Privacy notice
Version 1, 8 October 2026. This notice is given under the Protection of Personal Information Act, 2013 (POPIA). The responsible party is The Haff Group, which runs Property Intelligence at https://propertyapp.thehaff.co.za. Its information officer is The Haff Group.
What is held
About users: name, email address, password (stored only as a one-way hash), the secret of the authenticator app if two-factor authentication is on, the role and the companies a user may work in, the time and address of sign-ins, and the audit trail of what each user did.
About tenants and other people captured by an organisation: whatever the organisation records to manage its property: names, contact details, lease terms, meter readings, invoices and payments, correspondence it files, and documents it uploads. The organisation that captures this information decides what to hold and is itself a responsible party for it; the operator processes it on the organisation's behalf as its operator under POPIA.
From connected services: the invoices, contacts and payments a company's own Xero holds, and the messages and attachments read from a mailbox the organisation connects, kept so that meter slips and council statements can be filed and invoices sent. Connection credentials and tokens are stored encrypted.
Why, and on what basis
To provide the service the organisation asked for (performance of the agreement with it), to keep the service secure and recoverable (the operator's legitimate interest), and to meet legal duties such as keeping financial records. Nothing is sold, and nothing is used for advertising.
Who else sees it
Only the organisation's own people, at the rights their owner gave them; another organisation only where the owner has shared a company with it. The operator's staff see data only to support and maintain the service. The service runs on servers of the operator's hosting provider, which stores the data and the backups; no other third party receives it, other than Xero and Google where the organisation has connected them, and Anthropic where the AI reader is switched on under Settings, which then receives the text of statements uploaded under Utility invoices in order to read them into lines.
Security
Encrypted transport, encrypted storage of credentials, hashed passwords, two-factor authentication, sign-in limits, isolation between organisations enforced in the application and tested, and a full audit trail. Backups are taken several times a day and held in more than one place.
How long
For as long as the organisation uses the service. When an organisation is closed, a final export is kept for a reasonable period for the organisation to collect, and the data is then deleted, except where a law requires longer retention of financial records.
Your rights
A person whose information is held may ask what is held about them, ask for it to be corrected or deleted, and object to its processing, by contacting the information officer above. Tenants and other people captured by an organisation should contact that organisation first, as the party that holds their information. A complaint may also be lodged with the Information Regulator of South Africa (inforeg.org.za).
Changes
This notice may be updated; the version and date above change when it is. Owners are told of material changes.