POPIA Compliance Policy

1. Who We Are (Information Officer)

Ru Haus Holdings CC (CIPC registration number 2008/010859/23 · D-U-N-S 598730582), trading as PropGuard SA ("PropGuard SA", "we", "us"), is a South African Close Corporation operating a national property ownership registry. We are the Responsible Party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy applies to all personal information processed through our website at propguardsa.co.za, our mobile applications, and any associated services.

2. Personal Information We Collect

We collect the minimum personal information necessary to provide our property registry service. This includes:

2.1 Account Information

• Full name and SA ID number (for identity verification)
• Email address and mobile phone number
• Password (stored as a bcrypt hash — never in plain text)
• Province of residence

2.2 Registered Item Information

• Item description, type, and estimated value
• Serial numbers, IMEI numbers, VIN numbers
• Photographs and supporting documents you upload
• Purchase receipts or proof of ownership (optional)

2.3 Usage & Technical Information

• IP address and browser/device information (for security)
• Pages visited and search queries entered
• Payment information (processed by our payment provider — we do not store card numbers)

3. Purpose of Processing

We process personal information for the following specific, lawful purposes:

1. To create and manage your account — verifying your identity and enabling login
2. To register your property — linking valuables to a verified owner on our national registry
3. To issue ownership certificates — generating PDF certificates as proof of registration
4. To enable stolen item checks — allowing dealers and the public to verify item status
5. To send service notifications — alerts when your item is checked, flagged, or found
6. To process payments — for paid subscription plans
7. To maintain security — detecting fraud, abuse, and unauthorised access
8. To comply with legal obligations — where required by South African law

We will not process your personal information for any purpose incompatible with those listed above without obtaining your prior consent.

4. Lawful Basis for Processing

Under POPIA, we process personal information on the following grounds:

• Consent — when you create an account and agree to this policy
• Contractual necessity — to fulfil our service obligations to you
• Legitimate interest — for fraud prevention and security monitoring
• Legal obligation — where required by South African law or court order

5. Sharing of Personal Information

We share personal information only in limited, controlled circumstances:

5.1 Our Dealer Network

When a dealer or pawn shop checks an item serial number, IMEI, or VIN, they see only whether the item is registered or stolen — they do not see your name, contact details, or ID number. Only the item status and certificate number are disclosed.

5.2 Service Providers

We use trusted third-party service providers under data processing agreements, including:

• Brevo (Sendinblue) — email delivery and communications
• Payment processor — for subscription billing (PCI-DSS compliant)
• Hosting provider — South African-based server infrastructure

5.3 Law Enforcement

We may disclose personal information to law enforcement authorities where we receive a valid legal request, court order, or subpoena. We will notify you of such a request where legally permitted to do so.

5.4 Insurance Companies

PropGuard SA does not have formal data-sharing agreements with insurance companies at this time. Our certificates serve as supporting documentation that you may choose to provide to your insurer. Formal insurer partnerships are planned for the future and will be announced when confirmed.

6. Data Retention

• Active accounts — retained for the duration of your account plus 2 years after deletion
• Registered items — retained for 5 years after removal or account closure
• Stolen item reports — retained indefinitely for law enforcement and public protection purposes
• Verification check logs — retained for 12 months, then anonymised
• Payment records — retained for 7 years as required by South African tax legislation

You may request deletion of your personal data at any time (subject to legal retention obligations) by contacting our Information Officer.

7. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

• Right to access — request a copy of all personal information we hold about you
• Right to correction — request that inaccurate information be corrected
• Right to deletion — request erasure of your personal information (where no legal obligation to retain it exists)
• Right to object — object to the processing of your personal information
• Right to complain — lodge a complaint with the Information Regulator of South Africa

To exercise any of your rights, email privacy@propguard.co.za with your full name, email address on your account, and the nature of your request. We will respond within 10 business days.

8. Security Measures

We apply industry-standard technical and organisational measures to protect your personal information:

• AES-256 encryption for sensitive data at rest
• TLS/HTTPS for all data in transit
• bcrypt password hashing (minimum 12 rounds)
• Role-based access controls — staff access only what they need
• Login rate limiting and brute-force protection
• Regular security audits and vulnerability scanning
• South African-based hosting to ensure data sovereignty

In the event of a data breach that is likely to prejudice your rights, we will notify you and the Information Regulator within 72 hours of becoming aware of the breach.

9. Dealer & Business API Access

9.1 API Usage Rules

• API keys may not be shared, resold, or used outside the agreed purpose
• You may only query the API when a transaction is being evaluated — bulk scraping is prohibited
• All API queries are logged and auditable by PropGuard SA
• Misuse of the API results in immediate revocation and potential legal action

9.2 API Data Returned

The PropGuard API returns only the minimum data necessary: item registration status (registered / stolen / not found) and, where stolen, a case reference. No personal owner information is ever returned via the API.

10. Cookies & Analytics

PropGuard SA uses essential cookies to keep you logged in and secure your session. We may also use analytics tools to understand how our website is used — this data is anonymised and not linked to your personal identity.

• Essential cookies — required for login sessions and CSRF protection
• Analytics cookies — used to improve website performance (anonymised)

You may disable cookies in your browser settings, though this may affect login functionality.

11. Contact the Information Officer

For all POPIA-related enquiries, data access requests, or complaints, contact our Information Officer:

This policy was last updated in April 2026 and will be reviewed at least annually. Changes will be communicated via email to registered users and posted on this page.