Privacy Policy
Effective date: 16 May 2026 · Last updated: 16 May 2026
This Privacy Policy explains how Student Home Holdings Group (Pty) Ltd collects, uses, stores, and protects your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African legislation.
Table of Contents
1. Who We Are
Student Home Holdings Group (Pty) Ltd(“Student Home”, “we”, “us”, “our”) is a South African company registered with the Companies and Intellectual Property Commission (CIPC). We operate an online student accommodation platform at studenthome.co.za that connects students seeking accommodation with verified property owners across South Africa.
Registered Address
Student Home Holdings Group (Pty) Ltd
Sandton, Johannesburg
South Africa
Information Officer
Email: privacy@studenthome.co.za
2. Information We Collect
We collect different categories of personal information depending on your role on the platform.
2.1 Students
| Category | Data Collected | Retention Period |
|---|---|---|
| Identity | Full name, South African ID number or passport number, date of birth, gender | 5 years after account closure |
| Contact | Email address, phone number, physical address | 5 years after account closure |
| Academic | Institution name, student number, year of study, faculty, course | Duration of account + 2 years |
| Funding | NSFAS status, NSFAS reference number, bursary information, funding amounts | 7 years (financial records) |
| Documents | ID copy, proof of registration, proof of NSFAS funding, academic transcripts | 7 years (compliance) |
| Application Data | Accommodation applications, viewing bookings, application status, messages | 5 years after account closure |
| Usage Data | Pages visited, search queries, device type, IP address, session duration | 24 months |
2.2 Property Owners
| Category | Data Collected | Retention Period |
|---|---|---|
| Identity | Full name, ID number or passport, date of birth | 7 years after account closure |
| Business | Company name, CIPC registration number, tax number (income tax / VAT) | 7 years (SARS requirement) |
| Contact | Email address, phone number, business address | 7 years after account closure |
| Property | Property address, title deed details, zoning certificate, GPS coordinates | 7 years after listing removed |
| Compliance Docs | Electrical CoC, fire safety certificate, gas certificate, municipal rates account | 7 years (compliance) |
| Financial | Bank account number and branch code for rental payment processing | 7 years (SARS requirement) |
| NSFAS Docs | NSFAS accreditation letter, approved lease agreement template | 7 years |
| Usage Data | Dashboard activity, login times, IP address, browser information | 24 months |
2.3 All Users
- Authentication data (hashed password, session tokens — never stored in plain text)
- Communications sent through the platform's messaging system
- Support requests, complaints, and dispute records
- Reviews and ratings submitted on the platform
- Device information (operating system, browser, screen resolution)
- Cookie identifiers and analytics events (see Section 10)
3. How We Collect Information
We collect personal information through the following means:
- Account registration — information you provide when signing up or updating your profile
- Document uploads — files you upload for verification or application purposes
- Platform activity — actions you take such as searching, applying, messaging, or booking
- Payment processing — billing information collected through our payment partners
- Communications — emails, support tickets, or in-app messages you send us
- Automated technologies — cookies, server logs, and analytics tools (see Section 10)
- Third parties — identity verification services or NSFAS when you grant permission
4. Lawful Basis for Processing
Under POPIA, we may only process personal information if we have a lawful justification. We rely on the following grounds:
Contract performance
Processing necessary to provide our platform services to you — creating accounts, processing applications, facilitating payments.
Legal obligation
Processing required to comply with South African law — SARS tax records, POPIA compliance, NSFAS regulatory requirements.
Legitimate interest
Platform security, fraud prevention, improving our services, and sending service-related communications — where your rights do not override our interest.
Consent
Marketing communications, optional analytics, and any processing not covered by the above. You may withdraw consent at any time.
5. How We Use Your Information
5.1 To provide and operate the platform
- Create and manage your account
- Match students with suitable accommodation listings
- Process accommodation applications and manage application status
- Facilitate viewing bookings and inspection scheduling
- Enable in-app messaging between students and property owners
- Process rental payments and generate receipts
5.2 Verification and compliance
- Verify property owner identity, ownership, and compliance documents
- Coordinate and record site inspection results
- Confirm NSFAS accreditation status and maintain records
- Verify student identity and funding eligibility
5.3 Communication
- Send transactional emails (application updates, booking confirmations, payment receipts)
- Notify you of changes to your application, account, or listing status
- Respond to support requests and resolve disputes
- Send service announcements and important platform updates
- Send marketing communications (only with your consent, opt-out available at any time)
5.4 Platform improvement and safety
- Analyse usage patterns to improve user experience
- Detect, prevent, and investigate fraudulent or unlawful activity
- Enforce our Terms of Service and community guidelines
- Maintain platform security and prevent unauthorised access
6. How We Share Your Information
We do not sell your personal information. We share it only in the following circumstances:
6.1 Between platform users (with your knowledge)
- When a student submits an application, their name, contact details, institution, and uploaded documents are shared with the relevant property owner
- When an application is accepted, the property owner's name and contact details are shared with the student
- Reviews and ratings are displayed publicly on property listings
6.2 Service providers (processors)
We use the following trusted third-party service providers who process data only on our instructions:
| Category | Data Collected | Retention Period |
|---|---|---|
| Supabase | Database hosting, authentication, and file storage — servers located in South Africa / EU | Duration of service |
| Payment Processor | Processing rental payments, subscriptions, and inspection fees securely | Per transaction + 7 years |
| Email Service | Transactional and marketing email delivery | 24 months |
| Analytics Provider | Anonymised platform usage analytics | 24 months |
| Cloud Hosting | Secure hosting of platform infrastructure | Duration of service |
6.3 Legal and regulatory disclosures
- When required by a court order, law enforcement request, or legal obligation
- To the Information Regulator of South Africa in the event of a reportable data breach
- To NSFAS or the Department of Higher Education when required for accreditation verification
- To SARS when required by tax legislation
6.4 Business transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity. You will be notified of any such transfer and your rights will be preserved.
