Privacy policy

01 · Identification

Who we are

Pleks is operated by Pleks (Pty) Ltd, a private company incorporated in the Republic of South Africa. We provide a property-management software-as-a-service platform to estate agencies, property practitioners, and landlords managing residential and commercial rental property in South Africa.

Under POPIA, Pleks operates in two distinct roles:

Pleks as Responsible Party — Part A (platform purposes). For data arising from the platform itself: authentication, multi-factor authentication, error monitoring, in-product feedback, uptime monitoring, cost and usage observability, the marketing waitlist, platform-level billing and subscriptions, support communications, audit logging, and platform administration. Pleks is the sole decision-maker about this processing and is accountable under POPIA for it.

Pleks as Operator — Part B (agency purposes). For data arising from agency use of the platform: property portfolios, landlord relationships, tenant applications, credit checks, FitScore generation, lease generation and signing, rent invoicing, owner statements, rent ledgers and arrears, trust account reconciliation, deposit management, inspections, maintenance, critical incidents, tenant communications, supplier management, municipal bill processing, HOA/scheme management, document generation, AI-assisted processing, FICA/KYC documentation, and data-subject request handling. The agency is the Responsible Party for all this data; Pleks processes it on the agency’s behalf under the data-processing terms set out in the Pleks Terms of Service §09, which incorporates the written-contract requirements of POPIA · S20 POPIA · S21.

The full enumeration of every processing purpose, with lawful bases, data categories, retention periods, and operator recipients, is published in the Pleks POPIA Processing Register. The Register is the authoritative inventory; this Privacy Policy is a plain-language summary of it.

Where to direct your rights. For Part A data (your Pleks account, error events, billing records), exercise rights against Pleks directly. For Part B data (tenant or lease records held by an agency), exercise rights against the agency — they are the Responsible Party. Pleks routes misdirected requests to the correct party within 5 business days so the agency’s 30-calendar-day response clock under POPIA s23 is preserved.

Trust account framing. Pleks does not hold client funds. Trust money for rental management is held in the agency’s own Section 54 trust account at the agency’s own bank; Pleks is not a trustee and does not initiate payments.

02 · Data we collect

What we collect

The categories below summarise the personal information we process. Specific data fields by purpose are enumerated in the Processing Register.

• Account and authentication. Email address, password hash, session tokens, multi-factor authentication credentials (TOTP secret, passkey credential ID and public key), authentication event timestamps, IP address, user agent.
• Identity (Part B). Full name, date of birth, South African ID or passport number, copies of identity documents where stored on behalf of an agency for FICA purposes.
• Contact details. Email address, phone number, residential address, alternate contact details.
• Banking details (Part B). Bank account, branch and clearing details, used only for trust-related transactions and owner payouts; masked in the UI and encrypted at the column level. Where Pleks keeps a full account number (an owner’s or supplier’s payout account, or a tenant’s deposit refund account) it is held only as column-level ciphertext; the interface shows the last four digits.
• Credit information (Part B). Credit bureau reports, default records, civil judgments, credit score, affordability result, FitScore. Collected only with the applicant’s explicit written consent under POPIA · S11(1)(A) and the Credit Bureau Code of Conduct (issued under POPIA, October 2020).
• Employment and income (Part B). Pay slips, employer references, bank statements supplied during the application process.
• Lease and tenancy data (Part B). Lease agreements, rent ledgers, payment history, deposit records, escalation history, notice history, lease-lifecycle events.
• Communications content. Email messages, SMS and WhatsApp message bodies, in-app notifications, message templates and variants, delivery status, communication preferences.
• Inspection records. Photos with EXIF data including GPS coordinates and timestamps (preserved for evidentiary purposes), room-by-room condition ratings, voice notes, AI-generated summaries.
• Maintenance records. Issue descriptions, photos, contractor assignments, cost allocations, completion records.
• Telemetry and security data. IP address, user agent, device fingerprint, error events (PII-scrubbed before transmission to Sentry), audit-log payloads showing before-and-after values of changed fields, authentication events.
• Reference and household data. Names and contact details of references named by applicants; household members including minors named in applications, with bounded processing as set out below.

