Property Fusion

Privacy Policy

Effective
15 May 2026
Last updated
15 May 2026
Version
1.0

1. Who we are

This Privacy Policy explains how Property Fusion ("Property Fusion", "we", "us") collects, uses, shares and protects personal information when you use our proptech platform (the "Platform"). Property Fusion is the responsible party (data controller) for the personal information described in this policy and is committed to processing it in accordance with the Protection of Personal Information Act, 2013 (POPIA).

2. Information we collect

Depending on your role (landlord, agent, tenant, service provider or admin), we may collect:

  • Identity & contact: full name, ID or passport number, date of birth, photograph, email address, phone number, residential address.
  • Verification documents: proof of residence, proof of ownership, title deeds, agency licences, qualifications, insurance certificates, criminal-clearance documents.
  • Financial & banking: banking details for payouts, payment references, invoices, statements, proof of funding (NSFAS, bursary, employer letters).
  • Property & tenancy data: properties, units, leases, tenants, deposits, rent schedules, additional costs, maintenance history.
  • Uploaded content: documents, photographs, videos, signatures, inspection media.
  • Communications: messages exchanged on the Platform, support tickets and call notes.
  • Location: property addresses and approximate device location used for matching providers.
  • Usage & device data: log data, IP address, device identifiers, browser type, pages viewed, actions taken, error reports.
  • Cookies & similar technologies: see Cookies & tracking.

3. Purposes of processing

We process personal information for the following lawful purposes:

  • Account creation & verification — establishing identity, role, ownership and creditworthiness.
  • Lease management — generating, signing, activating and terminating leases.
  • Maintenance coordination — matching jobs to providers, scheduling and completion.
  • Property management — listings, viewings, occupancy and reporting.
  • Payment processing — invoicing, rent collection, deposits, subscriptions and provider payouts.
  • Fraud prevention & security — detecting suspicious behaviour and protecting users.
  • Customer support — answering enquiries and resolving disputes.
  • Analytics & product improvement — improving features and reliability.
  • Legal compliance — complying with tax, financial, housing and consumer protection laws.

Our legal bases include: performance of a contract with you, compliance with a legal obligation, our legitimate interests (or those of a third party), protection of your legitimate interests, and your consent where required.

4. POPIA compliance

We process personal information in accordance with POPIA, including the eight conditions for lawful processing (accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; and data subject participation). We collect personal information only for legitimate, explicit and operational purposes and we do not further process it in a way that is incompatible with those purposes.

Where we rely on consent (for example for marketing communications, sensitive document uploads or POPIA-restricted processing) we will:

  • present a clear, unbundled consent request — checkboxes are never pre-selected;
  • record the wording shown, the timestamp, the IP address and the version of the policy in force;
  • allow you to withdraw consent at any time by emailing privacy@propertyfusion.co.za or using in-Platform controls.

The standard consent wording is:

"I consent to the processing of my personal information in accordance with Property Fusion's Privacy Policy and POPIA requirements."

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect processing we are required or permitted to carry out on another lawful basis (such as legal obligation or performance of a contract).

6. Special personal information

POPIA classifies certain information as "special personal information". We may process the following with appropriate safeguards:

  • identity numbers and copies of ID/passport documents;
  • banking and financial information;
  • criminal background information (for tenant or provider screening, with consent);
  • biometric-style information such as electronic signatures and selfie verification;
  • proof of funding (NSFAS, bursary, employer letters);
  • company and trust registration documents.

Access to special personal information is restricted to authorised admins and authorised workflows, with audit logging and role-based permissions in place.

7. Payment providers

  • Paddle (Paddle.com Market Limited) is our Merchant of Record for subscriptions and handles checkout, billing, taxes, refunds and invoicing on our behalf. See Paddle's privacy policy.
  • Ozow (and other approved processors) facilitate instant EFT payments for rent, deposits and other lease-related payments.
  • We do not store sensitive payment card details. Card and bank credentials are handled directly by these PCI-compliant processors.

8. Third-party services

To run the Platform we rely on operators and third parties acting on our instructions, including:

  • Cloud infrastructure & database — hosting, storage and backups.
  • Email delivery & CRM — transactional and notification email (e.g. Zoho).
  • Lovable — application platform and tooling that helps us build and deploy the Service.
  • Verification providers — identity, banking and credit checks where required.
  • Analytics & error tracking — measuring usage and diagnosing issues.
  • Mapping & address services — for property locations and provider matching.

We require operators to keep personal information confidential and to apply security safeguards consistent with this policy and POPIA.

9. Data security

  • Encryption in transit (TLS) and at rest for sensitive data.
  • Role-based access control with separate roles for landlords, agents, tenants, providers and admins.
  • Row-level security in our database and least-privilege admin access.
  • Audit logging of admin verification actions, document access, banking changes, data exports and deletion requests.
  • Multi-factor authentication for admin accounts and sensitive actions.
  • Regular security reviews and dependency scanning.

No system is perfectly secure; we cannot guarantee absolute security but apply controls appropriate to the risk.

10. Your rights under POPIA

You have the right to:

  • be notified that your information is being collected or has been accessed without authorisation;
  • request access to the personal information we hold about you;
  • request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
  • object, on reasonable grounds, to the processing of your personal information;
  • object to processing for direct marketing by means of unsolicited electronic communications;
  • withdraw consent where we rely on it;
  • submit a complaint to the Information Regulator (South Africa).

To exercise any of these rights, email privacy@propertyfusion.co.za. We may ask you to verify your identity before acting on a request and we will respond within a reasonable period (and in any event within the timeframes required by POPIA).

Information Regulator (South Africa) — JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website: inforegulator.org.za.

11. Data retention

  • We retain personal information for as long as your account is active and as needed to provide the Platform.
  • Lease records, invoices, payment records and other financial documents are retained for the period required by South African tax and accounting law (typically at least 5 years).
  • Verification documents are retained for the duration of the relationship and a reasonable period thereafter for fraud-prevention and audit purposes.
  • When personal information is no longer required, we delete, destroy or de-identify it. Closed accounts may retain limited records (for example, financial history, dispute records and audit logs) where retention is legally required.

12. Cookies & tracking

We use:

  • Essential cookies — required to keep you signed in, remember preferences, and protect against fraud.
  • Analytics cookies — to understand how the Platform is used so we can improve it.
  • Functional cookies — for features such as remembering filters and view preferences.

You can manage cookies through your browser settings. Disabling essential cookies may prevent the Platform from working correctly.

13. Cross-border processing

Some of our operators and subprocessors may store or process personal information outside South Africa (for example in the European Union or the United States). Where this happens, we take reasonable steps to ensure that the recipient is subject to laws, binding corporate rules or binding agreements that provide an adequate level of protection consistent with POPIA.

14. Data breach handling

If we become aware of a security compromise that affects personal information, we will:

  • investigate the incident and contain it as quickly as reasonably possible;
  • assess the risk of harm to affected data subjects;
  • notify the Information Regulator and affected data subjects as soon as reasonably possible, where required by POPIA;
  • document the incident, our response, mitigation and any preventative measures taken.

15. Children

The Platform is intended for users aged 18 and older. We do not knowingly collect personal information from children without the consent of a competent person. If you believe a child has provided us with personal information, please contact us so we can delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. The current version, effective date and version number are shown at the top of this page. Material changes will be communicated through the Platform or by email.

17. Contact us