Privacy Policy

Short-Term Rental Licensing Compliance Services (Pty) Ltd (registration number 2026/533467/07) — “STRLCS”, “we”, “us”, “our” — is committed to protecting the personal information of every person who interacts with our services. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).

By submitting any form on our website, using our services, or otherwise providing information to STRLCS, you agree to the terms of this Privacy Policy.

1. Who we are

2. What information we collect

We collect the following categories of personal information, depending on which of our services you use:

2.1 Information you provide directly

• Contact details — name, email address, phone number, WhatsApp number, physical address, and province
• Business details — business name, industry / service category, business registration number, VAT number, tax compliance status, insurance details, and years in operation
• Property details (for property owners) — property address, unit configuration, and current compliance status
• Application details (for vendors and assessors) — accreditation body registrations, credentials, service coverage areas, and pricing

2.2 Information collected automatically

• Technical information — IP address, browser type, device type, and operating system
• Usage information — pages visited, time on site, and referring URL
• Tracking identifiers — UTM parameters, Google Click ID (GCLID), Facebook Click ID (FBCLID), and cookies for analytics and advertising attribution

2.3 Information from third parties

• Credential verifications performed on your behalf against the Companies and Intellectual Property Commission (CIPC), South African Revenue Service (SARS), relevant accreditation bodies (ECB, SAQCC Fire, SAQCC Gas, FSCA, and others), credit bureaux (TransUnion, Experian), and criminal-record databases (via authorised third parties such as MIE Screening)

3. How we use your information

We use your personal information only for the purposes for which it was collected, including:

• Delivering our services — STRLCS Compliance Verification, STRLCS Preferred Vendor Programme, STRLCS Assessor Programme, and related advisory services
• Assessing your suitability as a Preferred Vendor, Assessor, or client and verifying the credentials you supply
• Communicating with you by email, phone, WhatsApp, and SMS about your account, application, and services
• Processing payments and invoicing
• Complying with legal, regulatory, tax, and accounting obligations under South African law
• Improving our services, website, and marketing (only using aggregated, non-identifying analytics data where possible)

4. Legal basis for processing

We process your personal information under one or more of the following lawful bases set out in POPIA:

• Consent — where you have explicitly agreed (e.g. ticking a consent checkbox on our forms)
• Contract — where processing is necessary to conclude or perform a contract with you
• Legal obligation — where processing is required by South African law
• Legitimate interest — where processing is necessary for our legitimate business interests and does not override your rights

5. Who we share your information with

STRLCS does not sell your personal information. We share it only in the following circumstances:

5.1 Preferred Vendor referrals

If you are a property owner using STRLCS to become compliant, we may share your contact and service-need details with the relevant STRLCS Preferred Vendor(s) in your service category and city, so they can quote and complete the work. We ask for your explicit consent before doing so.

Referral commission disclosure: STRLCS receives referral commissions from Preferred Vendors when you engage them. This financial relationship is disclosed to comply with POPIA transparency requirements. It does not affect the fees you pay to any Preferred Vendor or to STRLCS.

5.2 Vendor referrals to property owners

If you are an approved STRLCS Preferred Vendor, we may share your business contact details with property owners who have engaged STRLCS and require your service category. This is the core value exchange of the Preferred Vendor Programme.

5.3 Reservation Hub Services — Hosting Advantage community (opt-in only)

Where you have consented, STRLCS may share your contact details and, where relevant, your property or business information with Reservation Hub Services (Pty) Ltd, an affiliated company, so that you may be invited to participate in the private Hosting Advantage community on Facebook and receive short-term rental-industry newsletters, marketing communications, and related offers from Reservation Hub Services.

This consent is granted only if you tick the relevant checkbox on our forms. You may withdraw it at any time by emailing privacy@strlcs.co.za. Withdrawal does not affect the underlying compliance services STRLCS provides to you.

5.4 Service providers and third-party software

STRLCS uses trusted third-party software providers to help operate and deliver our services. By creating an account, making a payment, or using any STRLCS service you consent to your personal information being shared with the categories of provider listed below to the minimum extent needed to deliver the service you have engaged us for. A current, itemised list of processors is available on request from privacy@strlcs.co.za.

• CRM, email, and back-office platform — Zoho Corporation. Personal information is stored in Zoho's data centres in the European Union under strict data-protection controls.
• Website hosting — Netlify.
• Communications — WhatsApp Business API, Zoho Mail, and SMS gateways where applicable.
• Payment processors — Paystack, PayJustNow, Payflex, PayFast, Ozow, and equivalent providers when you make payment through our platforms.
• Analytics and advertising attribution — Google Tag Manager, Google Analytics, Meta (Facebook) Pixel, Zoho PageSense, and equivalent tools that measure how our website and campaigns perform.
• Credit, tax, and background-check providers — CIPC eServices, SARS eFiling, TransUnion, Experian, MIE Screening, and equivalent SA-registered providers, used only for vendor and assessor credential verification with your consent.
• Accreditation body portals — Electrical Contractors Board (ECB), SAQCC Fire, SAQCC Gas, FSCA, Information Regulator, Department of Employment & Labour, and equivalent bodies queried during vetting.
• File and document storage — Zoho WorkDrive and equivalent secure cloud storage, used to hold the documents you provide us.
• Artificial intelligence providers — see 5.5 below.

