Legal

Privacy Policy

Last updated: September 2026

1. Introduction

Villa Tartaruga ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, how we use it, how long we keep it, and your rights.

2. Who We Are

Information Officer: [Full name]
Email: info@villatartaruga.co.za
Physical address: Paindane Siesta, Inhambane, Mozambique

You can contact our Information Officer with any questions about this policy or to exercise any of the rights described below.

3. Information We Collect

We collect the following personal information when you book or interact with us:

  • Guest name, email address, phone number, and country of residence
  • Booking details: stay dates, number of guests, arrival time, and special requests
  • Vehicle confirmation (4x4 acknowledgment)
  • Payment information and references from PayFast — we do not store card details
  • Bank transfer references and uploaded proof-of-payment documents
  • If you submit a review: your name, email, rating, and written review
  • If you opt in to marketing: a record of your consent

4. Why We Collect It

We process your personal information for the following purposes:

  • To process and confirm your booking
  • To communicate with you about your stay (confirmations, receipts, reminders)
  • To process payments and issue invoices and receipts
  • To comply with tax, accounting, and other legal obligations
  • To respond to enquiries and provide customer support
  • To send marketing communications — only if you have opted in

5. How Long We Keep It

We retain personal information for the following periods:

  • Booking and payment records: 5 years from the date of your stay, as required for tax and financial record-keeping
  • Customer profile (name, email, phone, country): 5 years from your most recent booking
  • Marketing consent: Until you withdraw it, or 3 years after your last interaction — whichever comes first
  • Guest access links: Expire automatically after 30 days; purged from our systems after 90 days
  • Review submissions: Retained until you request deletion

6. Marketing Consent

We only send marketing emails to guests who have explicitly opted in via the booking form or the "My Booking" page. You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email, or by emailing us directly.

Transactional emails (booking confirmations, receipts, balance reminders, arrival information) are essential to fulfil your booking and are not affected by your marketing preferences.

7. Who We Share It With

We share minimal information with the following service providers, strictly to fulfil our contract with you:

  • PayFast — for card payment processing. PayFast is a registered payment processor and complies with PCI-DSS standards.
  • Email service providers — to send booking confirmations, receipts, and reminder emails.

We do not sell, rent, or share your personal information with any third party for their own marketing purposes.

8. Your Rights Under POPIA

You have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request deletion of your information (subject to our legal obligations to retain financial records)
  • Object to processing in certain circumstances
  • Withdraw consent for marketing at any time
  • Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za

To exercise any of these rights, email info@villatartaruga.co.za with the subject line "POPIA Request". We will respond within 30 days.

9. Security

We use HTTPS, encrypted storage, and role-based access controls to protect your information. Only team members who need access to fulfil their duties can view your personal information. Access links to your booking are unique, time-limited, and never stored in plain form on our servers.

10. Cookies

The public website uses only one cookie: a session cookie for the admin panel. We do not use tracking cookies, advertising cookies, or third-party analytics that identify you personally.

11. Cross-Border Transfers

Some of our service providers (such as payment processors and email delivery platforms) may store data on servers outside South Africa. Where this occurs, we ensure that the receiving jurisdiction has comparable data protection laws, or that appropriate contractual safeguards are in place.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated to active customers by email.

13. Contact

For any privacy-related query:
Email: info@villatartaruga.co.za
Address: Paindane Siesta, Inhambane, Mozambique