POPIA & Data Subject Rights

You're probably reading this because an estate agency has messaged you on WhatsApp using PropChat, and you'd like to know what your rights are under South African law and how to use them.

The short answer: your rights under the Protection of Personal Information Act, 4 of 2013 ("POPIA") are wide-ranging. The most useful one right now is probably the right to opt out — reply STOP to any message and the agency cannot lawfully contact you again on that number through PropChat.

1. Who is responsible for the message you received

Under POPIA, the Responsible Party for a piece of personal information is the entity that decides what to do with it — why it is collected, who it is shared with, how long it is kept. Under POPIA Section 1, an Operator is a different entity that processes the information on the Responsible Party's instructions and does not decide those things itself.

For the message you received:

• The estate agency that sent the message is the Responsible Party for your personal information. They decided to contact you, they hold the lawful basis they say they have, and they own the consent record.
• PropChat is the Operator — the messaging infrastructure that delivered the message on the agency's instructions. We do not decide who you are, why you were contacted, or what is said. We also do not own the data; the agency does.

This is not a runaround. POPIA explicitly defines this split, and it determines who must answer your access / correction / deletion request: the agency, not us.

2. Your rights under POPIA

POPIA Sections 23, 24, and 25 give you the following rights:

2.1 Right to know who has your data (Section 23(1)(a))

You can ask the agency for confirmation that they hold your personal information.

2.2 Right of access (Section 23(1)(b))

You can ask the agency for a copy of the personal information they hold about you. They must provide it within a reasonable time at no or limited cost.

2.3 Right to correction or deletion (Section 24)

If the personal information is wrong, misleading, outdated, or excessive — or if the agency has no lawful ground to keep processing it — you can ask the agency to correct or delete it.

2.4 Right to object to processing (Section 11(3))

You can object to the processing of your personal information at any time. Where the processing is for direct marketing, the right to object is unconditional and you do not need to give a reason — POPIA Section 69 gives you the right to opt out of every direct-marketing communication you receive.

2.5 Right to lodge a complaint (Section 74)

If you believe an agency has processed your personal information unlawfully — for example, you never gave consent and there is no other lawful basis you can see — you can lodge a complaint with the Information Regulator (see Section 5 below). You do not need permission from the agency or from PropChat to do this.

3. How to exercise your rights — the practical path

Step 1: Reply STOP

If you do not want to receive further messages, the fastest action is to reply STOP (or any of: UNSUBSCRIBE, OPT OUT, CANCEL, NO, REMOVE) to the message. The opt-out is enforced platform-wide:

• The agency cannot send to you again from any of its channels (campaigns, inbox replies, automated flows).
• The opt-out is sticky — it persists across re-imports of contact lists.
• If you ever change your mind, reply START (or SUBSCRIBE / YES) to re-permission.

Step 2: Contact the agency directly

For substantive POPIA requests — access, correction, deletion, full objection — you must contact the agency. They are the Responsible Party. Their contact details should be in the privacy notice they showed you when collecting your information, or in the WhatsApp message you received.

If you cannot find the agency's contact details, write to privacy@propchat.co.za with the phone number you received the message on and any other identifying detail (the agency name shown in the message, the date, the message body). PropChat will:

• Identify which agency sent the message;
• Forward your request to the agency without undue delay;
• Confirm to you that we have done so;
• Where the agency does not respond within a reasonable time, follow up with the agency on your behalf.

PropChat cannot directly grant a POPIA access / correction / deletion request on the agency's behalf because we do not have the legal authority to make decisions about the agency's data. We can and will ensure the request reaches the Responsible Party.

Step 3: Lodge a complaint with the Information Regulator

If you have approached the agency and are not satisfied with the outcome, or if you believe the agency has no lawful basis to be processing your information at all, you have the unconditional right to lodge a complaint with the South African Information Regulator. Details in Section 5 below.

4. PropChat's Information Officer

The Information Officer is the contact point for any privacy concerns about PropChat as Operator — including requests to be told which agency sent you a message, complaints about how an agency handled a request you made of them, or questions about how the PropChat platform itself treats your data.

5. The Information Regulator

6. About the lawful basis claim — for the curious

POPIA does not say "no cold marketing without consent" outright. It says (in Sections 11 and 69) that direct marketing requires either consent or some other listed lawful ground, and that where the Responsible Party already has the data subject's contact details obtained in the context of a sale or service, certain directly- related direct marketing is permitted without fresh consent (Section 69(3)).

For estate agencies, the question of whether the public deeds-office record of a property purchase counts as "details obtained in the context of a sale" is a live legal question. PropChat treats it as permissible for a single first-touch message bearing mandatory in-message opt-out language, with the agency attesting to a documented lawful basis at import time.

If you believe the agency contacting you does not have a lawful basis, the correct route is the complaint to the Information Regulator. A successful complaint can result in significant fines against the agency under POPIA Section 107.

7. Effective date

This page is effective as of 2026-05-06, version 2026-05-06-cold-outreach-draft.