Legal
Privacy notice
Draft for attorney review · not yet in force
This notice explains what personal information McBeth Kings collects, why, who sees it, how long we keep it, and what you can do about it. It applies to everyone we deal with: landlords, tenants, sellers, buyers, people who visit our website, and people who apply to work with us.
If anything here is unclear, ask our Information Officer (section 18). We will explain it in person, by phone or in writing. Our documents are in English. Translations into Sepedi or Xitsonga are available on request.
1 Who we are
1.1 McBeth Kings (Pty) Ltd (“McBeth Kings”, “we”, “us”) is a property practitioner firm in Tzaneen, registered with the Property Practitioners Regulatory Authority (PPRA). We help people sell, buy and let homes in Tzaneen and Polokwane.
1.2 Under the Protection of Personal Information Act 4 of 2013 (“POPIA”) we are the responsible party for the personal information we collect. That means we decide why and how it is used, and we answer for it.
1.3 Our Information Officer is the principal, Sipho E. Mahayi. His contact details are in section 18.
1.4 We hold no trust account and never handle client money. Rent and deposits go to the landlord’s own account or to PayProp, a registered payment processing agent (PPA reg 2.4) that holds rent and deposits in its own trust account; McBeth Kings never receives them. Sale deposits go to the conveyancer’s trust account. This matters for privacy too: we hold fewer bank records than most agencies.
2 Words we use
2.1 Personal information is any information about an identifiable living person, and about an existing company, trust or other juristic person. Examples: your name, ID number, phone number, address, bank details, payslips, credit record, photos and messages.
2.2 Processing means anything we do with it: collecting, recording, storing, using, sharing, correcting or destroying it.
2.3 Operator means a service provider that processes personal information for us under our instructions, such as our cloud storage provider.
3 What we collect, and about whom
| Who you are | What we collect |
|---|---|
| Landlords (owners letting a property) | Name, ID or passport number, contact details, address, marital status and spouse’s details where the spouse must consent; company, trust or partnership details and those of directors, trustees, members and beneficial owners; proof of ownership and authority; bank details for rent payouts; tax number where needed; the property’s details, condition report, photos and keys; FICA records (section 7) |
| Tenants and applicants | Name, ID or passport and permit details, date of birth, marital status, contact details, current and previous addresses and landlords; employer and income details; payslips, bank statements and other proof of income; debts, judgments and debt-review status you disclose; your credit report; the number and ages of people who will live with you, pets and vehicles; an emergency contact; references; your lease, inspection reports and photos, payment history and correspondence; FICA records (identity verification and sanctions screening) |
| Sellers | The same identity, contact, marital, entity and FICA information as for landlords; title deed and bond details; the property’s condition and the mandatory disclosure form; certificates (electrical, gas, electric fence) |
| Buyers | Name, ID or passport, contact details, marital status; entity details where buying through a company or trust; how the purchase is funded and where the money comes from; bond pre-approval or proof of funds; FICA records; offers and correspondence |
| Other people linked to a deal | Spouses, co-owners, sureties, directors, trustees, beneficial owners, signatories, referees and emergency contacts: usually name, ID number, contact details and their link to the client |
| Website visitors and enquirers | What you type into our forms (for example name, phone, email, the address of a property for a value estimate, and your message); technical information our hosting and analytics providers process when you visit (section 11) |
| Job applicants | CV, qualifications, references, ID, PPRA registration or candidate status, and interview notes |
| Suppliers and contractors | Name, contact details, business details, bank details and invoices |
3.1 We do not collect information about your race, religion, health, sex life, political views or trade-union membership, and we do not need it. Please do not send it.
3.2 Criminal and sanctions checks. FICA requires us to check clients against the United Nations sanctions lists and to ask whether they are prominent public persons. Where a check shows information about alleged criminal behaviour, we keep it only because the law requires it ⚖.
3.3 Children. We record only the number and ages of children who will live in a rented home, to make sure the property suits the household. We do not collect children’s names or documents unless a parent or guardian gives them to us for a specific reason.