Special personal information (POPIA · S26–S27)

Pleks does not solicit special personal information as defined in POPIA s26 (religious or political beliefs, race or ethnic origin, trade-union membership, health or sex life, biometric information, criminal behaviour). Where it appears incidentally — for example, in free-text fields, photos, or reference comments — the agency, as Responsible Party, must hold a valid s27 ground for processing. Pleks’s interfaces include contextual nudges discouraging the entry of special personal information in free-text fields. WebAuthn passkey authentication uses biometrics on your own device; the resulting credential is a cryptographic public key, not biometric information, and Pleks does not receive biometric data.

Children’s personal information (POPIA · S34–S35)

Rental applications routinely list household members and dependants. Where any of these are under 18:

• The applicant submitting the form is treated as the competent person providing consent on the minor’s behalf within the meaning of POPIA s34. Pleks relies on the applicant’s representation that they are authorised to provide such consent.
• Processing of minors’ information is bounded strictly to housing-suitability necessity — establishing occupancy count and dependant-support obligations relevant to affordability.
• No credit check, identity verification, or marketing processing is performed against minor household members.

Reference contacts

References named by an applicant — landlords, employers, character references — are data subjects in their own right. The agency is contractually required under the Pleks Terms of Service §09 to send a POPIA · S18 notice to each reference at the point of first contact, explaining that they have been named, what information will be requested, how long it will be retained, and how to exercise their rights. Pleks provides a template notice and the platform’s communication log makes compliance auditable. Pleks does not independently verify that such notice has been provided and relies on the agency’s compliance with this obligation.

03 · Lawful processing

How we use it

We process personal information for the purposes summarised below. The full enumeration with lawful bases and data categories is in the Processing Register.

• Platform operations (Part A). Account creation and maintenance, authentication, security telemetry and fraud prevention, error monitoring (with PII scrubbed before transmission), uptime probes, cost and usage observability, audit logging, platform administration.
• Application and screening (Part B). Receiving rental applications, processing application fees, verifying identity and income, running credit checks with explicit consent, generating FitScore, supporting agency shortlist and decision workflows.
• Lease lifecycle (Part B). Generating, signing, and storing lease documents; tracking lease state, escalations, amendments, notices, and terminations; producing CPA · S14 auto-renewal notices for fixed-term agreements where CPA applies (40–80 business days before expiry per CPA s14(2)(d)).
• Communications and notifications (Part B). Sending mandatory notices required by RHA and CPA, and transactional notifications relating to rent, deposits, inspections, maintenance, and tenancy events, via WhatsApp (primary), SMS (backup), and email.
• Financial and trust (Part B). Maintaining the rent ledger, reconciling the agency’s Section 54 trust account, generating owner statements, managing arrears and letters of demand, recording deposit transactions and interest, producing PPRA-compliant audit exports.
• FICA and KYC storage (Part B). Storing FICA documentation on behalf of agencies that are Accountable Institutions under the Financial Intelligence Centre Act FICA. Pleks does not perform FICA verification — it provides secure storage and workflow tooling for the agency’s own compliance.
• Subject-rights handling. Routing access, correction, deletion, objection, and reconsideration requests to the correct Responsible Party (Pleks for Part A, agency for Part B), and supporting the agency’s 30-calendar-day response under POPIA s23.
• Compliance with law. Statutory record retention (Tax Administration Act s29, FICA s23, PPA s54 + Reg 33, Companies Act s24), audit-log retention for accountability under POPIA · S17, breach notification under POPIA s21–s22.

AI-assisted processing

Pleks uses bounded, assistive AI across multiple workflows — income extraction from bank statements, FitScore rationale, maintenance triage, deposit-deduction justification, lease-clause conflict checking, arrears-letter drafting, wear-and-tear assessment, municipal bill extraction, AGM notice drafting, and trust audit narrative. The AI model provider is listed in the Processing Register.

FitScore is a rules-based and data-weighted scoring tool that may incorporate AI-assisted analysis (for example, in generating the human-readable rationale that accompanies the score), but the score itself is computed by a deterministic weighting of inputs — credit results, verified income, rental history, and employment stability. FitScore does not constitute automated decision-making within the meaning of POPIA · S71. FitScore outputs are advisory signals only and may not be used as the sole basis for approval, rejection, or adverse treatment of an applicant.

AI is assistive only. Pleks does not make solely automated decisions that produce legal effects or similarly significant effects about tenants or applicants without meaningful human review — all decisions remain with the agency or landlord. The AI model provider operates under an Enterprise DPA configured for no model-training retention and minimal operational retention: Pleks does not intentionally retain prompts or responses beyond the workflow output required for the underlying purpose. PII minimisation is applied before cross-border transfer; structured context may remain reasonably linkable to an individual and constitutes pseudonymised, not anonymised, personal information under POPIA s1, governed by Standard Contractual Clauses under POPIA s72. Re-identification remains reasonably possible when combined with additional organisational context held by Pleks or the agency.

