Privately

Privacy Policy

Effective 12 May 2026 · Last updated 24 August 2026 · Version 2026.08.3

This policy explains how Privately Property (Pty) Ltd (“Privately”, “we”, “us”) collects, uses, shares and protects your personal information when you use our website and services. We comply with the South African Protection of Personal Information Act, 2013 (Act 4 of 2013) (“POPIA”).

Who we are

Privately is a private property marketplace that lets buyers and sellers in South Africa transact directly, without estate-agent commission. The legal entity behind the service is:

Information Officer

As required by POPIA section 56, we have appointed an Information Officer who is accountable for our compliance with POPIA.

You may contact the Information Officer for any privacy-related request, including data access, correction, deletion, or to lodge a complaint before approaching the Information Regulator.

What we collect

We only collect information that is necessary to provide the Privately service. Categories include:

  • Identifiers and contact details: full name, email address, phone number, and (where applicable for FICA) South African ID number.
  • Property data: listings you create, viewings booked, offers/bids submitted or received, disclosure form answers, and property photographs.
  • Verification data: documents you upload to verify your buying capacity (for example bond pre-qualification letters or proof of funds).
  • Communication data: messages you send through our on-platform chat to other users.
  • Behavioural data: pages visited, searches performed, properties favourited and saved searches — collected only with your analytics-cookie consent.
  • Payment data: the platform-access fee is processed by PayFast. We never see or store your card details — we only receive a payment confirmation and reference.
  • Technical data: IP address, browser type, and device information collected for security, fraud prevention and to deliver the service reliably.

Why we collect it

  • To create and maintain your account.
  • To allow you to list, browse, favourite and enquire about properties.
  • To book and confirm property viewings between buyers and sellers.
  • To facilitate offers and the negotiation between parties.
  • To deliver transactional emails about your activity on the platform.
  • To verify buyer financial capacity where you choose to participate.
  • To prevent fraud, abuse and security incidents.
  • To improve the product, measure performance and fix bugs.
  • To comply with our legal obligations (FICA, tax, court orders).
  • To send you marketing communications — only if you opt in.

We rely on one of the following lawful bases for each processing activity:

  • Contractual necessity — we cannot deliver the service without processing the data (for example, we cannot show your listing to buyers without storing it).
  • Legal obligation — FICA, the Income Tax Act, court orders and other applicable laws may require us to retain or disclose certain information.
  • Legitimate interest — for security, fraud prevention and reasonable improvement of the platform, balanced against your privacy.
  • Consent — for marketing emails, optional analytics and any non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Who we share it with

We do not sell personal information. We share data only with operators (POPIA-speak for “processors”) that help us run the service. Each operator is bound by a written agreement that limits use to our instructions.

  • Supabase — database, authentication and file storage. Hosted in the EU.
  • Vercel — application hosting and serverless functions. EU/US regions.
  • Resend — transactional and notification email delivery.
  • PayFast — processing of the once-off platform-access payment. Card details are handled directly by PayFast.
  • Google Maps & Google Fonts — map tiles, places autocomplete and font delivery. Subject to Google’s own privacy terms.
  • Lightstone — property valuation data, where you use a valuation feature for a specific property.
  • Secure Citizen — identity and KYC verification, processing ID numbers to verify buyers and sellers. Hosted in South Africa.
  • Cloudflare — video transcoding and metadata stripping for property videos you upload. Global CDN.
  • PostHog — product analytics, EU servers, enabled only with your analytics-cookie consent.
  • Google Analytics — website traffic measurement, enabled only with your analytics-cookie consent. Unlike PostHog it processes data on Google’s infrastructure outside South Africa. It is not loaded at all until you consent. Google states that Analytics 4 does not log or store IP addresses, using them only to derive approximate location. We do not enable page addresses are stripped of any token or identifier before they are sent. If you also accept marketing cookies, Google may use this data to show you Privately adverts on other websites (remarketing); declining marketing leaves measurement working with advertising features switched off. If you withdraw consent we disable the tag and delete its cookies.
  • Sentry — error and performance monitoring, enabled only with your analytics-cookie consent.
  • Better Stack — uptime monitoring and our public status page, EU servers. It pings our public pages only and holds minimal personal data.
  • Axiom — server log aggregation for diagnostics. Logs may contain identifiers such as user IDs or IP addresses and are retained for 90 days.
  • AgentLane — publishes a machine-readable list of actions that AI assistants can carry out on this site, so an assistant browsing on your behalf can do things like search listings or read our guides. It runs only on the public parts of the site — the home page, browse and our information pages. It is never loaded in your dashboard, the admin area, or any sign-in or account page. Loading it means AgentLane receives your IP address and browser type, as any third-party script does, and it stores a random identifier for the browser tab which is discarded when you close the tab. If an assistant carries out one of the published actions, AgentLane also receives what was asked for and what our site returned. The published actions are read-only — searching listings and reading property details that any visitor can already see — so what AgentLane receives is what a public page shows.
  • Attorneys you choose — once you accept an offer and select a conveyancing attorney, we share the deal details with that firm so they can complete the transfer.
  • Bond originators (optional) — only if you request a bond pre-qualification or originator referral.

