Privacy Policy

Welcome

This policy explains how Personal Information is processed on the RESTR platform, in accordance with the Protection of Personal Information Act, 2013 (POPIA).

1. Roles: Responsible Party vs Operator

Your accommodation provider (your Landlord/Manager) is the Responsible Party that determines why and how your Personal Information is processed. RESTR acts as an Operator, processing Personal Information on the Landlord/Manager's behalf and under their instruction, solely to provide the platform.

Questions about how your specific provider uses your data should be directed to that provider; RESTR will assist as Operator where required.

2. Information We Process

Students: name, ID or passport number, email, phone number, funding/bursary type (e.g. NSFAS, corporate, self-funded), assigned building/room, and digital signatures.

Contractors: name, business details, contact information, and assigned task records.

Media: photographs captured via device camera for room inspections and maintenance logging.

3. Purpose of Processing

We process this data only to operate the accommodation service: configuring monthly ledger billing splits, managing room-inspection verification records, and dispatching maintenance tickets to Contractors.

4. Lawful Basis

Processing is carried out to perform the accommodation contract, to comply with legal obligations (including tax and financial record-keeping), and on the basis of consent where required. Where you have consented, you may withdraw consent at any time, subject to legal or contractual record-keeping obligations.

5. Storage, Security & Cross-Border Processing

Data is hosted on encrypted, modern cloud infrastructure (Google Cloud Platform / Firebase). Some processing or storage may occur on servers located outside South Africa; where this happens, it is subject to safeguards consistent with POPIA's requirements for trans-border information flows.

Move-in inspection records are locked and read-only on submission to guarantee an unalterable audit trail.

6. Third-Party Sharing

We do not sell or rent your Personal Information. Data is shared strictly on a need-to-know operational basis — for example, a Contractor receives your room number and the relevant maintenance photo in order to carry out a repair.

7. Retention

We retain Personal Information only as long as necessary to fulfil the operational lease cycle, or as required by South African tax and financial record-keeping laws, after which it is deleted or de-identified.

8. Your Rights under POPIA

You have the right to request access to the Personal Information held about you, to request correction of inaccurate information, and to object to certain processing. To exercise these rights, contact your Landlord/Manager (as Responsible Party) in the first instance.

You also have the right to lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

9. Information Officer

Tumi Ncube — tumi@restr.it

10. Contact

hello@restr.it