04 · Lawful bases

Lawful basis

The lawful bases under which Pleks processes personal information vary by purpose. The full per-purpose mapping is in the Processing Register. Where multiple lawful bases are listed, Pleks and/or the agency rely primarily on the basis most directly connected to the processing activity, with additional bases applying only where independently necessary. The principal bases are:

For Part A (Pleks as Responsible Party):

• POPIA · S11(1)(B) — necessary for performance of the contract between Pleks and the platform user (the Terms of Service). Used for authentication, account management, billing, support.
• POPIA · S11(1)(C) — compliance with an obligation imposed by law. Used for security safeguards under POPIA s19, FICA-related storage on behalf of agencies, tax-record retention.
• POPIA · S11(1)(F) — necessary for the legitimate interests of Pleks or a third party. Used for error monitoring, uptime probes, cost observability, audit logging, and platform administration. A balancing test is conducted and documented for each purpose relying on this basis.
• POPIA · S11(1)(A) — explicit consent. Used for the marketing waitlist, optional MFA for non-agent users, and other opt-in processing.

For Part B (Pleks as Operator):

The agency holds the lawful basis. The basis typically applied by agencies in the South African rental-property-management sector is shown in the Processing Register. Each agency must confirm and document its own basis in its own register, including any balancing test required where POPIA s11(1)(f) is invoked.

For credit checks specifically:

The lawful basis is POPIA · S11(1)(A) explicit consent, supported by compliance with the Credit Bureau Code of Conduct issued under POPIA in October 2020, and the contractual terms imposed by Searchworx and the underlying credit bureaus. The National Credit Act establishes the regulatory framework under which credit bureaus operate (NCA · S43–S46) but does not itself impose the consent requirement — that flows from POPIA and the Credit Bureau Code.

05 · Operators & sub-processors

Who we share with

We share personal information only with operators who help us deliver the platform. We do not sell personal information.

GitHub is used for source-code hosting. It processes contributor identities (commit author records) only; no customer personal information is stored in source code.

Operators outside South Africa process personal information under Standard Contractual Clauses incorporated into the relevant Data Processing Addendum, as required by POPIA · S72(1)(A). Operators domiciled in South Africa (PayFast, Searchworx, DocuSeal on Hetzner SA) are domestic processors and no cross-border transfer occurs.

POPIA role distinction. Most parties in the table above act as Operators or sub-processors processing personal information on Pleks’s behalf. However, PayFast (as payment processor), Searchworx and the underlying credit bureaus (as credit information providers), and Meta (as an independent platform operator) may in certain contexts act as independent Responsible Parties for their own processing activities. Pleks does not control that independent processing and each party’s own privacy policy governs it. The Processing Register identifies the applicable POPIA role for each party.

06 · Cross-border transfers

Cross-border transfers

POPIA · S72(1)(A) permits cross-border transfers where the recipient is subject to a binding agreement providing an adequate level of protection substantially similar to POPIA. Pleks relies on appropriate contractual safeguards, including SCC-style data-transfer provisions, as the principal mechanism for all transfers outside South Africa.

• Africa’s Talking is also subject to the Kenya Data Protection Act 2019; SCCs are applied as the primary mechanism in addition to that local-law protection.
• Anthropic AI processing is governed by SCCs supplemented by a zero-retention Enterprise DPA — API inputs and outputs are not retained for model training or any other purpose beyond returning the immediate response; operational retention by the provider is minimised under the Enterprise DPA. Pleks does not intentionally retain prompts or responses beyond the workflow output required for the underlying purpose.
• Cross-border operators operate under Standard Contractual Clauses incorporated into their respective Data Processing Addenda. Our database and storage provider (Supabase) hosts in Ireland (EU); Vercel, Sentry, Resend, Better Stack and Meta are US-domiciled or globally distributed. Per-operator domiciles are listed in the operators directory.
• Contract-necessity backstop. In limited cases, transfers may also occur where necessary for the performance of a contract with the data subject, as permitted by POPIA · S72(1)(C). This is a backstop basis; SCCs remain Pleks’s primary mechanism.

Pleks evaluates each cross-border transfer against POPIA · S72 before contracting with the operator, and re-evaluates on operator change.