4 Where we get it
4.1 Mostly from you, in forms, documents, meetings, calls, WhatsApp and email.
4.2 From others, where needed and lawful:
- a registered credit bureau, such as TPN (with your consent)
- your current and previous landlord, your employer and the referees you name
- Home Affairs, CIPC and deeds office records, and electronic identity-verification services
- sanctions lists and public internet and news searches (FICA)
- the other party’s property practitioner, the conveyancer or the bond originator
- PayProp (payment records for managed rentals)
- the person who referred you to us
5 Why we use it, and on what lawful basis
POPIA (section 11) allows processing only on a lawful basis. These are ours:
| Purpose | Lawful basis |
|---|---|
| Marketing and letting or selling a property under a mandate; finding and assessing tenants and buyers; preparing leases and offers; inspections; arranging transfer with the conveyancer | Contract: needed to carry out the mandate, lease or offer you are party to, or to take steps you asked for |
| Identifying clients, checking sanctions and prominent-person lists, keeping FICA records, reporting to the Financial Intelligence Centre | Legal obligation: Financial Intelligence Centre Act 38 of 2001 (FICA) |
| Keeping mandates, agreements, disclosure forms and communications for five years; answering PPRA inspections | Legal obligation: Property Practitioners Act 22 of 2019 (PPA) and its Regulations |
| Issuing tax invoices; keeping accounting records | Legal obligation: tax and company law |
| Getting your credit report and contacting references | Your consent, given separately on the application or mandate |
| Sending you news, market reports and property offers | Your consent, given separately. Never assumed |
| Assessing a tenant’s ability to pay for the landlord; protecting a deal from fraud (for example confirming bank details by phone); defending or bringing a legal claim | Legitimate interests of the landlord, the seller or us, balanced against yours. You may object (section 15) |
| Answering an enquiry or a value-estimate request from our website | Your request (steps before a contract), and our legitimate interest in replying |
| Considering a job application | Steps before a contract at your request |
6 Do you have to give it?
6.1 FICA information is compulsory. We do full client due diligence on both sides of every deal: landlords, tenants (including individual tenants), sellers and buyers, using our Client Due Diligence forms ⚖. FICA requires us to identify and verify you. If you do not give us what FICA needs, we cannot act for you, and we may have to end an existing relationship.
6.2 Everything else is voluntary, but some of it is needed for the service. For example, without proof of income and a credit check we cannot recommend a tenant to a landlord, and without bank details a landlord cannot be paid.
6.3 Marketing consent is always optional. Saying no has no effect on any service.
7 Laws that require or allow us to collect
- Financial Intelligence Centre Act 38 of 2001: client identification, beneficial ownership, sanctions screening, record-keeping and reporting
- Property Practitioners Act 22 of 2019 and Regulations, 2022: mandates, mandatory disclosure, and keeping records, including electronic communications, for five years
- Rental Housing Act 50 of 1999: leases, receipts, inspections and deposits
- Tax Administration Act 28 of 2011, and the Companies Act 71 of 2008: our own financial records
- National Credit Act 34 of 2005: credit reports for lease applications ⚖
8 Who we share it with
We share only what each person needs for the job.
| Recipient | What and why |
|---|---|
| The landlord or seller we act for | Applicants’ or buyers’ details, our assessment, and the documents needed to decide |
| Tenants and buyers | The landlord’s or seller’s name and contact details where the deal requires it |
| PayProp (managed rentals only) | Lease, landlord and tenant details, so rent can be collected and paid out |
| A registered credit bureau (such as TPN) | Applicant identity details, to obtain the credit report |
| Conveyancers and bond originators | Seller and buyer details and the signed sale agreement, so that transfer and bond applications can go ahead. You choose your own conveyancer and bond originator; we do not tie you to one |
| Other property practitioners | Where another agency shares a sale or letting with us |
| Contractors (Full care rentals) | The tenant’s name and number, to arrange access for repairs |
| Regulators and authorities | The PPRA, the Financial Intelligence Centre, SARS, the Information Regulator, the Rental Housing Tribunal, courts and the police, only where the law requires it |
| Our operators | Cloud, email, website and software providers who store or process information for us (section 9) |
| Our attorney or auditor | Where needed for advice, a dispute or an independent review |
We never sell personal information, and we never give it to anyone for their own marketing.
9 Service providers who process information for us (operators)
9.1 We use a small number of operators. Each must keep your information confidential and secure under a written agreement (POPIA section 21; our A07).
9.2 PayProp is a registered payment processing agent (PPA reg 2.4) that holds rent and deposits in its own trust account; McBeth Kings never receives them. PayProp may be an independent responsible party for the information it processes, rather than our operator ⚖ to confirm. Either way, a written agreement that protects your information is required before PayProp is used.
9.3 Our current operators are:
| Operator | What they do | Where the data may be stored |
|---|---|---|
| Microsoft (OneDrive) | File storage | data location to confirm |
| Our web host (cPanel reseller hosting, rs63.cphost.co.za) | Email for [email protected] | South Africa (Johannesburg data centre, confirmed 5 Oct 2026) |
| Meta (WhatsApp Business) | Messaging with clients | Outside South Africa |
| Cloudflare | Website hosting, security and anonymous web analytics | Global network, mainly the USA |
| n8n server host (our own automation server at automate.mcbethkings.com, behind Cloudflare) | Receives website form submissions and routes them to us | host and server location to confirm |
| PayProp | Rent collection and payouts (managed rentals) | South Africa |
| Credit bureau (not yet chosen; TPN is the local default) | Credit and tenant checks | South Africa |
| CRM or contact system, if one is adopted | Contacts and enquiries |
We do not use an electronic-signature service. Our agreements are signed in ink.
10 Sending information outside South Africa
10.1 Some of our providers store data on servers outside South Africa, for example in the European Union or the United States. POPIA (section 72) allows this only where:
- the recipient is bound by law, binding company rules or an agreement that gives protection substantially similar to POPIA, or
- you consent, or
- the transfer is needed for a contract with you or in your interest.
