Who we are
LeasEase (Pty) Ltd is a private company registered in South Africa under registration number 2026/353559/07. In this policy we call it LeasEase, we or us.
We are the responsible party for the personal information collected through the LeasEase website at leasease.co.za and the LeasEase mobile application. We call both of these the Platform.
Our Information Officer is Darrshan Govender, Chief Executive Officer, who is registered with the Information Regulator. You can reach him at info@leasease.co.za.
What we collect
- Identity information: full name, ID or passport number, date of birth, photographs.
- Contact information: email address, mobile number, postal address and physical address.
- Financial information: bank account details, payment history, credit bureau data (with your consent), payslip and bank statement extracts (with your consent).
- Property information: property addresses, photographs, lease terms, rent and deposit amounts.
- Usage information: pages visited, features used, device type, IP address and approximate location.
- Communications: in-app chats, customer service interactions and voice recordings (with your consent).
Why we collect it
- To run the Platform and to provide any service you ask for.
- To verify who you are. Identity verification is carried out under section 11 of POPIA and section 21 of the Financial Intelligence Centre Act 38 of 2001 (FICA).
- To screen a prospective tenant. Credit bureau checks are only run with the tenant's consent, on the lawful processing grounds in section 11 of POPIA.
- To process payments through regulated payment rails.
- To meet our duties under the Rental Housing Act 50 of 1999, the Consumer Protection Act 68 of 2008, FICA and the Income Tax Act 58 of 1962.
- To improve the Platform, including training our own models on anonymised, aggregated data that cannot be traced back to you.
- To detect, investigate and prevent fraud, abuse and unauthorised access.
Legal basis
We process personal information on the grounds set out in section 11 of POPIA. Those grounds are: your consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest, and the pursuit of our own legitimate interests weighed against your rights.
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing that already happened, and it may mean we can no longer provide part of the service.
Who we share it with
- Credit bureaux (TransUnion, Experian, TPN and XDS) for tenant screening, with the data subject's explicit consent.
- Payment and collection partners. DebiCheck collection runs on our regulated banking rail at First National Bank, together with licensed payment processors, to collect rent and deposits.
- The trust-account banker (First National Bank). Deposits will be held in a PPRA property-practitioner trust account under a registered principal's Fidelity Fund Certificate, as contemplated in section 54 of the Property Practitioners Act. That account is not operating yet, so no deposit money is held or moved at this stage.
- A licensed insurer (in development, not yet appointed or named), if and when rent protection launches. Rent protection is not yet live and no personal information is shared with any insurer at this stage.
- Cloud and infrastructure providers (Vercel, Cloudflare, AWS, Azure, GCP, Sentry and Plausible) under operator agreements that meet POPIA.
- External advisors in law, audit and compliance, on a need to know basis.
We do not sell your personal information, and we do not share it with advertising networks.
Sending information abroad
Some of our operators sit outside South Africa. Where that happens we rely on the protections in section 72 of POPIA, which include binding corporate rules, standard contractual clauses and recognised adequate protection regimes.
You can ask us for the current list of cross-border operators and the basis on which each transfer is made. Email info@leasease.co.za.
How long we keep it
| Record | Retention period |
|---|---|
| Active customer data | While the account is open, and for five years after that. This is the minimum set by sections 22 to 24 of the FIC Act. We keep it longer where the Companies Act or tax law requires it. |
| Lease records | The lease term, and seven years after the lease ends. |
| Anonymised aggregate data | For example the Rental Health Index. Kept indefinitely. It cannot be traced back to a person. |
| Marketing data | Deleted within 12 months of your last interaction, unless you renew your consent. |
Where another law requires a longer period, that law wins and we will tell you why on request.
Your rights
- Access (section 23): ask for a copy of the personal information we hold about you.
- Correction (section 24): ask us to fix information that is wrong or out of date.
- Deletion (section 24): ask us to delete information we no longer need.
- Objection (section 11(3)): object, on reasonable grounds, to how we process your information.
- Human review (section 71): ask a person to review any decision made about you by automated means alone, where that decision affects you significantly.
- Complaint: lodge a complaint with the Information Regulator at inforegulator.org.za.
To use any of these rights, email info@leasease.co.za. We reply within 30 calendar days. There is no charge for a first request unless it is repetitive or excessive, in which case we will tell you the fee before we start.
Security
- Information is encrypted in transit using TLS 1.3 and at rest using AES-256.
- Access is role-based and protected by multi-factor authentication.
- An outside assessor runs penetration testing every year.
- We are working towards SOC 2 Type II readiness. A completion date has not been set.
- If a breach happens, we notify the Information Regulator and the affected people as required by section 22 of POPIA. We aim to do so within 72 hours of becoming aware of it.
No system is perfectly safe. Please use a strong, unique password, turn on multi-factor authentication, and tell us straight away if you think someone else has your account.
Changes to this policy
We may update this policy. If a change is material we will tell you by email and on the Platform at least seven days before it takes effect. If you keep using the Platform after the effective date, you accept the updated policy.
Contact
Information Officer: Darrshan Govender, Chief Executive Officer, LeasEase (Pty) Ltd, info@leasease.co.za, Ballito, 4420, South Africa.
The Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Telephone 010 023 5200. Email enquiries@inforegulator.org.za. Complaints: complaints.IR@inforegulator.org.za.