Privacy Policy

Last updated: July 18, 2024

1 Who We Are

2 What Personal Data We Collect and Why

We collect information to provide quality service and comply with hospitality regulations:

Directly Collected Data

• Booking Information: Full name, email, phone number, payment details
• Special Requirements: Health/accessibility needs where provided

Automatically Collected Data

• Technical Data: IP address, browser type, device information
• Usage Data: Pages visited, booking paths, referral sources

3 Comments

We do not have public comment sections on our website. Any guest feedback is collected privately through post-stay surveys.

4 Media

Guests may upload identification documents during booking. These are:

• Stored in encrypted format
• Automatically deleted 30 days after check-out
• Accessible only to authorized staff

5 Contact Forms

When you use our contact forms, we collect:

• Name and email address
• Contact reason and message content
• IP address for spam protection

Retention: Form submissions kept for 2 years for customer service purposes.

6 Cookies

We use cookies for essential functions:

Cookie	Purpose	Duration
cambalala_session	Booking process maintenance	Session
gdpr_consent	Cookie preference storage	1 year
_ga	Google Analytics	2 years

Manage preferences: Cookie Settings

7 Analytics

We use Google Analytics to understand:

• Booking conversion paths
• Page popularity
• Traffic sources

Opt-out: Google Analytics Opt-out

8 Who We Share Your Data With

Third Party	Data Shared	Purpose	Privacy Policy
Payment Processors	Card details, booking amount	Transaction processing	Provider Policy
Meta Platforms Inc.	Phone number, booking dates	WhatsApp notifications	WhatsApp Privacy
Cloud Hosting	All website data	Data storage	Hosting Policy

9 How Long We Retain Your Data

• Booking Records: 7 years (legal requirement)
• Identification Documents: 30 days post check-out
• WhatsApp Message Logs: 90 days
• Contact Form Entries: 2 years
• Analytics Data: 26 months

10 Your Data Rights

You have the right to:

1. Access your personal data
2. Correct inaccurate information
3. Request data deletion
4. Restrict processing
5. Data portability
6. Object to processing

11 Where Your Data Is Sent

Data may be transferred outside South Africa to:

• United States (Google Cloud, Meta)

Safeguards:

1. Standard Contractual Clauses
2. GDPR-compliant partners
3. Encrypted data transmission

12 Contact Information

13 Additional Information

How We Protect Your Data

• SSL/TLS encryption
• Regular security audits
• Two-factor authentication for staff
• Staff privacy training
• Privacy Impact Assessments conducted

Data Breach Procedures

1. Immediate system isolation
2. 72-hour regulatory notification
3. Affected user notification
4. Forensic investigation
5. Remediation implementation

Third Party Data Sources

We receive booking data from:

• Online travel agencies (Booking.com, Expedia)
• Tour operators
• Corporate booking systems

Automated Decision Making

We use automated fraud screening for:

• Payment verification
• Booking pattern analysis

You may request human review of automated decisions.

Industry Disclosures

As a hospitality provider, we comply with:

• South Africa POPIA regulations
• EU GDPR for international guests
• Tourism grading council requirements