Legal

Privacy Policy

How we look after your information — and the rights you have over it.

Effective 13 July 2026 · Last updated 13 July 2026

This Privacy Policy explains how ZD Rewards collects, uses, shares and protects your personal information when you use the ZeroDeposit mobile app and this website. We are committed to handling your information lawfully, transparently and only for the purposes described here, in line with the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

ZD Rewards is operated by ZD Rewards (Pty) Ltd, a company incorporated in the Republic of South Africa. In this policy, "we", "us" and "ZD Rewards" refer to that company. Under POPIA we are theresponsible party for the personal information described here.

We have appointed an Information Officer as your point of contact for privacy matters:

Information Officer: Paul Schaefer
Email:hello@zdrewards.co.za

2. Scope of this policy

This policy covers:

the ZeroDeposit app for iOS and Android; and
the zdrewards.co.za website.

ZD Rewards is a rewards and loyalty programme for renters on a qualifying lease. It works alongside the property-management platform your landlord or managing agent uses. That platform is operated separately and has its own privacy terms; where your landlord or their agent decides how your tenancy information is handled, they are responsible for it and you should also consult their privacy notice.

3. Summary

In short:

We collect the information needed to enrol you in the programme, verify your tenancy, run rewards, and (where you choose to) collect rent-related payments and pay out rewards.
Your mobile number is your account identifier — you sign in with a one-time PIN sent by SMS.
Most of your identity, lease and account-balance information comes from your landlord's or agent's property-management platform, not from a form you fill in.
We share information with a small, defined set of service providers (payments, rewards fulfilment, sign-in, hosting) — listed in full below.
We do not sell your personal information and donot use it for advertising or to track you across other companies' apps. We use only privacy-respecting, anonymous analytics to improve the app.
You can access, correct or delete your information — see your rights.

4. Information we collect

Depending on how you use ZD Rewards, we process the following categories of personal information:

Identity information

Your first and last name, and — where required to set up a payment or debit-order mandate — your South African identity number, passport number or tax number.

Contact information

Your mobile number (which is also your login identifier), email address, and your residential or billing address.

Account and sign-in information

A unique account identifier, your authentication details managed through our sign-in provider (you sign in with an SMS one-time PIN), your programme enrolment status, and a timestamped record that you accepted our Terms.

Tenancy and lease information

Details of your lease and the property you rent — for example the property address, lease start and end dates, your tenancy status and reference codes, and the base rental amount — used to confirm your eligibility and calculate rewards.

Financial and payment information

Where you set up a payment or debit order, we process your bank-account details and debit-order (DebiCheck) mandate information, together with payment amounts, transaction and mandate references, and payment status. Where relevant to your move-out, we process a snapshot of your final account statement and any balance owed or damages, so you can settle your account.We never see or store your full card number or CVV — card payments are entered directly on our payment partner's secure page (seePayments and banking).

Rewards activity

Your points balance, tier, badges and the record of points earned and spent, and the rewards you redeem (such as airtime, data, prepaid electricity or vouchers), including the voucher codes or PINs issued to you.

Device and technical information

A push-notification token for your device (so we can send notifications you have enabled), app-integrity signals used to protect the service from abuse, and server-side logs and error records used to operate and secure the app. Sensitive fields are masked in our logs.

App analytics

We use privacy-respecting analytics to understand how the app is used — for example which features people use and where they get stuck — so we can improve it. This is limited to aggregated and de-identified usage information (such as screens viewed and actions taken) together with a pseudonymous app-instance identifier. We do not use analytics for advertising, and we do not combine it with information from other companies to track you across their apps or websites.

Website information

If you contact us — by email, or through the website contact form once it is enabled — we process the details you send us (such as your name, email and message) to reply to you. We also store a "light or dark mode" preference in your browser, and our hosting provider keeps standard web-server request logs. The website uses no cookies or third-party tracking — see ourCookie and Tracking Notice.

5. Where your information comes from

From you — e.g. your mobile number, email, bank details for a mandate, and anything you enter in the app or contact form.
Automatically from your device — e.g. your push-notification token and app-integrity signals.
From your property-management platform — most of your identity, lease, property and account-balance information is provided to us by the platform your landlord or managing agent uses, when you enrol and when your profile refreshes.
From our service providers — e.g. our payment and rewards partners return transaction results and voucher codes.

6. How we use your information

To create and manage your account and verify your tenancy.
To run the rewards programme — award, track, and let you redeem points and rewards.
To process payments, debit-order mandates and move-out settlements you set up.
To provide statements and let you view your balance and history.
To send you service messages and (with your consent) reminders and updates.
To keep the service secure, prevent fraud and abuse, and debug problems.
To respond to your enquiries and support requests.
To comply with our legal obligations, including financial record-keeping.

7. Legal basis for processing

Under POPIA we rely on one or more of the following justifications:

Performance of a contract / at your request — to enrol you, run the programme, and process payments and settlements you ask for.
Legal obligation — to keep financial and transaction records the law requires us to keep.
Legitimate interests — to secure the service, prevent fraud and abuse, and improve reliability, balanced against your rights.
Consent — for optional push notifications and any direct marketing. You can withdraw consent at any time (see below).

