Legal & compliance
Security & Data Breach Notice
Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information, and section 22 requires us to notify affected people and the Information Regulator of a compromise. This page explains how we do that.
Draft document — not yet legally reviewed
This document is a working draft and has not yet been reviewed by a South African legal or compliance professional. Publishing these pages does not on its own make the business compliant with POPIA, PAIA, ECTA or the CPA.
1. Safeguards we apply
- Accounts are protected by password authentication; we never store passwords in readable form.
- Database access rules restrict every record to its owner, with administrator access limited to a named administrator role.
- Identity documents and verification uploads are stored privately and are readable only by the uploader and an administrator.
- Listing photographs are served through time-limited access links rather than an openly browsable storage folder.
- Card payments are processed by an independent payment processor. We never receive or store full card numbers or card security codes.
- Traffic between your device and the platform is encrypted in transit.
- Administrative actions such as approvals, suspensions and refunds are recorded for audit purposes.
No online service can be guaranteed to be completely secure. We do not claim certification by any regulator or standards body.
2. What you should do
- Use a strong, unique password and do not share it.
- Never send identity documents, bank details or deposits to anyone through unofficial channels.
- Report suspicious listings or messages using the report link on the listing, or by email.
3. Reporting a vulnerability
If you believe you have found a security weakness, email Rentdirecthub@hmrprop.co.za with the subject line “Security report” and enough detail for us to reproduce it. Please do not access, alter or publish other people's data. Security contact: ADMIN PLACEHOLDER — dedicated security contact, if different.
4. If a breach occurs
- We contain the incident and assess what information was affected.
- We notify the Information Regulator as soon as reasonably possible after establishing a compromise.
- We notify affected people in writing, describing what happened, the likely consequences and the steps they can take.
- We record the incident and the corrective steps taken.
Regulator: Information Regulator (South Africa) — complaints.IR@justice.gov.za, https://inforegulator.org.za. Our Information Officer is Hayden Delport.
5. Related pages
See the Privacy Policy for what we collect and why, and Complaints to raise a concern.