POPIA Compliance Statement

1. Introduction

Rubynet (Pty) Ltd (“we”, “us”, “our”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

This statement explains how we process personal information through the Rubyprop platform and its connected modules (PropSpec, RubyFICA, Ruby Social Hub).

2. Information Officer

• Name: Ray Roberts
• Company: Rubynet (Pty) Ltd
• Registration Number: 2026/345895/07
• Email: [email protected]
• Address: Durban, KwaZulu-Natal, South Africa

3. What personal information we collect

• Identity information: names, ID numbers, passport numbers, dates of birth, nationality, marital status
• Contact information: phone numbers, email addresses, physical and postal addresses
• Financial information: bank account details, rental amounts, deposit information, employment and salary details
• Property information: property addresses, lease terms, inspection records
• FICA compliance data: PEP status, source of funds/wealth, sanctions screening results, document uploads (ID copies, proof of address)
• Digital signatures and associated IP addresses and timestamps
• Usage data: login times, feature usage, browser information

4. Purpose of processing

• Facilitating rental property management between agents, landlords, and tenants
• FICA compliance as required by the Financial Intelligence Centre Act 38 of 2001
• Credit checks and tenant screening (with consent)
• Generating lease agreements, mandates, and supporting legal documents
• Communication between parties (email, WhatsApp notifications)
• Billing and subscription management

5. Legal basis for processing

• Consent: where you have given us permission (e.g. POPIA consent forms, credit check consent)
• Contract: necessary to perform our services under the subscription agreement
• Legal obligation: FICA compliance, Rental Housing Act requirements, tax records
• Legitimate interest: improving our services, fraud prevention, platform security

6. Data retention

• FICA records: 5 years from end of business relationship (as required by FICA Section 23)
• Lease and property records: duration of lease plus 3 years (Rental Housing Act)
• Financial records: 5 years (tax requirements)
• Account data: until account is deleted, then anonymised after 30 days
• Backup data: purged within 90 days of deletion

7. Third-party sharing

We share personal information only with:

• SMTP2GO (email delivery)
• PayFast (payment processing)
• TPN Credit Bureau (credit screening, with your consent)
• Meta/WhatsApp (message delivery)

We never sell personal information to third parties.

8. Cross-border transfers

All primary data is stored on servers located in South Africa. Where third-party services process data outside South Africa (e.g. email delivery), we ensure adequate protection measures are in place as required by Section 72 of POPIA.

9. Your rights under POPIA

You have the right to:

• Access your personal information we hold
• Correct inaccurate information
• Request deletion of your information (subject to legal retention requirements)
• Object to processing of your information
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with the Information Regulator

10. How to exercise your rights

Contact our Information Officer at [email protected]. We will respond within 30 days.

You may also contact the Information Regulator:

• Email: [email protected]
• Website: inforegulator.org.za

11. Security measures

• All data encrypted in transit (TLS/SSL) and at rest
• Access controls with role-based permissions
• Audit logging of all data access
• Regular security reviews
• Secure password hashing (bcrypt)

12. Cookies

We use essential cookies only:

• Session cookies for authentication
• Preference cookies for embedded mode detection

We do not use tracking or advertising cookies.

13. Updates to this statement

Last updated: April 2026. We may update this statement from time to time. Material changes will be communicated via email to registered users.