Privacy & Cookie Policy

1. Who We Are

Holiday Haus is a property management and marketing business based in Cape Town, South Africa. We manage short-term and mid-term holiday rentals across Cape Town and the Western Cape.

• Company: Holiday Haus
• Location: Cape Town, South Africa
• Contact: angi.whittle.live.co.za

For the purposes of POPIA, Holiday Haus is the responsible party. For the purposes of the GDPR, Holiday Haus is the data controller.

2. What Information We Collect

We collect personal information when you interact with our website, including:

2.1 Information You Provide

• Contact forms: Name, email address, phone number (optional), enquiry type, subject, and message.
• Lead forms: Name, email address, and property interest details.
• Reviews: Name, rating, and review content submitted voluntarily.

2.2 Information Collected Automatically

• Device and browser information: IP address, browser type, operating system, screen resolution, and language preferences.
• Usage data: Pages viewed, time spent on pages, referral sources, clicks, and navigation patterns.
• Cookies: Small text files stored on your device (see Section 6 below).

3. How We Use Your Information

We use the personal information we collect to:

• Respond to enquiries and facilitate bookings.
• Manage properties and communicate with landlords and guests.
• Improve our website, services, and user experience.
• Analyse website traffic and usage patterns.
• Comply with legal obligations.
• Send relevant communications where you have provided consent.

We process your data on the following legal bases: your consent, the performance of a contract, our legitimate interests (improving our services), and compliance with legal obligations.

4. Third-Party Services

We use the following third-party services that may collect and process personal data:

5. Data Sharing and Transfers

We do not sell, rent, or trade your personal information to third parties. We may share your data with:

• Service providers listed in Section 4, solely for the purposes described.
• Law enforcement or regulators where required by law.

Some of our third-party providers (Google, Microsoft) process data outside of South Africa and the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

6. Cookies

Our website uses cookies and similar tracking technologies. A cookie is a small text file placed on your device that helps us provide and improve our services.

6.1 Essential Cookies

These cookies are necessary for the website to function correctly. They enable core features such as page navigation, session management, and security. These cannot be disabled.

6.2 Analytics Cookies

These cookies help us understand how visitors use our website by collecting anonymous statistical information. We use Google Analytics and Microsoft Clarity for this purpose. Data collected includes pages visited, session duration, bounce rate, and general geographic location.

6.3 Marketing Cookies

These cookies may be set by third-party advertising partners to build a profile of your interests and show relevant advertisements on other websites. We currently use minimal marketing cookies, but this may change as our services grow.

7. Managing Cookies

You can manage your cookie preferences at any time:

• Browser settings: Most browsers allow you to block or delete cookies through their settings menu. Note that blocking essential cookies may affect website functionality.
• Google Analytics opt-out: Install the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity opt-out: You can opt out of Clarity tracking by enabling "Do Not Track" in your browser settings or by using the Microsoft privacy dashboard.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected:

• Contact and lead form submissions: Retained for up to 24 months from the date of submission, unless a continued business relationship exists.
• Analytics data: Retained in accordance with the default retention settings of the respective analytics provider (typically 14-26 months).
• Booking and transaction records: Retained for the duration required by South African tax and business legislation (typically 5 years).

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights Under POPIA (South Africa)

Under the Protection of Personal Information Act 4 of 2013 (POPIA), you have the right to:

• Access the personal information we hold about you.
• Correction of any inaccurate, incomplete, or misleading personal information.
• Deletion of your personal information where it is no longer necessary.
• Object to the processing of your personal information for direct marketing purposes.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.

Information Regulator (South Africa): inforegulator.org.za

10. Your Rights Under the GDPR (EU Visitors)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation, including:

• Right of access -- obtain a copy of your personal data.
• Right to rectification -- correct inaccurate data.
• Right to erasure ("right to be forgotten") -- request deletion of your data.
• Right to restrict processing -- limit how we use your data.
• Right to data portability -- receive your data in a structured, machine-readable format.
• Right to object -- object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, contact us at angi.whittle.live.co.za. We will respond within 30 days.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers.
• Firebase security rules restricting database access to authorised operations only.
• Regular review of access controls and data processing activities.

12. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete that information.

13. Changes to This Policy

We may update this Privacy and Cookie Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any significant changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your personal information, please contact us:

• Email: angi.whittle.live.co.za
• Phone: +27 82 522 4479
• WhatsApp: Chat on WhatsApp