MidTermStays — Privacy Policy

Last updated: 22 June 2026 (entity + IO + contact lanes locked; partner references generic)

1. Introduction

This Privacy Policy forms part of MidTermStays’ Terms of Use. Terms used in this Privacy Policy have the same meanings as in the Terms and Conditions (“T’s & C’s”) unless stated otherwise.

This Privacy Policy explains how MidTermStays collects, uses, processes, discloses, shares, transfers, and protects personal information obtained through midtermstays.co.za, our email correspondence, our events, workshops, and any other Platform operated by MidTermStays. The terms “we,” “us,” and “our” refer to MidTermStays. When we ask for personal information from users, it is because we are required by applicable laws (including the Protection of Personal Information Act 4 of 2013 — “POPIA”) or because the information is relevant for our specified purposes and the provision of our Services.

About MidTermStays’ role. MidTermStays is a marketing and lead-generation marketplace that connects owners of furnished mid-term rental properties (1–6 months) in South Africa with prospective tenants. We are not a party to any rental agreement between an owner and a tenant. The lease, the deposit, the property condition, the conduct of both parties, vetting decisions, and any disputes between owner and tenant are theirs — not ours. We facilitate the introduction, market listings, and facilitate a one-time first-month payment that serves as a commitment device — processed by a regulated third-party payment provider — and that is the limit of our role. This positioning informs everything in this Privacy Policy.

Please read this Privacy Policy in full. By visiting midtermstays.co.za, registering for an Account, or using any of our Services, you acknowledge, understand, and consent to this Privacy Policy. We will not use your personal information for any purpose not covered here without prior notification and your consent. We will not share your personal information for any purpose not described in this Policy without your consent.

This Privacy Policy incorporates the requirements of POPIA and we act in accordance with its personal-information processing rules within South Africa.

2. Definitions

“Account” / “MidTermStays Account” means a User’s account created on the Platform (owner Account, tenant Account, or both).

“MidTermStays” or “the Company” means Guest House Accommodation of South Africa CC (registration number 2006/203297/23), a close corporation incorporated under the laws of the Republic of South Africa, trading as MidTermStays, with its registered and postal address at 9 Zastron Road, Milnerton, Cape Town, Western Cape, 7441. References in this Privacy Policy to “MidTermStays” or “the Company” are to that entity in its capacity as operator of the MidTermStays platform.

“Owner” means a User who lists a property on the Platform for the purpose of receiving mid-term-rental enquiries.

“Tenant” means a User who searches for, enquires about, or books a property listed on the Platform.

“Personal Information” means personal information as defined in POPIA, including (but not limited to) information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person.

“Platform” means midtermstays.co.za, any subdomain, any email addresses associated with MidTermStays, and any other platform associated with the provision of the Services by MidTermStays.

“Processing” means the processing of personal information as defined in POPIA.

“POPIA” means the Protection of Personal Information Act 4 of 2013 and any regulations published under it.

“Information Regulator” means the Information Regulator (South Africa) established under POPIA.

“Services” means the marketing and lead-generation services provided by MidTermStays to Users, including listing exposure, search facilities, the messaging function, the verified-listing standard, optional connection to third-party vetting and lease-template providers, and the facilitation of a one-time first-month payment that serves as a commitment device, processed by a regulated third-party payment provider. The Services do not include the rental agreement, deposit handling, ongoing rent collection, vetting decisions, lease drafting, or dispute adjudication between owner and tenant — those are the responsibility of the owner and tenant directly.

“Third-Party Applications” means applications and websites operated by third parties that MidTermStays uses from time to time to deliver Services — including (without limitation) any third-party tenant-vetting service we work with, any third-party from which a mid-term lease template may be made available, our payment processor, our cloud-infrastructure provider, our analytics providers, and our marketing-service providers. We may change Third-Party Applications without notice provided the change does not materially reduce User protections; current providers are disclosed on request.

“User” means any natural or juristic person who accesses or uses the Platform, including Owners and Tenants.

“User Data” means data inputted by you, or by us on your behalf, for the purposes of using the Services or facilitating your use of the Services, which may include your Personal Information.

