This policy explains what personal information is collected when you use this site, who is responsible for it, and what you can do about it. It is written to meet section 18 of the Protection of Personal Information Act, 2013 (POPIA).
Two different things happen on this site, and they have two different responsible parties. Please read the next section carefully — it determines who you deal with about your information.
1. Who is responsible for your information
Browsing this site
Resitec (Pty) Ltd (“Resitec”) is the responsible party for information collected while you browse: page views, which sections you open, and whether you clicked through to apply. Resitec decides why this is collected and how, so Resitec answers for it.
Registered address: 42 Barrage Road, Vanderbijlpark, 1912.
Applying for accommodation
When you submit an application, the managing agent of the residence you are applying to is the responsible party. They decide who is accepted or declined, and they answer for your application information.
Resitec is their operator: Resitec provides and hosts the platform the managing agent uses, and stores your information on their behalf. Resitec processes your information only on the managing agent’s instructions and for no purposes of its own. Resitec does not decide your application, does not use your application information for its own purposes, and does not share it with other managing agents.
The managing agent’s details, and the Information Officer to contact about your application, are shown on the application form before you submit. They differ from residence to residence.
2. What is collected
When you browse
We count visits without identifying you. No cookies are used for this, and no identifier is stored on your device. Each event records the page, the type of interaction, a coarse referrer category, and a device class.
To avoid counting the same visit twice we derive a one-way key from the date, a shortened version of your IP address, and your browser’s user-agent string. It is a cryptographic hash — your IP address is not stored, the key cannot be reversed, and it changes every day, so visits cannot be linked across days or back to you.
If — and only if — you accept the cookie banner, Google Analytics also loads and sets its own cookies. Nothing analytics-related runs before you accept. You can decline and the site works normally.
When you apply
The application form collects: your name, your ID or passport number, your email address, your contact and address details, your university and study details, your intended year of residence, any comments you add, and a copy of your ID document or passport, which you upload.
We verify your email address by sending you a one-time code.
We also record the date you gave consent and the version of the consent wording you were shown, so it is always possible to establish exactly what you agreed to.
3. Why it is collected
Browsing information is used to understand which residences and which parts of a listing get attention, so listings can be improved. It is not used to profile you, is not used for advertising, and is not sold.
Application information is used by the managing agent to assess your application, to create your accommodation contract if you are accepted, and to communicate with you about it. Your ID or passport is used to confirm your identity — accommodation is allocated against a verified person.
The lawful basis for your application is your consent, which you give on the form. You are not obliged to apply, but the information marked as required is necessary — without it the managing agent cannot process an application.
4. Who it is shared with
Your application information is available to:
- The managing agent of the residence you applied to — the responsible party.
- The landlord of that residence, who receives it as a recipient in connection with your accommodation.
- Resitec, as operator, which stores it on the managing agent’s behalf.
It is not shared with managing agents or landlords of other residences. Access is scoped per managing agent on the platform.
Browsing information is not shared with managing agents in a form that identifies you, because it does not identify you to begin with. If you accepted the cookie banner, Google receives analytics data under its own terms.
5. How long it is kept
Raw browsing events are deleted after 90 days. Aggregated daily counts, which contain no identifiers, are kept indefinitely for year-on-year comparison.
Application information is kept by the managing agent for as long as they need it for your application and any resulting accommodation contract, and thereafter for as long as the law requires them to.
6. Information sent outside South Africa
If you accept the cookie banner, Google Analytics transfers browsing data outside South Africa.
7. Your rights
Under POPIA you may:
- Ask what is held about you and get a copy (s23).
- Correct or delete information that is wrong, misleading, or no longer needed (s24).
- Object to processing (s11(3)).
- Withdraw consent at any time (s11(2)). This does not undo what was already done lawfully, and withdrawing consent during an application means it cannot be processed further.
- Complain to the Information Regulator (details in section 10).
Direct requests about your application to the managing agent’s Information Officer, shown on the application form. Direct requests about browsing and cookies to Resitec’s Information Officer, above. If you contact the wrong one, say so and it will be passed on.
8. Security
Access to application information is restricted to the managing agent for that residence, and is scoped so one managing agent cannot see another’s applicants. Uploaded ID documents are not publicly accessible. As operator, Resitec is required to keep your information confidential, to secure it, and to notify the managing agent immediately if it is ever compromised.
If a breach affects your information, you will be notified as POPIA requires.
9. Changes to this policy
The version and effective date are at the top of this page. If a change materially affects what you agreed to, you will be asked to agree again — the previous version does not silently disappear, and the version recorded against your application always identifies the exact wording you accepted.
Changes to a party’s contact details are not a new version.
10. Contact and complaints
Resitec (Pty) Ltd
42 Barrage Road, Vanderbijlpark, 1912
Resitec’s Information Officer: dataprotection@resitec.cloud
For application matters, use the managing agent’s Information Officer shown on the application form.
You may complain to the Information Regulator at any time:
Information Regulator (South Africa) complaints.IR@justice.gov.za https://inforegulator.org.za