What other users can see about you

Some of your information is shown to other people on Privately. This is separate from the operators listed above — they process data on our instructions, whereas the items below are seen by other members. It is limited to what people need in order to deal with each other safely.

  • Anyone browsing the site can see your listings and the display name on your profile. They cannot see your email address, your phone number, or your verified legal name.
  • People you deal with — someone who messages you, who bids on your property, or who books a viewing with you — also see your verified full name as confirmed against Home Affairs records, shown alongside your profile name. You see theirs on the same basis.
  • Nobody sees your ID number, your ID photo, your date of birth, or your verification documents. Your email address and phone number are never shown to other users unless you choose to share them yourself.

We show verified names to people who are dealing with each other because it materially reduces the risk of impersonation and fraud in property transactions. Our legal basis is the legitimate interest — ours and yours — in a marketplace where you know who you are actually dealing with (POPIA section 11(1)(f)). We keep that disclosure proportionate: your verified name is never published openly, only shown to a person you are already in contact with. If you would prefer your verified name not to be shown, you can close your account — see your rights below.

Identity verification confirms that a person is who they say they are. It does not confirm that a property is genuinely for sale, that a seller owns it, or that any deal is legitimate. Always confirm ownership through a conveyancing attorney before transferring money.

International transfers

Some of our operators store data outside South Africa (primarily in the EU and the United States). Where this happens, we rely on POPIA section 72 — specifically the operator’s adherence to binding corporate rules or Standard Contractual Clauses, or your explicit consent. You can request a list of current sub-processors and their locations from the Information Officer.

How long we keep it

  • Active account data — while your account is active, plus 30 days after deletion (the POPIA-aligned grace period during which you can change your mind).
  • Bid, offer and transaction records — seven (7) years, as required by FICA and SARS record-keeping rules.
  • Verification documents — five (5) years post-transaction, in line with FICA.
  • Marketing consent records — until you withdraw, plus three (3) years as proof of the consent decision.
  • Server and application logs — up to 90 days for security and debugging.

After the retention period we delete or de-identify the data. Certain records (such as anonymised market statistics) may be retained indefinitely once de-identified.

Your POPIA rights

You have the right to:

  • Access — request a copy of the personal information we hold about you (POPIA s23). You can export your data yourself in your privacy settings.
  • Correct — ask us to correct information that is inaccurate, irrelevant, outdated or misleading. You can edit most fields directly on your profile.
  • Delete — request that we delete your account and personal information (POPIA s24). Some data must be retained longer under FICA — see “How long we keep it”.
  • Object — object to processing based on legitimate interest or for direct-marketing purposes.
  • Withdraw consent — at any time, with no effect on prior lawful processing.
  • Lodge a complaint — with the Information Regulator (details below).

To exercise any of these rights, use Privacy & data in your dashboard or email info@privatelyproperty.com. We will respond within a reasonable time, normally within 30 days.

Cookies

We use cookies and similar storage to keep you signed in, remember your preferences and — with your consent — understand how the product is used. Categories:

  • Essential — required for the site to work (authentication, security, load balancing). Cannot be disabled.
  • Analytics — help us understand which pages and features are useful (PostHog, Sentry, Google Analytics). Off by default.
  • Marketing — used to measure how our campaigns perform and, through Google, to show you Privately adverts on other websites you visit (remarketing). Off by default.

You can change your choices at any time using the link in our footer.

AI assistant access. On the public parts of the site we publish a machine-readable list of actions that AI assistants can carry out (see AgentLane above). The script that does this stores a random identifier for your browser tab, which is not a cookie, is not used to identify you, and is discarded when you close the tab. It is not one of the categories above because it does not track you or measure your use of the site; it is how the site describes itself to software. It is never loaded on your dashboard or any signed-in account page.

Embedded media. Some listings include videos or 3D virtual tours hosted by third parties — YouTube, Vimeo, Matterport, iGuide and Kuula. When you choose to play one, that provider receives your IP address and may set its own cookies. To limit this we load YouTube in privacy-enhanced (no-cookie) mode and ask Vimeo not to track, and we do not load any third-party embed until you click to play. If you have not accepted marketing cookies, embeds stay behind a click-to-play placeholder; clicking it counts as consent for that session.

Security

  • All traffic is encrypted in transit using TLS.
  • Data is protected by row-level security policies in our database so that one user’s data is never visible to another.
  • Passwords are stored as salted hashes by our authentication provider — we never see them.
  • Verification documents are stored in a private bucket that requires authentication and a signed URL.
  • Access to production data is limited to the Information Officer and essential engineering staff and is logged.

We will notify you and the Information Regulator without undue delay (and where feasible within 72 hours of becoming aware) if a security compromise affects your personal information, as required by POPIA section 22.

Children

Privately is not intended for users under 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided information to us, please contact the Information Officer and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make a material change we will email account holders and post a notice on the site at least 14 days before the change takes effect. The current version and effective date are shown at the top of this page. Each consent decision you give is recorded against the policy version in effect at the time.

Contact us

For any privacy question, request or complaint, contact the Information Officer:

Information Regulator

You have the right to lodge a complaint with the South African Information Regulator: