Privacy Policy

This policy applies to personal information we process about guests, prospective guests, website visitors, people who enquire about a tour, suppliers and job applicants. It covers information collected through this website, by email, telephone and WhatsApp, at reception, and on our premises.

“Personal information”, “processing”, “data subject”, “responsible party” and “operator” carry the meanings given to them in POPIA.

Lomaneva Hotel is the responsible party for the personal information described in this policy. It determines why and how that information is processed.

Responsible party

Lomaneva Hotel and Lomaneva Journeys

Physical address

5500 Kokolufute Street, Windmill Park Estate, Boksburg 1459, South Africa

Information Officer

The Information Officer, reachable at info@lomaneva.com or +27 63 943 8491

Our Information Officer is registered with the Information Regulator as required by section 55 of POPIA and is responsible for our compliance, for handling your requests, and for our manual under the Promotion of Access to Information Act 2 of 2000.

• Directly from you, when you enquire, book, check in, order a service or write to us. This is our main source.
• From the lead guest, where one person books for a party. That person warrants they have authority to share the others' details.
• From a travel agent, tour operator or corporate booker acting for you.
• From our CCTV system, which records the public areas and perimeter of the property and is signposted at the entrance.
• From our web server logs, automatically, when you visit this website.

We do not buy marketing lists and we do not collect personal information from public sources to market to you.

Section 11 of POPIA permits processing only on a recognised basis. Ours are set out below.

• Health, dietary and medical information is special personal information under section 26 of POPIA. We process it only with your consent, only to keep you safe and comfortable, and we share it only with the specific member of staff or supplier who needs it, such as a chef or an activity operator.
• We do not process information about your religious or philosophical beliefs, race, political persuasion, trade union membership, sexual life or criminal behaviour, except where you volunteer a religious dietary requirement, which we treat as a catering instruction and nothing more.
• Information about a child is processed under section 34 of POPIA only with the consent of a competent person, being the parent or guardian who makes the booking, and only for the purposes of the stay, safety and age eligibility for activities.
• Where an activity operator imposes a minimum age or requires a medical declaration, we pass on only the information that operator requires.

We share personal information only where it is necessary, and never for another party’s marketing.

• Tour, activity, rail and air operators, so that they can deliver the experience you have booked. They receive your name, party size, the date, and any safety-relevant detail such as weight or a medical condition.
• Our payment gateway and our bank, to process payment. They handle card data under the Payment Card Industry Data Security Standard.
• Our accountants and auditors, for statutory financial reporting.
• Our IT and hosting providers, who host this website and our email, and act as operators under section 21 of POPIA subject to written confidentiality and security obligations.
• Law enforcement, a regulator or a court, where we are legally obliged to disclose, or where disclosure is necessary to prevent or investigate a crime.
• A professional adviser, where required to establish or defend a legal claim.

We do not sell personal information. We do not share it with advertising networks or data brokers.

Some of our service providers, particularly for email, hosting and payment processing, operate servers outside South Africa. Section 72 of POPIA permits such a transfer only in defined circumstances, and we rely on the following:

• The recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA; or
• The transfer is necessary for the performance of our contract with you, for example booking an international flight or a service abroad; or
• You have consented to the transfer.

We contract with providers who commit in writing to protection standards equivalent to POPIA, and we will tell you which providers are involved if you ask.

Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. Ours include:

• Encryption of this website in transit using HTTPS, on every page.
• Access control, so that staff see only the information their role requires.
• Written confidentiality undertakings from every member of staff, and contractual security obligations on every operator who processes information for us.
• Storing paper records, including registration cards, in locked storage and destroying them securely once their retention period expires.
• Not storing full card numbers anywhere in our systems.
• CCTV footage kept on access-controlled equipment and reviewed only where there is a security reason to do so.
• Periodic review of our safeguards against reasonably foreseeable risks.

No system is perfectly secure, and we do not claim otherwise. What we do undertake is to keep our safeguards current and to tell you promptly if something goes wrong.

Section 14 of POPIA prohibits keeping records longer than necessary, unless a law requires it. Our periods are:

As a data subject you have the following rights under POPIA, and exercising them is free.

• To be told whether we hold personal information about you, and to be given a record of it, under section 23.
• To have information corrected, or destroyed or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, under section 24.
• To object, on reasonable grounds, to our processing of your information, under section 11(3).
• To withdraw consent at any time, where processing was based on consent. Withdrawal does not affect processing already carried out.
• To object at any time to direct marketing, and to require us to stop, under section 69.
• Not to be subject to a decision based solely on automated processing, under section 71. We do not make such decisions.
• To complain to the Information Regulator, and to institute civil proceedings under section 99.

• Write to our Information Officer at info@lomaneva.com, describing what you want. You do not need to use a form or cite a section.
• We will verify your identity before disclosing or changing anything, to protect you against someone impersonating you.
• We respond within 30 days. Where a request is complex we may extend that period once, and we will tell you why before the original period expires.
• A request for access to a record under the Promotion of Access to Information Act is made on Form 2 of that Act, and prescribed fees may apply to reproduction. Requests to correct your own information under POPIA carry no fee.
• If we decline a request in whole or in part, we will tell you the reason and how to take the matter further.

• The only value this site stores in your browser is a single session entry recording that you have already seen the opening animation, so that it is not replayed on every page. It is deleted when you close the tab and is never transmitted to us.
• Our web server keeps ordinary access logs, including IP address, browser type and pages requested, for security and troubleshooting. These are held for 30 days.
• Our location page embeds a Google Maps frame. Google may set its own cookies and receive your IP address when that frame loads, subject to Google's privacy policy, over which we have no control. If you would rather it did not load, do not open the location section of the home page.
• Links to third-party sites, such as WhatsApp or a supplier, are governed by those parties' own privacy policies.

• Section 69 of POPIA prohibits electronic direct marketing to a person who is not an existing customer unless that person has consented.
• If you have stayed with us or booked with us, we may send you occasional news and offers about our own services on the existing-customer basis in section 69(3). We will not do this if you have already objected.
• If you have not booked with us, we contact you only in response to your enquiry, or with your consent.
• Every marketing message carries a working unsubscribe link, and you may also simply reply asking to stop. We action it within 5 business days.
• We never share your details so that another business can market to you.

Section 22 of POPIA requires us to notify both the Information Regulator and you where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person.

• We will notify you as soon as reasonably possible after discovering the compromise, unless a public body tells us to delay so as not to impede a criminal investigation.
• The notification will describe the possible consequences, what we are doing about it, what we recommend you do, and the identity of the unauthorised person if we know it.
• Notification will be in writing to your email or postal address, and prominently on this website where we cannot reach you directly.

Please raise a privacy concern with us first, at info@lomaneva.com. If you are not satisfied with our response, or you would rather go straight to the regulator, you may lodge a complaint with:

Regulator

The Information Regulator (South Africa)

Address

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Postal

PO Box 31533, Braamfontein, Johannesburg, 2017

Telephone

+27 10 023 5200

POPIA complaints

POPIAComplaints@inforegulator.org.za

PAIA complaints

PAIAComplaints@inforegulator.org.za

Website

https://inforegulator.org.za

We review this policy at least annually and whenever our processing changes. The current version is always published here, with its effective date. Where a change materially affects how we use your information, we will tell you directly rather than relying on you noticing.

This policy should be read with our Terms & Conditions. Last updated: 10 September 2026.