“Website” means midtermstays.co.za and any other URL owned or controlled by MidTermStays that connects it to the public.

3. Consent

By creating a MidTermStays Account, using any of the Platforms or Services, completing a contact-submission form, providing information through a profile or enquiry, or corresponding with MidTermStays by email, you consent to our processing of your Personal Information and User Data as may be required for the provision of the Services, including in the ways described in this Privacy Policy.

Lawful bases beyond consent. In addition to your consent, we may process your Personal Information where processing is justified under one of the other lawful bases set out in POPIA section 11 — including performance of a contract to which you are a party, compliance with a legal obligation imposed on MidTermStays by law, protection of your legitimate interests, or pursuit of the legitimate interests of MidTermStays where these are not overridden by your privacy rights. Where we rely on a basis other than consent, withdrawing your consent does not affect processing carried out under those other lawful bases.

By creating a MidTermStays Account, you agree to be bound by our Terms and Conditions.

We may store your Personal Information and User Data outside South Africa, to which you consent. We will take all reasonable steps to ensure that your Personal Information and User Data is afforded the same standard of protection as required by POPIA.

We use third-party service providers for the provision of the Services (see “Third-Party Applications” above). By using the Services you consent to the sharing of your Personal Information with these providers, strictly to the extent required to deliver the Services.

Withdrawing consent. You may withdraw your consent at any time by emailing us at privacy@midtermstays.co.za. Note that we may not be able to provide some or all of the Services after you withdraw consent, and your MidTermStays Account may be deregistered.

4. Information We Collect

We keep all information collected from you in the provision of the Services confidential and will not share it with third parties except as described in this Policy.

4.1 Information You Provide to Us

When you create a MidTermStays Account and use our Services, you provide us with information, and consent to our processing of that information. The categories below differ depending on whether you are an Owner or a Tenant.

4.1.1 If you are an Owner

• Your full name and surname
• Your email address(es)
• Your phone number(s) (including WhatsApp where applicable)
• Your residential address
• Your South African ID number or passport number
• Your bank account details (for payout of the first month’s rent after deduction of our marketing fee)
• Details of the property you list (address, size, photos, description, availability, asking rent, amenities, house rules)
• Proof of ownership or authority to let (e.g. title deed, mandate from owner)
• Tax / VAT registration details (where applicable)

4.1.2 If you are a Tenant

• Your full legal name
• Your South African ID number or passport number
• Your date of birth
• Your email address(es)
• Your phone number(s)
• Your current residential address and recent address history
• Your employment status, employer details, and monthly income
• Your reason for the stay (relocation, contract, between homes, medical, renovation, etc.)
• Your desired length of stay and dates
• References (previous landlord, employer) where supplied

Why tenant details must be accurate. Your profile is the basis on which an Owner decides whether to accept your booking and is the data used by the optional third-party vetting service if the Owner orders it. Inaccurate information will result in a failed vetting check and a declined booking.

4.2 Information We Collect as You Access the Services

4.2.1 Service Usage Information

We may monitor and collect tracking information related to your use of the Platform, including but not limited to access date and time, device type and device identifier, operating system, browser type, IP address, and approximate location derived from IP. This information may be collected by MidTermStays directly or through Third-Party Applications (analytics, heatmap, advertising platforms). Service Usage Information helps us ensure the Platform is accessible and improve the experience for Users.

4.2.2 Booking and Enquiry Information

As you use the Services, we may collect information about your interactions with listings and other Users, including but not limited to: search queries, listings viewed, enquiries sent and received, messages exchanged between you and other Users, bookings made, bookings declined, the timing and amount of the first-month payment (where you are a Tenant), and the timing of payouts (where you are an Owner). We use this information to operate the Platform, monitor for suspicious activity, resolve disputes, comply with legal obligations, and improve the Services.

