Privacy notice under POPIA, the Protection of Personal Information Act

The responsible party for personal information processed through this platform is Fiswana Investments, trading as Samorwa Villages student accommodation, South Africa.

For privacy requests (access, correction, deletion, objection, or complaints about our processing), contact your property manager in the first instance, or email privacy@samorwavillages.co.za. You may also escalate to the Information Regulator (South Africa). See section 12.

We process personal information about:

• Residents and tenants of Samorwa Villages properties
• Visitors registered by residents or checked in by security
• Staff (property managers, security, housekeeping, service providers)
• People who raise public panic or first-aid alerts without signing in (optional name and phone)
• Portfolio administrators and other authorised Fiswana users

Residents: name, email, phone, room and building assignment, lease and funding type (including NSFAS status where recorded), maintenance requests and photos, facility bookings, visitor passes, payment and arrears records, announcements interaction, security alerts you raise, and account login details.

Visitors: name, contact details, vehicle registration (optional), purpose and expected arrival, access codes, check-in/out times, and, where captured, an image of an ID, driver's licence, or student card presented at registration.

Security & emergencies: panic and first-aid alerts, optional landmark description, optional contact details for unauthenticated callers, device GPS location when you allow it (so security can navigate to you), and written incident reports filed by security when closing an alert.

Staff & providers: name, work contact details, role and property assignments, job status updates, and timekeeping related to assigned work.

Technical: essential session cookies, IP address and device/browser data as needed for security and fraud prevention, and any optional analytics only if you consent (see cookie notice).

We process personal information to:

• Operate the residence (rooms, occupancy, communications)
• Handle maintenance, housekeeping, and facility bookings
• Manage visitor access and on-site security
• Respond to panic, first-aid, escort, and visitor-report alerts
• Record payments, NSFAS-related status, and arrears for property management
• Keep audit and incident records required for safety and accountability
• Authenticate users and protect the platform against misuse

Processing is based on: performance of the lease / accommodation relationship; legitimate interests in safety, security, and property operations (balanced against your rights); legal obligations where applicable; and consent where we ask for it (for example visitor registration acknowledgements, optional GPS for emergency response, and non-essential cookies).

We do not intentionally collect special personal information (such as health, biometric, or religious data) as a routine part of the platform. First-aid alerts may imply a medical need; we only process what is required to dispatch security. Identity document images are used solely for visitor verification and investigation of incidents.

• Residents see their own requests, bookings, visitors, payments, and alerts they raised.
• Property managers and security at your residence see what they need to perform their roles for that property only.
• Service providers see jobs assigned to them (including location details needed to complete the work).
• Portfolio administrators see aggregated and property-level operational data across the portfolio.

Multi-tenant controls are designed so one property cannot access another property's resident data. We do not sell personal information. We may share information with professional advisers, regulators, or law enforcement where required by law, or with infrastructure providers (hosting, email) under appropriate agreements.

When you use the panic or first-aid controls, the platform requests your device location so security can come to where you are. Coordinates are stored on the alert record and shown to authorised security and management staff, with a map link. You may refuse location permission; the alert can still be sent, but security may only have your room or any landmark text you provide. Location is not used for advertising.

• Visitor records (including ID images where stored): typically 12 months after the visit for security purposes, then deleted or anonymised unless needed for an open investigation or legal claim.
• Resident and financial records: for the tenancy and thereafter for periods required by law (for example tax and accounting) and legitimate safety/audit needs.
• Security alerts and incident reports: retained as part of the property safety log for the period needed for investigations, insurance, and legal defence.
• Account sessions: access tokens expire after a short idle period; refresh sessions have a hard maximum lifetime (see cookie notice).

We use role-based access control, property-scoped data isolation, encrypted transport (HTTPS in production), password hashing, and httpOnly session cookies. Photos and identity images should only be used for the purposes stated. No system is perfectly secure; if you suspect unauthorised access to your account, change your password and notify management immediately.

Primary operations and intended production hosting are in South Africa or jurisdictions with comparable protection. If a service provider processes data outside South Africa, we take steps consistent with POPIA section 72 (for example contractual safeguards or reliance on an adequate level of protection).

Subject to the Act and any lawful limitations, you may:

• Request confirmation whether we hold personal information about you
• Request a record or description of that information
• Request correction or deletion of inaccurate, incomplete, or excessive information
• Object to processing in certain circumstances
• Withdraw consent where processing is based on consent (without affecting prior lawful processing)
• Lodge a complaint with the Information Regulator

To exercise these rights, contact your property manager or privacy@samorwavillages.co.za. We may need to verify your identity before responding.

If you are not satisfied with how we handle your personal information, you may complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za

We use essential cookies for authentication and security. Optional cookies only run with your choice. Full details, cookie categories, and how to change your mind are in the cookie notice.

This platform is intended for adult residents and authorised staff. Visitor information about minors should only be submitted by a responsible adult where necessary for access control.

We may update this notice when our practices or the law change. The "Last updated" date at the top will change. Material changes may also be communicated by announcement on the platform or through your property manager.