Privacy Policy

1. Who we are

Elevate Management is a property and portfolio management platform. The platform is operated by HexaCode (the operator). When you register as a managing agent or trustee, you use the platform to process personal information about owners, tenants, visitors, contractors, and staff on behalf of your body corporate, HOA, or agency (you remain the responsible party for that information).

2. Information we collect

Through the platform we may process:

• Account details — name, email, phone, login credentials
• Complex and company branding — names, addresses, registration numbers, logos
• Owner and tenant records — contact details, unit links, financial balances, documents
• Visitor and contractor access data — names, phone numbers, vehicle registrations
• Financial and trust accounting records — invoices, levies, payments, bank reconciliation (which may include bank account details for EFT payments)
• Communications metadata — email and WhatsApp delivery where enabled
• Support tickets and audit log entries
• Optional AI assistant queries — when your complex has enabled that feature

3. How we use information

We process personal information to:

• Provide, secure, and improve the Elevate Management service
• Authenticate users and enforce role-based access
• Send transactional notifications (invoices, statements, portal links, reminders)
• Process subscription billing and support requests
• Meet legal, regulatory, and accounting obligations
• Detect abuse, fraud, and security incidents

We only process personal information for the specific purposes listed in this policy and do not use it for incompatible purposes without notifying you. We do not use personal information for automated decision-making that has legal effects on you, except as required for fraud detection.

4. Lawful basis

Processing is based on:

• Contract — providing the service you signed up for
• Legitimate interests — security, service improvement, billing
• Legal obligation — where applicable (e.g., trust accounting requirements)
• Consent — where required (e.g., optional marketing communications)

For processing of owner and tenant data, managing agents are responsible for obtaining and managing consent within the platform's consent management features.

5. Sharing and operators

We may share information with:

• Cloud hosting and infrastructure providers
• Email and WhatsApp delivery providers
• Payment gateways (for example PayFast, Yoco, Ozow) for online payments
• OpenAI or similar providers when the AI assistant is enabled for your complex (queries are anonymised where technically feasible before being sent)
• Professional advisers where required by law

We do not sell personal information. Managing agents must have their own POPIA compliance programme for data they control about owners and tenants.

A full list of subprocessors and their locations is available upon request.

6. Cross-border transfers

Some subprocessors may process data outside South Africa. Where this occurs, we implement appropriate safeguards required under POPIA, including standard contractual clauses or equivalent transfer mechanisms.

A list of subprocessors and their locations is available upon request.

7. Security

We apply technical and organisational measures including access controls, encrypted transport (HTTPS), password policies, and audit logging. No system is completely secure; please report suspected incidents promptly using the contact details below.

8. Retention

We retain platform account, billing, and operational data for as long as needed to provide the service, meet legal and trust accounting requirements, and resolve disputes. Retention periods for levy and trust records may be longer than general account data.

When retention ends, we will securely delete or anonymise the data within a reasonable timeframe, except where we are required by law to retain it for longer. You may request a data destruction certificate upon request.

9. Your rights

Under POPIA you may request:

• Access to your personal information
• Correction of inaccurate information
• Deletion of information (where applicable)
• Objection to certain processing

We will respond to data subject requests within 30 days as required by POPIA. To exercise rights relating to platform account data, contact us using the details below. For owner or tenant data held on behalf of your complex, contact your managing agent or body corporate in the first instance.

10. Information Officer and contact

Support: marshantviktor97@gmail.com

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by a new version number shown at the top of this page. Where required, continued use of the platform after notice may require renewed acceptance in the admin panel. The current version is 2026.06.01.