Privacy Policy

1. Who We Are

Estavo (Pty) Ltd (Registration No. Registration pending - CIPC registration in progress) ("Estavo", "we", "us", "our") is a South African company that develops and operates the Estavo Estate Operating System — a software platform for residential gated communities and their managing agents.

We are in the process of registering with the Information Regulator of South Africa as required under the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Scope of This Policy

This policy applies to:

• Residents and occupants of estates using the Estavo platform
• Visitors and guests accessing estates via Estavo guest codes
• Estate managers, trustees, and staff using Estavo's management tools
• Visitors to estavo.co.za and all Estavo subdomains

3. Personal Information We Collect

4. Driver's Licence Scanning

Estavo uses barKoder technology to scan and decode driver's licences at estate gates. We wish to be transparent about how this works:

• The scan extracts the identity data encoded in the driver's licence barcode (name, ID number, licence categories).
• This data is used to verify identity at the point of entry.
• Raw scan data is not retained beyond the verification event — only the extracted identity record is stored, linked to the access log.
• This processing is conducted on the lawful basis of legitimate interest (estate security) and, where required, with the resident's or visitor's informed consent.

5. Why We Process Personal Information

We do not sell personal information. We do not use personal information for advertising.

6. Third Parties We Share Information With

We work with trusted third-party processors to run the Platform. All partners are bound by compliance agreements equivalent to POPIA standards:

We do not share personal information with any other third party without your consent, except where required by law or court order.

7. Data Retention

8. Your Rights as a Data Subject

Under POPIA, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention obligations)
• Objection: Object to processing of your personal information in certain circumstances
• Complaint: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact: privacy@estavo.co.za. We will respond within 30 days of receipt of your request.

9. Security

Estavo implements the following technical and organisational safeguards:

• All data in transit is encrypted using TLS
• All data at rest is encrypted in Supabase (EU West Frankfurt)
• Row-level security (RLS) policies ensure estate data is isolated — no estate can access another estate's data
• Access to production systems is restricted to authorised personnel only
• No service role keys are exposed client-side

In the event of a data breach that may cause harm to data subjects, we will notify the Information Regulator and affected individuals as required by POPIA Section 22.

10. Cookies and Tracking

The Estavo web platform uses:

• Essential cookies: Required for session management and authentication. Cannot be disabled without breaking the platform.
• No advertising or tracking cookies.

The Estavo mobile app does not use cookies.

11. Children

Estavo does not knowingly collect personal information from persons under the age of 18 without the consent of a competent person (parent or guardian) as defined in POPIA. If you believe a minor's information has been submitted without proper consent, contact privacy@estavo.co.za immediately.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be notified to estate managers via the platform and via email. The updated effective date will appear at the top of this document.