1. Who We Are — and Who Is Responsible for Your Information

Buurt is a community platform operated by Buurt Solutions (Pty) Ltd. It is used by residential communities ("estates") to manage day-to-day community life.

Under the Protection of Personal Information Act (POPIA), responsibility for your information is shared. Your estate — its body corporate or homeowners' association — is the responsible party for the personal information you provide as a resident: your profile, ID number, vehicle details, unit, messages, bookings, reports and photos. Your estate decides why this information is collected and how it is used; Buurt Solutions processes it as your estate's operator, on its instructions.

Buurt Solutions is the responsible party only for the limited information it processes for its own purposes: billing the estate, platform usage statistics, security logs, and service improvement. In practice this tells you who answers for your information — for your resident data, your estate is accountable, and Buurt acts on its behalf.

2. What Information We Collect

• ✓Name and surname
• ✓Email address and phone number
• ✓Unit/property number and community affiliation
• ✓ID number and vehicle registrations, where your estate requires them at registration (used only for estate administration; not shown to other residents in the app)
• ✓Device push notification token
• ✓Location data (only when submitting maintenance issues or wildlife sightings)
• ✓Photos you choose to share (maintenance issues, community gallery, wildlife sightings, adverts)
• ✓Chat messages within community channels
• ✓Facility booking history and issue reports
• ✓Consent records including timestamp and version

3. Why We Collect It

• →Provide community management services
• →Send relevant community notifications
• →Enable facility booking and maintenance reporting
• →Enable communication between residents and trustees
• →Comply with our legal obligations under POPIA

These purposes are determined by your estate, and we process your information on its instructions. We do not use personal information for marketing, profiling, or any purpose beyond community management and running the platform itself.

4. Who Sees Your Information

• ✓Community trustees and administrators can see resident names, unit numbers, and issue reports
• ✓Other residents can see your name in community chat channels
• ✓We do not sell, rent, or share personal information with any third party

Our technical sub-processors (Supabase for data storage, Expo for push notifications, Vercel for web hosting) process data under their respective data processing agreements, as sub-operators in the chain that begins with your estate.

5. Data Retention

6. Your Rights Under POPIA (Section 5)

7. Security Measures

We implement appropriate technical and organisational measures to protect your personal information, including encrypted data transmission (TLS), role-based access controls, secure cloud infrastructure, and regular security reviews. If a data breach affects your resident information, we will notify your estate without delay and support it in notifying you and the Information Regulator, as POPIA requires of the responsible party. Where a breach concerns information for which Buurt Solutions is itself the responsible party, we will notify you and the Regulator directly.

8. Cross-Border Data Transfers

Your personal information is processed and stored on infrastructure hosted in Dublin, Ireland (European Union) via Supabase running on Amazon Web Services (AWS EU West). This means your data leaves South Africa for storage and processing.

We rely on POPIA Section 72(1)(a) for this transfer: Ireland and the wider European Union are bound by the General Data Protection Regulation (GDPR), which provides a level of personal information protection that is substantially similar to or stronger than POPIA, and the EU is recognised as having "adequate" data protection law for this purpose.

Sub-processor locations:

For US-based sub-processors, we rely on standard contractual clauses and the EU-US Data Privacy Framework where applicable. None of the sub-processors listed above use your data to train AI models or for their own marketing. By creating a Buurt account and continuing to use the service, you consent to these cross-border transfers. If you do not consent, please do not use the service.

9. AI Assistant (Ask Buurt)

The Buurt app includes an AI assistant ("Ask [Estate]") that answers resident questions about your community. When this feature is used, the following information is sent to AI sub-processors:

• →The resident's questions and conversation history
• →Relevant estate data retrieved to answer the question (notices, facility information, estate documents such as house rules and policies)
• →Voice audio (only when the microphone is used), transcribed before further processing

The following information is never sent to AI processors: personal profiles (name, email, phone number, address), other residents' personal information, or any financial information.

Neither Anthropic nor OpenAI use API data to train their models by default. Both operate under standard data processing agreements. The AI can only access data scoped to the resident's specific estate, and for bookings and maintenance issues, only that resident's own records.

10. Cookies & Website Analytics

Our marketing website (buurt.co.za) uses a single, privacy-friendly analytics cookie — and only if you accept it. On your first visit we ask for your consent; if you decline, no analytics runs and no cookie is set. If you accept, we use Google Analytics to understand how the site is used — pages viewed, visit counts and general region — with IP anonymisation enabled. It is never used for advertising and builds no personal profile of you.

You can change your choice at any time using the Cookie preferences link in the website footer. All fonts are self-hosted, so simply loading a page makes no third-party requests.

The Buurt app itself uses no advertising or tracking cookies. This section covers only the public marketing website.