Privacy policy

Vaal Students Accommodation (VSA) is the responsible party for your personal information as defined under the Protection of Personal Information Act 4 of 2013 (POPIA).

Our designated Information Officer is [To be confirmed]. You can reach them at support@vsa-connect.co.za for any privacy-related questions or requests.

This policy describes what we collect, why, and what rights you have under POPIA.

We collect the following personal information depending on how you use VSA:

Students

• Full name, email address, and contact number
• University (VUT or NWU Vaal) and funding type (NSFAS, bursary, or self-paying)

Applications and waitlist entries

• All student details above
• The listing applied for and the current application status

Listing reports

• Reason for the report, written details, and your email address
• An optional contact phone number

Landlord enquiries

• Full name, email address, and phone number
• Property name (optional), suburb or area, number of beds, and NSFAS status
• Nearest university and an optional message
• The date and time you gave consent to be contacted

Account credentials

• Your email address is stored on our platform. Your password is managed by Firebase Authentication — we never see it in plain text.

We process your personal information only for lawful purposes, including:

• Providing the VSA platform and enabling you to browse and apply for accommodation
• Placing students in accommodation and facilitating contact between students and landlords
• Reviewing and acting on listing reports submitted by users
• Following up on landlord enquiries submitted through the 'List your place' form
• Detecting and preventing fraud, scams, and misuse of the platform
• Complying with our legal obligations under South African law

We do not sell, rent, or trade your personal information. We may share it with:

• Landlords of properties you apply to — they receive the details needed to process your application.
• Service providers (such as Google Firebase) that help us operate the platform, under appropriate data processing terms.
• Law enforcement or regulatory authorities when required by law.

VSA is built on Google Firebase. Your personal information (database records and any files) is stored in Google Cloud's africa-south1 region (Johannesburg, South Africa).

Firebase Authentication, which manages login credentials, may process certain account data on Google servers outside South Africa. Google's safeguards for international transfers comply with applicable data protection requirements.

• Student profiles and account data: kept while your account is active and for a reasonable period afterwards to handle any outstanding matters.
• Applications and waitlist entries: kept for the duration of the relevant academic placement cycle.
• Landlord enquiry records: kept until the enquiry is resolved and for a reasonable period thereafter.
• Listing reports: kept for as long as necessary to investigate and resolve the report.

Once we no longer need your information for the purpose it was collected, we will delete or anonymise it.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or destruction. These include role-based access controls, encrypted connections (HTTPS), and Firebase's built-in security features.

No system is completely secure. If we become aware of a security breach affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

Under POPIA you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your information where we no longer have a lawful reason to retain it.
• Objection: object to our processing of your information in certain circumstances.
• Withdraw consent: where processing is based on your consent, withdraw it at any time — this does not affect processing that already took place.

To exercise any of these rights, contact our Information Officer at support@vsa-connect.co.za. We will respond within a reasonable time.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa): www.inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

For any privacy-related questions, requests, or complaints:

• Information Officer: [To be confirmed]
• Email: support@vsa-connect.co.za
• Address: [To be confirmed]