POPIA Notice

Responsible party and operator

The landlord, property manager or agency that creates an account is the responsible party for the tenant, lease and payment records it captures. Sharp-Stay acts as an operator, processing that information on the account holder's documented instructions.

For its own account holders' details (name, email, billing information), Sharp-Stay is the responsible party.

Information officer

Each account holder must appoint an information officer as required by POPIA and register them with the Information Regulator. Sharp-Stay's information officer can be reached through the support contact for your account.

Lawful basis and purpose limitation

Personal information is processed to conclude and administer a lease, collect rent, meet legal obligations, and pursue the legitimate interests of the landlord and tenant. Information is not used for unrelated purposes and is not sold.

Data subject rights

Tenants and account holders may request access to their personal information, ask for corrections or deletion, object to processing, and lodge a complaint with the Information Regulator of South Africa.

Access and correction requests are handled through the account holder that captured the records, with Sharp-Stay's assistance as operator.

Security safeguards

Records are isolated per organization and enforced at database level, documents are stored in a private bucket with per-organization access rules, and card details never reach Sharp-Stay's servers.

Where a security compromise affects personal information, the responsible party and the Information Regulator will be notified as required by section 22 of POPIA.

Retention and cross-border processing

Records are kept while the account is active and thereafter only as long as the law requires, including the record-keeping periods that apply to rental and financial records.

Some infrastructure and payment providers process information outside South Africa under contractual safeguards that require a comparable level of protection.

Consent for direct marketing

Operational messages such as rent reminders, receipts and maintenance updates form part of the service. Any direct electronic marketing is sent only with consent, and every message includes an opt-out.