Effective date: 14 July 2026

Helmsley Country Estate (“Helmsley”, “we”, “us” or “our”) respects your privacy and is committed to processing personal information lawfully, reasonably and securely. This Privacy and POPIA Policy explains how we collect, use, store and share personal information when you visit www.helmsleyestate.co.za, use our interactive masterplan, submit an enquiry, request a viewing, communicate with our sales team, attend an estate appointment, or otherwise interact with us.

For purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), Helmsley is the responsible party for personal information processed through this website and its property sales and marketing activities.

1. Scope

This policy applies to website visitors, prospective purchasers, purchasers, representatives, service providers and other people whose personal information we process in connection with Helmsley. It should be read together with our Website Terms and Conditions and any additional privacy notice provided for a specific transaction or service.

2. What is personal information?

Personal information is information relating to an identifiable living person and, where applicable, an identifiable juristic person. It includes contact, identification, demographic, financial, electronic and property-related information. “Processing” includes collecting, receiving, recording, organising, storing, updating, using, sharing, securing and deleting personal information.

3. Personal information we may collect

• Contact and identity information: your name, email address, telephone number, preferred contact method and, where required for a transaction, identity or company details.
• Property-enquiry information: plots or home designs viewed or selected, budget range, purchase timeframe, viewing preferences, questions, messages and other information you choose to provide.
• Sales and transaction information: offers, reservations, agreements, proof of payment, FICA-related documents and information reasonably required to administer a property transaction. These records may be collected through secure channels outside the public website.
• Marketing information: consent records, communication preferences, campaign source, enquiry source and your interaction with our communications.
• Website and device information: IP address, browser, device type, operating system, pages visited, referring page, timestamps, approximate location derived from an IP address, cookie identifiers and technical logs.
• Appointment and estate-visit information: appointment details and reasonable visitor or access information required for safety, security and visitor management.
• Correspondence: emails, telephone notes, WhatsApp messages and other communications with Helmsley or its authorised sales representatives.

Please do not send special personal information, financial account credentials or identity documents through a general website enquiry form unless we specifically request them through an appropriate secure process.

4. How we collect personal information

We collect information directly from you when you complete a form, select a plot, contact us, subscribe to communications, attend a viewing or proceed with a transaction. We may also receive information from an authorised representative, estate agent, professional adviser, referral partner, public record or service provider where this is lawful. Technical information is collected through the website, server logs, cookies and similar technologies.

5. Why we process personal information

We may process personal information to:

• respond to enquiries and arrange private viewings;
• help you compare plots, homes, availability and property information;
• manage leads, sales opportunities and customer relationships in our CRM;
• prepare, negotiate and administer reservations, offers, agreements and property transactions;
• verify information and comply with legal, regulatory, tax, accounting, FICA and record-keeping obligations;
• communicate service, appointment, construction, sales or estate-related information;
• send marketing where we have a lawful basis and provide a simple opt-out;
• operate, secure, troubleshoot and improve the website, interactive maps and digital services;
• measure campaign and website performance and understand visitor interests;
• prevent fraud, misuse, spam, security incidents and unlawful activity;
• establish, exercise or defend legal rights; and
• comply with lawful requests from regulators, courts and public authorities.

6. Lawful grounds for processing

Depending on the circumstances, we process personal information with your consent; to take steps at your request before entering into an agreement; to perform an agreement; to comply with a legal obligation; to protect a legitimate interest of you or another person; or to pursue our legitimate business interests where these do not unjustifiably infringe your rights.

Where information is mandatory, we will indicate this or explain it. If you do not provide information required to answer an enquiry, arrange a viewing, verify a purchaser or conclude a transaction, we may be unable to provide the relevant service.

7. Direct marketing

We will send electronic direct marketing only where permitted by POPIA and other applicable law. Where consent is required, you may refuse or withdraw it without charge. Every marketing communication will provide an opt-out method, or you may email info@helmsleyestate.co.za. Opting out of marketing does not prevent us from sending communications necessary to respond to an enquiry or administer an existing relationship or transaction.

