How we look after your information.

This notice explains what personal information Repat Advisory (Pty) Ltd collects when you contact us through our website, why we collect it, who else sees it, and what your rights are under the Protection of Personal Information Act (POPIA, 2013).

It is written in plain English. If anything is unclear, please email cliff@repat.co.za and we will explain it directly.

1. Who we are

Repat Advisory (Pty) Ltd is a South African private company, registration number 2026/429918/07, with its registered address in Hermanus, Western Cape. We provide advisory services to South Africans returning home, covering property acquisition, design, renovation oversight, and the wider logistics of relocation.

For the purposes of POPIA, we are the responsible party for the personal information described in this notice. Our Information Officer is Cliff van Tonder, reachable at cliff@repat.co.za.

2. What information we collect

When you complete the enquiry form on our website, we collect:

• Your first and last name
• Your email address
• Your phone number (only if you choose to provide one)
• The country and city you are returning from
• The area of the Cape coast you are interested in
• Your indicative timeline for the move
• Whatever you choose to write in the free-text message field
• Confirmation that you have agreed to this privacy notice

We also automatically capture limited technical information:

• The IP address you submitted from
• Your browser user agent string
• The timestamp of your submission

3. Why we collect it

We collect this information for three specific purposes, and only these:

• To reply to your enquiry and arrange an introductory call if you wish
• To prepare for that call, so we can be useful from the first minute rather than asking you to repeat the basics
• To keep an internal record of who contacted us and when, for our own administrative purposes

We do not use your information for marketing. We do not have a newsletter or mailing list, and we will not add you to one. If we ever launch one in future, it will be a separate opt-in with its own consent step.

4. Our lawful basis

Under POPIA Section 11, we rely on:

• Your consent (Section 11(1)(a)) when you submit the enquiry form. The tickbox on the form is your consent record. You can withdraw it at any time.
• Contract performance (Section 11(1)(b)) if you go on to engage us for advisory work. At that point we sign an engagement letter, and that contract becomes the basis for the broader information we hold to do the work.

5. Who else sees it

Your enquiry is read by Cliff van Tonder and Brendon Perold, the two principals of the practice. No one else inside Repat Advisory has access to the enquiry database.

Two third parties process your information on our behalf as operators under POPIA:

• Microsoft Ireland Operations Ltd, which runs the Microsoft 365 service we use for email. Notification emails about your enquiry and our reply to you pass through Microsoft 365 servers.
• Krystal Hosting Ltd (United Kingdom), which hosts the website and database where your enquiry is stored.

Both have signed data processing terms with us and are committed to UK GDPR equivalent protections.

Two additional third parties briefly receive your IP address when you load our homepage, to power the "live data" strip at the top of the page (the line showing the time and weather in Hermanus, and how far you are from us):

• Open-Meteo (Switzerland) returns the current Hermanus weather. Your IP is not sent to them; we only ask about Hermanus.
• ipapi.co (United States) translates an IP address into an approximate city, so we can show how far you are from Hermanus. Your IP is sent to them. We cache the result for one hour to minimise repeated lookups, and we do not store the IP or the result beyond that cache period.

You can avoid the ipapi.co lookup entirely by browsing the site through a VPN that masks your true location, or by simply ignoring the strip. The website works identically whether the lookup succeeds or not.

If you later engage us for property work, we may share specific information about your brief with selected downstream providers, with your knowledge and where relevant to the work, for example a registered estate agent helping us find suitable properties, a conveyancer, or a contractor providing a renovation quote. We never share information with downstream providers without your awareness, and we never accept commissions or referral fees from them for doing so.

We do not sell, rent, or trade your personal information. There are no exceptions to this.

6. Where it is stored, and cross-border transfer

Your enquiry is stored in a MySQL database hosted by Krystal in the United Kingdom. Emails containing your enquiry are stored in Microsoft 365 mailboxes which may be processed in Microsoft data centres in the European Union.

Under POPIA Section 72, transferring personal information out of South Africa is permitted when the destination jurisdiction provides adequate protection or the operator is bound by suitable contractual terms. The United Kingdom and the European Union both meet the adequacy standard, and both operators above have signed contractual terms that bind them to those protections.

7. How long we keep it

By default, enquiries are kept for thirty-six months, after which we delete the row from the database. If you go on to engage us for paid advisory work, your information becomes part of the engagement record and is kept for the periods specified in our engagement letter (typically five years after the engagement closes, in line with general business record-keeping practice).

If at any point you ask us to delete your information sooner, we will do so within 30 days of your request. The only exception is information we are legally required to keep, for example tax records once we have invoiced you.

8. How we keep it safe

We take the security of your information seriously. The practical measures we take include:

• All traffic to our website is forced to HTTPS
• The enquiry database uses parameterised queries throughout, so the system is not vulnerable to SQL injection
• Our email integration uses application-only authentication with Microsoft Graph, scoped specifically to the single mailbox that sends our correspondence
• Our hosting credentials, email accounts, and database access are protected by multi-factor authentication
• We do not log your enquiry content in any place outside the database and our email mailboxes
• We review who has access to your information on an ongoing basis, and as a two-person practice we know precisely who that is

9. Your rights under POPIA

Under POPIA Sections 23 to 25, you have the right to:

• Access a copy of the personal information we hold about you
• Correct any information that is wrong or out of date
• Delete your information, subject to any legal retention requirements
• Object to our continued processing of your information
• Withdraw consent that you previously gave
• Complain to the Information Regulator if you believe we have not handled your information properly

To exercise any of these rights, email cliff@repat.co.za. We aim to respond within 7 days and complete the action within 30 days. There is no fee.

10. Cookies

The Repat Advisory website does not set cookies of its own. We do not run analytics scripts, advertising pixels, social media trackers, or any other third-party tracking on our pages.

Our website loads typefaces from Google Fonts, which is a content delivery network operated by Google. Loading these typefaces involves an HTTP request to Google's servers, which Google may log per its own privacy policy. We do not pass any personal information to Google in this exchange.

11. Changes to this notice

If we change the way we collect or use personal information, we will update this notice and change the "last updated" date at the top of the page. Material changes will be flagged on the homepage for at least 30 days.

12. Contact and complaints

For any privacy question, request, or complaint, contact:

Cliff van Tonder
Information Officer, Repat Advisory (Pty) Ltd
cliff@repat.co.za

If you are not satisfied with our response, you have the right to lodge a complaint with the South African Information Regulator:

Information Regulator (South Africa)
inforegulator.org.za
POPIAComplaints@inforegulator.org.za