Privacy Policy

Luupa (Pty) Ltd ("Luupa", "we", "us", or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and any other applicable South African privacy legislation.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Luupa platform. By registering for or using the Platform, you acknowledge that you have read and understood this policy.

Luupa (Pty) Ltd is the responsible party ("operator") as defined in POPIA. Our Information Officer can be contacted at privacy@luupa.co.za.

We collect the following categories of personal information:

We process your personal information for the following purposes:

• To register and verify your identity ("Know Your Customer" obligations);
• To verify rent payment submissions and award points;
• To calculate and display credit scores;
• To send notifications about accounts, payments, rewards, and offers via WhatsApp, push notifications, and email;
• To facilitate referrals to financial product providers (insurance, short-term finance, savings);
• To improve the Platform and personalise the experience;
• To detect, investigate, and prevent fraud and abuse; and
• To comply with applicable South African legal and regulatory obligations.

Our lawful basis for processing is your consent (given at registration), the performance of our agreement with you, and our legitimate interests in operating a secure and compliant platform.

We may share your personal information with:

• Landlords and tenants — to facilitate payment confirmation and tenancy management;
• Identity verification providers — including the South African Department of Home Affairs or accredited bureaux (e.g. Lexis Nexis, Compuscan) for KYC checks;
• Financial product partners — only with explicit consent, when applying for or expressing interest in a financial product;
• Technology service providers — including cloud storage, document OCR, and WhatsApp messaging providers, who process data on our behalf and are bound by appropriate data processing agreements;
• Regulatory and law enforcement authorities — where required by law or to prevent fraud.

We do not sell personal information to third parties.

Some of our technology service providers process data outside South Africa. Where this occurs, we ensure that appropriate safeguards are in place as required by section 72 of POPIA, including data processing agreements that impose equivalent protections to those required under South African law.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, and in any event:

• Proof of payment documents — minimum 5 years (financial record-keeping requirements);
• Identity and KYC records — minimum 5 years after account closure (FICA obligations);
• Transaction and audit logs — minimum 5 years;
• Account data — for the duration of your account, plus 3 years after closure.

When retention periods expire, personal information is securely deleted or anonymised.

You have the right to:

• Access — request a copy of the personal information we hold about you;
• Correction — request that inaccurate or outdated information be corrected;
• Deletion — request the deletion of your personal information (subject to our legal retention obligations);
• Objection — object to the processing of your personal information for direct marketing purposes;
• Withdraw consent — where processing is based on consent, you may withdraw it at any time; and
• Lodge a complaint — with the Information Regulator of South Africa at inforeg@justice.gov.za or visit www.inforegulator.org.za.

To exercise any of these rights, please contact our Information Officer at privacy@luupa.co.za or use the support form.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction — including encryption of sensitive data at rest and in transit, role-based access controls, and regular security reviews.

In the event of a data breach that poses a risk, we will notify affected users and the Information Regulator as required by POPIA.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from persons under the age of 18.

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via in-app notification or WhatsApp before they take effect.

For privacy-related queries or to exercise your rights, contact our Information Officer:

Email: privacy@luupa.co.za
Luupa (Pty) Ltd, South Africa