Privacy notice under POPIA

Definitions

The terms below are defined so that our data handling practices and the obligations POPIA places on vindarop are easy to follow.

Personal information, as defined in POPIA, means information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person — including name, contact details, South African identity number or passport number, marital regime, income and bond details, and the transfer records generated in the course of the work.

Processing means any operation performed on personal information, such as collection, storage, use, disclosure, alteration, retrieval, erasure or destruction.

Data subject means the person to whom the personal information relates: anyone who uses vindarop services, requests information, submits intake documents for a transfer, or otherwise deals with the website or with our staff.

Responsible party means vindarop, which determines the purpose of and means for processing the personal information described in this notice. Where a service provider processes information on our instruction, it acts as an operator under POPIA.

Service means the conveyancing support and related informational services vindarop provides in connection with residential property transfers, including consultations, document review and administration of the transfer file.

Cookies are small text files stored on your device by your browser to enable site functionality, remember preferences and gather analytics about how the site is used.

Purposes of Processing

vindarop processes personal information for specific, explicitly defined and lawful purposes connected to supporting a property transfer, as section 13 of POPIA requires.

• To examine the title deed, run Deeds Office searches, draw the transfer documents and lodge for registration in the Deeds Office.
• To carry out client intake and the identity and FICA verification required by the Financial Intelligence Centre Act 38 of 2001.
• To apply for a rates clearance certificate from the municipality and, in a sectional title scheme, a levy clearance certificate from the body corporate.
• To prepare and submit the transfer duty declaration to SARS and to account for the CSOS levy where the property falls in a community scheme.
• To communicate with clients, answer enquiries and give updates on where the transfer stands.
• To handle payments, administer the trust account under section 86 of the Legal Practice Act 28 of 2014 and issue accurate statements of account.
• To keep the records required for professional responsibility, dispute resolution and regulatory compliance.
• To improve the website, analyse usage patterns and maintain security.
• To share information with the other professionals in the transfer — the bond attorney, the cancellation attorney, the bank, the property practitioner or a compliance inspector — where you have authorised it or the transfer requires it.
• To retain documents for tax reporting and audit as the law requires.

Lawful grounds for processing under POPIA

Every processing activity rests on one or more of the grounds set out in section 11 of POPIA, and is carried out in accordance with the eight conditions for lawful processing — accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.

• Performance of a contract — section 11(1)(b): processing needed to conclude or perform a mandate you have given us in relation to a property transfer.
• Legal obligation — section 11(1)(c): processing required by statute, including FICA verification, the transfer duty declaration to SARS, Deeds Office lodgement requirements and the record-keeping rules made under the Legal Practice Act 28 of 2014.
• Legitimate interests — section 11(1)(f): processing needed for operational security, fraud prevention (bank-detail interception in property transfers is a live risk in South Africa), defending a claim and improving the service, weighed against your rights.
• Consent — section 11(1)(a): where a specific processing activity falls outside the grounds above, vindarop will ask for your voluntary, specific and informed consent and record your preference. You may withdraw that consent at any time.

Your rights as a data subject

Sections 23 to 25 of POPIA give you rights over the personal information we hold about you. vindarop respects those rights and provides a route to exercise them. Requests are made on Form 2 or Form 3 prescribed under POPIA, or in plain writing to our information officer.

• Right of access — section 23: to confirm whether we hold information about you and to receive a record of it, subject to the fees and grounds of refusal in the Promotion of Access to Information Act 2 of 2000 (PAIA).
• Right to correction — section 24: to have inaccurate, irrelevant, excessive, out of date, incomplete or misleading information corrected or deleted.
• Right to deletion or destruction — section 24: to have a record destroyed or deleted where we are no longer authorised to keep it.
• Right to object — section 11(3): to object, on reasonable grounds, to processing based on legitimate interests.
• Right not to be subject to a decision based solely on automated processing — section 71. We do not make decisions about a transfer by automated means.
• Right to withdraw consent — section 11(2), without affecting the lawfulness of processing carried out before the withdrawal.
• Right to complain to the Information Regulator (South Africa) — section 74 — if you believe your rights have been infringed, at [email protected].
• Right to institute civil proceedings under section 99 of POPIA.

Cookies and Tracking

vindarop uses cookies and similar technologies to deliver site functionality, remember preferences and gather usage analytics. A cookie on its own does not identify a living natural person without further information supplied to the site.

We use session cookies for essential functions, persistent cookies for preferences, and analytics cookies to measure performance. Third-party cookies may be present for analytics or hosting. Non-essential cookies are set only with your consent, as required by POPIA and by section 45 of ECTA in relation to unsolicited communications.

Categories include essential cookies (required for site operation), performance cookies (analytics and usage measurement) and functional cookies (preferences and session state).

You can control cookies through browser settings or by using available opt‑out tools on the site. Disabling non‑essential cookies may affect some features of the website.

