Regional compliance

Built against the acts that govern your buildings.

Seven full compliance dossiers, four data-protection regimes, eleven tax-and-currency presets, one ledger. We don’t strap a "POPIA mode" on top of a North-American SaaS — the product was wired for African law from the first commit.

Talk to our compliance lead → Privacy policy

Pango · compliance mascot

compliance dossiers

ZA · BW · NA · ZM · ZW · LS · SZ

data-protection regimes

POPIA · BW DPA · ZM DPA · ZW DPA

100%

RLS-enforced isolation

per tenant, per property

By market

Country-by-country — what\u2019s in the box.

Each market below ships a full compliance dossier and a jurisdiction preset that wires tax rates, WHT stances, deposit rules, lease templates and reporting exports to the local regulator. Presets for four further markets (Malawi, Mauritius, Seychelles, Tanzania) are live in-app; their dossiers are being authored.

South Africa

Revenue: SARS

Data protection

Protection of Personal Information Act 4 of 2013 (POPIA)

Regulator: Information Regulator (South Africa)

Data-subject access, correction, and deletion rights surfaced in-app. Info Officer email published on /privacy. 72-hour breach notification playbook in the admin console.

Tenancy law

Rental Housing Act 50 of 1999 (as amended) + CPA where applicable

Lease templates carry the mandatory disclosures. Deposit is held in a separate liability account per tenant and an interest-tracking journal runs monthly.

Tax

VAT · VAT 15% (standard rate). Zero-rated and exempt line-items supported per SARS VAT 404.

WHT · WHT on non-resident landlords: 7.5% default, override per lease. SARS tax-certificate export.

In the console

ZAR currency + 15% VAT preset
WHT non-resident landlord workflow
SARS-aligned VAT 201 CSV export
POPIA data-subject request console
Deposit interest schedule

Botswana

Revenue: BURS

Data protection

Data Protection Act, 2018 (Act No. 32 of 2018)

Regulator: Information & Data Protection Commission

Consent records stored per data subject with timestamps. Cross-border transfer log attached to every third-party sub-processor in /privacy.

Tenancy law

Landlord and Tenant (Transfer of Property) Proclamation + common law

Standard lease template aligned with typical BURS-accepted clauses; two-month deposit cap auto-enforced at onboarding.

Tax

VAT · VAT 14%. Commercial rent is standard-rated.

WHT · WHT 10% on rent to non-residents. Auto-deducted and BURS certificate generated on receipt.

In the console

BWP currency + 14% VAT preset
BURS certificate export for WHT
Standard-rated commercial-rent invoicing
Pula-native bank reconciliation

Namibia

Revenue: NamRA

Data protection

Draft Data Protection Bill (advanced) — POPIA-equivalent controls applied in advance of enactment

Regulator: Office of the Communications Regulatory Authority (interim)

We apply POPIA-grade controls by default; when the Namibian DPA is gazetted we’ll swap our market label without a data migration.

Tenancy law

Rent Ordinance + Rent Control regulations (where applicable)

Rent escalation caps (where a Rent Control order is in force) are enforceable as a lease-level flag that blocks over-escalation.

Tax

VAT · VAT 15%. Commercial rent is standard-rated.

WHT · WHT on services 10%; on rent to non-residents per NamRA rules.

In the console

NAD currency + 15% VAT preset
Rent Control escalation guard
NamRA WHT certificate fields

Zambia

Revenue: ZRA

Data protection

Data Protection Act, 2021 (Act No. 3 of 2021)

Regulator: Data Protection Commissioner

Local data residency option on request. Data Protection Officer contact published in every in-product compliance pack.

Tenancy law

Landlord and Tenant (Business Premises) Act + common law

Turnover-rent leases (common in Lusaka retail) are first-class in the rent-roll — declared turnover flows into monthly invoice generation.

Tax

VAT · VAT 16%. Standard-rated for commercial rent.

WHT · WHT 10% on rent. ZRA-aligned monthly return export.

In the console

ZMW currency + 16% VAT preset
Turnover-rent lease type
ZRA WHT monthly return export

Zimbabwe

Revenue: ZIMRA

Data protection

Data Protection Act, 2021 (Cyber and Data Protection Act [Chapter 12:07])

Regulator: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)

Dual-currency lease + invoice support (USD + ZWL). Historical FX-applied amounts preserved in the ledger so audit trail survives re-denomination.

Tenancy law

Commercial Premises (Rent) Regulations + Housing and Building Act

Rent Board approval flow for contested escalations is tracked on the lease as a hold/release state.

Tax

VAT · VAT 15% (standard). Dual-currency invoicing supported.

WHT · WHT 10% on rent per ZIMRA schedules; automated per-invoice.

In the console

Dual-currency (USD + ZWL) lease and invoice
ZIMRA WHT schedule export
Rent Board hold state per lease

Lesotho

Revenue: RSL

Data protection

Data Protection Act, 2011 (Act No. 5 of 2011)

Regulator: Data Protection Commissioner (Lesotho)

Equivalent-jurisdiction cross-border transfer log auto-populated for SA-hosted data given CMA membership.

Tenancy law

Common law + Deeds Registry regulations

LSL / ZAR parity is encoded as a currency-equivalence flag — no FX rounding drift on South-African-denominated leases.

Tax

VAT · VAT 15%. Standard-rated on commercial rent.

WHT · WHT 10% non-resident.

In the console

LSL currency with ZAR parity handling
RSL filing-ready VAT export

eSwatini

Revenue: ERS

Data protection

Data Protection Act, 2022

Regulator: Eswatini Communications Commission (transitional)

Access + deletion requests routed through the in-app Compliance console regardless of the data subject’s market — one workflow covers every market we deploy in.

Tenancy law

Rent Restriction Act + common law

Rent Restriction Board caps enforced as escalation guards on covered tenancies.

Tax

VAT · VAT 15%. Commercial standard-rated.

WHT · WHT 10%.

In the console

SZL currency + 15% VAT preset
Rent Restriction escalation guard
ERS WHT export

How it\u2019s enforced

Compliance is a primitive, not a page.

The four primitives below live in the database and the audit layer. They\u2019re the reason a regulatory claim on this page ends up as a technical fact, not a checkbox.

Row-level isolation

Postgres RLS enforces tenant + property scoping at the database, not the application, layer. Policies are property-scoped so a centre manager on Property A literally cannot query Property B.

Tamper-evident audit log

Every sensitive action — receipts, permission changes, deposit refunds, period-close — is append-only-logged with actor, timestamp, IP and device. The log is writable by the database, not by users.

Data-subject primitives

Access, correction, export, and deletion requests are first-class: /compliance console, request → acknowledge → resolve state machine, and regulator-ready response packs.

Retention sweep

A scheduled anonymisation job clears PII from closed tenancies per your retention policy while preserving the ledger for statutory accounting retention.

Procurement-ready

Need our compliance pack?

Security questionnaire responses, sub-processor list, DPIA template, and regulator contacts. Drop us a line and we\u2019ll send the pack within a business day.

Request the pack → Read the privacy policy

Last reviewed: 25 April 2026