PRIVACY POLICY Website: www.vacay23.com

 

Effective date: 01.09.2026 Last updated: 31.08.2026

 

Vacay23 (“Vacay23”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, protect and disclose personal information when you visit or use www.vacay23.com, contact us, make an enquiry, make a booking, or otherwise interact with Vacay23. This Privacy Policy is intended to comply with the applicable requirements of the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Promotion of Access to Information Act 2 of 2000 (“PAIA”), and other applicable South African law.

 

1. WHO WE ARE

The responsible party for your personal information is: Owner: Matt Iwersen Trading name:

Vacay23 Website: www.vacay23.com

Physical address: 23 King Fisher Dr, 0216, Hartbeespoort, South Africa

Email: booking@vacay23.com

For privacy-related enquiries, please contact: Information Officer / Privacy Contact: Matt Iwersen Email: booking@vacay23.com

 

2. WHAT PERSONAL INFORMATION WE COLLECT

Depending on how you interact with us, we may collect personal information including: your name and surname; email address; telephone or mobile number; residential or postal address; booking and reservation information; dates of arrival and departure; number of guests; information provided when making an enquiry; correspondence and communications with us; payment-related information where necessary to process a booking or payment; identification or verification information where legally required or reasonably necessary for a booking; information relating to your preferences or requests during your stay; technical information such as IP address, browser type, device information and website usage information; information collected through cookies and similar technologies; and any other information that you voluntarily provide to us. We will only collect personal information that is reasonably necessary and relevant for a lawful purpose.

 

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information: directly from you when you contact us; when you complete a contact, enquiry or booking form; when you make or enquire about a reservation; when you communicate with us by email, telephone, WhatsApp or other communication channels; when you make a payment; automatically when you use our website, including through cookies and similar technologies; and from third parties where permitted by law and where reasonably necessary for the purposes described in this Privacy Policy.

 

4. WHY WE PROCESS YOUR PERSONAL INFORMATION

We may process your personal information for purposes including: responding to enquiries; processing and managing accommodation bookings; communicating with you regarding your reservation or stay; verifying information where reasonably necessary; processing payments and refunds; providing customer support; administering and improving our accommodation services; complying with applicable laws and legal obligations; preventing fraud, abuse or unlawful activity; maintaining the security of our website and systems; resolving complaints and disputes; maintaining appropriate business and financial records; sending service-related communications; sending marketing communications where permitted by law; understanding how visitors use our website and improving its functionality; and any other lawful purpose that is compatible with the purpose for which the information was collected.

 

5. LAWFUL PROCESSING We will process personal information in accordance with the conditions for lawful processing contained in POPIA. Depending on the circumstances, processing may be necessary because: you have provided consent; it is necessary to perform or take steps in relation to a contract with you; we are required to comply with a legal obligation; it is necessary to protect a legitimate interest recognised by law; it is necessary to protect your legitimate interests; or another lawful basis under POPIA applies. Where consent is required, we will request consent in an appropriate manner. You may withdraw consent where applicable, although withdrawal will not affect the lawfulness of processing that occurred before withdrawal.

 

6. PROVIDING PERSONAL INFORMATION

You may choose not to provide certain personal information. However, some information may be necessary for us to respond to an enquiry, process a booking, provide accommodation services, process a payment or comply with legal requirements. If you do not provide information that is necessary for these purposes, we may not be able to provide the relevant service or process your booking.

 

7. SHARING PERSONAL INFORMATION

We will not sell your personal information. We may disclose personal information where reasonably necessary to: service providers who assist us in operating our website or accommodation business; booking and reservation platforms; payment processors and financial institutions; website hosting, IT and technology providers; professional advisers such as accountants, auditors, lawyers and insurers; security or estate-management service providers where necessary; government authorities or regulators where required or permitted by law; law-enforcement authorities where legally required; or other parties where you have provided appropriate consent or where disclosure is otherwise lawful. Where third parties process personal information on our behalf, we will take reasonable steps to ensure that appropriate confidentiality and security obligations apply to that processing.