Full cookie details available at vindarop.site/cookie-policy

Sharing and Disclosure

vindarop shares personal information with service providers and other parties only where that is necessary to do the work or to comply with the law. Sharing is kept to the minimum required and takes place under written confidentiality and operator agreements, as section 21 of POPIA requires.

• The other attorneys in the transfer — the bond attorney and the cancellation attorney — together with the bank granting or cancelling the bond.
• The Deeds Office, the local municipality, the body corporate or managing agent, SARS and, for a community scheme, CSOS.
• The property practitioner handling the sale, and compliance inspectors issuing electrical, plumbing, gas, electric fence or beetle certificates.
• Identity verification and screening providers used for FICA checks.
• Banks and payment processors for trust account transfers and the payout on registration.
• IT hosting and analytics providers that process information on our instruction as operators under contract.
• Regulators or law enforcement where the law or a court order requires it, including reports to the Financial Intelligence Centre.
• Any other party you have authorised in writing or by documented instruction.

Transfers outside South Africa

Some of our hosting and analytics providers are located outside the Republic. Section 72 of POPIA permits a transfer across the border only where the recipient is subject to a law, binding corporate rules or an agreement that provides an adequate level of protection, where you consent, or where the transfer is necessary to perform a contract with you.

Our safeguards include written operator agreements that impose POPIA-equivalent obligations, encryption in transit, and access controls that limit who may see personal information during transfer and processing. Transfer files themselves — title deeds, FICA documents and Deeds Office records — are held on infrastructure located in South Africa.

Retention

Section 14 of POPIA requires that records are not kept for longer than is necessary. vindarop keeps personal information only for as long as it is needed for the purposes set out here and to meet legal, tax and professional record-keeping obligations.

Transfer files and client account records are kept for at least five years after registration — the period FICA prescribes for identification and transaction records — and attorneys' file-retention rules made under the Legal Practice Act 28 of 2014 may require longer. SARS requires supporting records to be kept for five years.

Correspondence relevant to a transfer is kept for as long as is needed to deal with the client's affairs, to support the resolution of a dispute and to satisfy those retention obligations.

System logs, access records and security logs are kept for defined periods for troubleshooting, security investigation and compliance monitoring.

Once a retention period ends, or where deletion is requested and the law permits it, vindarop securely destroys or de-identifies the personal information in a way that prevents its reconstruction, as section 14(5) of POPIA requires.

Security Measures

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. vindarop maintains safeguards against accidental loss, unauthorised access and unlawful processing, and reviews them as technology and practice change. Where a security compromise occurs, section 22 obliges us to notify the Information Regulator and the affected data subjects as soon as reasonably possible.

• Access controls and role-based permissions, so only authorised staff can reach a transfer file.
• Encryption in transit and, where appropriate, encryption at rest for records containing identity numbers, bank details or other sensitive information.
• Regular backups, monitoring, vulnerability management and secure hosting with reputable providers, with power and connectivity backup so that load-shedding does not interrupt a lodgement deadline.
• A standing rule that banking details are never changed by e-mail. Any request to change payment details must be confirmed telephonically on +27 11 447 3082 before funds are paid.

Exercising Your Rights

To exercise your rights, contact our information officer at the address below or through the contact form on vindarop.site. We handle requests in accordance with POPIA and PAIA, and we will verify your identity before acting, which takes a reasonable amount of time.

• Right to be told what personal information vindarop holds and why it is used in supporting a property transfer.
• Right to request access to that information, including the documents and records on your transfer file, in terms of section 23 of POPIA read with PAIA.
• Right to request correction of inaccurate or incomplete information in your file or account details, in terms of section 24.
• Right to request deletion or destruction of information we are no longer authorised to keep, in terms of section 24.
• Right to object on reasonable grounds to processing based on legitimate interests, and to object to direct marketing at any time.
• Right to receive a copy of your information in a commonly used, machine-readable format where that is technically feasible.
• Right to complain to the Information Regulator (South Africa) at [email protected] if you believe your rights have been infringed.
• Right to withdraw consent where processing rests on consent, without affecting the lawfulness of what was done before you withdrew it.

How to exercise your privacy rights

To exercise any of the rights listed above, send a written request to our information officer, using POPIA Form 2 (access) or Form 3 (correction or deletion) if you prefer. Include enough detail to identify yourself and to show what information or action you are asking for. We verify identity before acting, both to protect your information and to protect the privacy of others. A request touching on a transfer file will need documents establishing your authority to act for the client.

[email protected]

We aim to acknowledge a request within 10 business days and to respond substantively within 30 days, which is the period PAIA allows. Complex requests, or those needing input from the bank, the municipality or the body corporate, can take longer; where an extension is needed we will tell you and give reasons. Requests are handled during business hours, 08:00–17:00 SAST, Monday to Friday.