Last updated 28 October 2026.
Who we are
2Rent rents out residential units in Gauteng, South Africa. We are the responsible party (under South Africa's Protection of Personal Information Act, POPIA) and the controller (under the EU General Data Protection Regulation, GDPR, where it applies) for the personal information described here.
Our Information Officer is our Information Officer, who you can reach at [email protected]. Our office is at 150 Dane Road, AustinView, Midrand.
What we collect, why, and our legal basis
- Enquiries, viewing requests and messages: your name, cell number, email (if you give it), the development and unit size you're interested in, preferred dates and your message. We use it to reply to you and arrange viewings. Basis: your request to us (taking steps towards a lease) and our legitimate interest in answering enquiries.
- Rental applications: the above, plus your employment status, how many people will live with you, and any documents you upload (ID or passport, payslip, bank statements). We use it to assess your application, including credit and reference checks. Basis: your consent, given when you apply, and steps towards a lease you asked for.
- Tenants: contact details, ID number, emergency contact, lease terms and lease documents. We use it to manage your lease and the building. Basis: our lease agreement with you and our legal obligations.
- Landlord, investor and cleaning enquiries: your contact details and what you tell us about your property or the clean you need. Basis: your request to us.
- Technical information: your IP address when you send a form (kept for 90 days to deal with spam and abuse) and the essential cookies described in our cookie notice. Basis: our legitimate interest in keeping the website secure.
We don't need special personal information (such as health or religious beliefs), and the website isn't meant for children under 18. We don't sell your information and we don't send you marketing.
Who we share it with
- Credit bureaus and your references, only when you apply for a unit, to do the checks you agree to.
- Service providers who process information for us (operators under POPIA, processors under the GDPR), under agreements that require them to keep it secure and confidential: our website hosting provider, our email provider (Zoho) and Cloudflare, which protects and speeds up the website.
- WhatsApp (Meta), only if you choose to contact us on WhatsApp, and Google Maps, only if you click to show a map.
- Google Analytics, only if you accept analytics cookies, to understand how the website is used.
- Authorities, when the law requires it.
Information sent outside South Africa
Some of these providers (such as Zoho, Cloudflare, Meta and Google) may store or process information outside South Africa. We only use providers that are bound by laws, binding rules or agreements that give your information protection substantially similar to POPIA (POPIA section 72), and, for people in the EU, appropriate safeguards under the GDPR.
How long we keep it
- Documents uploaded with an application: deleted automatically after 90 days.
- Enquiries, viewing requests and applications that don't lead to a lease: deleted automatically after 24 months.
- Tenant and lease records: kept for as long as the law requires us to keep them (for example for tax), and then deleted.
- Email delivery logs: 24 months. Security audit logs: 36 months.
How we protect it
The website only works over an encrypted connection. Uploaded documents are stored privately, outside the public website, and only signed-in 2Rent office staff can open them; every time a document is opened it is recorded. Staff only get the access their job needs, and accounts of people who leave are switched off. If a security breach puts your information at risk, we'll tell the Information Regulator and you as soon as reasonably possible.
Your rights
You can ask us to:
- tell you whether we hold information about you, and give you a copy of it;
- correct information that's wrong or out of date;
- delete information we no longer need or are not allowed to keep;
- stop using your information (object), or withdraw consent you gave (this doesn't affect what we did before);
- give you your information in a format you can take elsewhere (GDPR data portability).
Send a privacy request or email [email protected]. We'll confirm who you are before we act, and reply within 30 days.
Complaints
Please contact us first so we can put things right. You can also complain to the Information Regulator (South Africa): inforegulator.org.za, email [email protected]. If you're in the European Union, you can complain to the data protection authority in your country.
Changes
We'll update this notice when how we use personal information changes. The date at the top shows when it last changed.