Security & Data Breaches

1. Safeguards we apply

Accounts are protected by password or Google sign-in, and access to data is controlled by account-based database rules so that users can only reach their own records.

Photographs and documents are held in private storage and are reachable only through restricted, time-limited links rather than public URLs.

Traffic between your device and the platform is encrypted. Secret keys, including payment keys, are stored server-side only and are never exposed in the website code.

Uploaded images and PDFs are processed before storage, with unnecessary image metadata, including location data, removed.

Payment card details are entered on the payment provider's own secure page. We do not receive or store full card numbers.

Administrative access is limited to authorised personnel, and service providers who process information for us are bound by confidentiality obligations.

2. Your part in keeping accounts secure

Use a strong, unique password, do not share your login, and sign out on shared devices.

Upload only what is reasonably necessary for the advert, request or record concerned.

Tell us immediately if you think your account has been accessed without permission.

3. Reporting a vulnerability or suspected compromise

Report security concerns to rentdirecthub@hmrprop.co.za, or to the Information Officer at [ADMIN PLACEHOLDER — Information Officer email address], with "Security" in the subject line.

Please give enough detail for us to reproduce or verify the issue, and allow us a reasonable period to investigate and fix it before disclosing it publicly.

Do not access, alter or download other people's data while testing, and do not run activity that degrades the service for others.

4. What we do if a compromise occurs

We investigate immediately, contain the incident, restore secure operation and preserve the evidence needed to understand what happened.

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected people as soon as reasonably possible after establishing the scope of the compromise, as POPIA requires.

The notification will describe, as far as we know it, what happened, what information was involved, the likely consequences and the steps we have taken, together with practical recommendations such as changing your password or watching for suspicious contact.

We notify affected people by email or another practicable means, and may publish a notice on the website where individual contact is not reasonably possible.

We record every incident, the decisions taken and the notifications sent.

5. Regulator details

Information Regulator (South Africa) — complaints.IR@inforegulator.org.za, https://inforegulator.org.za.

The Information Officer responsible for security incidents is [ADMIN PLACEHOLDER — Information Officer full name] ([ADMIN PLACEHOLDER — designation]).