How we protect your personal information
Residency Property Group (Pty) Ltd, trading as STAY365, is the responsible party for personal information collected through this website and the STAY365 portal. We process it in line with the Protection of Personal Information Act, 2013 (POPIA).
1. Information we collect
- Identity and contact details: name, SA ID or passport number, gender, email address and mobile number.
- Study and funding details: institution, campus, student number and funding type (for example NSFAS, bursary or self-funded).
- Booking and placement records: residence, room and bed, dates, lease, signatures, rent charges and payments.
- Payment information: payment references and amounts from Paystack. We do not receive or store your full card number.
- Messages and records: enquiries, comments, maintenance reports and photos you send us.
- Technical information: IP address, browser and device details and security logs, including those recorded when you sign a lease electronically.
2. Why we use it
- to handle your booking, allocate a bed and prepare and sign your lease;
- to process payments and refunds, and to manage your rent account;
- to confirm your funding and registration with NSFAS, your institution or your sponsor, where your funding requires it;
- to keep residences safe (for example, access control and incident records);
- to respond to your enquiries, complaints and maintenance requests;
- to meet our legal duties, including tax, accounting and rental housing law; and
- to prevent fraud and keep our systems secure.
We rely on the lawful grounds in section 11 of POPIA: your consent, performing your booking and lease, complying with the law, and our legitimate interests in running safe residences. We do not sell your personal information, and we only send marketing messages if you have agreed to receive them. You can opt out at any time.
3. Who we share it with
- The accommodation provider of your residence, to manage your stay. Owners using the STAY365 owner portal see placement and rent information for their own buildings only, and never your ID number or contact details.
- NSFAS, your institution or your sponsor, where needed to confirm or pay your accommodation funding.
- Service providers who process information for us under contract: Paystack (payments), Supabase (secure database hosting), Vercel (website hosting) and our email provider.
- Authorities, where the law requires it.
4. Information stored outside South Africa
Some of our service providers store data on secure servers outside South Africa (for example, in the European Union). We only use providers that are bound by data protection laws or agreements giving a level of protection similar to POPIA, as required by section 72.
5. How we protect it
- Access is limited by staff role and by building. Only staff who need your information can see it.
- Data is encrypted in transit and at rest. Leases and maintenance photos are kept in private storage and opened only through short-lived secure links.
- Lease signing links expire and use one-time codes sent to your email.
- Full ID-number exports are restricted to senior management.
If we become aware of a security compromise affecting your information, we will notify you and the Information Regulator as POPIA requires.
6. How long we keep it
We keep booking, lease and payment records for as long as needed for the purposes above and to meet legal record-keeping periods (for example, tax and accounting records are generally kept for at least five years). Enquiries that do not lead to a booking are deleted when no longer needed. When records are no longer required, we delete or anonymise them.
7. Your rights
You have the right to:
- ask what personal information we hold about you and get a copy;
- ask us to correct or delete information that is wrong, out of date or no longer needed;
- object to processing based on our legitimate interests, or to direct marketing;
- withdraw consent (this does not affect processing already done, or processing we must do for your lease or by law); and
- complain to the Information Regulator.
To use these rights, email bookings@stay365.co.za with the subject "POPIA request". We may ask you to confirm your identity first, and we respond within 30 days.
8. Information Officer
Julian King, Residency Property Group (Pty) Ltd, 71 Old Main Road, Hillcrest, KwaZulu-Natal, 3650, South Africa. Email bookings@stay365.co.za, phone 061 882 2530.
9. Information Regulator
If you are not satisfied with how we handled your information, you may complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
10. Cookies
This website uses only the cookies needed for it to work, such as keeping staff signed in to the portal. We do not use advertising cookies.
11. Changes
We may update this policy. The date at the top shows when it last changed. Significant changes will be shown on this page.