PAIA Manual
In terms of Section 51 of PAIA, Umastande (Pty) Ltd hereby publishes its PAIA Manual. This manual must be filed with the South African Human Rights Commission (SAHRC).
1. Contact Details of the Private Body
Name: Umastande (Pty) Ltd
CIPC Registration Number: 2026/757331/07
Physical Address: 16 Mokgatle Street, Kwa Thema, Springs, Gauteng, 1575, South Africa
Postal Address: 16 Mokgatle Street, Kwa Thema, Springs, Gauteng, 1575, South Africa
Email: paia@umastande.co.za
2. Information Officer
Information Officer: Thebeyapelo Modise, Chief Executive Officer
Contact: paia@umastande.co.za · 16 Mokgatle Street, Kwa Thema, Springs, Gauteng, 1575, South Africa
In terms of section 1 of PAIA read with section 56 of POPIA, the Information Officer of a private body is the head of that body. No Deputy Information Officer has been designated.
Registered with the Information Regulator (South Africa) as required by POPIA. Registration No: 2026-067370.
3. Categories of Records Held
- User account records (name, email, phone)
- Room listing and rental application records
- Communication records (platform messages)
- Financial records (ZAR transactions, retained 5 years — SARS)
- Company registration and statutory documents
3A. Personal Information Processed, by Data Subject
Published in terms of section 51(1)(c) and 51(1)(e) of PAIA, read with section 17 of POPIA. Each category below is processed for the stated purpose and no other; where consent is the lawful basis it is obtained at the point of collection and may be withdrawn.
| Category of data subject | Categories of personal information | Purpose of processing |
|---|---|---|
| Tenants (people seeking accommodation) | Identity and contact details (full name, email address, mobile number); account credentials (password, stored only as a hash); optional employment status and income range; rental applications and the messages they contain; saved searches and saved rooms; tenancy history and rent records; reviews written and received. | To create and operate the account (POPIA s.11(1)(b), contract); to transmit an application to a landlord and let the two parties correspond; to send alerts the tenant has asked for (s.11(1)(a), consent); to maintain the reputation record both sides rely on. |
| Tenants applying for a Renter's Passport | Special personal information — identity document, SASSA grant confirmation, employer confirmation, bank-activity screenshots, and the name and mobile number of a previous landlord given as a reference. | To verify identity and that rent can be paid, so a landlord can assess an application on evidence rather than assumption (s.11(1)(a), consent; s.27(1)(a) for special personal information). Documents are deleted the moment a decision is made. Only the outcome and an audit record of what was checked are retained — never the contents of the document. |
| Landlords (people letting accommodation) | Identity and contact details (full name, email address, mobile number, optional company name); room listings, photographs and suburb-level location; applications received; rent records kept against their own tenancies; rating and review history; payment references for the verification fee. | To create and operate the account and publish listings (s.11(1)(b), contract); to receive and respond to applications; to take payment for an optional identity check. No card or bank-account details are held — payment is processed by PayFast and only a transaction reference is stored. |
| Landlords applying for verification | Special personal information — identity document; proof of address; proof of the right to let the property. | To confirm a landlord is who they say they are before a tenant is asked to trust them with a deposit (s.11(1)(a), consent; s.27(1)(a)). Documents are deleted on decision, as above. |
| Previous landlords given as a reference | Name, mobile number, and the answer they give about a former tenant. | To confirm a tenant's rental history at the tenant's own request (s.11(1)(f), legitimate interest, the tenant having supplied the details). The referee needs no account. The link expires after 14 days and the number is used once, for that purpose only. |
| Advertisers | Company name, contact person, business email and telephone number, campaign and billing records. | To sell, deliver, invoice and report on board advertising (s.11(1)(b), contract). Advertisers receive aggregate impression and click counts for their own campaign and nothing about any individual who saw it. |
| Website visitors (not signed in) | No personal information. A single session cookie is set only once a person signs in. Aggregate daily counters record that an event happened, never who caused it — they carry no user identifier, no session identifier, no IP address and no timestamp beyond the date. | To understand where people abandon a task and fix it. No profiling, no behavioural advertising, no third-party analytics and no third-party trackers are used. The counters cannot reconstruct an individual's activity, including by us. |
| People who report a safety concern | Contact email (optional), the listing reported and what they say about it. | To investigate the report and protect other users (s.11(1)(d), legitimate interest of the data subject and the public). A report may be made without an account. |
| Employees, directors and contractors | Identity and contact details, banking details for remuneration, tax reference numbers, employment contracts and payroll records. | To administer employment and to meet obligations under the Basic Conditions of Employment Act, the Income Tax Act and the Labour Relations Act (s.11(1)(c), legal obligation). |
| Suppliers and service providers | Company name, contact person, business contact details, banking details for settlement, contracts and invoices. | To procure, pay for and account for services (s.11(1)(b), contract; s.11(1)(c) for tax record-keeping). |
Cross-border transfer. Personal information is processed in South Africa and the European Union (database and application hosting). Any transfer outside the Republic is made only to a jurisdiction with comparable protection or under a written agreement imposing equivalent obligations, as section 72 of POPIA requires. We do not send user content to third-party artificial intelligence services.
Retention. Account records are kept for as long as the account is open and for a reasonable period afterwards; transaction records are kept for five years as the Income Tax Act and the Companies Act require; verification documents are deleted on decision and are never retained.
4. How to Submit a Request for Access to Records
- Complete Form C (available at justice.gov.za/paia)
- Submit to paia@umastande.co.za
- Pay the prescribed request fee of R140
We acknowledge requests within 5 business days and decide within 30 days.
5. SAHRC Contact Details
South African Human Rights Commission (SAHRC)Private Bag 2700, Houghton, 2041
Tel: 011 877 3600 · paia@sahrc.org.za · www.sahrc.org.za