Version 1.0
This Privacy Policy ("Policy") describes how Deedy ("we", "us" or "our") collects, uses, shares, retains and protects the personal information of users ("you" or "User") of the Deedy platform, including the website www.deedy.co.za, any associated mobile applications, and all related products, features and services (collectively, the "Platform").
This Policy is published in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Promotion of Access to Information Act 2 of 2000 ("PAIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA") and any other applicable South African law.
This Policy is incorporated into, and forms part of, the Deedy Terms and Conditions of Use. Capitalised terms not defined in this Policy have the meaning given to them in the Terms and Conditions of Use.
By using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described herein. If you do not agree, you must not use the Platform.
1. Responsible Party and Information Officer
1.1. The Responsible Party for the processing of personal information under this Policy is Deedy, a company incorporated under the laws of the Republic of South Africa.
1.2. The Information Officer of Deedy is responsible for ensuring compliance with POPIA and may be contacted at:
1.3. The Information Officer is registered with the Information Regulator of South Africa as required by POPIA.
2. Scope of this Policy
2.1. This Policy applies to all personal information collected from or about you when you:
- register an account on the Platform;
- list a property as a Seller;
- search, view or enquire about properties as a Buyer;
- purchase any Deedy product (including Pre-Approval, Buyer Verification, Property Valuation, Suburb Demand Insight or Demographics Insight);
- attend or facilitate a Viewing arranged through the Platform;
- communicate with Deedy or other Users through the Platform;
- subscribe to marketing communications or participate in surveys, competitions or research; or
- otherwise interact with the Platform, including by visiting www.deedy.co.za.
2.2. This Policy does not apply to third-party websites, services or applications linked to or referenced from the Platform. Such third parties have their own privacy practices, which you should review independently.
3. Personal Information We Collect
We collect personal information in the categories set out below. Not all categories will apply to every User; what we collect depends on which features of the Platform you use.
3.1. Information you provide directly
- Identity information: full name, identity number (South African ID or passport number), date of birth, gender, nationality, residential and postal addresses.
- Contact information: mobile number, email address and (where relevant) alternative contact details.
- Account information: username, password (stored in hashed form), profile photo and account preferences.
- Financial information: income, employment, monthly expenses, existing debt obligations, banking details, payment card details (processed by our payment processors) and any other information required for affordability or Pre-Approval assessment.
- Property information (Sellers): property address, erf details, title deed information, photographs, descriptions, asking price, occupancy status, condition disclosures and supporting documents.
- Search and enquiry information (Buyers): property preferences, locations of interest, budget, saved listings, enquiries, messages and offers.
- Communications: any messages, enquiries, support requests, feedback, reviews or other content you submit through the Platform.
3.2. Information collected automatically
- Device and technical information: IP address, device type, operating system, browser type, language settings, mobile network information and unique device identifiers.
- Usage information: pages visited, features used, listings viewed, searches performed, click patterns, session duration and referring URLs.
- Location information: approximate location derived from IP address. If you enable location services on your device, we may also collect precise location data, but only with your express consent.
- Cookies and similar technologies: see clause 9 (Cookies) below.
3.3. Information collected from third parties
To deliver our products and verify the information you provide, we lawfully obtain personal information from third-party sources, including:
- Department of Home Affairs ("DHA"): via authorised identity verification providers, we verify your identity number against DHA records to confirm that the person presenting an identity number is the holder of that identity number. This is used for Buyer Verification, Pre-Approval and account fraud prevention.
- Credit bureaus: including TransUnion, Experian, XDS, Compuscan, Vericred and other registered credit bureaus, from which we obtain credit profile data to generate a Pre-Approval indicator. This is done only with your express consent at the point of requesting Pre-Approval.
- Lightstone Property and other property data providers: we obtain property valuation, sales history, ownership tenure, demographic and suburb-level data derived from the Deeds Office and other public and proprietary sources. This data underpins Property Valuation, Suburb Demand Insight and Demographics Insight.
- Deeds Office: indirectly, through Lightstone and similar aggregators who source records from the Deeds Office in accordance with the Deeds Registries Act 47 of 1937.
- Payment processors: transaction confirmation, fraud signals and tokenised card information.
- Identity verification providers: biometric verification results (where used), liveness check outcomes and document authenticity signals.
- Referral partners and bond originators: where we refer you to a credit provider, conveyancer or bond originator, we may receive confirmation that the referral was actioned and (in some cases) the outcome.
- Publicly available sources: including the CIPC register (for juristic person Users), and other public records.