4.2.3 Communication Information

You agree that, for the purposes disclosed in this Privacy Policy, we may collect and use the information contained in or related to the communications you send through the Platform or to us directly (“Communication Information”), which includes:

• All messages, enquiries, and other information you send through the messaging function on the Platform (between Users and to MidTermStays)
• All correspondence and file attachments exchanged with MidTermStays support, including by email, WhatsApp, or telephone
• Records generated through your use of the Services (booking confirmations, payment confirmations, support tickets)

4.2.4 Financial Information

We retain information relating to the first-month payment processed through the Platform, including the amount, the date, the payment method used, and the resulting payout to the Owner. We do not store full card details — these are handled by our regulated third-party payment processor, which acts as a separate responsible party under POPIA for the card-payment transaction and operates under its own privacy policy and applicable financial-services regulation. MidTermStays does not hold or control card data, and does not hold any rent payment in a fiduciary capacity for the Owner.

We do not collect, hold, or process the Owner’s deposit. Deposits are between the Owner and the Tenant directly.

We do not collect or process rent payments after the first month. Monthly rent from month 2 onwards is paid by the Tenant directly to the Owner.

5. How We Collect Information

5.1 Information MidTermStays Automatically Collects

Most of the Personal Information we collect is provided by you directly. In the following situations, we collect it automatically:

• When you register, log in to, or use your MidTermStays Account
• When you visit the Website or use Platform features
• When you voluntarily complete a survey, leave a review, or provide feedback
• When you use cookies on the Platform (see Section 13)
• Other situations described in this Privacy Policy or the Terms and Conditions

5.2 Information Collected from Third-Party Sources

We may collect information about you from third-party sources, including but not limited to:

• The optional third-party vetting service provider (where you or an Owner has consented to vetting), who returns credit, employment, and affordability check results
• The optional third-party lease-template provider, who confirms a lease has been issued
• Our payment processor, who returns transaction status and reference data
• Our marketing partners, advertising partners, and analytics providers
• Public sources (e.g. company registration data, where you are listing as a business)

These third parties are bound by written agreements to protect your Personal Information in accordance with POPIA and to process it only for the specific purposes for which we share it, as required by POPIA section 21.

5.3 Anonymised and Aggregated Data

We may anonymise or aggregate User data so that it can no longer be associated with a specific individual (“de-identified”) and use it for any business purpose, including improving the Services, business intelligence, market analysis, marketing, and security threat detection. We may perform our own analytics on anonymised data or enable analytics provided by third parties.

6. How We Use the Information We Collect

6.1 To Provide and Maintain MidTermStays Services

We use the information collected to deliver, maintain, and improve our marketing and lead-generation Services, including operating the listing marketplace, the search and enquiry function, the verified-listing standard, the messaging function, the first-month payment facilitation, the owner payout, and our customer support.

We may share your information with third-party service providers (cloud infrastructure, payment processing, analytics, customer support tooling, security) for the purpose of providing the Services.

6.2 To Verify Listings and Facilitate the Optional Vetting / Lease Add-Ons

We use Owner-supplied information to apply fraud filters to listings — checking that a listing appears legitimate, that the Owner has provided supporting documentation of authority to let, and that obvious signs of misrepresentation are absent. This is a fraud-filter function — it is not an endorsement of the Owner, the property, or the Owner’s title, and Users should not rely on our verification as a substitute for their own due diligence. We do not vet Tenants ourselves. Where an Owner orders the optional third-party vetting service, we share the relevant Tenant profile data with that provider with the Tenant’s consent. Where an Owner orders the optional lease-template service, we share the necessary Owner and Tenant data with that provider with both parties’ consent.

6.3 To Protect Our Users and the Platform

We use the information collected to protect Users, Accounts, and the Platform from abuse, fraud, and unauthorised use. We use IP addresses, device identifiers, and cookies to protect against automated abuse including spam, phishing, scraping, and denial-of-service attacks. Messages exchanged through the Platform’s messaging function may be reviewed — using automated detection and, where necessary, by trained personnel — for fraud detection, safety, abuse prevention, regulatory compliance, and dispute investigation.

6.4 To Comply with Legal and Regulatory Requirements

We may disclose your Personal Information to comply with our legal obligations under POPIA, the Companies Act 71 of 2008, the Financial Intelligence Centre Act 38 of 2001 (where applicable to payment facilitation), the Consumer Protection Act 68 of 2008, lawful government requests, and to respond to reasonable User-generated inquiries. Except as stated in this Privacy Policy or the Terms and Conditions, we will not disclose your Personal Information without your prior consent.

