Privacy notice

1. Two roles

ResiCore is provided by the operator of ResiCore named on the Contact page. Under the Protection of Personal Information Act (POPIA) we have two roles:

• For students and applicants we are an operator. Each residence decides why and how your information is used and is the responsible party. Your residence's own privacy notice is shown when you create your account and when you apply, and names its Information Officer, whom you can ask to see or correct your information. We process it only on the residence's instructions, under a written operator agreement.
• For our own customers and visitors we are the responsible party. This covers residence staff who register or manage a subscription, people who contact us, and visitors to these pages. The rest of this notice is about that information.

2. What we collect

• Account details: name, email address, cellphone number, and your role at the residence.
• Registration details of a residence: the owner or company, contact person, properties and bed numbers, and verification documents (proof of identity, proof that you may manage the property, and company registration where relevant).
• Billing records: plan, invoices, payments and the payment method's reference. Card details are entered on the payment provider's own page and never reach ResiCore.
• Security records: sign-ins, devices, IP addresses and an audit log of important changes.
• Messages you send us.

We use only essential cookies (see Cookies).

3. Why we use it

To create and secure your account, verify that a residence is genuine, provide and bill the service, send notices you need (such as invoices, price changes and security alerts), answer you, meet our legal duties, and protect ResiCore and its users against fraud and abuse. We do not sell personal information or use it for advertising.

4. Where it is kept and who helps us

Information is stored in the European Union (Frankfurt, Germany). POPIA section 72 allows this because the law there (the EU's General Data Protection Regulation) protects personal information at least as well as POPIA, and our hosting providers are bound by written agreements to keep it confidential and secure. We use a small number of service providers for hosting, email delivery and payments; each is bound to keep it confidential and secure. If a provider has to process information outside South Africa, we do so only as POPIA section 72 allows. The current list is available on request.

5. How long we keep it

Account and billing records are kept while the residence is a customer and afterwards for as long as tax and company law require. Verification documents are kept only as long as needed to verify the residence and meet our legal duties. When a residence cancels, its data is kept for 90 days so it can be downloaded, and is then deleted.

6. Security

Each residence's data is kept apart in the database itself. Sensitive fields are encrypted, uploads are virus scanned and stored privately, staff use two-step verification, and important changes are written to an audit log that cannot be edited. If a security compromise affects your information, we will tell you and the Information Regulator as POPIA requires.

7. Your rights

You may ask to see the personal information we hold about you, to correct or delete it, or object to how it is used, and you may withdraw consent you have given. Contact ResiCore's Information Officer at the email address on the Contact page. If you are not satisfied, you may complain to the Information Regulator (South Africa) (website inforeg.org.za, email complaints.IR@justice.gov.za).

Students and applicants: please ask your residence first, since it decides about your information. We will help it answer you.

8. Changes

We update this notice when our practices change. The date at the top shows the version in force.