Clear privacy roles for Devv and every agency.

An agency normally determines the purpose and means of processing the property, client, tenant, landlord, applicant, and staff information it places in PropOS. The agency is therefore generally the responsible party for that information, while Devv acts as its operator to provide and support the platform.

Devv is a responsible party for limited information it uses for its own legitimate business purposes, such as account administration, subscriptions, security, support, and direct customer communications. A signed service agreement or data-processing schedule may provide more specific instructions and will prevail where applicable.

• Process agency information to provide, maintain, secure, support, and administer PropOS, or as otherwise lawfully instructed.
• Use reasonable safeguards appropriate to the nature of the information and the risks involved.
• Limit supplier access to what is needed to provide contracted infrastructure or support.
• Assist agencies reasonably with data-subject requests, incidents, and lawful export or deletion instructions.
• Not sell, rent, or commercially exploit identifiable agency data.

• Identify and document a lawful purpose and lawful basis before collecting information.
• Give appropriate privacy notices and obtain consent where consent is the proper basis.
• Keep records accurate, relevant, and limited to what is necessary.
• Invite only authorized users, assign appropriate roles, review access, and protect credentials.
• Respond to data-subject requests and determine whether a legal retention duty prevents deletion.
• Maintain its own PAIA manual, Information Officer arrangements, policies, and regulatory registrations where required.

POPIA requires records not to be kept longer than authorized or necessary, but other law can require retention. Section 55 of the Property Practitioners Act 22 of 2019 requires a property practitioner to retain specified records—including certain agreements, mandates, disclosure forms, lease-related documents, and marketing material—for five years.

PropOS therefore does not publish a blanket schedule that pretends every record has the same legal period. Each agency must apply the period relevant to the record, purpose, dispute, legal hold, and regulatory duty. When retention ends, deletion or de-identification should be used where appropriate and technically available.

If your information was collected by a PropOS agency, contact that agency first because it normally controls the record. You may also email legal@teamthink.co.za. We will verify the request, identify the responsible party, and respond or assist as required.

POPIA rights and procedures are subject to lawful grounds, exceptions, identity checks, and prescribed forms. A person may also complain to South Africa's Information Regulator using the contact channels and forms published on its official website.

Suspected loss, unauthorized access, or disclosure should be reported promptly toSupport@teamthink.co.za. Devv will investigate and cooperate with the responsible party so that notifications can be made where POPIA requires them. Some infrastructure providers may process information outside South Africa; Devv takes reasonable steps to use a transfer basis permitted by POPIA.

Read this page with the Privacy Policy, Security page, Terms of Service, and the agency's signed service agreement. This is a transparency statement, not legal advice or a claim that use of PropOS automatically satisfies every agency obligation. Last updated: 13 August 2026.