4. Purposes for Which We Process Personal Information
We process your personal information only for lawful purposes and only to the extent necessary. The purposes include:
4.1. Providing the Platform and its products
- creating and managing your account;
- publishing and managing Listings;
- processing payments for Subscriptions and product purchases;
- generating Pre-Approval indicators;
- performing Buyer Verification before Viewings;
- producing Property Valuation, Suburb Demand Insight and Demographics Insight reports;
- facilitating communications and enquiries between Buyers and Sellers;
- referring you to mortgage originators, conveyancers and other transaction support professionals.
4.2. Customer support and service improvement
- responding to queries, complaints and support requests;
- investigating disputes between Users;
- improving the Platform, its features and its user experience;
- conducting research, analytics and product development.
4.3. Marketing and communications
- sending you transactional notifications relating to your account and activity (these are necessary for the provision of the service and not subject to opt-in);
- sending you marketing communications about Deedy products and services, where you have opted in;
- personalising the Platform experience, including recommended Listings or suburbs.
You may opt out of marketing communications at any time by emailing hello@deedy.co.za. Opting out of marketing does not affect transactional notifications.
4.4. Legal and regulatory compliance
- complying with applicable laws, regulations, court orders and lawful requests from regulatory authorities;
- responding to legal claims, defending our rights and enforcing our Terms;
- reporting suspicious transactions where required by law.
5. Lawful Basis for Processing
We process personal information on one or more of the following lawful bases set out in POPIA:
- Consent: where you have voluntarily, specifically and informedly consented to the processing (for example, when you opt in to marketing or request a Pre-Approval involving credit bureau data).
- Contractual necessity: where processing is necessary to perform our obligations to you under the Terms and Conditions of Use (for example, to publish your Listing or process a Subscription payment).
- Legitimate interests: where processing is necessary for the legitimate interests of Deedy, a third party, or you, and such interests are not overridden by your privacy rights (for example, fraud prevention and Platform security).
- Public interest: where processing is necessary for the proper performance of a public law duty.
6. How We Share Personal Information
We do not sell your personal information. We share personal information only as described in this Policy, and only with parties who are bound by appropriate confidentiality and data protection obligations.
6.1. With other Users of the Platform
Where you list a property, certain Listing information (such as photographs, description, asking price and approximate location) is made publicly visible on the Platform. We do not display your full name, contact details or identity number publicly, except where necessary to facilitate a property Viewing accepted by the Seller and limited to the Buyer who scheduled the Viewing.
Where you complete Buyer Verification and proceed to a Viewing, the Seller will receive limited information confirming that your identity has been verified. We do not share your identity number or full credit profile with the Seller.
6.2. With service providers (Operators) acting on our instructions
We engage third-party service providers ("Operators" under POPIA) to perform services on our behalf. These include:
- cloud hosting, data storage and infrastructure providers;
- payment processors;
- identity verification providers (who interface with the DHA);
- credit bureaus (TransUnion, Experian, XDS, Compuscan, Vericred and others);
- Lightstone Property and other property data providers;
- email, SMS and communication delivery providers;
- analytics and product telemetry providers;
- fraud detection and security service providers;
- customer support and CRM platforms.
Each Operator is contractually required to process your personal information only on our instructions, to maintain appropriate security safeguards, and to comply with POPIA.
6.3. With referral partners
Where you request or consent to a referral to a credit provider, bond originator, conveyancer or other transaction-support professional, we share the personal information necessary to facilitate that referral. The receiving party becomes a separate Responsible Party in respect of any further processing.
6.4. With regulators, law enforcement and other authorities
- to comply with a lawful request, court order, subpoena or warrant;
- to comply with a legal or regulatory obligation, including reporting obligations under FICA;
- to protect our rights, property or safety, or those of our Users or the public;
- to investigate or prevent fraud, security incidents or other unlawful activity.
6.5. In connection with a corporate transaction
If Deedy is involved in a merger, acquisition, restructuring, financing, sale of assets or insolvency, your personal information may be transferred to the acquiring or successor entity, subject to confidentiality protections and continued compliance with this Policy or a substantially similar privacy policy.
7. Cross-Border Transfers of Personal Information
Some of our Operators and service providers are located outside the Republic of South Africa, including in jurisdictions that may not have a level of data protection equivalent to POPIA. Where personal information is transferred outside South Africa, we ensure that one of the following applies:
- the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection consistent with section 72 of POPIA;
- you have consented to the transfer;
- the transfer is necessary for the performance of a contract between you and Deedy, or to take steps at your request prior to entering into such a contract;
- the transfer is necessary for the conclusion or performance of a contract concluded in your interest between Deedy and a third party; or
- the transfer is for your benefit and it is not reasonably practicable to obtain your consent.
