# Privacy Statement URL: https://www.leasesurance.co/privacy Title: Privacy Statement: POPIA Notice for Website Visitors | LeaseSurance Summary: How LeaseSurance collects, uses, shares and protects personal information submitted through this website, our cookie position, and your rights under POPIA. --- Legal How we handle personal information collected through this website, in accordance with POPIA (Protection of Personal Information Act). **Effective date:** 1 September 2026 **Last updated:** 1 September 2026 ## 1. Purpose and scope of this statement {#clause-1-heading} This statement explains how LeaseSurance collects, uses, shares and protects personal information when you visit or interact with our website at leasesurance.co (the **Website**). It is our notification to you in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (**POPIA (Protection of Personal Information Act)**). **This statement covers the Website only.** It does not cover: - personal information processed in the course of operating a lease insurance programme, including landlord, property manager and tenant information, credit and affordability assessments, policy administration, claims and recoveries; - personal information processed through the LeaseHub™ platform. Those activities are governed by separate privacy notices and by the terms of the relevant programme agreement and policy documents. Please ask us if you would like a copy of the applicable notice. ## 2. Who is responsible for your information {#clause-2-heading} **The LeaseSurance Agent (Pty) Ltd** (registration number **2020/763628/07**), trading as LeaseSurance, is the responsible party for the personal information described in this statement. | Registered address | 46 2nd Avenue, Linden, Johannesburg, 2195 | | --- | --- | | Email | paul@leasesurance.co | | Telephone | +27 82 875 9154 | | Information Officer | Paul Schaefer | | Information Officer email | paul@leasesurance.co | LeaseSurance is an authorised financial services provider, FSP (Financial Services Provider) **55633**. With effect from 1 September 2026 LeaseSurance is appointed by Guardrisk Insurance Company Limited as binder holder and non-mandated intermediary under a binder agreement. Our Information Officer is registered with the Information Regulator (South Africa) and is responsible for our compliance with POPIA (Protection of Personal Information Act) and for handling requests and complaints relating to personal information. ## 3. What we collect {#clause-3-heading} ### 3.1 Information you give us {#clause-3-1-heading} When you complete the enquiry form on the Website, we collect: - first name and last name - email address - telephone number (optional) - company name - the content of your message If you email us, call the number published on the Website, or connect with us in response to something you read on it, we collect the information contained in that correspondence and any contact details you give us. We do not ask for and do not want identity numbers, banking details, credit information, health information or any other special personal information through the Website. Please do not send them to us through the enquiry form. ### 3.2 Information collected automatically {#clause-3-2-heading} Our web hosting infrastructure records standard technical information each time a page is requested. This ordinarily includes your IP (Internet Protocol) address, the date and time of the request, the pages requested, HTTP (Hypertext Transfer Protocol) status codes, referring page, and your browser type, version and operating system. These records are generated for security, fault diagnosis and infrastructure integrity, and are kept in server logs. We do not use them to build a profile of you or to target advertising at you. ### 3.3 Cookies and tracking {#cookies} **We do not currently use analytics, advertising or social media tracking cookies on the Website.** There is no Google Analytics tag, no advertising pixel and no third-party tracking script. The Website may set strictly necessary cookies where these are required for it to function or to remain secure, for example to maintain session integrity or to record a preference. Strictly necessary cookies do not require your consent. The Website loads the Inter and Outfit typefaces from Google Fonts. This means Google receives your IP address and browser information in order to serve the font files. It does not set a cookie for this purpose. Most browsers allow you to block or delete cookies through their settings. Blocking strictly necessary cookies may affect how parts of the Website work. **If this changes.** Should we introduce analytics or marketing tracking in future, we will update this statement and, where the law requires consent, we will ask for it through a cookie banner before those cookies are set. ### 3.4 Children {#clause-3-4-heading} The Website is directed at property professionals, landlords and institutional investors. We do not knowingly collect the personal information of children through it. If you believe a child has submitted information to us, contact our Information Officer and we will delete it. ## 4. Why we process your information, and on what legal basis {#clause-4-heading} We process personal information collected through the Website for the following purposes. In each case we rely on one or more of the lawful bases in section 11 of POPIA (Protection of Personal Information Act). | Purpose | Lawful basis | | --- | --- | | Responding to your enquiry and corresponding with you about it | Necessary to take steps at your request with a view to concluding a contract, and our legitimate interest in responding to business enquiries | | Providing information about our products, arranging a meeting or preparing an indicative proposal | Steps at your request; legitimate interest | | Keeping a record of enquiries and our responses, including for audit, compliance and dispute purposes | Compliance with our obligations as a licensed financial services provider; legitimate interest | | Maintaining the security, integrity and availability of the Website and investigating misuse | Legitimate interest; compliance with legal obligations | | Improving the Website and understanding, at an aggregate level, how it is used | Legitimate interest | | Sending you commercial communications about our products | Your consent, or the direct marketing exemption in section 69(3) of POPIA where you are an existing customer. See section 7 | We do not use the information you submit through the Website to make any automated decision about you, and no profiling takes place on the Website. ## 5. Providing your information is voluntary {#clause-5-heading} You are not obliged to submit anything through the Website. The fields marked as required on the enquiry form are the minimum we need in order to identify you and respond sensibly. If you do not provide them we will not be able to respond to your enquiry. Everything else is optional, and there is no consequence to leaving it out. ## 6. Who we share your information with {#clause-6-heading} We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We share the information described in this statement only as follows: **Our operators.