10.2 We choose providers whose contracts give that protection, and we check them against our A07 checklist. The countries involved are listed in section 9.
11 Our website
11.1 Forms. When you use a form on mcbethkings.com, such as the property value lookup, what you type is sent securely to our own automation server (automate.mcbethkings.com) and passed to Sipho by email or message. We use it only to answer you. It is not added to a marketing list unless you tick the separate marketing box.
11.2 Analytics. We use Cloudflare Web Analytics to count visits and see which pages are useful. It does not use cookies and does not build a profile of you. Cloudflare processes your IP address briefly to deliver and protect the site .
11.3 Cookies. Our site does not set advertising or tracking cookies . If that changes, we will ask first.
11.4 Links. Property portals and social media sites we link to have their own privacy notices.
12 WhatsApp, email and phone
12.1 Many clients prefer WhatsApp, and we use it. Messages and documents sent to us form part of your file and are kept for five years, as the PPA requires.
12.2 Protect yourself from fraud. We will never ask you by WhatsApp or email to pay any deposit, rent or purchase money to McBeth Kings, or to pay into a new bank account. If anyone does, phone 064 048 0426 before you pay.
12.3 Where possible, send ID copies and bank statements by email or upload link rather than WhatsApp, and delete them from your own phone afterwards.
13 Marketing
13.1 We send news, market reports and property offers only if you opt in, by ticking a box that is never pre-ticked (form A06, or the marketing box on our mandates and applications). You choose the channel: email, WhatsApp, SMS or phone.
13.2 If you have never dealt with us, we may ask you for consent once only. If you say no, we will not ask again.
13.3 Every marketing message tells you how to stop it. Reply STOP, or email [email protected], and we stop within 5 business days. Withdrawing consent costs nothing.
14 Decisions about you
14.1 We do not make decisions about you by computer alone. A credit score is one input; Sipho reviews every application and the landlord decides.
14.2 If a landlord declines your application because of your credit record, you may ask which credit bureau we used, so that you can check and correct your record.
15 Your rights
You have the right to:
| Right | How |
|---|---|
| Know whether we hold information about you, free of charge | Email or phone the Information Officer |
| Get a copy of it, and the names of those who have had it | Ask the Information Officer. A copy of a record may carry the prescribed fee, which we tell you beforehand. Our PAIA Manual (A09, at mcbethkings.com/legal/paia) explains the process |
| Correct or delete information that is wrong, out of date, incomplete, misleading or unlawfully held | Ask in writing. POPIA Form 2 may be used ⚖ |
| Object to processing based on legitimate interests | Ask in writing. POPIA Form 1 may be used ⚖ |
| Withdraw consent at any time | Tell us by any channel. It does not affect what was done before |
| Stop marketing at any time | Reply STOP, or tell us |
| Not be subject to automated decisions | See section 14 |
| Complain to the Information Regulator | Section 19 |
15.1 We reply within 30 days. We confirm your identity before releasing anything.
15.2 Limits. We cannot delete records the law makes us keep (FICA and PPA records for five years), and we may refuse access where PAIA allows, for example to protect someone else’s privacy. In that case we tell you why.
16 How long we keep it
16.1 We keep information only as long as we need it or the law requires. The main periods are:
| Record | Period |
|---|---|
| Mandates, leases, sale agreements, disclosure forms, inspection reports and photos, and related emails and WhatsApp messages | 5 years (Property Practitioners Act) |
| FICA identification and verification records | 5 years after the business relationship ends, or after a once-off transaction |
| Our accounting and tax records | 5 to 7 years (tax and company law) |
| Applications from tenants who were not placed | 12 months, unless FICA requires longer |
| Website enquiries that did not lead to business | 24 months |
| Marketing consent records | While you receive marketing, and 3 years after you opt out |
16.2 Our full Records Retention Schedule is available on request. At the end of the period we shred paper and permanently delete electronic records.
17 How we protect it
17.1 We protect personal information with reasonable technical and practical measures (POPIA section 19), including:
- encrypted, password-locked devices
- two-step login on every account
- access limited to the principal
- locked storage for paper
- secure shredding
- written agreements with operators
17.2 Our internal procedure is A08.
17.3 If a breach happens. If we believe someone has accessed your information without permission, we will tell the Information Regulator and you as soon as reasonably possible. We will explain what happened and what you can do to protect yourself.
18 Information Officer
| Name | Sipho E. Mahayi, Principal |
| [email protected] | |
| Phone | 064 048 0426 |
| Office | 9 Tom Van Aardt, Aqua Park, Tzaneen, Limpopo, 0850 (weekdays 08:00–17:00) |
19 The Information Regulator
You may complain to the Information Regulator at any time, though we would like the chance to put things right first.
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Phone | 010 023 5200 · Toll-free 0800 017 160 |
| POPIA complaints | [email protected] |
| General enquiries | [email protected] |
| Website | inforegulator.org.za |
20 Changes to this notice
We review this notice at least once a year. The current version is always at mcbethkings.com/legal/privacy, with its effective date at the top. If a change affects how we use information you have already given us, we will tell you.