5.5 Artificial intelligence and automated processing

STRLCS uses artificial intelligence (“AI”) tools to help deliver our services more efficiently. AI is used for:

• Automated credential lookups against public and licensed South African authority databases during vendor and assessor vetting
• Drafting communications, audit summaries, and support responses which are then reviewed by a STRLCS specialist before being sent to you
• Powering our AI messaging agent (“Zia” and successor agents) that responds to your queries on WhatsApp, email, and web chat
• Flagging anomalies or unusual patterns in application data so that a specialist can prioritise their review

What this means for you:

• Any AI-generated content that materially affects you (audit findings, decision letters, contractual outputs) is reviewed by a STRLCS specialist before it is treated as a final STRLCS position.
• You may request a human review of any AI-assisted communication or decision at any time by emailing privacy@strlcs.co.za. We will respond within 30 days.
• We share only the personal information necessary for the specific AI task, and we contractually require our AI providers to process that information solely on our instructions and to delete it once the task is complete.
• We do not permit our AI providers to use your personal information to train their models.
• Current AI providers include, among others, OpenAI, Anthropic, and Zoho Zia. The current list is available on request from privacy@strlcs.co.za.

5.6 Your consent to AI and third-party software use

By creating an account with STRLCS, making a payment through our platforms, or using any STRLCS service, you consent to:

• The use of AI tools as described in 5.5 to assist in delivering the service you have engaged us for.
• Your personal information being shared with the third-party software providers listed in 5.4 — and with the AI providers listed in 5.5 — to the minimum extent needed to deliver that service.
• Human specialist review of AI-assisted decisions before they are treated as final where those decisions materially affect you.

You may withdraw this consent at any time by emailing privacy@strlcs.co.za. Withdrawal may make it impossible for STRLCS to continue delivering some or all of the services you have engaged us for; where that is the case, we will explain the specific impact before applying the withdrawal, and any fees you have paid will be handled in line with the relevant Terms & Conditions and the refund policies published there.

5.7 Legal disclosures

We may disclose your information where required by law, court order, or a request from a South African regulatory authority.

6. Cookies and tracking

Our website uses cookies and similar technologies for:

• Essential functionality — keeping the site working (cannot be disabled)
• Analytics — understanding how visitors use our site (Google Tag Manager, Google Analytics, Zoho PageSense)
• Advertising attribution — measuring the effectiveness of our ads (Meta Pixel, Google Ads conversion tracking)

You can disable non-essential cookies via your browser settings. Doing so will not affect your ability to use STRLCS's core services.

7. Consent to electronic communications

By using our services or submitting information to us, you consent to receive notices, agreements, disclosures, and any other communication from us electronically by email (to the address you provide) or by SMS or WhatsApp (to the number you provide). Electronic communication of this nature satisfies any legal requirement that such communication be in writing.

8. How long we keep your information

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, and to meet our legal and regulatory obligations. In most cases:

• Active customer / vendor / assessor records — for the duration of our relationship and 5 years thereafter (for tax and audit compliance)
• Marketing contact records — until you opt out
• Vendor credential-verification evidence — 5 years, per POPIA and industry compliance norms

After the retention period expires, we delete or anonymise your personal information.

9. Security

We use industry-standard technical and organisational safeguards to protect your personal information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for STRLCS staff, and regular security reviews of our vendors. Where a security compromise involving your personal information occurs, we will notify you and the Information Regulator in line with POPIA section 22.

10. Your rights under POPIA

As a data subject you have the right to:

• Access the personal information we hold about you
• Request that we correct or update inaccurate information
• Request that we delete information we no longer need to retain
• Object to the processing of your information for direct marketing
• Withdraw your consent to processing at any time (where consent is the lawful basis)
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email privacy@strlcs.co.za. We will respond within 30 days.

Information Regulator of South Africa
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
inforeg@justice.gov.za

11. Cross-border transfers

Your personal information may be stored or processed outside South Africa (specifically in the European Union, where Zoho's data centres are located). We ensure that any cross-border transfer meets POPIA's requirements for adequate protection, including standard contractual clauses with our processors where required.

12. Reporting abuse or a privacy concern

If you believe someone is misusing our services, has misrepresented themselves to you as a STRLCS agent, or has otherwise breached this Policy, email abuse@strlcs.co.za with details. We treat abuse reports as confidential.

13. Children

STRLCS's services are intended for adults (18 and older). We do not knowingly collect personal information from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email (to existing customers, vendors, and assessors) and via a prominent notice on our website. The “Effective” date at the top of this page will reflect the latest version.

15. Contact us

Questions, requests, or complaints about this Privacy Policy or how STRLCS handles your information: