Regional compliance

Built against the acts that govern your buildings.

Seven tuned markets, four data-protection regimes, one ledger. We don\u2019t strap a "POPIA mode" on top of a North-American SaaS — the product was wired for African law from the first commit.

Talk to our compliance lead → Privacy policy

Pango · compliance mascot

markets tuned

ZA · BW · NA · ZM · ZW · LS · SZ

data-protection regimes

POPIA · BW DPA · ZM DPA · ZW DPA

100%

RLS-enforced isolation

per tenant, per property

By market

Country-by-country — what\u2019s in the box.

Each tuned market ships a jurisdiction preset that wires tax rates, WHT stances, deposit rules, lease templates and reporting exports to the local regulator.

South Africa

Revenue: SARS

Data protection

Protection of Personal Information Act 4 of 2013 (POPIA)

Regulator: Information Regulator (South Africa)

Data-subject access, correction, and deletion rights surfaced in-app. Info Officer email published on /privacy. 72-hour breach notification playbook in the admin console.

Tenancy law

Rental Housing Act 50 of 1999 (as amended) + CPA where applicable

Lease templates carry the mandatory disclosures. Deposit is held in a separate liability account per tenant and an interest-tracking journal runs monthly.

Tax

VAT · VAT 15% (standard rate). Zero-rated and exempt line-items supported per SARS VAT 404.

WHT · WHT on non-resident landlords: 7.5% default, override per lease. SARS tax-certificate export.

In the console

ZAR currency + 15% VAT preset
WHT non-resident landlord workflow
SARS-aligned VAT 201 CSV export
POPIA data-subject request console
Deposit interest schedule

Botswana

Revenue: BURS

Data protection

Data Protection Act, 2018 (Act No. 32 of 2018)

Regulator: Information & Data Protection Commission

Consent records stored per data subject with timestamps. Cross-border transfer log attached to every third-party sub-processor in /privacy.

Tenancy law

Landlord and Tenant (Transfer of Property) Proclamation + common law

Standard lease template aligned with typical BURS-accepted clauses; two-month deposit cap auto-enforced at onboarding.

Tax

VAT · VAT 14%. Commercial rent is standard-rated.

WHT · WHT 10% on rent to non-residents. Auto-deducted and BURS certificate generated on receipt.

In the console

BWP currency + 14% VAT preset
BURS certificate export for WHT
Standard-rated commercial-rent invoicing
Pula-native bank reconciliation

Namibia

Revenue: NamRA

Data protection

Draft Data Protection Bill (advanced) — POPIA-equivalent controls applied in advance of enactment

Regulator: Office of the Communications Regulatory Authority (interim)

We apply POPIA-grade controls by default; when the Namibian DPA is gazetted we’ll swap our market label without a data migration.

Tenancy law

Rent Ordinance + Rent Control regulations (where applicable)

Rent escalation caps (where a Rent Control order is in force) are enforceable as a lease-level flag that blocks over-escalation.

Tax

VAT · VAT 15%. Commercial rent is standard-rated.

WHT · WHT on services 10%; on rent to non-residents per NamRA rules.

In the console

NAD currency + 15% VAT preset
Rent Control escalation guard
NamRA WHT certificate fields

Zambia

Revenue: ZRA

Data protection

Data Protection Act, 2021 (Act No. 3 of 2021)

Regulator: Data Protection Commissioner

Local data residency option on request. Data Protection Officer contact published in every in-product compliance pack.

Tenancy law

Landlord and Tenant (Business Premises) Act + common law

Turnover-rent leases (common in Lusaka retail) are first-class in the rent-roll — declared turnover flows into monthly invoice generation.

Tax

VAT · VAT 16%. Standard-rated for commercial rent.

WHT · WHT 10% on rent. ZRA-aligned monthly return export.

In the console

ZMW currency + 16% VAT preset
Turnover-rent lease type
ZRA WHT monthly return export

Zimbabwe

Revenue: ZIMRA

Data protection

Data Protection Act, 2021 (Cyber and Data Protection Act [Chapter 12:07])

Regulator: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)

Dual-currency lease + invoice support (USD + ZWL). Historical FX-applied amounts preserved in the ledger so audit trail survives re-denomination.

Tenancy law

Commercial Premises (Rent) Regulations + Housing and Building Act

Rent Board approval flow for contested escalations is tracked on the lease as a hold/release state.

Tax

VAT · VAT 15% (standard). Dual-currency invoicing supported.

WHT · WHT 10% on rent per ZIMRA schedules; automated per-invoice.

In the console

Dual-currency (USD + ZWL) lease and invoice
ZIMRA WHT schedule export
Rent Board hold state per lease

Lesotho

Revenue: RSL

Data protection

Data Protection Act, 2011 (Act No. 5 of 2011)

Regulator: Data Protection Commissioner (Lesotho)

Equivalent-jurisdiction cross-border transfer log auto-populated for SA-hosted data given CMA membership.

Tenancy law

Common law + Deeds Registry regulations

LSL / ZAR parity is encoded as a currency-equivalence flag — no FX rounding drift on South-African-denominated leases.

Tax

VAT · VAT 15%. Standard-rated on commercial rent.

WHT · WHT 10% non-resident.

In the console

LSL currency with ZAR parity handling
RSL filing-ready VAT export

eSwatini

Revenue: ERS

Data protection

Data Protection Act, 2022

Regulator: Eswatini Communications Commission (transitional)

Access + deletion requests routed through the in-app Compliance console regardless of the data subject’s market — one workflow covers all seven regions.

Tenancy law

Rent Restriction Act + common law

Rent Restriction Board caps enforced as escalation guards on covered tenancies.

Tax

VAT · VAT 15%. Commercial standard-rated.

WHT · WHT 10%.

In the console

SZL currency + 15% VAT preset
Rent Restriction escalation guard
ERS WHT export

How it\u2019s enforced

Compliance is a primitive, not a page.

The four primitives below live in the database and the audit layer. They\u2019re the reason a regulatory claim on this page ends up as a technical fact, not a checkbox.

Row-level isolation

Postgres RLS enforces tenant + property scoping at the database, not the application, layer. Policies are property-scoped so a centre manager on Property A literally cannot query Property B.

Tamper-evident audit log

Every sensitive action — receipts, permission changes, deposit refunds, period-close — is append-only-logged with actor, timestamp, IP and device. The log is writable by the database, not by users.

Data-subject primitives

Access, correction, export, and deletion requests are first-class: /compliance console, request → acknowledge → resolve state machine, and regulator-ready response packs.

Retention sweep

A scheduled anonymisation job clears PII from closed tenancies per your retention policy while preserving the ledger for statutory accounting retention.

Procurement-ready

Need our compliance pack?

Security questionnaire responses, sub-processor list, DPIA template, and regulator contacts. Drop us a line and we\u2019ll send the pack within a business day.

Request the pack → Read the privacy policy

Last reviewed: 25 April 2026