CommunityDesk is software for South African sectional title schemes, homeowners’ associations (HOAs), other community schemes and the managing agents who run them. It is provided by The Growth Box (Pty) Ltd (registration number 2014/113470/07), trading as CommunityDesk, of 25 Ormonde View, Corwen Street, Ormonde Extension 26, Johannesburg, 2091 (“CommunityDesk”, “we”, “us”).

Our Information Officer is our director. You can reach them at enquiry@communitydesk.co.za or 067 861 3549, or by post at the address above.

This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) when you:

• visit communitydesk.co.za or chat with our AI assistant;
• ask for a demo, sign up for news or start a free trial;
• use CommunityDesk as a trustee, managing agent, member of a management team, owner, tenant, resident or supplier of a scheme that uses it;
• correspond with us, or work with us as a supplier or partner.

How we use cookies is explained in our Cookie Policy.

When a scheme (a body corporate, HOA or managing agent) loads its owners, residents, units, levies and other records into CommunityDesk, the scheme is the responsible party for that information and decides why and how it is used. We process it on the scheme’s behalf as its operator (POPIA sections 20 and 21): only to provide the service, on the scheme’s instructions, under appropriate security safeguards, and we tell the scheme without delay if we believe its information has been accessed without authority.

For our own website visitors, enquiries, trial and customer accounts, and our suppliers, we are the responsible party.

If you are an owner, tenant or resident with a question about how your scheme uses your information, please ask your trustees or managing agent first; we will help them answer.

• When you contact us, book a demo or start a trial: your name, email address, phone number, organisation, role, the number of units you manage and what you tell us.
• When you chat with our AI assistant: your messages and, if you choose to leave them, your contact details.
• When you sign up for news: your email address, optional name and organisation, and the consent you gave.
• Visit statistics: only if you allow analytics cookies, a random identifier so we can count visits and see which pages help. We do not link it to your name or email, and we do not store your IP address with it.
• When you use the app: your account details, sign-in and security records (including two-step login settings), your preferences, and an audit log of the actions you take.
• What your scheme records: for example units, owners, tenants and residents, contact details, levies, statements and payments, debit order mandates (which banks require to include an identity number and bank account details), meter readings and photos, maintenance requests, meetings, votes and proxies, documents, supplier details and messages.
• Payments to us: we receive confirmation of payment and invoice details. Card details are captured by the payment provider, not by us.

We do not intentionally collect special personal information (such as health, religion or biometric information) or information about children. If a scheme needs to record a child as a resident, the scheme is responsible for having a lawful basis and the consent of a competent person, and should record no more than is necessary.

We use personal information only for purposes that are lawful and reasonably expected (POPIA sections 11 and 13):

• to provide and run the service you or your scheme signed up for, including support (performing a contract);
• to answer your enquiry and, if you asked us to, to follow up about CommunityDesk (your request, or our legitimate interest in replying);
• to bill for the service and keep accounting records (contract and legal obligations);
• to keep the service secure, detect fraud and misuse, and keep the records the law requires (legal obligations and legitimate interests);
• to understand, in aggregate, how our website and app are used so we can improve them (your consent for analytics cookies; our legitimate interest for in-app usage counts);
• to send news and offers, only with your consent or as allowed for existing customers under POPIA section 69. Every message tells you how to unsubscribe, and unsubscribing is free.

We do not sell personal information, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects (POPIA section 71).

Some features use artificial intelligence (AI) from Anthropic or OpenAI: our website’s AI assistant, help with drafting (for example minutes, notices and website content), and reading meter photos when a scheme turns it on.

• The assistant on our website is an AI, and it says so. You can ask for a person at any time.
• Text sent to an AI provider is used to produce the answer and is processed under agreements that do not allow the provider to use it to train its models.
• AI answers can be wrong. Anything important is confirmed by a person, and drafts are reviewed before they are used.

We share personal information only with service providers (operators) who help us run CommunityDesk, under written agreements that require them to keep it confidential and secure, and only as much as they need:

• hosting and database: Vercel (application hosting) and Supabase (database, in the European Union);
• email: Amazon Web Services (Amazon SES) and Twilio SendGrid;
• SMS, WhatsApp and voice calls: WinSMS, Twilio and Meta (WhatsApp Business), when your scheme uses them;
• online payments and debit orders: the provider your scheme chooses, such as Netcash, Paystack or Payfast, under the scheme’s own agreement with it;
• AI: Anthropic and OpenAI, as described above;
• maps: Mapbox, to show addresses on maps;
• professional advisers such as our auditors and attorneys, under a duty of confidentiality.

We also disclose information when the law requires it, to protect our rights or the safety of others, or to a buyer of our business under the same protections as this policy.

Some of our providers store or process information outside South Africa, for example in the European Union and the United States. As POPIA section 72 requires, we only use providers that are bound by law, binding corporate rules or written agreements giving protection substantially similar to POPIA, or where the transfer is needed to perform the contract you asked for.

• Enquiries and demo requests: up to 24 months after our last contact, unless you become a customer.
• Website visit statistics: up to 24 months, then deleted or kept only as anonymous totals.
• AI assistant conversations: up to 12 months, unless they become part of a customer or support record.
• Customer and scheme records: for as long as the subscription runs, then for 30 days so you can export them, after which we delete or anonymise them, except what the law requires us to keep.
• Financial and tax records: at least five years, and longer where the law requires (for example seven years under the Companies Act).
• Security and audit logs: as long as needed to protect the service and to answer disputes.

We take appropriate, reasonable technical and organisational measures to prevent loss, damage and unauthorised access (POPIA section 19), including:

• each customer’s information is kept separate, and access is limited by role and scheme;
• information is encrypted in transit, and passwords are never used: sign-in is by one-time emailed link or code;
• two-step login, and our team must use it to enter the Super User Portal;
• every change is recorded in an audit log;
• our team only enters a customer’s account for support, with a recorded reason, for a limited time;
• sensitive settings such as provider keys are stored encrypted;
• the database is backed up daily, and backups are kept for seven days, so information can be recovered after an incident.

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as POPIA section 22 requires (or, where we act as operator, the scheme, so that it can).

We will never ask you for a password, a one-time sign-in code, or card or bank details by email, SMS, WhatsApp or phone. Genuine sign-in emails come from @communitydesk.co.za and link only to communitydesk.co.za.

We use cookies that are strictly necessary for the site and app to work, and, only if you allow them, cookies that remember your chat and referral and count visits. You can change your choice at any time with Cookie Settings at the bottom of every page. See our Cookie Policy for the full list.

Under POPIA you may:

• ask whether we hold personal information about you and for a copy of it (section 23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
• object to processing based on our legitimate interests (section 11(3)), and to direct marketing at any time, free of charge;
• withdraw your consent where we rely on it, without affecting what was done before;
• complain to the Information Regulator.

Write to our Information Officer at enquiry@communitydesk.co.za. We may ask you to confirm your identity, and we answer within a reasonable time, within 30 days where we can. Requests for records may also be made under the Promotion of Access to Information Act (PAIA): see our PAIA Manual.

If your information was loaded by your scheme, we will pass your request to the scheme and help it answer.

Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za. Website: inforegulator.org.za.

We will update this policy when our practices change and show the date of the latest version at the top. If a change materially affects how we use your information, we will tell customers in advance by email or in the app.