6.5 For Measurement, Research, and Development

We may analyse statistical trends in your use of the Services to improve the Platform. Personal Information analysed in this manner will be anonymised before analysis.

We continuously monitor activity within our systems and our communications with Users to detect and fix problems.

6.6 To Communicate with You

We use Personal Information — including your phone number, WhatsApp number, and email address — to communicate with you directly when providing the Services and customer support, and to keep you informed of logins, bookings, payments, listing status, and Account security. Direct communications are retained by MidTermStays or our service providers for accuracy, for legal purposes, and to perform contractual obligations.

6.7 To Enforce Our T’s & C’s and Other Agreements

Collected information may be used to enforce our Terms and Conditions and other agreements with Users. This includes reviewing, investigating, and preventing potentially prohibited or illegal activity, and disclosing information to a third party where required by law.

MidTermStays reserves the right to suspend or terminate any Account found to be engaged in activity that violates our Terms and Conditions.

6.8 For Marketing and Advertising

We may share anonymised Personal Information with our marketing partners, or on our Platform, for targeting, modelling, analytics, marketing, and advertising. We will not disclose your Personal Information (in identifiable form) to third parties for the purposes of direct marketing without your consent.

6.9 Automated Decision-Making

Where an Owner orders the optional third-party tenant-vetting service (see §6.2), the outcome of that vetting may be communicated to the Owner as an automated pass/fail or risk rating that contributes to the Owner’s booking decision. Under POPIA section 71, you have the right to:

• Request the basis for an automated outcome that affects you
• Request human review of an automated outcome that has a legal or similarly significant effect on you
• Object to being subject to a decision based solely on automated processing where it produces a legal effect for you

To exercise these rights in respect of vetting results, contact privacy@midtermstays.co.za. The final booking decision is made by the Owner, not by MidTermStays — MidTermStays does not itself take automated decisions that produce legal effects in respect of you.

6.10 Other Purposes

We may disclose your Personal Information for other purposes from time to time. We will obtain your explicit consent for any such purpose and provide full details.

7. Marketing

We aim to keep Users up to date on MidTermStays Services, new features, and relevant content. We provide all Users with the option to unsubscribe from marketing or promotional material by clicking the unsubscribe link at the bottom of any marketing email, or by contacting privacy@midtermstays.co.za.

8. Advertising

You give MidTermStays permission for the collection, collation, processing, or disclosure of your Personal Information and User Data for the specific purpose of creating advertising material relating to the Services.

MidTermStays will notify you that it intends to use your Personal Information or User Data before doing so for any new purpose. Should MidTermStays require your Personal Information or User Data for any purpose other than the disclosed purpose, it will obtain your express consent unless permitted or required to do so by law.

MidTermStays undertakes to keep a record of the Personal Information used for advertising and the specific purpose for which it was collected, for the period the information is used and for at least one year thereafter.

You consent to MidTermStays disclosing anonymised Personal Information and User Data to third parties that access the Platform for advertising purposes. MidTermStays will keep a record of any third party to whom your Personal Information was disclosed, the date of disclosure, and the purpose of disclosure, for the period it is used and at least one year thereafter.

MidTermStays undertakes to delete or destroy any Personal Information that has become obsolete or for which the lawful purpose for retention has ended.

9. How We Store and Protect User Data

MidTermStays keeps Personal Information safe using reasonable security measures including:

9.1 Physical Measures

Materials containing Personal Information held in physical form are stored in a locked and access-controlled location.

9.2 Electronic Measures

Computer data containing Personal Information is stored on systems and storage media protected by strict access controls, including multi-factor authentication where appropriate.

9.3 Management Measures

Only authorised personnel are permitted to access Personal Information for the purposes described in this Privacy Policy. Such personnel are bound by our internal confidentiality rules. We also impose physical and logical access controls.

9.4 Technical Measures

We use industry-standard security technologies (including transport-layer encryption, encrypted storage where appropriate, regular vulnerability scanning, and routine backups) and supporting management systems to minimise the risk that your information may be disclosed, damaged, misused, accessed without authorisation, or altered.

