1. Introduction and Scope
VaalResList operates a student accommodation platform dedicated to helping Vaal University of Technology (VUT) students browse, compare, and apply for private accredited student housing. In doing so, we collect and process personal information.
We respect your constitutional right to privacy and are committed to processing your personal data lawfully, transparently, and securely in full compliance with South Africa's Protection of Personal Information Act No. 4 of 2013 (POPIA). This policy details the types of data we collect, why we need it, who can access it, and your legal rights as a data subject.
2. Personal Information We Collect
We only collect personal information that is strictly necessary for matching students with private accommodations and processing room applications:
Student Applicants
- Full legal name and surname
- South African ID number or foreign passport number
- VUT student registration number
- Email address and mobile contact telephone number
- Gender, year of study, and expected move in month
- Funding source (NSFAS, private bursary, or self funded)
- Bursary provider name where applicable
Accommodation Managers
- Manager legal name and designated business email
- Direct contact phone number
- Associated residence property name and room listings
- Encrypted account credentials (salted PBKDF2 hash)
3. Zero Fee Guarantee (We Never Take Money from Students)
To protect students against fraud, deceptive fees, and unauthorized financial demands, our zero fee policy is absolute:
- No Application or Placement Fees: You will never be asked to pay an application fee, viewing fee, reservation charge, or placement fee to use VaalResList, submit applications, or create an account.
- No Collection of Banking Details: VaalResList does not collect, store, or process student credit card details, debit card numbers, bank account numbers, or internet banking passwords.
- Direct Housing Transactions Only: Any accommodation rental fees, deposits, or NSFAS and bursary allowance disbursements are settled directly between the student (or the student's funding scheme) and the accredited residence management, never through VaalResList.
- Fraud and Impersonation Warning: If anyone contacts you claiming to represent VaalResList and demands money, e-Wallet transfers, cash, or card details to secure a room, do not pay them. Please report any such incident immediately to our Information Officer at privacy@vaalreslist.co.za.
4. Purpose and Legal Basis for Processing
We process your personal information based on your explicit consent and for the performance of our accommodation service:
5. Access Controls and Tenant Isolation
We enforce strict tenant boundaries and cryptographic protection to prevent unauthorized data exposure:
- Row Level Tenant Filtering: Residence managers can only view applicant records submitted specifically for their assigned residence. No manager can see applications or student details belonging to other residences.
- Sensitive Identification Redaction: South African ID numbers and account passwords are never included in email notifications, application receipts, or client console logs.
- Salted PBKDF2 Password Protection: Account passwords are protected using industry standard PBKDF2 hashing with unique random salts. Neither administrators nor staff can view your plaintext password.
6. Cross Border Data Transfer (POPIA Section 72)
Our backend database and cloud services are hosted in enterprise data centers located within the European Union (Ireland region) and South Africa, using Convex Cloud and Vercel infrastructure.
In compliance with Section 72 of POPIA, transfers to these facilities are protected by binding agreements, encryption in transit (TLS 1.3) and at rest (AES 256), and regulatory regimes (such as the EU General Data Protection Regulation) that provide an equivalent or higher level of personal information protection as POPIA.
7. Data Retention and Deletion
We retain your student application records only for as long as is necessary to fulfill the application, bed allocation, and annual audit cycle of the relevant academic year.
You may request the deletion or anonymization of your application history and account by contacting our Information Officer. When an account is removed, personal contact details and identification numbers are wiped permanently.
8. Your Legal Rights as a Data Subject
Under POPIA, you have the right to:
9. Contact Our Information Officer
If you have questions regarding this Privacy Policy, wish to exercise any of your POPIA rights, or have questions about how your student details are handled, please contact our designated Information Officer:
VaalResList Information Officer
Email: privacy@vaalreslist.co.za
Physical Address: Vanderbijlpark, Gauteng, South Africa
Platform Support: Available Monday to Friday (08:00 to 17:00 SAST)
You also have the right to lodge a formal complaint with the South African Information Regulator if you believe your personal information has been handled in violation of POPIA.