8. How Long We Retain Personal Information
We retain personal information only for as long as is necessary to achieve the purposes for which it was collected, or as required or permitted by law. The principal retention periods are:
- Account information: for the duration of your account, plus a reasonable period after closure to handle disputes, refunds and regulatory queries.
- Listing information: for the duration of the Listing, plus a reasonable historical period for market analysis and dispute handling.
- Identity verification records: for a minimum of 5 (five) years from the date of the relevant transaction or business relationship, in accordance with FICA and other applicable record-keeping obligations.
- Financial and transactional records: for a minimum of 5 (five) years, in accordance with FICA and tax legislation.
- Credit bureau enquiry data: retained only as long as necessary to generate, deliver and audit a Pre-Approval, and as required by applicable retention rules.
- Marketing preferences and opt-outs: retained indefinitely to honour your opt-out and prevent re-contact.
After the applicable retention period, we will delete, destroy or de-identify the personal information in a manner that prevents reconstruction.
9. Cookies and Similar Technologies
9.1. Our Platform uses cookies, web beacons, local storage and similar tracking technologies (collectively, "Cookies") to operate the Platform, remember your preferences, analyse usage and personalise content.
9.2. We use the following categories of Cookies:
- Strictly necessary: required for the Platform to function (for example, authentication, security and load balancing). These cannot be disabled.
- Functional: remember your preferences and improve usability.
- Analytics: measure how Users interact with the Platform to help us improve it.
- Marketing: used to deliver personalised marketing and measure marketing performance, where you have consented.
9.3. You can manage Cookie preferences via your browser settings or, where provided, the Platform's Cookie banner. Blocking strictly necessary Cookies may prevent parts of the Platform from working.
10. Security Safeguards
10.1. We have implemented appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised access, unlawful processing or accidental destruction, in accordance with section 19 of POPIA. These measures include:
- encryption of personal information in transit (TLS) and, where appropriate, at rest;
- access controls, role-based permissions and authentication;
- secure storage with reputable cloud infrastructure providers;
- logging, monitoring and intrusion detection;
- regular security reviews, vulnerability assessments and patching;
- contractual safeguards with Operators and service providers.
10.2. No system can be guaranteed to be completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
10.3. Where we have reasonable grounds to believe that the personal information of a User has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected User as soon as reasonably possible, in accordance with section 22 of POPIA, unless the identity of the affected User cannot be established or notification would prejudice an investigation.
11. Your Rights Under POPIA
Subject to certain legal limitations, you have the following rights in respect of your personal information:
- Right to be notified: to be informed that personal information is being collected, and that it has been accessed or acquired by an unauthorised person.
- Right of access: to request confirmation of whether we hold personal information about you, and a copy of that information.
- Right to correction or deletion: to request correction of inaccurate, irrelevant, excessive, outdated or misleading personal information, or deletion of personal information that we are no longer authorised to retain.
- Right to object: to object to the processing of your personal information on reasonable grounds.
- Right to withdraw consent: to withdraw any consent you have given, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
- Right to object to direct marketing: to request that we stop sending you direct marketing communications.
- Right to complain: to submit a complaint to the Information Regulator (see clause 14 below).
To exercise any of these rights, please contact the Information Officer at hello@deedy.co.za. We may request proof of identity before actioning your request. We will respond within a reasonable period and, in any event, within the timeframes prescribed by POPIA.
12. Children's Personal Information
The Platform is not intended for use by persons under the age of 18 (eighteen). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verifiable parental or guardian consent as required by POPIA, we will take steps to delete that information.
13. Automated Decision-Making and Profiling
13.1. Certain Deedy products involve automated processing, including:
- Pre-Approval, which uses an algorithm together with credit bureau data to generate an affordability indicator;
- Property Valuation, Suburb Demand and Area Demographics, which use third-party algorithmic models to estimate property value.
13.2. Pre-Approval and Property Valuation are indicators only and do not constitute final decisions about whether you will be granted credit, what your property is worth, or any other matter. A formal decision by a credit provider or registered valuer remains entirely separate.
14. Contact Us
For questions, requests or complaints regarding this Policy or your personal information, please contact:
Last updated: June 2026