8. Cookies, analytics and similar technologies

The website may use:

• essential cookies needed for security, forms, sessions and basic operation;
• preference cookies that remember selections and improve usability;
• analytics cookies that help us understand website use and performance; and
• marketing technologies used to measure campaigns or show relevant advertising, where enabled and lawfully permitted.

Our website may use services supplied by WordPress hosting providers, Google, Meta, map or tile providers, email providers, Supabase and other technology operators. These providers may receive technical identifiers necessary to deliver their services. You can restrict non-essential cookies through any consent tool provided on the website and through your browser settings, although blocking essential technologies may affect functionality.

9. Sharing of personal information

We do not sell personal information. We may share it only where reasonably necessary with:

• Helmsley’s authorised sales, development, estate-management and administrative teams;
• estate agents, contractors and professional advisers involved in an enquiry or transaction;
• technology, CRM, hosting, cloud-storage, analytics, communications, mapping, security and support providers acting under appropriate obligations;
• banks, conveyancers, attorneys, auditors, accountants and compliance providers where relevant to a transaction;
• regulators, courts, law-enforcement authorities or other persons where disclosure is required or permitted by law; and
• a successor, purchaser or adviser involved in a lawful reorganisation or transfer of the relevant business or development, subject to appropriate safeguards.

Operators processing information on our behalf are required to protect it and use it only for authorised purposes.

10. Cross-border processing

Some technology providers or their infrastructure may be located outside South Africa. Where personal information is transferred across borders, we will take reasonably appropriate steps to ensure that the recipient is subject to a law, agreement, binding corporate rules or other safeguards providing an adequate level of protection as contemplated by POPIA, or that another lawful basis for the transfer applies.

11. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to maintain appropriate sales and transaction records, to comply with legal obligations, resolve disputes and enforce agreements. Retention depends on the nature of the information and relationship. Enquiries that do not proceed may generally be reviewed for deletion or anonymisation after a reasonable inactivity period; transaction and compliance records may be retained for the periods required by law. When information is no longer required, we securely delete, destroy or de-identify it.

12. Security

We apply reasonable technical and organisational safeguards appropriate to the nature of the information, including access controls, role-based permissions, secure connections, authentication, backups, monitoring and service-provider controls. No internet service is completely risk-free. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects as required by POPIA.

13. Your POPIA rights

Subject to applicable law, you may:

• ask whether we hold personal information about you and request access to it;
• request correction, completion, deletion or destruction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;
• object, on reasonable grounds, to certain processing;
• withdraw consent where processing is based on consent;
• object at any time to direct marketing;
• request information about the identity of third parties who have had access to your information where applicable;
• not be subject to a decision based solely on automated processing where POPIA provides protection; and
• lodge a complaint with the Information Regulator.

To exercise a right, contact info@helmsleyestate.co.za. We may need to verify your identity and authority before releasing or changing information. We will respond within a reasonable period and explain any lawful basis on which a request cannot be fully granted.

14. Children

The website and property-enquiry services are intended for adults. We do not knowingly solicit personal information directly from children without the consent of a competent person or another lawful basis. If you believe a child’s information has been submitted improperly, please contact us.

15. Third-party websites

Links, embedded maps and third-party services may be governed by their own terms and privacy policies. We do not control independent third parties and encourage you to review their policies before providing information to them.

16. Information Officer and privacy contact

Responsible party: Helmsley Country Estate
Information Officer / privacy enquiries: The duly appointed Information Officer
Email: info@helmsleyestate.co.za
Telephone: +27 82 525 2488
Address: Helmsley Country Estate, D176, Ballito, KwaZulu-Natal, South Africa

17. Complaints to the Information Regulator

We ask that you contact us first so that we can try to resolve your concern. You may also lodge a POPIA complaint through the Information Regulator’s eServices portal at eservices.inforegulator.org.za.

Information Regulator (South Africa)
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

18. Changes to this policy

We may update this policy to reflect legal, operational or technology changes. The current version will be published on this page with its effective date. Material changes may also be communicated through the website or another appropriate channel.