How PropOS handles personal information.

Devv PropOS is an agency operations platform provided by TeamThink Solutions (Pty) Ltd, trading as Devv Technology ("Devv", "we", "us" or "our"). This policy applies to the PropOS website, platform, support channels, pilot access process, and related services.

For information an agency enters about its clients, tenants, landlords, applicants, employees, contractors, and other contacts, the agency will ordinarily decide why and how that information is used. In that context, the agency is generally the responsible party and Devv acts as its operator. Devv may be the responsible party for account, billing, security, support, and direct business-relationship information that we process for our own purposes. The exact allocation may depend on the circumstances and any signed service agreement.

• Account and team information, such as names, email addresses, roles, agencies, branches, and invitation status.
• Agency records, including contacts, properties, leads, mandates, viewings, offers, leases, inspections, tasks, events, notices, maintenance records, and reports.
• Uploaded content, which may include agreements, identity or address evidence, compliance documents, photographs, signatures, and other property-related records.
• Commercial and support information, such as plan details, invoices, enquiries, support messages, and service correspondence.
• Technical and security information, such as timestamps, device or browser details, IP-derived request information, authentication events, and recorded actions where available.

We receive information from users and their agencies, from people who contact us, from connected services where an authorized integration is enabled, and automatically when the service is used. Agencies must avoid uploading information that is not reasonably necessary for a legitimate property or business purpose.

We process information where necessary to:

• provide, administer, secure, support, and improve PropOS;
• authenticate users and enforce agency, branch, role, and assignment controls;
• run agency workflows, notifications, document access, reporting, and audit features;
• manage subscriptions, service requests, and our customer relationship;
• detect misuse, investigate incidents, enforce agreements, and comply with law; and
• produce aggregated or de-identified operational insights that do not identify a person or agency.

The lawful basis will depend on the context and may include performance of a contract, compliance with a legal obligation, consent, or a legitimate interest that does not unjustifiably prejudice the data subject. We do not sell or rent personal information.

Information may be shared with authorized users of the relevant agency; suppliers that provide hosting, database, authentication, storage, email, monitoring, or support services; professional advisers; regulators or law-enforcement bodies where legally required; and a successor in a lawful business reorganization. Suppliers may only use information to provide their contracted service and must be subject to appropriate confidentiality and data-protection obligations.

Some suppliers may process information outside South Africa. Where this occurs, we take reasonable steps to use a transfer mechanism permitted by POPIA, including contractual protections or a recipient subject to substantially similar protection.

We retain information only for as long as reasonably needed for the purpose for which it was collected, a customer's documented instructions, dispute resolution, security, and applicable legal or regulatory duties. South African property practitioners may have statutory duties to retain specified property and transaction documents, including the five-year requirements in section 55 of the Property Practitioners Act 22 of 2019.

Retention therefore varies by record and agency. We do not promise automatic deletion on a fixed date unless that feature or obligation is expressly agreed. Following termination, export, archiving, anonymisation, or deletion is handled in accordance with the applicable service agreement, lawful instructions, technical feasibility, and legal hold requirements.

Subject to POPIA and other applicable law, a data subject may ask whether personal information is held, request access or correction, object to certain processing, withdraw consent where processing relies on consent, or request deletion where retention is no longer authorized. If an agency controls the relevant record, we may refer the request to that agency and assist it as operator.

Send requests to legal@teamthink.co.za. We may need to verify identity and authority before acting. Requests are handled within a reasonable period and in accordance with the timeframes and procedures required by law; some rights are subject to lawful exceptions.

We use reasonable technical and organizational safeguards described on our Security page. No online service can guarantee absolute security. PropOS uses essential technologies required for authentication, session continuity, security, and core platform operation. If optional analytics or marketing technologies are introduced, this policy and any consent controls will be updated before they are used where consent is required.

PropOS does not make solely automated decisions that produce legal or similarly significant effects for data subjects. Workflow statuses, reminders, and reports support human agency decisions; they are not legal, credit, tenant-screening, or professional determinations.

Please raise privacy concerns with us first at legal@teamthink.co.za. You may also lodge a complaint with South Africa's Information Regulator. Its current contact details and prescribed forms are available on the Information Regulator's official website.

We may update this policy when the service, suppliers, or legal requirements change. A material change will be communicated through the service, by email, or by another reasonable channel. Last updated: 13 August 2026.