Privacy Policy

Last updated 31 July 2026

Who is responsible for your information

Professor AB Stuurman Ka Nxuba Guest House of 234A Steve Biko Street, Gugulethu, Cape Town, 7750, South Africa decides what happens to the personal information you give us, and is the responsible party for it under the Protection of Personal Information Act 4 of 2013 (POPIA).

Our Information Officer can be reached at ladyndish@gmail.com or +27 719448893. Please use those details for anything in this policy.

What we collect

When you book a room

• Your name, email address and mobile number
• The town or country you are travelling from, if you tell us
• Your dates, the room you chose and how many people are staying
• Any special requests you write in, such as a late arrival or a dietary need

When you pay

• A record of what you paid, when, how, and your booking reference
• If you pay by EFT and upload proof of payment, the document you upload
• We do not receive, see or store your card number, expiry date or CVV. Card payments are handled entirely by PayFast on their own secure page.

When you ask for a taxi

• Your name and mobile number, where you are being collected from and going to, the time, how many passengers and bags, and your flight number if you give it

When you write a review

• Your name, your email address, the town or country you are from, your rating and what you wrote
• Your email address is never published. We publish your first name and the initial of your surname, for example "Nomsa D."
• We also record the internet address your review was sent from, to help us spot spam

When you send us a message

• Your name, email address, telephone number if you give it, and your message

Why we collect it

• To take, confirm and manage your booking, which is what you asked us to do
• To contact you about your stay, including confirmations, directions and anything you have asked for
• To take payment and to keep the accounting and tax records the law requires of us
• To arrange a taxi with our partner when you ask us to
• To publish reviews, with your agreement, and to answer them
• To keep the property and our guests safe

We do not use your information for advertising, we do not build profiles, and we do not make automated decisions about you.

Who else sees it

We do not sell your personal information and we do not give it to anyone for their own marketing. We share only what is necessary, and only with:

• **PayFast**, our payment gateway, when you pay by card or instant EFT. They handle your card details under their own privacy policy and PCI-DSS obligations.
• **Our bank**, for EFT payments and refunds.
• **Our metered taxi partner**, but only your name, mobile number, pick-up details and passenger numbers, and only when you have asked us to arrange a taxi.
• **CallMeBot**, a message relay we use to forward a booking alert to the owner's own WhatsApp number the moment you book. That alert contains your name, telephone number, email address, the room and your dates. The relay is run by an independent operator using Amazon Web Services and Google Cloud, and it does not publish a statement about whether the content of messages is stored or for how long. If you would rather we did not send your details through it, tell us when you book and we will take the booking by telephone instead.
• **Google**, because the map on our Find Us page is embedded from Google Maps. Loading that map tells Google you visited the page. See Google's own privacy policy for what they do with that.
• **Our accountant and, where the law requires it, SARS or another authority.**

Cookies and this website

• We set one cookie: a session cookie that keeps your booking form and, for staff, the administrator login working. It is marked HttpOnly and SameSite, and it disappears when you close your browser.
• We do not use advertising cookies, tracking pixels or third-party analytics.
• The embedded Google map may set its own cookies. You can block those in your browser without breaking the rest of the site.
• Our web server keeps ordinary access logs, which include internet addresses, for security and troubleshooting.

How long we keep it

• Booking and payment records are kept for five years after the end of the tax year they fall in, because tax law requires it.
• Proof-of-payment documents are kept only until the payment is reconciled, and are then deleted.
• Taxi requests are kept for twelve months.
• Published reviews stay up until you ask us to remove them.
• Enquiries sent through the contact form are kept for twelve months.
• When a record reaches the end of its life we delete it.

How we protect it

• Passwords are stored only as one-way hashes, never in a readable form.
• Our database is reached only through parameterised queries, and every form carries a token that prevents forged submissions.
• Uploaded files are checked by their actual content, not their name, and the folder they live in cannot run programs.
• Administrator access needs a username and password, and repeated failed attempts lock the form.
• Only the owner and staff who need it can see guest records.
• No system is perfect. If a breach ever puts your information at real risk, we will tell you and the Information Regulator as POPIA requires.

Sending information outside South Africa

Your information is stored in South Africa. Some of the services we rely on may process data outside the country:

• email delivery of booking confirmations;
• the map embedded on our Find Us page, which is served by Google; and
• the CallMeBot relay that forwards a booking alert to the owner's WhatsApp, which runs on Amazon Web Services and Google Cloud. Its operator does not say in which country those servers are located.

Where information does leave the Republic we rely on recipients subject to laws or agreements affording protection substantially similar to POPIA. We keep the amount of information sent through these services to the minimum needed.

Children

Our rooms are booked by adults. We do not knowingly collect information about a child except the name and age a parent gives us as part of their own booking.

Your rights

Under POPIA you may:

• Ask us what personal information we hold about you and get a copy of it
• Ask us to correct anything that is wrong or out of date
• Ask us to delete information we no longer have a lawful reason to keep
• Object to a particular use of your information
• Withdraw your agreement to something you previously agreed to, such as a published review
• Complain to the Information Regulator

Write to ladyndish@gmail.com and we will answer within 30 days. We may ask you to confirm who you are first, so that we do not hand your information to someone else.

How to complain

Please raise it with us first at ladyndish@gmail.com or +27 719448893. Most things are sorted out quickly.

If you are still unhappy, you may complain to the Information Regulator of South Africa. At the time of writing they can be reached at:

• Website: inforegulator.org.za, where complaints are lodged through their eServices portal
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200, or toll free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Changes to this policy

We update this policy when what we do changes. The date at the top shows when it last changed. If we ever make a change that materially affects you, we will tell you.