Privacy Policy

Entegral Technologies (Pty) Ltd (“Entegral”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information that we process.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, communicate with us, become a customer, or use our software, platforms and related services.

It is intended to comply with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.

This Privacy Policy should be read together with our Customer Terms of Service and any product-specific terms or agreements that may apply.

1. Who we are

Entegral Technologies (Pty) Ltd is a South African real estate technology company providing software, websites, data services and related technology to estate agencies, property practitioners and other customers.

Our products and services may include Base, Flex, Sync, Vault, APIs, integrations, websites and other products or services that we introduce from time to time (“Services”).

For purposes of POPIA, Entegral may act either as a responsible party or as an operator, depending on the circumstances.

2. When Entegral is the responsible party

Entegral acts as a responsible party when we determine why and how personal information is processed.

This may include personal information relating to:

• Entegral customers and prospective customers;
• individual users of Entegral Services;
• website visitors;
• people who contact our sales or support teams;
• suppliers and business partners;
• applicants for employment or contracting opportunities;
• subscribers to Entegral communications; and
• other people with whom we have a direct business relationship.

When Entegral acts as the responsible party, this Privacy Policy describes how we process that personal information.

3. When Entegral acts as an operator

Our customers use Entegral Services to manage information relating to their own businesses, properties, contacts, clients, leads and transactions.

Where a Client determines the purpose for which personal information is collected and Entegral processes that information on the Client's behalf, the Client is generally the responsible party and Entegral acts as an operator as contemplated by POPIA.

In these circumstances:

• the Client is responsible for ensuring that it has a lawful basis for processing the personal information;
• the Client is responsible for providing appropriate privacy notices and obtaining consent where consent is required;
• Entegral processes the information for purposes of providing the Services and in accordance with the Client's instructions and our contractual obligations; and
• requests relating to the personal information should generally be directed to the relevant Client in the first instance.

Entegral will maintain appropriate safeguards when processing personal information as an operator.

4. What is personal information?

“Personal information” has the meaning given to it under POPIA and generally means information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person.

Depending on the circumstances, personal information may include:

• names and surnames;
• identification or registration numbers;
• contact details;
• email addresses and telephone numbers;
• physical, postal or business addresses;
• employment and professional information;
• financial and billing information;
• property-related information;
• correspondence and communications;
• online identifiers and device information; and
• other information that can reasonably be linked to an identifiable person or organisation.

5. What does processing mean?

“Processing” includes any operation or activity involving personal information, whether automated or not.

This includes collecting, receiving, recording, organising, storing, updating, retrieving, using, analysing, transmitting, sharing, restricting, deleting or destroying personal information.

6. Personal information we may collect

The information we collect depends on your relationship with Entegral and the Services you use.

Account and identity information

We may collect:

• your name and surname;
• business or agency name;
• job title or role;
• email address;
• telephone number;
• username and account information;
• identity or registration information where required;
• regulatory or professional registration information; and
• information required to verify your business or account.

For South African property practitioners, this may include information relating to registration with the Property Practitioners Regulatory Authority or a Property Practitioner Fidelity Fund Certificate where applicable.

Billing and transaction information

We may process:

• billing information;
• payment method information;
• bank or debit order details where applicable;
• invoices;
• payment history;
• transaction records; and
• records relating to the Services you subscribe to.

Where payments are processed by an external payment provider, that provider may process payment information in accordance with its own privacy requirements.

Communications

We may retain records of communications with you, including:

• support requests;
• sales enquiries;
• contact and callback requests;
• emails;
• chat conversations;
• feedback;
• complaints; and
• other correspondence.

Service and usage information

When you use our website or Services, we may automatically collect certain technical information such as:

• IP address;
• browser and device information;
• operating system;
• login activity;
• dates and times of access;
• pages or features accessed;
• system activity;
• security events;
• audit trail information; and
• diagnostic and performance information.

We use this information to operate, secure, maintain and improve our Services.

Client Data

Clients may upload or create information within Entegral Services.

This may include:

• contacts and leads;
• buyer and seller information;
• property information;
• property mandates;
• photographs and documents;
• transaction and deal information;
• communication records;
• compliance information; and
• other information required for the Client's business activities.

Where Entegral processes this information on behalf of a Client, the Client will generally be the responsible party and Entegral will act as an operator.

7. How we collect personal information

We may obtain personal information:

• directly from you;
• when you create or use an account;
• when you submit a form or enquiry;
• when you contact our sales or support teams;
• when you purchase or subscribe to a Service;
• through your use of our websites and Services;
• from an organisation that you represent;
• from a Client that uses our Services;
• from service providers or business partners;
• from publicly available sources;
• through integrations that you or a Client have authorised; or
• from another lawful source.

POPIA does not require consent for every form of processing.

Where information is obtained indirectly, we will process it only where permitted by POPIA or another applicable law.

8. Why we process personal information

We process personal information only where there is an appropriate purpose and basis for doing so.

