Privacy Policy

1. Who We Are

https://www.holidaystays.co.za is a South African accommodation search engine. Like a general web search engine, we automatically index information that accommodation providers have published on their own websites — and, where a property is connected, rates and availability from its booking system — and present it as listings so travellers can discover places to stay and contact the property directly.

2. Personal Information We Collect

Property owners and managers

When we index a property's own website we may collect, as published there:

• Business contact details: phone numbers and email addresses used to run the property.
• Property addresses: the physical address of the property, which may be linked to an individual.
• Owner portal accounts: if you claim your listing, the phone number or email address you use to log in with a one-time passcode.
• Upgrade billing: if you purchase a paid upgrade, payment is handled by our third-party payment processor — we receive confirmation of payment and subscription status, never your card details.

Guests sending an enquiry

When you use the enquiry form on a listing we collect the details you enter: your name, email address, phone number (optional), travel dates, party size, and message.

All website visitors

• Cookies and usage data: essential cookies for the site to function, plus Google Analytics cookies that measure how the site is used (see Section 6).
• Approximate location: derived from your IP address to tailor content (e.g., regional listings).
• Server logs: standard technical logs (IP address, pages requested) kept for security and troubleshooting.

We also collect non-personal information, such as property descriptions, photos, rates, and website URLs, to build listings.

3. How We Collect Personal Information

Automated indexing: our crawler gathers publicly available information from accommodation providers' own websites and re-indexes them periodically to keep listings current. Listings are created from this public information without prior contact — every listing shows its source website and carries a link for the owner to claim, update, or remove it (see Section 11).

Directly from you: when you submit an enquiry, claim a listing, create an owner portal account, purchase an upgrade, or email us.

From connected systems: where a property uses a supported booking system, we retrieve its published rates and availability; we may also display publicly available ratings and grading from third-party sources.

4. Purpose of Processing

We process personal information to:

• Create and maintain accommodation listings and operate the search engine.
• Deliver guest enquiries to the relevant property by email and monitor that delivery succeeded.
• Contact property owners about their listing — to verify details, hand over enquiries, support claiming and removal, or offer optional paid upgrades.
• Provide the owner portal, including passcode login and subscription administration.
• Measure and improve how the website is used.
• Comply with legal obligations.

We do not sell personal information, and we do not use it to market unrelated third-party products.

5. Legal Basis for Processing

• Legitimate interest: we index and display publicly available business information (including business contact details and property addresses) in our legitimate interest of operating an accommodation search engine that promotes South African tourism, balanced against the rights of the people concerned. Owners can object and have their listing removed at any time, free of charge (see Section 11).
• Performance of a service you request: when you send an enquiry, claim a listing, or purchase an upgrade, we process the details you provide in order to deliver that service.
• Consent: where the law requires it — for example certain direct marketing — we rely on your consent, which you may withdraw at any time.

6. Cookies and Analytics

Our website uses essential cookies for basic functionality (such as remembering preferences), and Google Analytics to understand how visitors use the site. Google Analytics sets persistent cookies (such as _ga) that identify your browser across visits; the resulting usage data is processed by Google on our behalf under Google's own privacy terms. You can block or delete cookies through your browser settings, or opt out of Google Analytics with Google's browser opt-out add-on — the site keeps working either way.

We also derive an approximate location from your IP address during your visit, solely to tailor content (e.g., showing nearby rentals).

7. Automated and AI Processing

We use third-party AI services (currently including Anthropic, xAI, and Google) to help turn indexed web pages into structured listings — for example extracting property details, summarising descriptions, classifying photos, and improving image quality. The content sent to these services is the material collected from a property's public website, which can include the business contact details and address published there. These providers process the content on our behalf and under their own service terms.

Guest enquiry details are not sent to AI services; they are used only to deliver your enquiry to the property.

8. Sharing Personal Information

We share personal information only as follows:

• With accommodation providers: when you send an enquiry, we forward it — including your name and contact details — to the property so they can respond to you directly.
• On listings: a property's contact details are shown publicly on its listing only where that has been enabled for the listing; by default guests contact properties through our enquiry relay.
• Service providers: hosting, email delivery, Google Analytics, the AI services in Section 7, our payment processor for owner upgrades, and SMS/WhatsApp providers used for owner portal login and messaging — each processing data on our behalf.
• Legal obligations: where disclosure is required by law or necessary to protect our rights.

9. How We Protect Your Information

• Encryption in transit: all traffic to and from our website uses HTTPS.
• Access controls: administrative access to stored data is restricted to authorized personnel and protected by network-level restrictions and authentication.
• No card storage: payment card details are handled by our payment processor and never touch our systems.

While we take reasonable measures to secure your information, no system is completely impenetrable. In the event of a data breach affecting personal information, we will notify the Information Regulator and affected data subjects as required by POPIA.

10. Your Rights Under POPIA

As a data subject (e.g., property owner, guest, or website user), you have the following rights:

• Access: request details of the personal information we hold about you.
• Correction: ask us to update inaccurate or incomplete data.
• Deletion: request removal of your personal information from our platform.
• Objection: object to processing based on legitimate interest or withdraw consent.
• Complaint: lodge a complaint with the Information Regulator (South Africa) — inforegulator.org.za.

To exercise these rights, email [email protected]. We will respond within a reasonable time and at no charge, as required by POPIA.

11. Removing Your Listing (Property Owners)

If you do not want your property listed, you can have the listing removed at any time, free of charge:

• Use the "claim it and update it" link shown on your listing page; or
• Email [email protected] with your property name or website URL.

We will unpublish the listing and mark the property so that future indexing does not re-publish it. Website visitors can separately limit tracking by managing cookies as described in Section 6.

12. Retention of Personal Information

• Listing data: kept while the listing is published; removed listings are unpublished and the property is flagged against re-indexing.
• Guest enquiries: kept for as long as needed to deliver the enquiry, confirm delivery, and support follow-up between you and the property; deleted or anonymised on request.
• Owner accounts and billing: kept while the account or subscription is active, and thereafter as required for financial record-keeping.
• Logs and analytics: server logs are kept for security and troubleshooting for up to 12 months; analytics data is retained per Google Analytics' configured retention.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The updated policy will be posted on this page with a revised effective date, and we will notify property owners of material changes at the last email address they provided. We encourage you to review it periodically.

14. Contact Us

For questions or concerns, email [email protected] or visit https://www.holidaystays.co.za.