07 · Data subject rights

Your rights

Every data subject has the following rights under POPIA. For Part B data (tenant or lease records held by an agency), exercise rights against the agency. For Part A data (your Pleks account), exercise rights against Pleks directly. Pleks supports the agency’s response and routes misdirected requests within 5 business days.

• Right of access (POPIA · S23). Request a copy of the personal information we hold about you, the categories of recipients, the source, and the purpose. Self-service access via Settings → Data & Privacy within the platform is immediate for profile data and most account records. Other records: contact the Information Officer. Formal PAIA requests: use Form 2. We respond within 30 calendar days, extendable per PAIA s26 with written notice.
• Right to correction (POPIA · S24). Request correction or deletion of inaccurate, misleading, outdated, incomplete, or unlawfully obtained personal information, and notification to third parties to whom the information was disclosed.
• Right to deletion or restriction (POPIA · S25). Request destruction or deletion of personal information that Pleks is no longer authorised to retain. Statutory retention obligations may prevent deletion during the applicable retention window; Pleks will explain the basis for any retention that continues past a deletion request. If you are not satisfied with the response, you may apply to the Information Regulator under s74 or to court under s99.
• Right to object (POPIA · S11(3)). Where Pleks’s lawful basis is legitimate interest under POPIA s11(1)(f), you may object on reasonable grounds relating to your particular situation. Pleks will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for the exercise or defence of legal claims.
• Automated-decision rights (POPIA · S71). Pleks does not make automated decisions about applicants or tenants that produce legal or similarly significant effects. FitScore is an assistive tool — final tenancy decisions remain with the agency or landlord. If you believe an automated decision was nonetheless taken, you have the right under s71(2) to make representations to the agency and to receive information about the underlying logic of the decision.
• Direct-marketing opt-out (POPIA · S69 / s11(3)). Where Pleks sends you direct marketing, you may opt out at any time via the unsubscribe link in every message or by contacting the Information Officer. Opt-outs are honoured within 5 business days.
• Right to withdraw consent. Where consent is the lawful basis (waitlist marketing, optional MFA, credit checks), you may withdraw at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. For credit checks, once a bureau query has been submitted, consent cannot retrospectively unwind that query, but you may withdraw consent for any future checks and may object to further use of an already-obtained result subject to retention obligations.
• Right to complain (POPIA · S74). You may lodge a complaint with the Information Regulator at any time, independently of Pleks’s or the agency’s response. Contact details are in §13.

Many rights — particularly access to account records, profile correction, marketing opt-out, and consent log inspection — can be exercised directly in Settings → Data & Privacy within the platform. All other requests should be sent to the Information Officer at legal@pleks.co.za. Formal PAIA requests may be refused where POPIA, privilege, confidentiality obligations, or statutory exemptions apply; Pleks will state the basis for any refusal in writing.

08 · Retention schedule

How long we keep it

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law. Where multiple retention periods apply to the same record, we enforce the longest applicable statutory, contractual, or evidentiary period. Subject-initiated erasure does not remove records subject to active legal hold or accountability documentation under POPIA s17. Retention windows in this table reflect Pleks platform defaults and sector-standard compliance guidance for Part B categories; agencies remain responsible for determining whether different lawful retention periods apply to their own obligations.

Purpose-level retention periods in this table are minimum commitments and may be overridden by mandatory statutory retention, active legal holds, subject-request restrictions, ongoing disputes, or subpoenas.

Statistical monitoring of screening accuracy and fairness (POPIA · S15(3)(e) POPIA · S14(2))

Separately from the operational retention above, Pleks keeps a pseudonymised record of screening decisions and the inputs behind them — with direct identifiers such as name, identity number, contact details and address removed — in order to monitor, over time, whether its screening is accurate and whether it operates fairly.

This is further processing for statistical purposes, permitted under POPIA · S15(3)(e) because it is compatible with the purpose for which the information was collected and its results are not published in identifiable form. The associated records may be kept beyond the operational retention period under POPIA · S14(2), which permits retention for historical, statistical or research purposes where safeguards prevent the records being used for any other purpose.

The safeguards, stated plainly. These records carry no name, identity number or address. They are never used to make or influence a decision about you outside the application they came from. They are never shared with another agency, and Pleks does not operate a shared tenant blacklist or any cross-agency applicant register. Anything published or reported is aggregate only — never about an identifiable person, agency or property.