Depending on the circumstances, we may process information to:

• provide and operate our Services;
• create and administer accounts;
• authenticate users;
• process subscriptions, payments and billing;
• provide customer support;
• respond to enquiries and requests;
• communicate important Service information;
• manage our relationship with customers;
• operate, maintain and improve our websites and software;
• provide integrations and syndication services;
• maintain audit trails and activity histories;
• protect the security of our systems;
• detect or investigate fraud, misuse or security incidents;
• verify identities where required;
• provide compliance or verification services;
• meet legal, regulatory and contractual obligations;
• maintain financial, tax and business records;
• analyse Service performance and usage;
• develop and improve products and functionality;
• communicate relevant Entegral products and services where permitted by law; and
• establish, exercise or defend legal rights.

Depending on the processing activity, Entegral may rely on consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest, or another basis permitted by POPIA.

9. Information that is required

Some information is necessary for us to provide a Service or comply with legal or regulatory requirements.

For example, we may require certain information to:

• establish and administer an account;
• verify a user or business;
• process billing;
• provide a requested Service;
• comply with regulatory requirements; or
• protect the security of an account.

Where information is mandatory and you choose not to provide it, we may be unable to provide the relevant Service or functionality.

Other information may be optional.

10. Special personal information

POPIA provides additional protection for certain categories of information referred to as special personal information.

Entegral will only process special personal information where this is permitted by POPIA or another applicable law.

Certain Entegral Services, particularly identity, verification or compliance-related Services, may require the processing of information that is subject to additional legal protection.

Where Entegral processes this information on behalf of a Client, the Client is responsible for ensuring that it has the necessary authority to submit the information for processing.

11. Information relating to children

Entegral's Services are primarily intended for businesses and adult users.

We do not knowingly collect personal information directly from children where doing so would be prohibited by POPIA.

Where information relating to a child is processed through an Entegral Service, it must be processed in accordance with POPIA and any applicable consent, authorisation or other legal requirements.

12. Vault and compliance information

Where Vault or another Entegral Service provides identity verification, FICA, sanctions, PEP, screening or related compliance services, information may be processed for purposes including:

• verifying identity;
• performing compliance checks;
• screening against relevant data sources;
• detecting potential fraud or risk;
• satisfying applicable legal or regulatory requirements; and
• returning results to the Client requesting the service.

Information may be obtained from the Client, the person being verified, authorised data providers, official sources or other lawful sources.

Clients remain responsible for ensuring that they are legally entitled to submit information for verification and for determining what action should be taken based on the results.

13. Cookies and similar technologies

Our websites and Services may use cookies and similar technologies.

These technologies may be used to:

• keep users signed in;
• maintain security;
• remember settings and preferences;
• provide website and application functionality;
• understand how our websites and Services are used;
• diagnose technical problems;
• measure performance; and
• improve the user experience.

Some cookies are necessary for the operation of our websites and Services.

Where we use optional analytics, advertising or similar technologies requiring consent, we will request consent where required by applicable law.

You can also manage cookies using your browser settings. Disabling certain cookies may affect the functionality of our websites or Services.

14. Direct marketing

Entegral may communicate with existing or prospective customers about our products, services, updates and related offerings where permitted by POPIA and other applicable law.

Where consent is required for electronic direct marketing, we will seek the necessary consent.

Where POPIA permits us to communicate with an existing customer about our own similar products or services, we may do so subject to the requirements of the Act.

Marketing communications will identify Entegral as the sender and provide a reasonable method to opt out.

You may unsubscribe from marketing communications at any time.

Opting out of marketing communications will not prevent us from sending communications that are necessary to administer your account or provide the Services, such as:

• security notifications;
• billing notices;
• support communications;
• important Service announcements; and
• notices relating to your contractual relationship with Entegral.

15. Sharing personal information

We do not sell Client Data or personal information to third parties.

We may share personal information where reasonably necessary with:

• employees and authorised personnel;
• cloud infrastructure and hosting providers;
• communication service providers;
• payment and billing providers;
• security and fraud-prevention providers;
• professional advisers;
• verification and compliance data providers;
• technology and integration providers;
• artificial intelligence service providers where applicable;
• property portals or other destinations selected by a Client;
• regulators, courts or law enforcement authorities where required by law; and
• other service providers that assist us in delivering the Services.

Service providers processing personal information on our behalf are required to handle the information appropriately and in accordance with applicable privacy and security requirements.

Where a Client instructs us to send information to a third-party service, the processing of that information by the recipient may also be governed by the recipient's own terms and privacy policy.

16. International processing and transfers

Entegral uses modern cloud and technology services, and personal information may therefore be stored or processed outside South Africa in certain circumstances.

Where personal information is transferred to a recipient in another country, Entegral will take reasonable steps to ensure that the transfer complies with section 72 of POPIA.

This may include ensuring that the recipient is subject to:

• an applicable law providing an adequate level of protection;
• binding corporate rules;
• a contractual agreement providing appropriate safeguards; or
• another lawful basis for transferring the information under POPIA.

