Privacy Policy

DRAFT — not approved for publication. Complete the outstanding facts, obtain appropriate legal review and add a version and effective date before publishing.

Who is responsible for your information

[Confirm the registered legal entity, registration details, business address, privacy contact and Information Officer. Identify any representative or data protection officer where applicable.]

Information we collect and why

Document the account/contact details, traveller profile, operator memberships, business information, verification files, requests and security records actually processed. Explain sources, purposes and the applicable justification or legal basis for each purpose. Do not describe planned quotation, booking or payment features as live services.

Service providers and sharing

Confirm hosting, SendGrid email delivery, identity/security providers, and any enabled GA4 or Microsoft Clarity processing. Explain recipients, roles, locations and safeguards. Confirm actual deployment facts before publication.

Cookies and optional tracking

Link to the Cookie Policy and explain the Essential, Analytics and Marketing choices. Optional tracking is disabled until the relevant consent is granted. Cookie preferences can be changed through the permanent footer control.

Retention and security

Summarise the reviewed retention criteria and periods, legal holds and protection measures. Do not invent a fixed period where no policy has been approved. Explain any justified retention of shared business records after account deletion.

South Africa — POPIA

Confirm the responsible party, Information Officer contact, collection notice, access/correction/objection process and complaint route to the Information Regulator. Verify the applicable grounds, procedures and any PAIA obligations with the reviewer.

European Union — GDPR

Confirm applicability, purposes and legal bases, data subject rights, supervisory authority complaint information, international transfer safeguards and representative/contact arrangements where required. Review the actual processing and geographic scope.

United Kingdom — UK GDPR

Confirm applicability, UK rights and complaint information, applicable transfer safeguards and any UK representative/contact arrangements. Review the current UK framework before publication.

Your rights and requests

Link to Data Rights and the secure request service. Explain identity checks, documented exceptions and applicable response periods without promising unconditional deletion.

Changes to this notice

[Add policy version, effective date, last review date and the method for communicating material changes.]

Reviewer references

Information Regulator · European Commission · UK Information Commissioner's Office