Privacy Policy

1. Who we are and what this policy covers

Bolulo is a student management system that student accommodation providers use to manage applications, tenancies, maintenance and communication with residents and staff. It is operated by OOWEBOO IT Solutions, info@ooweboo.co.za.

This policy applies to vantimode.bolulo.co.za, including the applicant portal, the dashboards used by residents and staff, and the email and WhatsApp notifications sent from it. Each accommodation provider uses its own Bolulo address, and this policy applies to all of them.

Two organisations are involved in handling your information:

• Vantimode (the organisation whose accommodation you apply for or live in, called the “Provider” here) decides why and how personal information about its applicants, residents and staff is used. Under the Protection of Personal Information Act 4 of 2013 (POPIA) it is the “responsible party”, and Bolulo processes that information on its behalf as an “operator”.
• Bolulo is the responsible party for the limited information it needs to run the platform itself: sign-in security, system and diagnostic logs, support and issue reports, and usage statistics.

2. Information we collect

Applicants

• Name, email address, phone number and WhatsApp number, date of birth, nationality and province.
• Institution, student number, year of study, preferred move-in date, duration and room preferences.
• Funding details (for example NSFAS, bursary, self-funded or private sponsor) and related details.
• Whether you have a disability and any accommodation needs, where you provide them.
• Supporting documents you upload, such as ID, proof of registration, funding letters, proof of payment, bank statements and fee-payer ID.
• How you heard about the Provider, comments, and messages you exchange with the Provider through the applicant portal.

Residents

• Profile details such as student number, institution, guardian name and phone, emergency contact and sponsor information.
• Room, bed and lease details (dates, academic year and rent amount).
• Maintenance requests, including descriptions, photos and videos, and electricity meter readings and photos.
• Safety and incident reports, some of which may be confidential, and messages and announcements.

Owners, managers, staff, contractors and workers

• Name, email, phone number, role, property assignments and, for contractors, company, specialisation and availability.
• A record of actions taken in the platform (who did what, and when).

Collected automatically

• Login history (time, success or failure, IP address, browser, operating system and, where available, approximate location) and security events.
• Records of emails sent (recipient, subject and delivery status).
• Page visit records (page, IP address, browser and referrer) and aggregated page-view statistics.
• Technical details (page, browser, app version) when you submit an issue report.

From other sources

Provider staff may create or import applications and accounts on your behalf, for example when entering an application or uploading a spreadsheet. WhatsApp tells us whether a message was delivered or failed.

Sensitive information

Some information is sensitive under POPIA, for example disability or accommodation needs (which may relate to health) and safety reports. We use it only for the purpose it was given, such as arranging suitable accommodation or dealing with a safety concern, and access is limited to authorised staff.

3. How and why we use information

• Applications, allocation and tenancy: to process your application, allocate a room, manage your lease and tenancy. This is necessary to take steps at your request and to perform the agreement with you.
• Maintenance, safety and administration: to handle maintenance and safety reports, inventory, electricity readings and announcements, which is necessary for running the accommodation.
• Communication: to send operational messages by email, in the platform and, if you opt in, WhatsApp (section 4).
• Security: sign-in protection, temporary lockouts, security logs and abuse prevention, in the legitimate interests of everyone using the platform.
• Fair allocation: to detect duplicate applications we compare identifiers such as email, phone, student number and name with date of birth. These comparisons use hashed keys rather than a second copy of your details.
• Support and improvement: to answer issue reports and understand how the platform is used.
• Legal: to comply with the law and to establish or defend legal claims.

Where the law requires your consent (for example for WhatsApp notifications, or for sensitive information you choose to give), we ask for it and you can withdraw it at any time. Withdrawing does not affect what was done before. Bolulo does not sell personal information and does not use it for advertising.

4. WhatsApp notifications

WhatsApp notifications are optional and are sent in addition to email. A WhatsApp message is only sent if the person it is for has agreed for that specific number. If your number changes, you need to agree again.

How you opt in

• By ticking the box on the application form, or in your profile settings when signed in.
• Staff may record that you asked for WhatsApp updates in person, on paper or directly. They must confirm that you actually asked.

What we send

Only operational notifications: application received and updates, accommodation and lease updates, maintenance updates and job assignments, electricity meter-reading requests, notices of new portal messages, and emergency notices from Vantimode. We do not use WhatsApp for marketing.

