Privacy Policy

This Privacy Policy explains how Flipside Up (Pty) Ltd(“we”, “us”, or “our”), trading as Orogin, collects, uses, stores, shares, and protects personal information when you visit our website, create an account, use our software platform, or interact with us in any other way.

We process personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Promotion of Access to Information Act, 2 of 2000 (“PAIA”), and other applicable laws of the South Africa.

By using Orogin, you acknowledge that you have read this Privacy Policy. Where consent is required, we will request it separately and in a clear manner.

For the purposes of POPIA, the responsible party is:

Flipside Up (Pty) Ltd
Registration No.: 2019 / 112213 / 07
VAT No.: 4880325164
Trading as: Orogin
Physical address: Le Coste Lifestyle Estate, Cape Town, South Africa
Email: info@orogin.co.za
Information Officer: David Botha
Tel: 071 852 0047

POPIA-related requests, complaints, or questions about this policy should be directed to the Information Officer at the contact details above.

Oroginis a cloud-based property development management platform used by developers, sales teams, project managers, and related staff (“Organisation Users”), and by purchasers of property units (“Buyers”).

Organisation Users. When a property developer or related business registers forOrogin, Flipside Up (Pty) Ltd is generally the responsible party for the personal information of account holders and Organisation Users.

Buyer and customer data. Organisation Users upload and manage personal information relating to their Buyers (including FICA documents, contact details, sale records, finish selections, snag lists, and messages). In respect of that information, the Organisation (the developer or agency using Orogin) is typically the responsible party and Flipside Up (Pty) Ltdacts as an operator processing personal information on the Organisation’s instructions, subject to our agreement with that Organisation and this Privacy Policy.

If you are a Buyer and wish to exercise your POPIA rights in relation to information held about you in connection with a specific development or sale, you may contact the developer or agency concerned directly. We will assist Organisation Users to respond to valid requests where required.

Depending on how you use Orogin, we may collect the following categories of personal information:

4.1 Account and identity information

• Full name, email address, and password (stored in hashed form)
• Company or organisation name, job role, and profile details (including optional avatar image)
• Authentication logs, session identifiers, and security-related metadata
• Communications with our support team

4.2 Organisation and billing information

• Organisation name, contact email, telephone number, and business address
• Subscription plan, trial status, billing history, and payment references
• Payment tokenisation and transaction metadata processed by our payment provider (we do not store full card numbers on our servers)

4.3 Buyer and sale information (processed on behalf of Organisations)

• Buyer name, email address, telephone number, identity number, residential address, and buyer type (individual, company, trust, or other entity)
• Sale and reservation details including unit purchased, purchase price, deposit and bond information, sale stage, agent details, and notes
• Finish selections, optional upgrades, special finish requests, and related pricing
• Snag lists, inspection records, photographs, and handover-related information
• Construction milestone progress linked to a Buyer's unit

4.4 FICA and compliance documents

Where required for property transactions and anti-money-laundering compliance, Organisation Users and Buyers may upload documents such as identity documents, proof of address, bank statements, proof of income, company registration documents, trust deeds, and related verification materials. These may contain special personal information as defined in POPIA.

4.5 Documents, images, and files

• Development brochures, architectural plans, sale agreements, OTPs, compliance certificates, site plans, and other files uploaded to the platform
• File names, types, sizes, upload timestamps, and uploader identity

4.6 Communications

• Unit-level chat messages, internal staff notes, @mentions, and linked document references
• System-generated notifications about sales progress, finishes, compliance deadlines, and similar events
• Email delivery metadata for invitations, password resets, and account confirmations

4.7 Technical and usage information

• IP address, browser type, device information, and approximate location derived from IP
• Pages viewed, features used, timestamps, and error logs
• Cookies and similar technologies used to maintain secure sessions (see section 12)

• Directly from you when you register, sign in, update your profile, subscribe, or contact support
• From Organisation Users who create buyer records, upload documents, or invite team members and Buyers
• From Buyers who register for the buyer portal, submit FICA documents, select finishes, or send messages
• Automatically through your use of the platform, including server logs and session cookies
• From third-party authentication and payment providers where you choose to use those services

We process personal information for the following purposes:

