Privacy Policy

VulaKomplex is a South African software-as-a-service platform providing management tools for sectional title schemes, body corporates, and managing agents. References to "VulaKomplex", "we", "us", or "our" in this policy refer to the operator of the VulaKomplex platform at vulakomplex.co.za. Company registration number: 2026/311419/07 Registered address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Email: legal@vulakomplex.co.za

This Privacy Policy explains how we collect, use, store, and share personal information when you use the VulaKomplex platform, visit our website, or interact with us by email or other means. It applies to all users of the platform including managing agents, trustees, owners, tenants, and residents.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and its implementing regulations. We process personal information only where we have a lawful basis to do so, including where processing is necessary to perform a contract with you, to comply with a legal obligation, to protect a legitimate interest, or where you have given consent.

Under POPIA, a Responsible Party determines the purpose and means of processing personal information. An Operator processes personal information on behalf of a Responsible Party. VulaKomplex acts as a Responsible Party in respect of personal information that it processes for its own purposes — for example, account management, billing, and platform improvement. In respect of personal information of scheme members (owners, tenants, and residents) processed through the platform, VulaKomplex acts as an Operator. In that context, the Body Corporate, HOA or other Scheme Entity is the Responsible Party and is responsible for ensuring that residents' personal information is processed in accordance with POPIA. A Managing Agent operating the platform on behalf of a Scheme Entity acts as an authorised administrator of the Scheme Entity — the Scheme Entity remains the Responsible Party. VulaKomplex processes that data solely to deliver the platform services.

We may collect the following categories of personal information: • Identity information: full name, identity number (where required) • Contact information: email address, phone number (including WhatsApp number) • Account information: username, password (stored as a secure hash), role within the scheme • Property information: unit number, complex name, ownership or tenancy status • Financial information: levy amounts, payment status, billing history (we do not store card numbers — payment processing is handled by third-party providers) • Usage information: pages visited, features used, log data, IP address • Device information: browser type, device type, operating system • Communications: messages, maintenance queries, and documents you submit through the platform

We use your personal information to: • Create and manage your account • Deliver levy statements, reminders, and notifications via email and WhatsApp • Process and track maintenance queries • Generate financial reports for trustees and managing agents • Facilitate alteration applications and committee voting • Comply with legal obligations • Improve and develop the platform • Respond to support requests • Prevent fraud and maintain platform security We also derive anonymised, aggregated insights from platform usage — such as feature adoption rates, scheme size distributions, and operational trends — to inform product development, business planning, and commercial reporting. This processing uses data in a form that does not identify any individual.

Where you provide a phone number, we may send you communications via WhatsApp, including levy statements, payment reminders, and maintenance updates. By providing your phone number you consent to receiving such messages. You may opt out at any time through your account settings on the platform, or by logging a support ticket. WhatsApp messages are delivered via a registered WhatsApp Business API provider.

We do not sell your personal information to third parties. We may share information with: • Your Body Corporate, HOA trustees, managing agent or scheme administrators (in their capacity as Responsible Party or authorised administrators of the scheme) • Service providers who process data on our behalf (cloud hosting, email delivery, WhatsApp API, analytics) under written data processing agreements • Regulators or law enforcement where required by law • A successor entity in the event of a merger, acquisition, or sale of all or part of VulaKomplex's business or assets — in which case we will give prior notice and the successor will be bound by this Privacy Policy or an equivalent standard All third-party processors are contractually bound to process personal information only on our instructions and in accordance with applicable law.

Personal information is stored on secure cloud infrastructure hosted within or outside South Africa by sub-processors operating under appropriate safeguards. We implement appropriate technical and organisational measures including: • Encryption in transit (TLS 1.2 or higher) • Encryption at rest • Row-level security and role-based access controls • Multi-factor authentication for administrative access • Regular access reviews Only authorised personnel and systems can access personal data. Despite these measures, no internet transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

We retain personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Financial records may be retained for up to 7 years in accordance with South African tax and company law requirements. You may request deletion of your personal information subject to these retention requirements.

You have the right to: • Access the personal information we hold about you • Correct inaccurate or incomplete information • Request deletion of your information (subject to legal retention requirements) • Object to the processing of your information • Lodge a complaint with the Information Regulator of South Africa To exercise any of these rights, submit a written request to legal@vulakomplex.co.za with the subject line "POPIA Data Request". We will respond within 30 days. If you are dissatisfied with our response, you may escalate to the Information Regulator: Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za

VulaKomplex has appointed an Information Officer as required by POPIA: Information Officer: Cornel Esterhuyzen Email: legal@vulakomplex.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 The Information Officer is responsible for overseeing VulaKomplex's compliance with POPIA and handling data subject requests and complaints.

We use cookies and similar technologies to operate the platform and understand how it is used. For full details of the cookies we use and how to manage them, see our Cookie Policy at vulakomplex.co.za/cookie-policy. In summary: we use essential session cookies (required for login and platform operation) and privacy-preserving analytics. We do not use advertising or tracking cookies.

VulaKomplex is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at legal@vulakomplex.co.za and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the platform. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

For privacy-related queries, requests, or complaints: Information Officer: Cornel Esterhuyzen Email: legal@vulakomplex.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za