 

8. INTERNATIONAL TRANSFERS

Some of our technology, hosting, booking, payment, communication or other service providers may process personal information outside South Africa. Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with POPIA, including applicable requirements relating to cross-border transfers.

 

9. COOKIES AND WEBSITE TECHNOLOGIES Our website may use cookies and similar technologies to: enable essential website functionality; remember preferences; improve website performance; understand how visitors use the website; improve our services and website experience; and support analytics or other legitimate website functions. Some cookies may be placed by third-party service providers used by our website. You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of the website.

 

10. DIRECT MARKETING

We may send you marketing communications where permitted by POPIA. Where POPIA requires consent for electronic direct marketing, we will obtain the required consent before sending such communications. You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting us at booking@vacay23.com.

 

11. SECURITY OF PERSONAL INFORMATION

We take reasonably practicable technical and organisational measures to protect personal information against loss, damage, unauthorised access, unlawful processing, disclosure or other misuse. These measures may include appropriate access controls, password protection, secure hosting and website technologies, confidentiality obligations and limiting access to personal information to persons who reasonably require it. No electronic transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of personal information.

 

12. SECURITY COMPROMISES

If we become aware of a security compromise involving personal information, we will take appropriate steps required by POPIA, which may include investigating the incident, taking steps to mitigate harm and notifying the Information Regulator and affected data subjects where required by law.

 

13. RETENTION OF PERSONAL INFORMATION

We will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. When personal information is no longer required, we will take reasonable steps to securely delete, destroy or de-identify it, where appropriate.

 

14. YOUR RIGHTS AS A DATA SUBJECT

Subject to the limitations and requirements contained in POPIA and other applicable law, you may have the right to: request confirmation of whether we hold personal information about you; request access to personal information we hold about you; request correction or updating of inaccurate, incomplete or misleading information; request deletion or destruction of personal information where permitted by law; object to certain processing of your personal information; object to the processing of your personal information for direct marketing; withdraw consent where processing is based on consent; request information regarding the purposes for which your personal information is being processed; and lodge a complaint with the Information Regulator where you believe your personal information has been processed unlawfully. Requests should be sent to booking@vacay23.com. We may need to verify your identity before processing a request.

 

15. AUTOMATED DECISION-MAKING

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you unless permitted by applicable law and subject to any safeguards required by POPIA.

 

16. CHILDREN'S PERSONAL INFORMATION

Our website and accommodation services are not intended to knowingly collect personal information directly from children without the appropriate consent or other lawful basis required by POPIA. Where we become aware that personal information of a child has been collected unlawfully, we will take reasonable steps to address the situation in accordance with applicable law.

 

17. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, booking platforms, social-media services or other websites. We are not responsible for the privacy practices, content or security of third-party websites. You should review the privacy policies of those websites before providing personal information to them.

 

18. PAIA AND ACCESS TO INFORMATION

Access to records held by Vacay23 may also be governed by the Promotion of Access to Information Act 2 of 2000 (PAIA). Requests for access to records should be directed to our Information Officer at booking@vacay23.com and will be handled in accordance with applicable PAIA requirements. Vacay23 will maintain and make available the appropriate PAIA manual and related information where required by law.

 

19. COMPLAINTS

If you have a concern about how we process your personal information, we encourage you to contact us first at booking@vacay23.com so that we can investigate and attempt to resolve the matter. You also have the right to lodge a complaint with the Information Regulator of South Africa. Information Regulator (South Africa) Woodmead North Office Park 54 Maxwell Drive Woodmead Johannesburg, 2191 South Africa Telephone: 010 023 5200 Toll-free: 0800 017 160 Email: enquiries@inforegulator.org.za

 

20. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or privacy practices. The latest version will be published on www.vacay23.com with the applicable effective or updated date.

 

21. CONTACT US

Vacay23 Owner: Matt Iwersen Physical address: 23 King Fisher Dr, 0216, Hartbeespoort, South Africa Email: booking@vacay23.com Website: www.vacay23.com Information Officer / Privacy Contact: Matt Iwersen Last updated: 01.09.2026