Privacy Policy
How VarsityStay collects, uses, protects and shares your personal information.
Last updated: —
In short: We collect only what we need to verify you're a student and process your accommodation registration — your profile details, your documents, and how you use the platform. We verify your documents with your university, share your application with the accommodation provider you choose, and never sell your data. You can ask us to show, correct or delete your information at any time.
1. Who We Are
VarsityStay ("we", "us") is a South African online platform that connects registered university students with accredited student accommodation providers. This Privacy Policy explains how we handle your personal information under the Protection of Personal Information Act, 2013 (POPIA). By creating an account or using the platform, you agree to this policy alongside our Terms & Conditions.
2. What Information We Collect
| Category | Details |
|---|
| Account details | First name, surname, email address, gender, candidate type (First Year / Senior), university, system-assigned student number (VS-YEAR-XXXXXX), password (stored securely by our authentication provider — we never see it in plain text). |
| Application details | University student number, year of study, preferred residence and room type, uploaded documents, registration status, room allocation. |
| Documents you upload | NSFAS / bursary proof; Proof of University Registration (First Years) or Academic Record (Seniors). Files (PDF/JPG/PNG, max 10MB) are stored on a secure third-party cloud service (Cloudinary). |
| Payment records | Application fee, re-registration fee and deposit payment references and statuses. Card details are handled entirely by our payment processor (Paystack) — we never see or store your card numbers. |
| Communications | Messages you send to administration, admin replies to you, and the agent referral code you submit (if any). |
| Platform activity | Ratings and reviews you post, sign-in activity, and audit records of actions taken on your account. |
3. Why We Collect It (Purpose)
We process your personal information strictly to:
- Create and secure your account, and identify you as a registered student;
- Verify your student status and the authenticity of your documents with your university;
- Process and assess your accommodation registration, and allocate rooms;
- Share your application details with the accommodation provider you select so they can administer your stay;
- Process application fees and deposits and keep payment records;
- Communicate application updates, admin messages and announcements to you;
- Operate the ratings/review system and the agent referral programme;
- Prevent fraud, enforce our Terms & Conditions, and comply with legal obligations.
We do not use your information for automated profiling, and we do not sell, rent or trade your personal information to anyone — ever.
4. Who We Share It With
Your information is shared only with the following, and only to the extent necessary:
- Your university — to verify your registration status and documents;
- The accommodation provider you select — your name, student details, room preference and application status, so they can manage your placement;
- Paystack (payment processor) — payment processing only, once payments are active on the platform;
- Cloudinary (cloud storage) — secure storage of the documents you upload;
- Google Firebase (authentication & database) — account security and data hosting;
- Law enforcement / authorities — where legally required, or to protect our rights, your safety, or the safety of others.
5. How Long We Keep It (Retention)
We keep your personal information only as long as necessary:
- Account & application data — while your account is active and for the duration of the application/academic cycle it relates to;
- Uploaded documents — until your application is finalised and any verification or dispute period ends, after which they are deleted on request or per our retention schedule;
- Payment records — as required by South African tax and financial record-keeping laws (generally 5 years);
- Audit logs — up to 12 months, for security and dispute resolution.
When information is no longer needed, it is securely deleted or de-identified.
6. How We Protect It (Security)
- All traffic between you and the platform is encrypted in transit (HTTPS/TLS);
- Authentication and data storage are handled by Google Firebase with industry-standard safeguards;
- Access to student data is restricted to authorised administrators and enforced at database level (security rules);
- Passwords are managed by our authentication provider and are never stored or visible in plain text;
- Rate limiting and audit logging protect against abuse and unauthorised changes;
- Only the minimum data necessary is collected for each purpose (data minimisation).
No system is perfectly secure. If a breach affecting your information occurs, we will notify you and the Information Regulator as required by POPIA.
7. Your Rights Under POPIA
Access Request a copy of the personal information we hold about you.
Correction Ask us to correct or update inaccurate or outdated information.
Deletion Request deletion of your personal information (subject to legal retention duties).
Objection Object to our processing of your information on reasonable grounds.
Complaint Lodge a complaint with the Information Regulator South Africa.
Portability Request your information in a portable, readable format.
To exercise any of these rights, contact us using Section 9. We respond within a reasonable time and may ask you to verify your identity first. You will not be charged for a request.
8. Children's Information
VarsityStay is intended for university students. We do not knowingly collect information from children under 18 without the consent of a competent person (parent/guardian). If you believe a minor has provided us information, contact us and we will delete it.
9. Cookies & Local Storage
VarsityStay uses only essential browser storage needed for the site to function (keeping you signed in between pages, and remembering form progress). We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across other websites.
10. Contact Us & The Information Regulator
For any privacy question, request, or complaint about how your information is handled:
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the platform or the law. The "Last updated" date above will change, and significant changes will be announced on the platform. Continued use after an update constitutes acceptance of the revised policy.