Privacy Policy

VulaLet is a South African software-as-a-service platform providing rental property management tools for individual landlords and managing agents. References to "VulaLet", "we", "us", or "our" in this policy refer to the operator of the VulaLet platform at vulalet.co.za. VulaLet is a product of the same legal entity that operates VulaKomplex. Company registration number: 2026/311419/07 Registered address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Email: legal@vulalet.co.za

This Privacy Policy explains how we collect, use, store, and share personal information when you use the VulaLet platform, visit our website, or interact with us by email or other means. It applies to all users of the platform including property owners, managing agents, accountants, maintenance agents, contractors, and tenants.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and its implementing regulations. We process personal information only where we have a lawful basis to do so, including where processing is necessary to perform a contract with you, to comply with a legal obligation, to protect a legitimate interest, or where you have given consent.

Under POPIA, a Responsible Party determines the purpose and means of processing personal information. An Operator processes personal information on behalf of a Responsible Party. VulaLet acts as a Responsible Party in respect of personal information that it processes for its own purposes — for example, account management, billing, and platform improvement. In respect of personal information of tenants, applicants, and other third parties entered into the platform by property owners or managing agents, VulaLet acts as an Operator. In that context, the property owner or managing agent is the Responsible Party and is responsible for ensuring that personal information is collected and processed in accordance with POPIA. VulaLet processes that data solely to deliver the platform services.

We may collect the following categories of personal information: • Identity information: full name, identity number (where required for tenant vetting or FICA compliance) • Contact information: email address, phone number (including WhatsApp number) • Account information: username, password (stored as a secure hash), role and permissions within the platform • Property and financial information: property addresses, rental amounts, lease terms, bond details, bank statement data (imported for reconciliation only — we do not store bank credentials) • Tenant information (collected by property owners and agents): name, email, phone, ID number, employment details, TPN credit bureau results • Usage information: pages visited, features used, log data, IP address • Device information: browser type, device type, operating system • Communications: WhatsApp message logs, email delivery status, OTP verification records

We use your personal information to: • Create and manage your account • Deliver rent invoices, reminders, and notifications via email and WhatsApp • Process lease agreements, OTP e-signatures, and document workflows • Generate SARS-ready financial statements and reports for property owners • Track maintenance requests and contractor activities • Run TPN credit bureau checks on explicit request • Comply with legal obligations including POPIA and tax legislation • Improve and develop the platform • Respond to support requests • Prevent fraud and maintain platform security We also derive anonymised, aggregated insights from platform usage — such as feature adoption rates and operational trends — to inform product development. This processing uses data in a form that does not identify any individual.

Where you or a tenant provides a phone number, we may send communications via WhatsApp, including rent reminders, payment notifications, maintenance updates, and lease renewal alerts. By providing your phone number (or a tenant's phone number), you confirm that the relevant party has consented to receive such messages. Recipients may opt out at any time through account settings or by replying STOP. WhatsApp messages are delivered via a registered WhatsApp Business API provider (360dialog).

We do not sell your personal information to third parties. We may share information with: • Property owners, managing agents, or other authorised users you have granted access to within the platform • Service providers who process data on our behalf (cloud hosting, email delivery, WhatsApp API) under written data processing agreements • TPN Credit Bureau — for tenant screening checks, on explicit per-request authorisation only • Lightstone — for property valuations, on explicit per-request authorisation only • PayFast — for payment processing; we do not store card numbers • Regulators or law enforcement where required by law • A successor entity in the event of a merger or acquisition — in which case we will give prior notice All third-party processors are contractually bound to process personal information only on our instructions and in accordance with applicable law.

Personal information is stored on Supabase infrastructure (hosted on AWS, af-south-1 Cape Town region). We implement appropriate technical and organisational measures including: • Encryption in transit (TLS 1.2 or higher) • Encryption at rest • Field-level encryption for sensitive personal data (ID numbers, bank details, tax references) • Row-level security and role-based access controls at the database level • Multi-factor authentication for administrative access • Regular access reviews No user can access another owner's data. Despite these measures, no internet transmission is completely secure. If we become aware of a personal information breach, we will notify affected persons and the Information Regulator as required by section 22 of POPIA.

We retain personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Financial records are retained for up to 7 years in accordance with South African tax and company law requirements. After account closure, your data is retained for 90 days to allow export, after which it is permanently deleted in accordance with our scheduled purge process.

You have the right to: • Access the personal information we hold about you • Correct inaccurate or incomplete information • Request deletion of your information (subject to legal retention requirements) • Object to the processing of your information • Lodge a complaint with the Information Regulator of South Africa To exercise any of these rights, submit a written request to legal@vulalet.co.za with the subject line "POPIA Data Request". We will respond within 30 days. If you are dissatisfied with our response, you may escalate to the Information Regulator: Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za

VulaLet has appointed an Information Officer as required by POPIA: Information Officer: Cornel Esterhuyzen Email: legal@vulalet.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 The Information Officer is responsible for overseeing VulaLet's compliance with POPIA and handling data subject requests and complaints.

We use essential session cookies required for authentication and platform operation. We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in. For full details, contact legal@vulalet.co.za.

VulaLet is not directed at persons under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at legal@vulalet.co.za and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before changes take effect. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

For privacy-related queries, requests, or complaints: Information Officer: Cornel Esterhuyzen Email: legal@vulalet.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za