1. Information We Collect
Account details: Full name, email address, and profile photo collected via Google OAuth at registration. Phone number collected and validated before a user can submit their first booking.
Booking and listing data: Reservation details including dates, times, party size, booking mode (private or shared), total price, payment status, and booking reference numbers. Space listing data including address, GPS coordinates, photos, pricing, capacity, amenities, and house rules.
Identity and verification data: Phone numbers are validated against South African number formats. Google OAuth provides verified email addresses as a base identity signal. We do not currently collect government-issued identity documents but reserve the right to introduce additional KYC steps where required by our payment provider or applicable law.
Payment and transaction data: Paystack transaction references, payment authorisation status, payout records, and service fee calculations. Occushare does not store full card numbers, CVV codes, or raw banking details — these are handled exclusively by Paystack.
Communications: Messages sent between guests and hosts through the Occushare in-platform messaging system. Support correspondence submitted to Occushare staff.
Technical and usage data: Device type, browser, IP address, pages visited, search queries, and interaction events used for platform performance monitoring and abuse detection.
2. How We Use Your Information
Booking operations: To process and confirm bookings, hold and release payments via Paystack, send booking confirmations and receipts, and enable communication between guests and hosts.
Identity and fraud prevention: To verify user identity at sign-up, validate phone numbers before booking, detect fraudulent accounts or transactions, and enforce platform policies.
Dispute resolution: To investigate disputes between guests and hosts, review evidence submitted by either party, and make fair determinations on refund or damage claims.
Platform improvement: To analyse booking patterns, search behaviour, and feature usage to improve the product, search relevance, and user experience.
Legal and compliance: To comply with South African law including POPIA, respond to lawful requests from authorities, and maintain records required for financial and regulatory compliance.
Communications: To send transactional messages (booking confirmations, payment receipts, dispute updates) and, where consented, platform updates or promotional content.
3. Legal Bases for Processing (POPIA)
Occushare processes personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA). Our legal grounds for processing include:
— Contractual necessity: processing required to perform the booking contract between Occushare, hosts, and guests
— Legal obligation: processing required to comply with South African law, including financial record-keeping and reporting obligations
— Legitimate interests: processing required for fraud prevention, platform security, and dispute resolution
— Consent: where we send optional marketing communications, we rely on your consent which you may withdraw at any time
4. Information Sharing
With hosts: When a guest books a space, the host receives the guest's name, profile photo, phone number (after booking confirmation), party size, and booking details necessary to facilitate check-in and space access.
With guests: Guests can view the host's name, profile photo, space address (after booking confirmation), and contact information needed to coordinate their visit.
With Paystack: Payment transaction data including booking amounts, references, and payout details are shared with Paystack for payment processing and disbursement. Paystack operates under its own privacy policy and PCI-DSS compliance framework.
With service providers: Cloud infrastructure (for hosting and storage), analytics tools, and customer support systems — all under contractual data processing agreements that restrict use to service delivery only.
With authorities: Where required by South African law, court order, or to prevent imminent fraud, harm, or serious security incidents, we may disclose information to law enforcement or regulatory bodies.
5. Marketplace Payments and Financial Data
Occushare operates as a marketplace that receives and holds payments on behalf of hosts. When a guest pays for a booking, the funds are received by Occushare through Paystack and held until the booking is completed, at which point the host is paid out minus Occushare's service commission.
Payment transactions are processed exclusively by Paystack. Occushare does not store card numbers, CVV codes, or raw banking credentials on its own systems.
When instant booking is disabled, a guest's payment is placed on hold (authorised but not captured). If the host declines, the authorisation is voided and no charge is made. If the host accepts, the payment is captured.
Paystack transaction references, booking amounts, service fees, and payout records are retained by Occushare for accounting, dispute resolution, and regulatory compliance purposes.
6. Cookies and Tracking
Occushare uses essential cookies for session management, authentication state, and platform security. These are required for the platform to function and cannot be disabled.
We may use analytics tools to understand how users navigate the platform in aggregate. Analytics data is used solely for product improvement and is not sold to third parties.
You can manage non-essential cookie preferences through your browser settings. Disabling essential cookies may prevent certain platform features from functioning correctly.
7. Data Retention
We retain personal information only as long as necessary for the purposes described in this policy, subject to legal and operational requirements:
— Active account data: retained for the lifetime of the account and for a reasonable period after deletion to handle outstanding disputes or legal claims
— Booking and payment records: retained for a minimum of 5 years for accounting, tax, and legal compliance
— Support communications: retained for up to 3 years
— Platform usage and analytics data: retained in anonymised or aggregated form for product analysis
Upon account deletion request, we will remove personally identifiable information within a reasonable timeframe, except where retention is required by law.
8. Your Rights Under POPIA
Right to access: You may request a copy of the personal information Occushare holds about you by contacting info@occushare.co.za.
Right to correction: You can update your name, profile photo, and phone number directly from your account settings. For other corrections, contact us.
Right to deletion: You may request deletion of your account and associated personal data. Requests will be processed within a reasonable timeframe subject to legal retention requirements for booking and financial records.
Right to object: You may object to processing for direct marketing at any time by using the unsubscribe link in any marketing email or contacting us directly.
Right to lodge a complaint: If you believe your personal information has been processed unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg.
9. Security
Occushare applies industry-standard technical and organisational safeguards to protect personal information, including HTTPS encryption for all data in transit, access controls limiting data access to authorised personnel, and regular security reviews of platform infrastructure.
Payment data security is handled by Paystack under their PCI-DSS compliance framework. Occushare does not store sensitive card data.
If you believe your account has been compromised, contact us immediately at info@occushare.co.za. In the event of a data breach affecting your personal information, we will notify affected users and the Information Regulator as required by POPIA.
10. Cross-Border Processing
Some of our service providers, including cloud infrastructure and analytics tools, may process data in countries outside South Africa. Where this occurs, we ensure appropriate contractual safeguards are in place to protect your information in compliance with POPIA's conditions for cross-border transfers.
11. Children's Privacy
Occushare is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered an account, please contact us at info@occushare.co.za and we will promptly remove the account.
12. Changes and Contact
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised effective date. Where required by POPIA, we will notify registered users of significant changes directly.
To exercise your rights, submit a privacy request, or ask questions about this policy, contact our Information Officer at: info@occushare.co.za
To report a compliance concern or lodge a complaint, you may also contact the Information Regulator of South Africa: www.justice.gov.za/inforeg