If you ask us to delete your information, we remove your identity, not the statistics. Identifying fields are deleted or severed; the de-identified fact — that an application with certain characteristics received a certain outcome — remains, because it no longer identifies you and because s14(2) permits its retention. This is what allows Pleks to answer a fairness question honestly years later without holding onto anyone’s personal information to do it.

09 · Security & transfer

How we protect it

Pleks implements appropriate technical and organisational measures consistent with POPIA · S19. Key measures include:

• Encryption in transit: TLS 1.3 for all connections; HSTS enforced; no plaintext fallback.
• Encryption at rest: AES-256 at the database layer; sensitive fields (bank account numbers, TOTP secrets, passkey credentials) additionally encrypted at the column level before INSERT, so raw values are never visible to infrastructure operators or in database dumps.
• Row-Level Security: Row-level access controls are enforced across production application data stores containing personal information; service-role access restricted to server-side only with org-scoped gateway helper; administrative access is restricted by role separation and least-privilege principles.
• Authentication: magic-link auth for tenant/landlord/supplier roles; password + mandatory MFA for agent roles; MFA step-up required for fiduciary-class actions.
• Immutable audit logging: every state-changing operation recorded with actor, target, event type, timestamp, IP address, and change payload. The audit log is designed to be append-only and operationally immutable within the application layer, and is protected against ordinary alteration or deletion.
• PII scrubbing for observability: error monitoring and log aggregation tools receive PII-scrubbed events only; the scrubber runs pre-transmission and strips request bodies from sensitive routes and PII patterns from all payloads.
• Signed URLs with TTL: all sensitive downloads use time-limited signed URLs; no public bucket access to customer data.
• Operator contractual controls: every third-party operator operates under a Data Processing Addendum with Standard Contractual Clauses where cross-border, and documented retention and breach-notification terms.

10 · Breach notification

Breach notification

Pleks as Operator (Part B). As soon as Pleks has reasonable grounds to believe that someone without authority has accessed or acquired personal information Pleks processes for an agency, Pleks tells that agency immediately — POPIA s21(2) requires it. Telling the Information Regulator and the affected data subjects is the agency’s own duty as Responsible Party under POPIA · S22, which requires it as soon as reasonably possible; the agency assesses whether that duty is triggered.

Pleks as Responsible Party (Part A). Where a security compromise affects personal information for which Pleks is the Responsible Party, Pleks will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA · S22.

In all cases, Pleks will maintain a written record of the breach, the steps taken in response, and the rationale for any decision not to notify a particular individual. A written post-mortem is shared with every affected agency.

To report or escalate a suspected breach, contact the Information Officer at legal@pleks.co.za.

11 · Sub-processor changes

Sub-processor authorisation

Pleks uses general written authorisation from agencies for the operators listed in §05 of this Privacy Policy and §C of the Processing Register, consistent with POPIA · S21(2) and industry practice.

When Pleks proposes to change an operator in a way that materially affects agencies’ data, Pleks will notify agencies by email to their registered address at least 30 days before the change takes effect, giving agencies a reasonable right to object in writing. Changes that do not materially affect data processing — for example, infrastructure migration within the same legal entity or jurisdiction — are recorded in the Register’s version history without the 30-day window.

The current operator list is maintained in §05 above and in §C of the Processing Register, and updated on every version increment.

12 · Changes to this policy

How we update this

This Privacy Policy is a living document. Material changes — new processing purpose, new operator, new cross-border transfer, retention-period change, lawful-basis change — trigger a version bump and a re-consent notification flow to affected agencies and, where appropriate, individual data subjects.

Non-material changes (typographical corrections, structural clarifications, consistency corrections) are recorded in the version history but do not trigger re-consent.

If an inconsistency exists between this Privacy Policy and the Pleks Terms of Service, the Terms of Service prevail unless mandatory law requires otherwise.

The current version is always available at pleks.co.za/privacy. Version history is maintained alongside the Processing Register.

13 · Contact & complaints

Contact us

For any question about this policy, the data we hold, or to exercise your rights, contact our Information Officer. The head of the private body for the purposes of PAIA · S51(1)(A) is the same person, who also serves as Information Officer under POPIA · S55.

You may lodge a complaint with the Information Regulator at any time, independently of Pleks’s or the agency’s response. Pleks will not retaliate against any data subject for exercising this right.

For formal PAIA access requests, see the Pleks PAIA Manual.