Privacy Policy

Worthington PMR (Pty) Ltd (registration number 2023/778348/07), trading as RenDex (“RenDex”, “we”, “us”) operates the rental-intelligence platform at rendex.co.za. This policy describes how we process personal information in line with the Protection of Personal Information Act, 2013 (POPIA).

This policy covers two categories of data subject:

• Landlords who create an account on RenDex to manage their rental portfolio.
• Tenants whose information landlords enter into RenDex about their rental relationship.

For tenant data, the landlord is the responsible party in POPIA terms and RenDex acts as an operator. For landlord data, RenDex is the responsible party.

From landlords (directly)

• Email address and password (Supabase Auth).
• Account activity (login times, IP address) used to secure your account.
• Anonymised technical data via Sentry to diagnose errors.

About tenants (entered by landlords)

• Full name, unit number, property address, phone number, email (if provided), lease start and end dates, monthly rent amount.
• Payment history (due dates, paid dates, amounts).
• Maintenance issues, escalations, deposit records, lease and inspection documents the landlord uploads.
• Free-text notes the landlord enters.

We do not collect ID numbers, credit-bureau data, or payment-card details. We do not perform automated decision-making with legal consequences for any data subject.

• To provide the service. Calculate Rent Reliability Index (RRI) scores, surface arrears, generate reports.
• To send alerts to the landlord about overdue rent or expiring leases (currently sent to the landlord's email only).
• To secure the account (authentication, session management).
• To diagnose and fix errors (Sentry error reports).
• To comply with legal obligations where applicable.

For landlord personal information, processing is necessary to perform the contract between the landlord and RenDex (POPIA s11(1)(b)) and pursuant to the landlord's consent on signup (s11(1)(a)).

For tenant personal information, the landlord (as responsible party) is required by POPIA to have its own lawful basis for processing their tenants' data, typically the lease agreement (necessity for the contract) or legitimate interest in managing the rental.

We share personal information only with the operators required to run the service:

• Supabase (database + authentication, hosted in the EU).
• Vercel (application hosting, US-based with EU edge).
• Resend (transactional email).
• Sentry (error monitoring).
• Anthropic (when a landlord explicitly uses the AI Analysis feature, anonymised aggregates may be sent to the Claude API).

We do not sell personal information. We do not share it for advertising or with credit bureaus.

The operators above process data outside South Africa. Each provides contractual safeguards (Standard Contractual Clauses or equivalent) that POPIA recognises as adequate. By using RenDex, you accept that data is transferred to and processed in those jurisdictions.

We retain account data for as long as your account exists. If you close your account we delete personal information within 90 days, except where retention is required by law (e.g. tax records; invoices may be kept for the SARS-mandated retention period). Backups containing your data are overwritten on a 30-day cycle.

We use Row-Level Security on the database, encrypted connections (TLS) end-to-end, hashed credentials (Supabase Auth, bcrypt), per-request CSP nonces, CSRF origin checks on state-changing requests, and a strict Permissions-Policy. Service-level secrets are stored as encrypted environment variables and not exposed to the browser.

Despite these measures no internet service can guarantee absolute security. If a security compromise affects your personal information we will notify you and the Information Regulator without undue delay.

Under POPIA you have the right to:

• Confirm whether we hold personal information about you.
• Request a copy of that information.
• Request correction of inaccurate or outdated information.
• Request deletion of your information (subject to retention requirements above).
• Object to processing on reasonable grounds.
• Lodge a complaint with the Information Regulator at inforegulator.org.za.

To exercise any of these, email admin@rendex.co.za. We respond within 30 days.

If you are a tenant and your landlord uses RenDex, your landlord is the responsible party for your data. Send any access, correction, or deletion request to your landlord first. If they don't respond, you can also email us at admin@rendex.co.za.

We use only strictly-necessary cookies for authentication (Supabase session cookies) and to remember your sign-in state. We do not use analytics or advertising cookies.

We may update this policy as the product evolves. We will update the “Last updated” date at the top, and material changes will be notified to active accounts by email.

Information Officer: Liam Worthington
Email: admin@rendex.co.za
Entity: Worthington PMR (Pty) Ltd (2023/778348/07)