PAIA manual

This manual explains what records Campus Galleries keeps and how you can ask for access to them under PAIA. It also describes how we process personal information, as section 51 of PAIA requires for the Protection of Personal Information Act 4 of 2013 (POPIA). Our privacy notice has more detail on how we use personal information.

Campus Galleries is a sole proprietorship owned by Keabetswe France Masela, trading as Campus Galleries. It runs an online service where students publish accommodation-wanted profiles and verified landlords, who pay a monthly plan, send them offers. Campus Galleries doesn't list properties, match tenants or charge a fee per tenant.

The head of the business and Information Officer is the owner. There is no deputy Information Officer.

Head and Information Officer

Keabetswe France Masela

Email

campusgalleries.za@gmail.com

Phone

+27 79 320 9306

Street address

15 Riebeek Street, Hurst Hill, Johannesburg, 2092

Postal address

15 Riebeek Street, Hurst Hill, Johannesburg, 2092

Website

campusgalleries.com

The Information Regulator publishes a guide on how to use PAIA and POPIA (section 10 of PAIA). It's available in every official language on the Regulator's website, and you can ask us for a copy.

Website

inforegulator.org.za

Enquiries

enquiries@inforegulator.org.za

PAIA complaints

PAIAComplaints@inforegulator.org.za

POPIA complaints

POPIAComplaints@inforegulator.org.za

Postal address

P.O. Box 31533, Braamfontein, Johannesburg, 2017

We haven't published a notice under section 52 of PAIA. These records are freely available on our website without a formal request: the privacy notice, terms of use, this manual, the student guide, how it works, and our plan prices.

Where they apply to us, we keep records under these laws, among others:

• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991, if we become a VAT vendor
• Electronic Communications and Transactions Act 25 of 2002
• Consumer Protection Act 68 of 2008
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000
• Financial Intelligence Centre Act 38 of 2001, to the extent it applies

Subject	Categories of records
Business	Business registration and tax records, bank statements, income and expense records, agreements with service providers, and correspondence with regulators (including the PPRA and the Information Regulator)
Students	Accounts and profiles, consent records, parent or guardian consent records (for 16 and 17 year olds), offers received and responses, status updates, reviews, reports and messages
Landlords	Accounts and business details, verification records, rooms and room photos, offers sent, plans and payment records, reviews, reports and messages
Website and service	Activity records (log-ins, searches, profile views, offer views), first-visit source links, login sessions, email notification records and security records
Marketing	Newsletter sign-ups and opt-outs, and content we publish

Why we process it

• To run student and landlord accounts, including log-in and password reset
• To show student profiles (without surnames or contact details) to verified landlords, and to deliver landlords' offers to students
• To share contact details between a student and a landlord only when the student accepts that landlord's offer, and with a parent or guardian for students under 18
• To verify landlords and keep the service safe: handling reports, preventing scams and enforcing our terms
• To take payment for landlord plans, send receipts and keep financial records
• To send service emails and, if you agree, news, and to understand what works using service statistics
• To meet our legal obligations

Data subjects and the information we process

Data subject	Personal information
Students	Full name, username, email, WhatsApp number, age group, institution and campus, year and enrolment status, funding type, budget, room needs, move-in month, a short description, account and activity records
Parents and guardians	Name, email, WhatsApp number and consent record
Landlords	Full name, business name, username, email, WhatsApp number, campuses served, verification information (such as ID and proof of ownership or management), rooms and photos, offers, plan and payment records (never card numbers)
Website visitors and subscribers	Messages sent to us, newsletter email address, and basic technical and usage information
Service providers	Contact and account details of the businesses we use

Who receives it

• Landlords see limited student profile details; full contact details are shared only after a student accepts an offer
• Parents or guardians of students under 18 receive the accepted landlord's details
• Service providers that operate the service for us: Google (data storage and email), Cloudflare (website hosting and security) and Yoco (card payments)
• Authorities, when the law requires it

We don't sell personal information.

Information sent outside South Africa

Google stores our data and Cloudflare runs our website on servers that may be outside South Africa. We rely on their data processing terms, which give a level of protection comparable to POPIA (section 72). Yoco processes card payments.

How we keep it safe

• Only the owner has access to the stored data
• Passwords are stored only in scrambled (hashed) form, and log-ins expire
• The website uses encrypted connections (HTTPS)
• Card details are entered on Yoco's secure page, and we never see them; payment confirmations are signature-checked
• Landlords are verified before they see students, contact details are shared only on acceptance, and the board limits repeated searches to prevent copying
• Accounts inactive for 12 months are deleted, and anyone can delete their account at any time

If a security compromise happens, we'll notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires.

1. Complete Form 2 (request for access to a record), which you can download from the Information Regulator's website, or ask us for a copy.
2. Email it to campusgalleries.za@gmail.com or post it to the postal address in section 2. Include a copy of your ID.
3. Describe the records you want clearly, say how you'd like to receive them (for example by email) and which right you're trying to exercise or protect. If you're asking on someone else's behalf, include proof that you may do so.

For your own personal information, you don't need a formal PAIA request: you can see and change your profile in the app, delete your account in Profile, or email us to ask what we hold about you, to correct it or to object to its processing.

Fees are set by the PAIA Regulations. The request fee for a private body is currently R140. It isn't payable if you're asking for your own personal information. An access fee may apply for copying, preparing and delivering the records. If the search and preparation take more than the prescribed number of hours, we may ask for a deposit, which we refund if access is refused. We'll tell you the amount before charging anything.

We'll decide within 30 days of receiving a complete request. We may extend this once by up to 30 more days, and we'll tell you why. If we don't decide in time, the request is treated as refused.

We may refuse access on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, confidential or commercial information, someone's safety, or legally privileged records. If part of a record can be shared, we'll share that part.

We don't have an internal appeal. You can complain to the Information Regulator (see section 3) within 180 days, or apply to court.

This manual is on our website and available free of charge by email or at our street address. We update it when our business or the law changes.