Legal
Data Processing Agreement
How Landlodz processes personal and land-use application data under the Protection of Personal Information Act 4 of 2013 (POPIA). For a complete description of what we collect and why, see our Privacy Policy.
Last updated: July 2026
Responsible Party & Operators
Landlodz is the Responsible Party
Under POPIA, Landlodz (Pty) Ltd is the Responsible Party (data controller) for personal information you provide through the Platform. Landlodz decides the purpose of the processing (preparing and lodging your SPLUMA land use application) and the means of processing (the workflow, the planner assignment, the document pack). You are the data subject.
Operators (Sub-processors)
Landlodz uses third-party Operators (POPIA sub-processors) to deliver the service. Operators may only process your data on Landlodz's documented instructions and are contractually bound to confidentiality, security and POPIA-equivalent safeguards.
Current Operators
The Operators below process personal information on Landlodz's behalf. Where an Operator is outside South Africa, transfers are made under adequate safeguards (Standard Contractual Clauses or equivalent).
Google Maps & Places - Address lookup
- Data shared: address search queries you type into the property picker
- Data received: geocoded coordinates, formatted addresses, place details
- Cross-border transfer under Google's Standard Contractual Clauses
First National Bank (FNB) - Invoice settlement
- Data shared: payer name, invoice reference and amount, as reflected on the Landlodz bank statement
- Landlodz invoices clients directly and is paid by EFT; no card details are ever collected, seen or stored by Landlodz
- South Africa-based; retention aligned with financial record-keeping obligations
Supabase - Application database & storage
- Data stored: user profile, application intake responses, uploaded documents, planner correspondence
- Encryption in transit and at rest; row-level security enforced per user
Brevo - Transactional email
- Data shared: recipient email and the contents of transactional messages we send you
- Cross-border transfer under Standard Contractual Clauses
Meta Platforms (WhatsApp Business Cloud API) - Client messaging
- Data shared: your WhatsApp number, your name, message content and any images or documents attached to a message
- Purpose: two-way messaging between you and your assigned planner from the Landlodz business number, including delivery and read status
- Cross-border transfer to Meta Platforms Ireland Ltd / WhatsApp LLC under Standard Contractual Clauses
- Optional channel - tell your planner if you prefer email or phone only
Google Analytics 4 - Website statistics (opt-in only)
- Data shared: pages visited, approximate location, device and browser details, with IP addresses anonymised
- Loaded only after you allow Analytics cookies, and never when your browser sends a Global Privacy Control or Do Not Track signal
- Never receives your name, contact details or application content
- Cross-border transfer to Google LLC (United States) under Standard Contractual Clauses
Hosting and content delivery infrastructure
- Data processed: network requests to landlodz.com, including IP address and browser details, for secure delivery and abuse prevention
- Encrypted in transit; no application documents are stored by the delivery layer
- Cross-border transfer under Standard Contractual Clauses
Automated drafting and summarisation tools
- Purpose: drafting assistance for client and municipal communications - used by Landlodz staff to help prepare correspondence, which a human then reviews and sends personally
- Data shared: contact details and application / property information needed for that specific communication - never ID numbers, payment details or passwords
- No decision affecting your legal position is taken by an automated system - a registered planner reviews and personally sends every communication and document
Data Subject Rights
Legal Basis for Processing
- Contract: planner intake, drafting, review and municipal lodgement of your application
- Legal obligation: financial record-keeping and regulatory compliance
- Consent: product updates and marketing communications
- Legitimate interest: security monitoring and fraud prevention
How to Exercise Your Rights
- Email: consult@landlodz.com (Information Officer: Reabetswe Qametsi)
- We respond within 30 days as required by POPIA
- Unresolved complaints can be escalated to the Information Regulator
Data Retention
Retention periods are set out in section 7 of our Privacy Policy. In short: active account data is kept for the duration of the relationship plus 5 years for planning record-keeping, financial records are kept for the period required by tax law, and diagnostic logs are kept for up to 12 months.
Data Breach Notification
Immediate Response (0-24 hours)
- Contain and assess the incident
- Document what happened, what data was affected and who is at risk
Regulatory Notification
- Notify the Information Regulator as soon as reasonably possible after discovery (POPIA section 22)
- Notify affected data subjects directly where there is a risk to their rights
- Set out the remedial measures we are taking