obligations under applicable law.

8. DATA RETENTION

We retain Personal Information only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, including:

• providing and administering our services
• conducting pre‑approval, eligibility, and ongoing monitoring
• complying with legal, regulatory, and financial record‑keeping requirements
• resolving disputes and enforcing our contractual rights
• preventing fraud and maintaining the security and integrity of our platform

Where laws prescribe minimum retention periods, we retain Personal Information for the period required by law. Financial and transactional records are retained for at least five (5) years, or longer where required by applicable legislation.

Once Personal Information is no longer required for lawful purposes, we securely delete, de‑identify, or anonymise it in accordance with our data‑retention and destruction policies.

9. HOW WE PROTECT YOUR INFORMATION

We take the security of your Personal Information seriously and implement a combination of technical, organisational, and administrative safeguards to protect it from loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption, used to protect data in transit and at rest.
• Access controls, ensuring that only authorised personnel and service providers can access Personal Information on a need‑to‑know basis.
• Secure data‑storage practices, including the use of reputable cloud‑hosting providers with strong security certifications.
• Regular security audits and monitoring, designed to identify vulnerabilities, detect suspicious activity, and maintain the integrity of our systems.
• Third‑party compliance checks, ensuring that all service providers who process Personal Information on our behalf meet appropriate security and data‑protection standards.

While no system can ever be completely secure, we take reasonable and appropriate steps to safeguard your Personal Information in accordance with POPIA and industry best practices.

10. YOUR RIGHTS UNDER POPIA

As a data subject, you have several rights under the Protection of Personal Information Act (POPIA). You may exercise these rights at any time, subject to applicable legal and contractual limitations. These rights include:

10.1. Right of Access

You may request confirmation of whether we hold Personal Information about you and obtain a copy of such information.

10.2. Right to Correction or Update

You may request that we correct, update, or complete any Personal Information that is inaccurate, outdated, or incomplete.

10.3. Right to Deletion

You may request that we delete your Personal Information where there is no lawful basis for us to continue processing it. Deletion may not be possible where retention is required by law or necessary for contractual or legitimate business purposes.

10.4. Right to Object to Processing

You may object to the processing of your Personal Information where such processing is based on legitimate interests, or where you believe the processing is unlawful or unnecessary.

10.5. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

10.6. Right to Lodge a Complaint

You may lodge a complaint with the Information Regulator if you believe your Personal Information has been processed in a manner that violates POPIA.

Information Regulator (South Africa) Website: https://www.inforegulator.org.za Email: complaints.IR@justice.gov.za

10.7. How to Exercise Your Rights

Requests to access, correct, update, delete, or object to the processing of your Personal Information may be submitted through the De‑Posit Platform or via our customer support channels. We may require verification of your identity before processing your request.

11. COOKIES AND TRACKING

We use cookies and similar tracking technologies to improve the functionality, security, and performance of the De‑Posit platform. Cookies help us:

• enhance and personalise your user experience
• analyse usage patterns and platform performance
• remember your preferences and settings
• improve navigation and platform features

You may disable cookies through your browser settings; however, certain features of the platform may not function properly if cookies are disabled.

12. INTERNATIONAL TRANSFERS

If we transfer Personal Information outside of South Africa, we ensure that such transfers comply with POPIA and that appropriate safeguards are in place. These safeguards may include:

• transfers to countries with adequate data‑protection laws, or
• contractual protections that require the recipient to maintain the same level of data protection required under South African law

We only transfer Personal Information where it is necessary for service delivery, secure data hosting, or lawful business operations.

13. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data‑processing practices. When we make changes, we will post the updated version on our website with a revised effective date. Continued use of the De‑Posit platform after such updates constitutes acceptance of the updated Policy.

14. CONTACT US

For privacy‑related queries or requests:

De‑Posit (Pty) Ltd Email: willem@de-posit.co.za

Address:337A Chappies Road, Lynnwood, Pretoria, 0081

Information Officer: Willem van der Merwe

You may also contact the Information Regulator of South Africa for complaints.