7. Data Retention
We retain personal information only for as long as necessary for the purpose it was collected, or as required by law. The specific retention periods are set out in the tables in Section 2. General principles:
- Active accounts: personal information is retained for the duration of the account
- Closed accounts: most data is retained for 5 years after closure for legal and dispute resolution purposes
- Financial records: retained for 7 years as required by the South African Revenue Service and the Companies Act
- Compliance documents: retained for 7 years as required by applicable regulations
- Analytics data: anonymised and deleted after 24 months
When personal information is no longer required, it is securely deleted or anonymised so it can no longer be linked to you.
8. International Transfers
Some of our service providers (including cloud infrastructure and analytics tools) may process data outside South Africa. Where data is transferred internationally, we ensure appropriate safeguards are in place, including:
- Contractual clauses requiring the recipient to protect data to POPIA-equivalent standards
- Use of service providers in jurisdictions with adequate data protection laws (such as the EU under GDPR)
- Your consent where required for specific transfers
9. Security Measures
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration, including:
Encryption in transit
All data transmitted between your device and our servers is encrypted using TLS 1.3.
Encrypted storage
Sensitive data is encrypted at rest in our database. Passwords are hashed using industry-standard algorithms (bcrypt) and never stored in plain text.
Access controls
Role-based access controls ensure staff and systems only access data they need. Admin access is logged and audited.
Secure file storage
Documents uploaded to the platform are stored in a private, access-controlled storage bucket — never publicly accessible.
Session security
User sessions expire automatically. Authentication tokens are rotated and revoked on logout.
Monitoring
We monitor our systems for unusual activity, attempted breaches, and unauthorised access attempts.
10. Cookies & Tracking Technologies
We use cookies and similar technologies on our platform. For full details of exactly which cookies we use, their purpose, and how to manage them, please read our Cookie Policy.
In summary, we use:
- Strictly necessary cookies — required for the platform to function (authentication sessions, security tokens)
- Functional cookies — remember your preferences (language, saved searches)
- Analytics cookies — understand how the platform is used to improve it (anonymised data)
- Marketing cookies — only placed with your explicit consent
You can manage your cookie preferences at any time through your browser settings or our cookie consent tool.
11. Children's Privacy
Our platform is intended for persons 18 years of age and older. We do not knowingly collect personal information from children under the age of 18. If you believe a minor has created an account on our platform, please contact us immediately at privacy@studenthome.co.za and we will delete the account and all associated data promptly.
12. Your Rights Under POPIA
As a data subject under POPIA, you have the following rights. To exercise any of these rights, email us at privacy@studenthome.co.za. We will respond within 30 days of receiving your request.
Right to access (POPIA s.23)
Request a copy of all personal information we hold about you.
Right to correction (POPIA s.24)
Request correction of inaccurate, incomplete, or out-of-date information.
Right to deletion
Request deletion of your personal information, subject to our legal retention obligations.
Right to object (POPIA s.11(3))
Object to the processing of your personal information, including for direct marketing.
Right to restrict processing
Request that we limit how we use your information in certain circumstances.
Right to data portability
Request your personal information in a structured, machine-readable format.
Right to withdraw consent
Withdraw any consent you have given at any time, without affecting prior lawful processing.
Right not to be subject to automated decisions
Object to any decisions made about you solely through automated processing that produce legal or similarly significant effects.
We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests.
13. Complaints
If you are unhappy with how we have handled your personal information, please contact our Information Officer first at privacy@studenthome.co.za. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you remain unsatisfied, you have the right to lodge a complaint with the:
Information Regulator of South Africa
Website: inforegulator.org.za
Email: inforeg@justice.gov.za
Tel: 012 406 4818 / 012 406 4819
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Display a notice on the platform informing you of the change
- Send you an email notification if the changes significantly affect your rights
Your continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.
15. Contact Us
For all privacy-related enquiries, please contact our Information Officer:
privacy@studenthome.co.za
Response time
Within 30 days