10. Disclaimer & User Obligations

While we take all reasonable steps to secure your User Data and Personal Information according to industry standards, it is not possible to guarantee complete security at all times.

Breach notification. We will notify you, and the Information Regulator where required by POPIA, as soon as reasonably practicable after becoming aware of a security compromise affecting your Personal Information.

Your responsibilities. You are responsible for:

• Taking reasonable precautions to safeguard your Personal Information
• Notifying us of any changes to your User Data or Personal Information so it remains accurate
• Maintaining the security of your Account credentials (email, password, two-factor authentication, etc.)
• Notifying us immediately at support@midtermstays.co.za if you become aware of any unauthorised use of your Account or any other security breach affecting you

Limitations of liability. MidTermStays will not be held liable for:

• Losses arising from incorrect User Data or Personal Information provided by Users
• Losses arising from a security breach or disclosure of your Personal Information, to the maximum extent permitted by law
• Any damage or interruption caused by computer viruses, malicious code, phishing, spoofing, or other attacks. MidTermStays recommends the regular use of reputable virus-protection software. SMS and email services are vulnerable to spoofing and phishing — review messages purporting to originate from MidTermStays carefully.
• Disclosure of your Personal Information or User Data by you to a third party

Marketplace position. MidTermStays is not a party to any rental agreement between an Owner and a Tenant and accepts no liability for the conduct of either party, the condition of any property, or the outcome of any rental.

Owner’s downstream use of Tenant data. Once an Owner receives a Tenant’s contact details or profile information through the Platform — whether through an enquiry, a confirmed booking, the optional vetting service, or the optional lease-template service — the Owner becomes an independent responsible party under POPIA in respect of any further processing of that Tenant’s Personal Information for the Owner’s own purposes. This includes (without limitation) the Owner’s own customer-relationship records, additional screening, lease administration, communications, and any onward disclosure to the Owner’s own service providers. MidTermStays does not control, audit, or assume responsibility for the Owner’s downstream processing of Tenant data, and accepts no liability for the Owner’s POPIA compliance in that respect. Tenants who become aware of misuse of their Personal Information by an Owner should contact us at privacy@midtermstays.co.za — we will assist where reasonably possible, including by suspending the Owner’s Account where misuse is established.

Cross-reference to Terms and Conditions. The limitations of liability stated in this Privacy Policy address personal-information harms specifically. Broader limitations of MidTermStays’ liability — including monetary caps and excluded categories of loss — are set out in the Terms and Conditions. In the event of any inconsistency between this Privacy Policy and the Terms and Conditions on the scope or quantum of liability, the Terms and Conditions apply.

11. Record Retention

Unless otherwise required by law or our Terms and Conditions, we retain your records for a period of five years after closure of your MidTermStays Account, or as required by applicable law (including South African tax legislation, which generally requires the retention of financial records for five years from the relevant tax year). After this period we will destroy or anonymise your Personal Information. Anonymised information may be retained for statistical purposes.

12. Transfers of Personal Information

We may transfer your Personal Information outside South Africa for storage or analytical purposes, to which you consent by accepting this Privacy Policy. We may enlist third-party operators in other jurisdictions (including cloud infrastructure providers and analytics providers) to provide these services.

Any jurisdiction to which we transfer Personal Information will be subject to the same standards of protection as required by POPIA, either through binding contractual protections with the third-party operator or because the receiving jurisdiction provides substantially similar protection. Third-party operators are required to treat your User Data and Personal Information as confidential and to apply industry-standard security measures.

13. Cookies

13.1 What Are Cookies?

Cookies are small text files placed on your device by your browser when you visit a website. They are used to collect standard log information and visitor-behaviour information. When you visit midtermstays.co.za we may automatically collect information from you through cookies and similar technologies (web beacons, pixel tags, local storage).

13.2 How We Use Cookies

• To keep you signed in to your Account (where applicable)
• To remember your preferences, settings, and recently viewed listings
• To measure the performance of the Platform and verify the effectiveness of online advertising (via Google Analytics, Meta Pixel, and similar tools)
• To prevent fraud and abuse

13.3 Types of Cookies We Use

Strictly necessary cookies. Required for the Platform to function — login state, security, and core functionality.