Messages contain your first name, the Provider’s name, an application reference where relevant, a short headline or notice title, and a link to the portal. They do not contain application decisions, the text of messages, documents or passwords.

Stopping

Reply STOP to any WhatsApp message and we stop messaging that number and confirm. Reply START to resume. Signed-in users can also switch it off in their profile. Email notifications are not affected.

Records we keep

• A consent record (number, opt-in or opt-out, date, how it was given and the version of the wording shown), kept as evidence even after you opt out.
• A “do not message” register of numbers that sent STOP (the number only), so we do not message them again.
• A log of messages sent, including your number and the message details, which is automatically deleted after 90 days.

Meta and WhatsApp

WhatsApp is operated by Meta. When we send a message, Meta receives your number, the message and delivery information, and handles it under WhatsApp’s own terms and privacy policy. We receive delivery statuses and any messages you send to our WhatsApp number. We act on STOP and START, and our system does not store the content of other messages. This number is not monitored: at most once a day we reply with a pointer to the portal.

5. Who we share information with

We share information only as needed to run the service:

• The Provider’s authorised users (owners, managers, staff and contractors), who see what is relevant to their role.
• Our email delivery provider: sends emails from the platform.
• Meta (WhatsApp Business Platform): delivers WhatsApp notifications (section 4).
• Authorities and advisers, where the law requires it or to protect rights and safety.

These providers handle information on our or the Provider’s instructions, except that Meta acts under its own terms for WhatsApp. This list will be updated if providers change.

6. International transfers

Some of our providers store or process information outside South Africa. POPIA allows this where the recipient is bound by law, binding rules or an agreement that gives similar protection, or where another lawful ground applies, such as your consent or the transfer being necessary to perform a contract.

7. Cookies, analytics and logs

• Essential: a sign-in session cookie, and a session for the applicant portal, so you stay signed in securely.
• Your browser’s storage: preferences and interface state on your device, such as colour theme, filters and cached counts. This is not used to track you.
• Analytics: Vercel Web Analytics for aggregated page-view statistics, designed to work without tracking cookies. We remove query strings and fragments before reporting and do not report password-reset or invitation pages. We also keep a first-party page visit record (page, IP address, browser, referrer).
• No advertising: we do not use advertising cookies or ad trackers.

8. How long we keep information

We keep personal information only for as long as it is needed for the purposes above or required by law. The Provider decides how long to keep its applicant and resident records, and can deactivate or remove users.

• WhatsApp message logs: deleted automatically after 90 days.
• WhatsApp consent evidence and the do-not-message register: kept while needed to prove consent and honour opt-outs.
• Spreadsheet import staging data: removed automatically under a retention schedule.
• Backups: our database provider keeps backups for a limited period. Deleted information may remain in backups until they expire.

9. How we protect information

We use reasonable technical and organisational measures, including:

• role-based access, with each Provider’s data kept separate from other Providers’;
• encrypted connections (HTTPS) and hashed passwords;
• temporary lockouts after repeated failed sign-ins, and security event logging;
• access to uploaded files controlled by the application;
• verification of messages we receive from WhatsApp.

No system is completely secure. If a security compromise affects your personal information, we will notify the Information Regulator and the people affected as POPIA requires.

10. Your rights and how to exercise them

You may ask whether we hold information about you, request a copy, ask us to correct it, ask us to delete or destroy it, object to its processing, and withdraw consent. To make a request, contact Vantimode or email us at help@bolulo.co.za. We will verify who you are first, so that information is not given to the wrong person, and respond within the time the law allows.

If you are unhappy with how your information is handled, you can complain to the Information Regulator (South Africa) at inforegulator.org.za, by email to enquiries@inforegulator.org.za or on 010 023 5200.

11. Data deletion

You can ask us to delete your personal information, including WhatsApp-related records. Submitting a request is not the same as deletion: see how to request deletion and what happens next. To stop WhatsApp messages right away, reply STOP.

12. Children

Bolulo is intended for students. If an applicant is under 18, the application must be made by a parent or legal guardian, who confirms they have authority to provide the child’s information. Children should not create accounts or apply on their own.

13. Changes to this policy

We may update this policy. The latest version is always on this page with its effective date, and we will take reasonable steps to tell account holders about material changes, for example by email or a notice in the platform.

14. Contact us

Privacy questions and requests: Contact help@bolulo.co.za.