Privacy Policy

Goose Valley Accommodation is the “responsible party” under POPIA for the personal information described in this policy. We operate the website goosevalleyaccommodation.co.za, an independent directory of holiday accommodation in Plettenberg Bay. We are not an accommodation provider and we are not affiliated with Goose Valley Golf Estate.

For anything relating to your personal information, write to privacy@goosevalleyaccommodation.co.za. We operate online only and do not maintain a public office address.

Information you give us. When you submit the enquiry form on our contact page, we collect the fields you complete:

• your name and email address (required, so that we can reply)
• your phone number, if you choose to give it
• your intended check-in and check-out dates and number of guests, if you give them
• the content of your message

The form also carries two invisible anti-spam fields — a decoy input that a human never sees, and a timestamp recording when the form loaded. Neither says anything about you personally; they exist only to discard automated submissions.

Alongside what you type, an enquiry is saved with three technical details: the page you sent it from, your browser's user-agent string, and a shortened form of your IP address. We deliberately truncate the address before storing it — an IPv4 address keeps only its first three blocks (for example 41.13.7.0/24) and an IPv6 address only its first three groups. That is enough to spot a flood of spam from one network and not enough to identify a person. The full address is never written down.

Information collected automatically. Our web host generates standard server logs when it serves a page (IP address, browser and device type, the page requested and the time of the request), and the same happens when your browser loads a property photograph from our image host. If you accept analytics cookies, Google Analytics 4 also records how you move around the site.

What we never collect. We do not take payments, so we never see card or banking details. We do not ask for identity numbers, passport numbers or dates of birth. We do not knowingly collect information from children, and we do not collect special personal information as defined in POPIA.

POPIA requires a lawful justification for every use. Ours are:

• Enquiries — to store your message, send you an automatic confirmation that it arrived, and reply to it properly. Justification: your consent, given by submitting the form, and the performance of a request you have made of us.
• Anti-spam details attached to an enquiry (page sent from, browser string, shortened IP) — to tell a real enquiry from an automated one. Justification: our legitimate interest in keeping the contact form usable.
• Analytics — to understand which pages are useful so we can improve the site. Justification: your consent, given through the cookie banner. Analytics does not run until you accept.
• Affiliate click tracking — to allow Booking.com to attribute a commission to us. Justification: our legitimate interest in being paid for referrals, which is what funds this site.
• Security and abuse prevention — to keep the site available and block malicious traffic. Justification: our legitimate interest in protecting the service.

We do not use your information to build a marketing profile, and we do not send marketing email to people who have simply made an enquiry.

This site sets exactly one cookie of its own: the record of the choice you make in the cookie banner. It is strictly necessary — without it we would have to ask you again on every page — and POPIA and the Regulations permit setting it without consent. Nothing else is stored on your device by us.

Analytics is the only thing gated by that choice. It does not run until you accept, and declining leaves every part of the site working exactly as before.

Affiliate tracking is a separate matter, because it does not happen here. Nothing is set on your device by us when you click through to Booking.com — the cookies involved are set by Commission Junction and Booking.com once you are on their sites, under their terms. See clause 05 below.

You can change your mind at any time using the cookie settings control in the footer, and you can block or delete cookies in your browser settings.

Every “check availability” link on this site is a Booking.com affiliate link carrying our partner identifier through Commission Junction. When you click one, Commission Junction and Booking.com may set cookies or identifiers on your device so that a later booking can be credited to us.

That tracking is operated by them, under their own privacy terms, and it takes effect on their websites — not on ours. We are not told who you are. What we receive is a commission report showing that bookings happened, not a list of the people who made them.

The full commercial arrangement is explained on our affiliate disclosure page.

We use a small number of service providers (“operators” under POPIA). Each one is bound to process personal information only on our instructions and to keep it secure.

We may also disclose personal information where we are legally obliged to do so, or where it is necessary to establish, exercise or defend a legal claim. We do not sell, rent or trade personal information to anyone.

The website itself is hosted in South Africa with Afrihost. Most of our other service providers are not: Booking.com is in the Netherlands, and Commission Junction, Google, Resend and Supabase operate principally from the United States and the European Union. Where those providers are involved, your information is processed abroad.

Section 72 of POPIA permits this where the recipient is subject to a law, binding agreement or corporate rules that give substantially similar protection to POPIA, or where you consent. Each of these providers contracts on data-protection terms that meet that standard, and we rely on those agreements when we transfer information to them.

An enquiry exists in two places: the email in our inbox, and a row in our own database. Both are kept for up to 24 months from your last contact with us, so that we have context if you write again, and then deleted. If you ask us to delete an enquiry sooner, we delete both unless a law requires us to keep them.

Analytics data is retained by Google for 14 months. Web-server logs are kept for a short rolling period, typically no more than 30 days.

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. In practice: the site is served over HTTPS and redirects any plain-HTTP request to it; the enquiry endpoint accepts submissions only from our own pages, strips markup out of every field, caps their length and rejects anything submitted faster than a person could type it; the public key this website runs on has no permission to read stored enquiries at all, so they can only be reached with a server-side key that never leaves our server; and access to our email is protected by multi-factor authentication.

No system is perfectly secure. If a compromise occurs that creates a real risk to you, we will notify you and the Information Regulator as section 22 requires.

As a data subject you have the right to:

To exercise any of these, email privacy@goosevalleyaccommodation.co.za and tell us what you would like done. We will respond within a reasonable period and normally inside 30 days. We may need to ask a question or two to confirm that the request really comes from you. There is no charge for a straightforward request.

Formal requests under POPIA and the Promotion of Access to Information Act may be made on the prescribed forms published by the Information Regulator.

If you are not satisfied with how we have handled your information or your request, you may complain to the Information Regulator (South Africa):

We would rather hear from you first, though — most things are quicker to fix directly.

This site is aimed at people planning a stay in Plettenberg Bay, and many of our visitors are from outside South Africa. If the privacy law of your own country gives you rights beyond those set out above, write to us and we will deal with your request on the same terms.

We will update this policy when our practices or our service providers change. The revised version takes effect when it is posted, and the “last updated” date at the top will change. Material changes will be flagged on the site.

See also our terms and conditions.