POPIA Operator Agreement

The Responsible Party is the estate agency (including each of its branches) that subscribes to PropSource and decides why and how personal information is processed.

The Operator is PropSource, which processes that personal information only on the Responsible Party's behalf, to provide the platform.

This agreement covers personal information the Responsible Party or its users place on the platform, including:

• property owners, sellers, directors, members and trustees: names, ID numbers, contact details and ownership details;
• property details, addresses, erf numbers, location pins, photos and uploaded documents;
• FICA questionnaires, mandates and other generated or uploaded compliance documents;
• agents and staff: names, work contact details, FFC numbers, notes and activity history.

The Operator processes personal information only to provide, secure, support and maintain the platform, in line with the Responsible Party's documented instructions. Those instructions are this agreement, the Terms of Service, and the actions the Responsible Party's users take in the platform.

The Operator does not sell personal information, use it for advertising, or use it for any purpose of its own. Each agency's workspace is kept separate. Information is only visible to another agency where the Responsible Party's administrator has deliberately connected with that agency and chosen to share selected listings.

The Operator treats all personal information as confidential and does not disclose it unless the Responsible Party instructs it to, or the law requires it. Anyone acting on the Operator's behalf with access to personal information is bound by confidentiality and may access it only where needed to provide or support the platform.

The Operator maintains appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, and unlawful access to personal information, as required by section 19 of POPIA. These include:

• encryption of information in transit;
• separation of each agency's workspace at database level;
• role-based access for admins, managers and agents;
• logging of sensitive administrative actions;
• restricted and logged access to production systems.

The Operator reviews these safeguards regularly and updates them as risks change.

The Operator uses a small set of service providers to run the platform, such as cloud hosting and database infrastructure, mapping and geocoding, push notifications and email delivery. These are listed in our Privacy Policy. The Operator only uses providers that are bound to protect the information, and remains responsible to the Responsible Party for their processing under this agreement.

Some providers may process or store information outside South Africa. Where this happens, the Operator takes reasonable steps to ensure the transfer meets the requirements of section 72 of POPIA.

If the Operator has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will notify the Responsible Party immediately, as required by section 21(2) of POPIA, using the administrator's registered email address.

The notification will describe what is known about the incident, the information likely affected, and the steps being taken. The Operator will reasonably assist the Responsible Party in meeting its own duties to notify the Information Regulator and affected people under section 22.

Requests from owners or other people to access, correct or delete their information belong to the Responsible Party. The platform gives the Responsible Party tools to meet them, including per-person Do Not Contact flags, agent-raised erasure requests, and permanent erasure by an admin or manager. If the Operator receives such a request directly, it will refer it to the Responsible Party without delay.

When the subscription ends or the workspace is closed, the Responsible Party may request an export of its information. After the export is provided, or if none is requested, the Operator securely deletes the Responsible Party's personal information within a reasonable period, except where the law requires it to be kept. Cancelling a renewal does not by itself delete any information; see our Refund & Cancellation Policy.

The Responsible Party confirms that it:

• has a lawful basis under POPIA for the personal information it places on the platform;
• has appointed an Information Officer and registered them with the Information Regulator;
• controls who it invites into its workspace and the role each person holds;
• keeps its users' sign-in details secure and removes people who leave the agency.

The Operator will provide reasonable information to help the Responsible Party show compliance with POPIA. This agreement applies for as long as the Operator holds the Responsible Party's personal information. It is governed by the laws of the Republic of South Africa. Where this agreement and the Terms of Service conflict on the protection of personal information, this agreement prevails.

Questions about this agreement can be sent to info@propsource.app.