Privacy Policy

This Privacy Policy explains how The Millstock (“The Millstock”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal information when you visit this website, enquire about accommodation, or submit an accommodation application.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African laws.

The Millstock is the responsible party for the personal information processed through this website and the accommodation application process.

Address: 260 Main Road, Observatory, Cape Town

Email: info@themillstock.co.za

Telephone: 063 642 4898

Depending on how you interact with us, we may collect:

• Identity information, including your full name and student number.
• Contact information, including your email address and telephone number.
• Accommodation information, including your preferred year, room or pricing option, intended move-in and move-out dates, and application notes.
• Application and tenancy information, including application status, assigned room, lease details, correspondence, and supporting information you provide.
• Billing and payment information required to administer fees, deposits, rent, invoices, and payment status. Payment card details are processed by the applicable payment provider and are not stored by this public application form.
• Technical information, including IP address, browser type, device information, access times, pages visited, and security or diagnostic logs.
• Any other information you voluntarily provide when contacting or corresponding with us.

Please provide only information that is accurate, relevant, and necessary for your enquiry or application.

We collect personal information directly from you when you complete an online application, contact us, sign a lease, make a payment, or otherwise communicate with us.

We may also receive information from a parent, guardian, guarantor, educational institution, payment provider, service provider, reference, or other person where this is lawful and reasonably necessary for your application or tenancy.

We may process personal information to:

• Receive, assess, verify, approve, or decline accommodation applications.
• Contact applicants and respond to enquiries.
• Check room availability and assign accommodation.
• Prepare, conclude, and administer lease agreements.
• Administer deposits, rental, invoices, payments, and outstanding amounts.
• Provide accommodation services and manage resident relationships.
• Maintain the safety, security, access control, and proper operation of the residence.
• Send operational notices, decisions, room information, rules, and welcome materials.
• Maintain records, prevent fraud or misuse, secure our systems, and resolve disputes.
• Comply with legal, accounting, regulatory, and law-enforcement obligations.
• Improve our website, application process, services, and communications.

We process personal information where one or more of the following applies:

• You have consented to the processing.
• Processing is necessary to consider your application, conclude a lease, or perform our obligations under an agreement with you.
• Processing is required to comply with a legal obligation.
• Processing protects your legitimate interests or those of another person.
• Processing is necessary for our legitimate interests or those of a third party, provided your rights and interests are appropriately protected.

You may withdraw consent where processing relies on consent. Withdrawal does not affect processing that took place lawfully before the withdrawal, and we may continue processing where another lawful justification applies.

Certain information is required for us to assess an application, communicate a decision, prepare a lease, allocate a room, or meet legal requirements. If you do not provide required information, we may be unable to process your application or provide accommodation services.

We do not sell personal information. We may share relevant information with:

• Our authorised employees, managers, administrators, and professional advisers.
• Service providers that support hosting, databases, email, communications, document storage, security, maintenance, billing, and payment processing.
• Payment providers and financial institutions where necessary to process or verify payments.
• Guarantors, parents, or guardians where authorised, contractually required, or otherwise permitted by law.
• Government bodies, regulators, courts, law-enforcement authorities, or other parties where required or permitted by law.
• A purchaser, successor, or relevant adviser in connection with a lawful business transaction, subject to appropriate confidentiality and data-protection measures.

Recipients may use personal information only for the authorised purpose and must protect it appropriately.

Some service providers may process or store information outside South Africa. Where personal information is transferred internationally, we take reasonable steps to ensure that the recipient is subject to a law, agreement, binding corporate rules, or other safeguards that provide an adequate level of protection as required by POPIA.

We use reasonable technical and organisational safeguards designed to protect personal information against loss, unauthorised access, interference, alteration, disclosure, or destruction. These measures may include access controls, authentication, secure hosting, backups, monitoring, and limiting access to authorised persons.

No online system is completely secure. If we become aware of a security compromise affecting your personal information, we will take reasonable steps to contain and investigate it and will notify affected persons and the Information Regulator where POPIA requires us to do so.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to administer an application or tenancy, to enforce or defend legal rights, and to meet legal, tax, accounting, and regulatory obligations. When information is no longer required, we will delete, destroy, or de-identify it in a reasonably secure manner, unless continued retention is permitted or required by law.

This website may use essential cookies or similar technologies needed for security, navigation, form operation, and basic functionality. We and our hosting or infrastructure providers may also process technical logs to maintain and protect the website.

You can control cookies through your browser settings. Blocking essential cookies may affect how parts of the website function.

We may send communications directly related to your enquiry, application, lease, payments, or residence. We will send electronic direct marketing only where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe method provided or by contacting us. Opting out of marketing will not stop necessary service or tenancy communications.

If an applicant is under 18, a parent or legal guardian may need to provide consent and participate in the application or lease process. We do not knowingly process children’s personal information without appropriate authorisation or another lawful basis under POPIA.

Subject to POPIA and applicable limitations, you may:

• Ask whether we hold personal information about you.
• Request access to your personal information.
• Ask us to correct, update, delete, or destroy inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained information.
• Object to certain processing on reasonable grounds.
• Withdraw consent where processing is based on consent.
• Object to direct marketing.
• Submit a complaint to the Information Regulator.

We may need to verify your identity before responding. Some requests may be refused or limited where the law requires or permits us to retain or continue processing information.

To ask a privacy question or exercise a data-protection right, contact us at info@themillstock.co.za. Please describe your request clearly and provide enough information for us to identify the relevant records.

If you believe your personal information has been processed contrary to POPIA, you may lodge a complaint with the Information Regulator (South Africa). Current complaint procedures and contact channels are available on the regulator’s official website.

We may update this Privacy Policy when our practices, services, or legal obligations change. The latest version will be published on this page with its effective date. Material changes may also be communicated through an appropriate additional notice.