Privacy Policy

1. Who We Are

Amahle Guest House ("we", "us", "our") is the data controller responsible for your personal information. We operate the website www.amahleguesthouse.co.za and provide guest accommodation services.

We are committed to protecting your personal data in compliance with the Protection of Personal Information Act (POPIA) 4 of 2013 (South Africa) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. What Data We Collect

Information You Provide

• Booking data: Full name, email address, phone number, number of guests, check-in/check-out dates.
• Payment data: Card details are processed directly by Paystack (our payment processor). We do not store full card numbers on our servers.
• Communications: Messages you send us via email or contact forms.
• Account data: If you create an account, your username, email and hashed password.

Information Collected Automatically

• Usage data: IP address, browser type, operating system, pages visited, time on site, referring URL.
• Device data: Device type, screen resolution, browser language.
• Cookies: Session cookies, preference cookies and analytics cookies (see Section 6).

3. How We Use Your Data

• To process and manage your reservation and send booking confirmations.
• To process payments securely via Paystack.
• To communicate with you about your booking (updates, reminders, invoices).
• To comply with legal and regulatory obligations (e.g. guest registers required by South African law).
• To improve our website performance and user experience using anonymised analytics.
• To send you promotional communications, where you have given explicit consent (you may opt out at any time).
• To prevent fraud and ensure the security of our systems.

4. Legal Basis for Processing (GDPR / POPIA)

• Contract performance: Processing required to fulfil your booking contract.
• Legal obligation: Compliance with South African legislation (e.g. guest register requirements).
• Legitimate interests: Fraud prevention, website security, and service improvement.
• Consent: Marketing communications and non-essential cookies — you may withdraw consent at any time.

5. Who We Share Data With

We do not sell your personal data. We share data only with the following trusted third parties where necessary:

• Paystack — payment processing. Paystack Privacy Policy.
• Email service providers — to deliver booking confirmation and transactional emails.
• Google Analytics (if enabled) — anonymised website usage statistics.
• Hosting providers — infrastructure (servers, databases) used to run the website securely.
• Law enforcement / regulators — where required by law or court order.

All third-party processors are required to handle your data in accordance with applicable data protection law.

6. Cookies & Tracking

We use cookies to make our website work properly and to understand how it is used. For full details please see our Cookie Policy.

Types of Cookies We Use

• Essential cookies: Required for the website and booking process to function. Cannot be disabled.
• Session cookies: Temporary cookies deleted when you close your browser.
• Preference cookies: Remember your settings and choices.
• Analytics cookies: Help us understand visitor behaviour (anonymised). Require your consent.

You can manage cookie preferences in your browser settings at any time.

7. Data Retention

• Booking records: Retained for 5 years from the date of stay, as required for financial and legal compliance.
• Guest communications: Retained for 2 years from the date of last communication.
• Marketing consent records: Until you withdraw consent.
• Analytics data: Anonymised — no personal retention period applies.

We will securely delete or anonymise your personal data when it is no longer needed for the purposes described in this policy.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at info@amahleguesthouse.co.za. We will respond within 30 days. Under POPIA, you may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS/TLS), hashed passwords, restricted access controls, and regular security reviews.

No internet transmission is completely secure. While we take all reasonable precautions, we cannot guarantee absolute security of data transmitted to our website.

10. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify guests via email where we hold contact details. We encourage you to review this policy periodically.

12. Contact & Complaints

South African residents may also contact the Information Regulator:
https://inforegulator.org.za