17. Artificial intelligence and automated processing

Some Entegral Services use artificial intelligence, machine learning or other automated technologies.

These technologies may assist with functions such as:

• drafting content;
• classifying or extracting information;
• search and matching;
• summarising information;
• analysing property or market information;
• recognising features within data or images; and
• generating recommendations or suggestions.

Where third-party AI providers are used, information necessary to perform the requested function may be transmitted to those providers subject to appropriate data protection arrangements.

We take reasonable steps to limit information supplied to external providers to what is necessary for the applicable function.

AI and automated outputs may contain errors and should be reviewed where appropriate before being relied upon.

Entegral's automated features are generally intended to assist users rather than make decisions that have legal or similarly significant consequences for an individual solely by automated means.

Where Entegral introduces automated decision-making falling within section 71 of POPIA, we will process the information in accordance with the requirements and safeguards of that section.

18. Aggregated and de-identified information

We may create statistical, aggregated or de-identified information from information processed through our Services.

Where information has been appropriately de-identified so that it can no longer reasonably identify a person, it is no longer treated as personal information for purposes for which identification is not possible.

We may use this information to:

• measure Service performance;
• understand usage trends;
• improve our products;
• develop new functionality;
• perform research and analysis; and
• produce statistical insights.

We will not intentionally use de-identified information to re-identify an individual unless necessary for security, legal compliance or another lawful purpose.

19. Security

Entegral takes the security and protection of personal information seriously.

We implement reasonable technical and organisational safeguards designed to protect personal information against:

• loss;
• unauthorised access;
• misuse;
• alteration;
• disclosure;
• destruction; and
• other unlawful processing.

These measures may include access controls, authentication, encryption, monitoring, audit trails, backups and other appropriate safeguards.

No internet-based service can be guaranteed to be completely secure.

Users are also responsible for protecting their accounts and devices, including maintaining secure passwords and authentication credentials and preventing unauthorised access.

20. Security compromises

If Entegral has reasonable grounds to believe that personal information for which we are the responsible party has been accessed or acquired by an unauthorised person, we will investigate the incident and take appropriate steps in accordance with POPIA.

Where required by law, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful restrictions on notification.

Where Entegral acts as an operator and becomes aware of a relevant security compromise, we will notify the responsible party in accordance with POPIA and our applicable contractual obligations.

21. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently processed, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• the nature of the information;
• the Service being provided;
• contractual requirements;
• legal or regulatory obligations;
• tax and accounting requirements;
• security and fraud-prevention requirements;
• dispute-resolution requirements; and
• legitimate business needs.

When information is no longer required, we may securely delete, destroy or de-identify it.

Information contained in system backups may remain for a limited period until it is overwritten in accordance with our normal backup processes.

22. Your rights under POPIA

Subject to POPIA and any applicable limitations, you may have the right to:

• ask whether Entegral holds personal information about you;
• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion or destruction of information where permitted by law;
• object to certain processing of your personal information;
• object to direct marketing;
• withdraw consent where processing is based on consent;
• request information about relevant third parties that have had access to your information;
• exercise applicable rights relating to certain automated decisions; and
• lodge a complaint with the Information Regulator.

We may need to verify your identity before processing a request.

We may also refuse or limit a request where permitted or required by POPIA, PAIA or another applicable law.

23. Access to records

Requests for access to personal information may also be subject to the Promotion of Access to Information Act 2 of 2000 (“PAIA”).

Where applicable, requests will be handled in accordance with POPIA, PAIA and Entegral's PAIA procedures.

Any fee lawfully prescribed under PAIA may apply to a formal access request.

24. Third-party websites and services

Our websites and Services may contain links to or integrations with websites and services operated by third parties.

Entegral does not control the privacy practices of independent third parties.

When you leave an Entegral website or choose to use a third-party service, you should review the privacy terms applicable to that service.

25. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our products or Services;
• new technology or functionality;
• changes to our processing activities;
• changes in applicable law or regulatory guidance; or
• improvements to our privacy practices.

The latest version will be published on the Entegral website and will show the date on which it was last updated.

Where a change materially affects how we process personal information, we will take reasonable steps to notify affected users where appropriate.

26. Privacy and Information Officer enquiries

Questions, requests or concerns regarding this Privacy Policy or Entegral's processing of personal information can be directed to:

Entegral Technologies (Pty) Ltd

Postnet Suite 394

Private Bag X31

Knysna 6570

South Africa

Telephone: +27 (0)21 201 6777

Email: support@entegral.net

Privacy and POPIA-related requests sent to this address will be directed to Entegral's Information Officer or the appropriate person responsible for handling the request.

27. Complaints

If you believe that Entegral has processed your personal information contrary to this Privacy Policy or applicable South African privacy law, please contact us first so that we have an opportunity to investigate and address your concern.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Regulator (South Africa).

Information Regulator (South Africa)

Telephone: 010 023 5200

POPIA complaints: POPIAComplaints@inforegulator.org.za

Complaints can also be submitted through the Information Regulator's official complaints process.