Functional cookies. Help us identify you and remember your previous preferences and settings, including device, operating system, preferred language, location, and session data. We use a mix of first-party and third-party cookies.

Analytics cookies. Provided by Google Analytics 4 (or similar) to help us understand how the Platform is used.

Marketing cookies. Used to collect information about your visit, content viewed, links followed, browser and device, IP address, and referral URL — to deliver and measure advertising.

13.4 Managing Cookies

Most browsers are pre-set to accept cookies. You can adjust your browser settings to prevent cookies or be notified when they are set. Stopping all cookies may prevent some Platform features from working correctly.

14. Your Data Protection Rights

Unless otherwise required by law, each User has the following rights under POPIA:

Right of access. You have the right to access or obtain copies of your Personal Information held by us. We may charge a reasonable fee for providing this access in accordance with POPIA. You have the right to be notified when your information is collected.

Right to correction and notification. You have the right to ask us to correct Personal Information you believe is inaccurate or incomplete, within reasonable limits. You have the right to be notified if there is a security compromise affecting your information.

Right to erasure (right to be forgotten). You have the right to request the deletion of your Personal Information in certain circumstances. Where we are required to retain information by law (for example, financial records under tax law), the retention obligation may override an erasure request — we will explain this if it applies to your request.

Right against direct marketing. You have the right, in certain circumstances, to opt out of receiving direct marketing.

Right to restriction of processing. Under certain circumstances required by law, you may request that we restrict the processing of your Personal Information. Such a restriction may prevent your Account from being verified and may prevent us from providing the Services.

Right to object. Under certain circumstances required by law, you may object to the processing of your Personal Information. Such an objection may prevent your Account from being verified and may prevent us from providing some or all of the Services.

Right to complain. If you are unsatisfied with how we have handled a request or an objection, you have the right to lodge a complaint with the Information Regulator (South Africa):

The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: inforeg@justice.gov.za / POPIAComplaints@inforegulator.org.za Website: https://inforegulator.org.za

To exercise any of these rights, contact us at privacy@midtermstays.co.za.

15. Privacy Policies of Other Websites

15.1 Other Websites

If you visit other third-party platforms or partner websites via links on midtermstays.co.za (including our third-party vetting partner’s site, our third-party lease-template partner’s site, or our payment processor’s site), you should review and abide by their separate, independent privacy policies. We are not responsible for the content of those sites or for the activities on them.

15.2 The MidTermStays Ecosystem

This Privacy Policy applies to all platforms, websites, and departments of MidTermStays.

16. Changes to This Privacy Policy

From time to time, MidTermStays may revise this Privacy Policy to reflect changes in law or our personal-data collection, processing, and use practices. Changes will be announced by posting on the Website and/or by direct notification to Users. If you do not agree with a revised Privacy Policy, you may exercise the option to deregister your MidTermStays Account. Continued use of the Platform after an updated version is published constitutes acceptance of the updated Privacy Policy.

17. Dispute Resolution

Any dispute arising in terms of this Privacy Policy will be dealt with, as far as permitted by law, in terms of the Dispute Resolution clause of the Terms and Conditions. Nothing in this clause limits your right to lodge a complaint with the Information Regulator.

18. Contact Us

We are committed to respecting the freedoms and rights of all MidTermStays Users. For any question or concern regarding this Privacy Policy, or to file a data-protection request:

• Anything regarding this Privacy Policy, any data-subject request, or any legal request: legal@midtermstays.co.za (primary)
• Privacy / POPIA data-subject requests (alternate channel): privacy@midtermstays.co.za (routes to legal@ during initial operation
• Information Officer (POPIA s.55): David Nurick, contactable at legal@midtermstays.co.za or privacy@midtermstays.co.za. Registration of the Information Officer with the Information Regulator is pending and must be completed before the platform processes Personal Information at scale.
• General business enquiries (not legal / privacy): info@midtermstays.co.za
• Customer support (account, bookings, security incidents): support@midtermstays.co.za
• Postal address: Guest House Accommodation of South Africa CC, 9 Zastron Road, Milnerton, Cape Town, Western Cape, 7441