Privacy Policy – GSAH

1. Introduction

1.1 Growthpoint Student Accommodation Holdings (RF) Limited (Registration Number: 2014/195480/06) (“GSAH”/ “We”/ “Us”) is committed to protecting the privacy and security of your Personal Information in accordance with POPIA. This Policy outlines how We collect, use, disclose, and safeguard your Personal Information when you engage with us through our websites, transactions, subscriptions, and other interactions.
1.2 This Policy is aligned with POPIA and will be updated by GSAH from time to time to ensure continued compliance. The date of the most recent revision of this Policy will be indicated on the first page of this Policy.
1.3 By registering or placing an order, you:
1.3.1 confirm that you have read and understood the Policy
1.3.2 consent to the Processing of your Personal Information in accordance with the Policy
1.3.3 consent to us collecting and Processing your Personal Information, where lawful and reasonable, from public sources, for the purposes set out in this Policy
1.3.4 confirm that the Personal Information you provide to us, whether relating to you or another person, is correct, and that you have the necessary authority to disclose such Personal Information to us

2. Definitions

2.1 The capitalised words and expressions in this Privacy Policy shall bear the meaning assigned to them below:
2.1.1 “Affiliates” means, in relation to GSAH, the ultimate shareholder of GSAH and any person or entity which is directly or indirectly controlled by GSAH or any such ultimate shareholder
2.1.2 “Personal Information” refers to any information that identifies or relates to an identifiable individual or juristic person, as contemplated in POPIA, including but not limited to:
2.1.2.1 demographic details (e.g., race, gender, age, nationality)
2.1.2.2 contact details (e.g., email address, phone number, physical address)
2.1.2.3 biometric data
2.1.2.4 online identifiers (e.g., IP address, device information)
2.1.2.5 preferences and opinions
2.1.2.6 correspondence and communication history
2.1.2.7 behavioural, educational, transactional, and loyalty-related information
2.1.3 “POPIA” refers to the Protection of Personal Information Act, No. 4 of 2013
2.1.4 “Policy” refers to this Privacy Policy for GSAH
2.1.5 “Processing” refers to any operation, activity or set of operations, whether or not by automatic means, concerning personal information, including collection, receipt, storage, use, dissemination, erasure or destruction
2.1.6 “Websites” refer to the following websites:
2.1.6.1 www.staging.thrivestudentliving.co.za
2.1.6.2 www.shop.staging.thrivestudentliving.co.za
2.2 Unless the context requires otherwise:
2.2.1 words referring to one gender include all genders
2.2.2 words in the singular include the plural and vice versa
2.2.3 references to a person include both natural and juristic persons
2.3 The use of “including”, “other” or “otherwise” followed by examples does not limit the preceding general wording.
2.4 The rule that contracts must be interpreted against the drafter does not apply to this Policy.

3. When Do We Collect Personal Information?

3.1 We collect Personal Information from various sources, including when you:
3.1.1 visit and browse our Websites
3.1.2 engage in transactions or subscriptions for our services
3.1.3 submit enquiries or communicate with us
3.1.4 participate in our surveys, competitions, promotions, or events
3.1.5 voluntarily share information via GSAH platforms or those of our Affiliates
3.2 We may also collect your Personal Information from third parties, where permitted by law. Use of third-party platforms (e.g., social media, search engines) may result in additional Processing of your data, for which GSAH is not responsible.

4. What Personal Information Do We Collect?

4.1 The types of Personal Information we may collect include:
4.1.1 identity details, including your name, surname, contact number, email address
4.1.2 preferences and interests
4.1.3 technical information such as your IP address and device/browser information
4.1.4 website navigation and engagement data
4.1.5 subscription and transaction history
4.1.6 any other information voluntarily provided by you
4.2 Information may be collected directly or via cookies and other electronic means.

5. Cookies Policy

5.1 GSAH uses cookies to enhance your browsing experience. Cookies are small text files stored on your device to remember preferences, analyse usage, and improve website functionality.
5.2 You may accept or decline cookies upon visiting our Websites, and manage settings through your browser at any time.

6. Why Do We Collect Your Personal Information?

6.1 We process your Personal Information for the following purposes:
6.1.1 website administration and performance monitoring
6.1.2 customer relationship management, newsletters, and updates
6.1.3 responding to enquiries and communication
6.1.4 market analysis and profiling
6.1.5 managing data protection requests under POPIA
6.1.6 legal and regulatory compliance
6.2 We may use anonymised or aggregated data that does not identify individuals.
6.3 Personal Information will only be used for the purposes stated in this Policy, unless otherwise authorised or legally required.

7. Disclosure of Personal Information

7.1 We do not sell your Personal Information to unaffiliated advertisers.
7.2 We may share your information in the following circumstances:
7.2.1 with service providers performing functions on our behalf
7.2.2 with selected marketing or business partners
7.2.3 where you have given consent or directed us to do so
7.2.4 within our corporate group and Affiliates
7.2.5 to comply with legal or regulatory obligations
7.2.6 during business restructuring, mergers or acquisitions
7.3 We maintain records of all third-party disclosures, as required by POPIA.
7.4 Where Personal Information is transferred outside South Africa, we will ensure compliance with POPIA through:
7.4.1 your explicit consent
7.4.2 adequate protection laws in the recipient country
7.4.3 binding agreements ensuring adequate protection

8. How Do We Protect Your Personal Information?

8.1 We use appropriate technical and organisational safeguards including:
8.1.1 secure servers and firewalls
8.1.2 SSL encryption for sensitive data
8.1.3 internal reviews of privacy practices
8.1.4 physical access controls
8.2 We regularly update security practices in line with POPIA.

9. Policy Regarding Minors

9.1 We do not knowingly collect or process information from individuals under 18 without parental/legal guardian consent.
9.2 If you believe we have collected such data without consent, contact us at info@thrivestudentliving.co.za.

10. Data Retention

10.1 We retain Personal Information only as long as necessary for the stated purposes and legal compliance.
10.2 Generally, data is retained for up to 3 years from collection or last interaction.
10.3 After this period, we may request your consent to retain your information further. If not granted, we will securely delete or archive the data.
10.4 In certain cases, we may retain information longer for legal or regulatory reasons.

11. Your Rights and Contact Information

11.1 You have the right to:
11.1.1 access, correct, or delete your Personal Information
11.1.2 object to or restrict the processing of your data
11.1.3 withdraw your consent at any time
11.2 To unsubscribe from direct marketing, contact us or use the unsubscribe link in our communications.
11.3 We may require proof of identity for data requests.
11.4 Requests will be addressed within 1 month of receipt and verification.
11.5 Service-related communications (e.g., maintenance alerts) are essential and not subject to opt-out.
11.6 To lodge a complaint, contact info@thrivestudentliving.co.za or the Information Regulator at infoirsa@justice.gov.za.
11.7 For any other queries, contact us via our Websites or email: info@thrivestudentliving.co.za.

12. Amendment to Privacy Policy

We reserve the right to change all or parts of this Privacy Policy, without prior notice, from time to time to reflect changes in our practices and/or applicable laws. Such changes will become effective upon being posted to our Websites. Your continued use and access of the Websites and/or the services following the posting of changes or updates will be considered notice of your acceptance of the revised terms of the Privacy Policy. Please periodically check on our Websites for any such changes or updates. If there is a conflict between any versions of the Privacy Policy, the provision of the Privacy Policy last in time shall prevail.