Privacy Policy

1. Who we are

ErfFind is operated by ErfFind, Vredenburg, Western Cape. Our Information Officer, Tim Lotter, is responsible for how we handle personal information and can be reached at info@erffind.co.za.

This policy covers the ErfFind website, agency websites hosted by ErfFind and the ErfFind Android app. The app shows the same service as the website and does not collect any extra personal information of its own.

2. Our two roles: responsible party and operator

2.1 Responsible party. For information about our own users (your account, your listings, your enquiries and your payments), we decide how it is used, so we are the “responsible party” under POPIA.

2.2 Operator. For information an agency records in its CRM or collects through its agency website (its clients, leads, notes, appointments, chats, documents and accounting records), the agency is the responsible party and we are its “operator”. We process that information only on the agency's instructions and to provide the service. We never sell it or use it for our own marketing. If you are a client of an agency, please contact that agency about your information; we will help them respond.

3. What we collect

• Account details: your name, email address, phone number, password (stored only in encrypted, hashed form), profile photo, account type and settings. If you choose to sign in with Google, we receive your name, email address and profile photo from Google. We never receive your Google password.
• Agent and agency details: agency name and registration number, your PPRA Fidelity Fund Certificate number, your role in the agency, and documents supplied for verification.
• Listings: property details, address and map location, price, photos and video. Photos and video may show people or personal items, so please take care what you upload.
• Communications: enquiries, chat messages (including photos and documents attached to them), reviews, demo bookings and anything you send us.
• Payments: what you bought, the amounts and your invoices. Your card details are entered directly with our payment provider, Yoco. We never receive or store them.
• Agency Data (processed as operator; see clause 2.2): client names and contact details, notes, appointments, commission records, and documents such as mandates, leases and FICA documents, which may contain identity numbers, together with the signatures captured when documents are signed on screen. It also includes buyers' property-alert criteria, chats between agents and their clients, and, on plans with Accounting, trust and business accounting records: money received and paid out for clients, bank statement lines used for reconciliation, receipts and other proof, and the names of the people who sign reconciliations.
• Technical information: your IP address, browser type and the pages you request, logged for security, fraud prevention, rate limiting (for example, limiting repeated login attempts) and fixing errors.

4. How and why we use it

We use personal information only where POPIA allows it:

• To provide the service you asked for (performing our agreement with you): running your account, publishing and reviewing listings, delivering enquiries and messages, the CRM, agency websites, syndication and customer support.
• To meet legal obligations: VAT invoices, tax records, and responding to lawful requests.
• For our legitimate interests, balanced against your rights: keeping ErfFind secure, preventing fraud and fake listings, verifying agents and agencies, and improving the service using aggregated statistics.
• With your consent, where we ask for it. You may withdraw consent at any time.

5. Who we share it with

We do not sell personal information. We share it only as follows:

• Other users, when you choose to. A published listing shows its details and the contact details of the lister or agent. An enquiry goes to the seller, landlord or agent concerned. A review shows your name.
• Your agency. If you are a member of an agency, its owner and Super Users can see your activity in the CRM, according to the roles they set.
• Your franchise head office. If your agency is a branch in a franchise group on ErfFind, the head office can see the branch's performance figures, targets, listings, leads, clients, agents, compliance details and royalty statements, and can message the branch. An agency agrees to this when it joins a franchise group.
• ErfFind support staff. To resolve a support request or investigate a problem, authorised ErfFind staff may sign in to your account as you. A banner is shown on every page while this happens. Staff are bound by confidentiality and do only what the support task needs.
• Service providers who process information for us under confidentiality obligations:
  • Yoco, for payments;
  • our hosting, backup and email providers;
  • OpenStreetMap's Nominatim service, which turns listing addresses into map locations (it receives the address only, never your name);
  • OpenStreetMap's Overpass service, which finds schools, shops and healthcare near a listing (it receives the listing's map location only);
  • Google, if you choose to sign in with Google;
  • Google Meet, for online demos you book.
• Property portals. Where an agency switches on syndication, we send its listing details and agent contact details to the portals it chooses.
• Authorities and advisers. Where the law requires it, or to protect our rights, users or the public.
• A successor business, if ErfFind is sold or restructured, on the same privacy terms.

6. Information sent outside South Africa

Some of our providers operate servers outside South Africa, including OpenStreetMap (maps, address lookup and nearby amenities), Google (if you sign in with Google), Google Fonts (typefaces on some pages and on agency websites) and content delivery networks that serve standard website code. When your browser loads these, the provider receives technical information such as your IP address. We only use providers that are subject to data protection laws or agreements offering protection comparable to POPIA, as section 72 of POPIA requires.

7. How we protect it

We take reasonable technical and organisational measures to protect personal information, including:

• encrypted connections (HTTPS);
• hashed passwords;
• role-based access within agencies;
• limits on repeated login attempts;
• security headers;
• restricted administrator access;
• regular backups.

No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.

8. How long we keep it

• We keep account and listing information while your account is active. When you close your account, we delete or anonymise your personal information within 30 days, apart from what we must keep by law.
• We keep invoices and payment records for five years, as the Tax Administration Act requires.
• Deleted CRM records stay in the agency's Trash for 30 days and are then permanently removed.
• Backups are overwritten on a rolling basis, so deleted information may remain in a backup for up to about 30 days.
• Security records of login and form attempts are kept for about a day. Error logs are kept only as long as needed to fix the problems they record.

9. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and ask for a copy of it;
• ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• object to processing based on our legitimate interests, and to direct marketing;
• withdraw consent you have given;
• complain to the Information Regulator (inforegulator.org.za).

To use any of these rights, email info@erffind.co.za. We may need to confirm your identity first. We will respond within 30 days, free of charge except where the Promotion of Access to Information Act allows a prescribed fee. You can update most of your details yourself under Settings.

10. Emails and direct marketing

We send emails that are necessary for the service: account security, payment receipts, listing status, enquiries, appointment reminders and plan renewal reminders. We will only send you marketing with your consent, or about similar services if you are an existing customer. Every marketing email lets you opt out, as section 69 of POPIA requires. We never allow third parties to market to you using your information.

Property alerts from agencies. An agent may set up alerts that email you properties matching what you are looking for. These emails are sent on the agency's behalf, and the agency is responsible for having your consent. To stop them, ask the agency, or contact us and we will pass your request on.

11. Cookies and similar technology

We use only what ErfFind needs to work:

• a session cookie that keeps you signed in and protects forms against forgery, removed when your session ends;
• a theme cookie that remembers whether you chose light or dark mode, kept for a year;
• browser storage that remembers small display preferences, such as your calendar view.

We do not use advertising cookies or third-party tracking or analytics cookies.

12. Children

ErfFind is intended for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a competent person. If you believe we have, please contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change and show the date of the latest version at the top. If a change materially affects how we use your personal information, we will tell you by email or in your account before it takes effect.