We do not sell your personal information. We share it only with the service providers ("operators" under POPIA) that help us run ZD Rewards, and only to the extent each needs to do its job. These fall into the following categories:

Payment and collection providers — to process payments, debit orders and settlements.
Rewards fulfilment providers — to deliver the airtime, data, electricity and vouchers you redeem.
Sign-in, messaging and app-security providers — to sign you in, send notifications you have enabled, and protect the app from abuse.
Cloud hosting and infrastructure providers — to run the service securely.
Your property-management platform — the system your landlord or managing agent uses, which supplies most of your tenancy information.

We require each provider to process your information only on our instructions and to keep it secure, and we give them only what they need. You can ask us for more detail about the providers we use.

We may also share information where the law requires it (for example, with regulators or in response to a lawful request), to establish or defend legal claims, or as part of a business reorganisation, always subject to appropriate safeguards. The apps are distributed through the Apple App Store and Google Play, which process limited information as app-store operators under their own privacy policies.

9. Cross-border transfers

We host ZD Rewards and its data in South Africa, and most of our providers operate here too. A few process information outside South Africa — for example, certain sign-in, messaging and hosting services. Where information is transferred outside South Africa, POPIA requires an adequate basis for the transfer. We rely on the recipient being subject to laws or binding agreements that provide a comparable level of protection, and/or on your consent, and we transfer only what is necessary for the service.

10. Payments and banking

If you make a card payment, you enter your card details directly on our payment provider's secure hosted page. ZD Rewards never receives or stores your full card number or security code; we only receive the result of the payment and a reference. For debit orders we register a DebiCheck mandate with your authorisation, which requires your bank-account and identity details, and your bank may ask you to approve it. You can ask us to cancel a future mandate at any time, subject to any amounts you still owe under your lease.

11. Rewards and automated decisions

Whether you earn points (for example, for paying on time) is determined automatically from your payment and tenancy records, according to the published programme rules. These calculations do not have legal consequences for you in the sense POPIA is concerned with, but if you believe a rewards decision is wrong you can ask us to review it — a person will look into it. Contact the Information Officer using the details below.

12. Notifications and marketing

We send service notifications (for example about payments, rewards and your account) as part of providing the service. Push notifications are optional — you choose whether to enable them on your device, and you can turn them off in the app or your device settings at any time. We send direct marketing only with your consent (you opt in — it is off by default), and you can withdraw that consent at any time; every marketing message also includes a way to opt out. Turning off marketing does not affect essential service messages.

13. How we protect your information

We take appropriate, reasonable technical and organisational measures to safeguard your information, including:

encrypting data in transit using HTTPS/TLS;
capturing card details directly on our payment partner's own secure hosted page, so your full card number never reaches our systems;
masking sensitive fields (such as identity, banking and contact details) in our logs;
app-integrity and anti-abuse checks, per-request authentication, and non-guessable account identifiers;
restricting access to personal information to those who need it to do their work;
storing only the minimum necessary on your device; and
hosting in a South African data-centre region with regular backups.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security compromise affecting your personal information occurs, we will notify the Information Regulator and affected users as required by POPIA.

14. How long we keep your information

We keep your personal information only for as long as needed for the purposes above, and then delete or anonymise it — except where we are required or entitled to keep it longer. In particular:

Account and tenancy records — for as long as your account is active, and for a reasonable period afterwards.
Financial and transaction records — retained for the period required by South African tax and financial-record-keeping law (generally at least five years).
Rewards ledger and redemption records — retained as a tamper-evident record of points and rewards for fraud prevention and audit, and de-identified when you close your account so they no longer identify you (see the Account & Data Deletionpage).
Logs — kept for a limited period for security and troubleshooting.

Once information is no longer needed for these purposes, we delete or anonymise it.

15. Your rights

Subject to POPIA, you have the right to:

ask whether we hold personal information about you, and to a copy of it;
ask us to correct or update information that is inaccurate or incomplete;
ask us to delete or destroy information we are no longer entitled to keep;
object, on reasonable grounds, to certain processing;
withdraw consent where we rely on it (this does not affect processing before withdrawal); and
complain to the Information Regulator.

To exercise any of these rights, emailhello@zdrewards.co.za. We may need to verify your identity first. We will respond within a reasonable time and as required by law. Some information — such as records we must keep by law or the permanent rewards ledger — may be retained even after a deletion request; we will explain what we can and cannot delete.

16. Deleting your account

You can ask us to delete your ZD Rewards account and associated personal information. Full details of how to request deletion, what is removed, and what we must keep are on ourAccount & Data Deletion page.

17. Children's privacy

ZD Rewards is intended for adults (18 and older) who hold a qualifying lease and have the capacity to enter into a rental and payment arrangement. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

18. Cookies and tracking

Our website does not use cookies or third-party tracking. Our app uses only privacy-respecting, anonymous analytics to improve the service, and contains no advertising or cross-app tracking software. For the detail, see ourCookie and Tracking Notice.

19. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of ZD Rewards after an update means you accept the revised policy.

20. How to contact us and complain

For any privacy question or request, contact our Information Officer athello@zdrewards.co.za.

If you are not satisfied with how we have handled your information, you may lodge a complaint with the Information Regulator (South Africa):

Website: https://inforegulator.org.za
Email:POPIAComplaints@inforegulator.org.za

Questions about this document? Emailhello@zdrewards.co.za orget in touch.