• Providing, operating, maintaining, and improving the Orogin platform
• Creating and administering user accounts and organisations
• Enabling property developers to manage developments, units, sales pipelines, buyers, finishes, construction, compliance, documents, and team collaboration
• Enabling Buyers to view their unit, submit FICA documents, select finishes, track construction, report snags, access documents, and communicate with the development team
• Processing subscriptions, trials, invoices, and payments
• Sending service-related communications (account verification, security alerts, invitations, and transactional notifications)
• Monitoring platform security, preventing fraud and abuse, and enforcing our Terms and Conditions
• Complying with legal and regulatory obligations, including record-keeping and lawful requests from authorities
• Generating aggregated, de-identified analytics to understand platform usage and improve our services

We rely on one or more of the following grounds under POPIA, as applicable:

• Performance of a contract — to provide the platform and related services you or your Organisation have requested
• Consent — where required, for example optional marketing communications or certain document uploads
• Legitimate interests — to secure our platform, prevent misuse, and improve our services, balanced against your rights
• Legal obligation — including FICA-related processing instructed by Organisation Users, tax and accounting records, and responses to lawful requests
• Protection of a legitimate interest of the data subject or third party — in limited circumstances relating to fraud prevention and security

We do not sell personal information. We may share personal information with:

• Organisation Users within your organisation according to role-based permissions you or your administrator configure
• Buyers and staff participants in unit-level communication threads to the extent necessary for the transaction
• Infrastructure and hosting providers (including database, authentication, file storage, and application hosting services)
• Payment processing partners (Paystack) for subscription billing and payment tokenisation
• Email and notification delivery services used to send account and transactional messages
• Professional advisers (legal, accounting, or technical) bound by confidentiality obligations
• Law enforcement, regulators, courts, or other authorities when required by law or to protect rights, safety, and security
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections

Organisation Users are responsible for ensuring they have a lawful basis to upload Buyer information to Orogin and for configuring appropriate access within their teams.

Our service providers may process or store personal information in data centres located outside the South Africa, including in the European Union, United Kingdom, or United States. Where personal information is transferred cross-border, we take reasonable steps to ensure appropriate safeguards are in place, including contractual protections with our operators and, where applicable, compliance with POPIA section 72 requirements.

We retain personal information for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Active account data is retained while your account or Organisation subscription remains active
• Buyer, sale, and document data uploaded by an Organisation is retained according to that Organisation's use of the platform and export/deletion requests
• Billing and tax records may be retained for up to seven (7) years after the relevant transaction
• Security logs may be retained for a shorter defined period for incident investigation
• Upon account closure, we will delete or anonymise personal information within a reasonable period, subject to legal retention obligations and backup cycles

Organisation administrators may export Organisation data through platform tools. Deletion requests should be submitted to info@orogin.co.za.

We implement appropriate, reasonable technical and organisational measures to protect personal information against loss, unauthorised access, disclosure, alteration, or destruction. These measures include encrypted connections (HTTPS), access controls, role-based permissions, row-level database security, hashed passwords, and restricted access to production systems.

No method of transmission or electronic storage is completely secure. You are responsible for maintaining the confidentiality of your login credentials and for activity under your account.

We use essential cookies and similar technologies to maintain authenticated sessions, protect against cross-site request forgery, and keep you signed in securely. These are strictly necessary for the platform to function and are not used for third-party advertising.

You can configure your browser to refuse cookies, but some features of Orogin may not work correctly without them.

Subject to POPIA, you may have the right to:

• Request confirmation of whether we hold personal information about you
• Request access to personal information we hold about you
• Request correction or deletion of inaccurate, irrelevant, excessive, or unlawfully processed information
• Object to processing in certain circumstances
• Withdraw consent where processing is based on consent (without affecting prior lawful processing)
• Submit a complaint to the Information Regulator of South Africa

To exercise these rights, contact info@orogin.co.za. We may require proof of identity and will respond within the timeframes prescribed by POPIA. Buyers seeking access to sale-specific records should also contact the relevant developer or agency.

Information Regulator (South Africa): www.inforegulator.org.za

Orogin is a business platform and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, contact us and we will take appropriate steps to delete it.

We may send service-related and product update communications to account holders. We will not send unsolicited direct marketing in contravention of POPIA. You may opt out of non-essential marketing emails at any time using the unsubscribe link or by contacting us.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date. Continued use of Orogin after changes take effect constitutes acceptance of the revised policy, to the extent permitted by law.