** Third parties that process personal information on our behalf, under a written contract requiring them to maintain confidentiality and appropriate security safeguards, and to process the information only on our instruction. For the Website these are our web hosting provider, our email and business productivity provider, and our customer relationship management provider where an enquiry is recorded in it. **Our insurance partner and other professional parties.** Where your enquiry requires it, we may share your contact details and the substance of your enquiry with Guardrisk Insurance Company Limited, with Guardrisk Alternative Partner Solutions (Pty) Ltd, or with our professional advisers, each of whom is bound by their own confidentiality and data protection obligations. **Within our group.** With group and affiliated companies where necessary for the purposes set out above. **Where the law requires or permits it.** With regulators including the Financial Sector Conduct Authority and the Information Regulator, with law enforcement, or with a court, where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend a legal right. **On a corporate transaction.** With a prospective purchaser, investor or their advisers in connection with a sale, merger, restructure or funding transaction, subject to confidentiality undertakings. ## 7. Marketing communications {#clause-7-heading} If you have submitted an enquiry, we may contact you about the products and services you enquired about. We will only send you unsolicited electronic marketing where you have consented to receive it, or where section 69(3) of POPIA (Protection of Personal Information Act) permits it because you are an existing customer and the marketing relates to similar products. Every marketing email we send will include a working unsubscribe mechanism. You may also object at any time by emailing our Information Officer, and we will stop. Withdrawing consent for marketing does not affect our ability to correspond with you about a live enquiry or an existing programme. ## 8. Cross-border transfers {#clause-8-heading} Some of our operators, in particular cloud hosting, email and CRM (Customer Relationship Management) providers, process or store information on servers located outside South Africa. Where personal information is transferred outside the Republic, we do so in accordance with section 72 of POPIA (Protection of Personal Information Act), on one or more of the following bases: the recipient is subject to a law, binding corporate rules or a binding agreement that gives effect to principles for the lawful processing of personal information substantially similar to POPIA; the transfer is necessary for the performance of a contract with you or at your request; or you have consented. We will tell you the countries involved and the safeguards applied on request. ## 9. How long we keep it {#clause-9-heading} We keep enquiry correspondence for as long as necessary for the purpose for which it was collected, and thereafter for as long as the law requires or permits. - **Enquiries that do not lead to a relationship:** retained for up to 36 months from our last contact with you, then deleted or de-identified. - **Enquiries that lead to a programme or contract:** retained for the duration of the relationship and for a minimum of five years from its termination, in line with the record-keeping obligations that apply to us under FAIS (Financial Advisory and Intermediary Services Act 37 of 2002), the Insurance Act 18 of 2017 and the Financial Intelligence Centre Act 38 of 2001. - **Server logs:** retained for up to 12 months for security and diagnostic purposes. Where information must be retained for a legal or regulatory reason, we restrict access to it and use it only for that reason. ## 10. Security {#clause-10-heading} We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing, as required by section 19 of POPIA (Protection of Personal Information Act). These include encryption of data in transit to and from the Website, access controls on a least-privilege basis, authentication controls on our email and business systems, contractual security obligations on our operators, and periodic review of those measures. No transmission over the internet can be guaranteed as completely secure. If a security compromise affects your personal information and there are reasonable grounds to believe it has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as required by section 22 of POPIA. ## 11. Your rights {#clause-11-heading} Subject to POPIA (Protection of Personal Information Act) and to any conditions or exemptions in it, you have the right to: - **be told** whether we hold personal information about you, and to request a record or description of it, together with the identity of any third party who has had access to it (sections 23 and 24). A request for access must be made on the prescribed form and we may charge the prescribed fee; - **have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained information corrected or deleted**, and to request deletion of information we are no longer authorised to retain (section 24); - **object** to processing on the grounds set out in section 11(3), by submitting the prescribed form; - **withdraw consent** where our processing relies on your consent, without affecting the lawfulness of processing carried out before withdrawal; - **opt out of direct marketing** at any time (section 69); - **not be subject** to a decision based solely on automated processing intended to profile you (section 71); - **complain** to the Information Regulator; and - **institute civil proceedings** in respect of an alleged interference with the protection of your personal information (section 99). To exercise any of these rights, contact our Information Officer at **paul@leasesurance.co**. We will respond within the period prescribed by POPIA. We may need to verify your identity before acting on a request. The prescribed POPIA forms are available from the Information Regulator's website. ## 12. Complaints to the Information Regulator {#clause-12-heading} If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with: **The Information Regulator (South Africa)** JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 PO Box 31533, Braamfontein, Johannesburg, 2017 General enquiries: enquiries@inforegulator.org.za POPIA complaints: POPIAComplaints@inforegulator.org.za Website: inforegulator.org.za ## 13. Access to information under PAIA {#clause-13-heading} Requests for access to records held by LeaseSurance may also be made under the Promotion of Access to Information Act 2 of 2000. Our PAIA (Promotion of Access to Information Act 2 of 2000) manual is available on request from our Information Officer. ## 14. Changes to this statement {#clause-14-heading} We may update this statement to reflect changes in our practices, our technology or the law. The current version is always the one published on the Website, and the date at the top tells you when it last changed. Where a change materially affects how we process your personal information, we will take reasonable steps to bring it to your attention. © 2026 The LeaseSurance Agent (Pty) Ltd t/a LeaseSurance. All rights reserved.An authorised financial services provider, FSP 55633, and binder holder for Guardrisk Insurance Company Limited (FSP 75).