Privacy & POPIA Notice

How we collect, use, protect and delete your personal information — in terms of the Protection of Personal Information Act 4 of 2013 (POPIA).

Effective 23 August 2026 · Version 1.0

The short version

We collect only what we need to host you: your name, contact details, your booking details, and a copy of your ID or passport. We use it to run your stay and keep our records. We do not send marketing, we do not sell your information, and we do not share it with anyone except the people who help us run the properties — or the police, if they lawfully request it as part of a criminal investigation. You can ask us at any time what we hold on you, and ask us to correct or delete it.

1Who we are

Tiny Home Properties (Pty) Ltd is the responsible party for the personal information described in this notice. We operate two short-stay guest properties in Gqeberha (Port Elizabeth): Tiny Home on Broadway and Retreat on 3rd.

Responsible party: Tiny Home Properties (Pty) Ltd
Company registration number: 2023/176508/07
Business address: 6a Broadway Avenue, Fernglen, Gqeberha, 6045, South Africa
Information Officer: JP Stander (registered with the Information Regulator, reg. no. 2026-063447)
All privacy requests and queries: [email protected]
Website: [www.tinyhomeproperties.co.za](https://www.tinyhomeproperties.co.za)

This notice is our notification to you in terms of section 18 of POPIA. It applies to guests, prospective guests, and anyone who contacts us or submits an enquiry through our website or a booking platform.

2What personal information we collect

We deliberately keep this list short. If we don't need it to host you or to keep a lawful record, we don't ask for it.

Category	What that means	Where we get it
Identity & contact	Full name and surname, email address, mobile number, and — where you give it — your home or postal address and country of residence.	Directly from you, or from the booking platform you booked through.
Identity document	Your South African ID number or passport number, and a copy or photograph of the document itself. Also collected for each adult guest staying with you.	Directly from you, at or before check-in.
Booking details	Which property, arrival and departure dates, number of guests, whether you are bringing pets, and any special requests or accessibility needs you tell us about.	Directly from you, or from the booking platform.
Payment records	Proof of payment, payment reference, amount and date, and payout records from booking platforms. We do not store your card number, CVV or online banking credentials — we never see them.	From you, your bank, or the booking platform.
Correspondence	Emails, WhatsApp and SMS messages, platform messages, quotes and invoices, and notes about your stay (for example, an early check-in you arranged with us).	Directly from you.
Reviews & feedback	Reviews you publish on Airbnb, Lekkeslaap or Google, and any feedback you send us directly.	From you, or publicly from the platform.
Website enquiry data	Whatever you type into our booking or contact form, plus basic technical data your browser sends (see section 14).	Directly from you.

Giving us this information is voluntary — but it is necessary. Without your name, contact details, booking details and ID we cannot confirm a booking, issue an invoice, or lawfully record who is staying on the property.

We do not collect special personal information as defined in section 26 of POPIA — we do not ask about your race, religion, political persuasion, trade union membership, health, sex life, biometrics, or criminal history.

3Why we process it, and on what lawful basis

Section 11 of POPIA requires us to have a lawful justification for every purpose. Ours are:

Purpose	Lawful basis under section 11
Confirming, managing and honouring your booking; sending check-in instructions, access codes, directions and house rules; handling changes and cancellations.	Necessary to conclude and perform our contract with you.
Issuing quotes, invoices and receipts; reconciling payments and refunds.	Contract performance, and compliance with our obligations under South African tax law.
Keeping a record of who stayed at the property and when.	Our legitimate interest in the security of our properties, our guests and our neighbours.
Responding to your enquiries and messages.	Your request, and our legitimate interest in running the business.
Resolving disputes, damage claims, insurance claims and platform complaints.	Our legitimate interest in establishing, exercising or defending a legal claim.
Making records available to the South African Police Service or a court when lawfully required (see section 4 below).	Compliance with an obligation imposed by law.
Retaining accounting and tax records.	Compliance with an obligation imposed by law.

We will not use your information for a new purpose that is incompatible with the purpose we originally collected it for, unless you agree or the law requires it.

4Your ID document — exactly what we do with it

Because a copy of an identity document is sensitive, we want to be specific about it.

What we do

We take one copy or photograph of the ID or passport of each adult guest.
We store it with the booking record, on access-controlled cloud storage.
We use it to verify that the person arriving is the person who booked, and to maintain an accurate guest record for the property.
If the South African Police Service, a court, or another authority with legal power to demand it makes a lawful request in connection with a criminal investigation, we will provide the record. Where we are legally permitted to do so, we will tell you that we have done this.

What we never do

We do not use your ID for credit checks, background screening, or profiling.
We do not use it for marketing of any kind.
We do not sell it, trade it, or hand it to anyone commercially.
We do not upload it to a booking platform or any third-party service beyond our own storage.
We do not keep it in printed form.

5Marketing — we don't do it

We do not send direct marketing. No newsletters, no promotional mailers, no special-offer campaigns, no SMS blasts. We do not add you to a mailing list, and we do not sell, rent or share your contact details with any third party for their own marketing.

The only messages you will receive from us are operational — that is, communication directly connected to your booking or to a query you have raised with us. For example: your booking confirmation, payment and invoice correspondence, check-in and access details, a message about maintenance affecting your stay, a note about something you left behind, or a reply to a question you asked us.

If we ever decide to introduce genuine marketing communication, we will not simply start sending it. We will ask for your consent first, in the manner required by section 69 of POPIA, and you will be free to say no with no effect on your booking. You can also tell us at any time, at [email protected], that you never want to be contacted for marketing — and we will record that permanently.

We share as little as possible, with as few people as possible. The full list:

Who	What they receive	Why
Booking platforms — Airbnb, Lekkeslaap	Whatever the platform itself handles: your name, booking dates and platform messages.	You booked through them. Each platform is a responsible party in its own right, under its own privacy policy.
Our co-host (Retreat on 3rd only)	Your name, arrival and departure dates, guest count, and any access or special-request notes.	To manage check-in, cleaning and guest support at that property.
Cleaning and maintenance contractors	Dates and access times only. Not your ID, not your contact details, unless you have asked us to arrange something directly with them.	To service the property between stays.
Our bank and accountant	Payment and invoice records.	Reconciliation, accounting and tax compliance.
Cloud service providers (email, document storage, calendars)	Whatever is contained in the records stored with them.	These are our operators under sections 20 and 21 of POPIA. They process only on our instruction.
Trello (internal task/booking boards)	Your name and arrival/departure dates.	To coordinate booking and cleaning schedules internally between our team.
Anthropic (Claude AI, via our internal booking-summary automation)	Your name, stay dates and property.	To generate our internal daily booking summary — this is an operational tool for us, not a guest-facing service.
South African Police Service, a court, or a regulator	Only the specific records lawfully demanded.	Where we are legally obliged to disclose, or where disclosure is necessary to protect someone's life or safety.
Our insurer or attorney	Only the records relevant to a specific claim or dispute.	To establish, exercise or defend a legal claim.

We never sell your personal information. There is no circumstance in which your details are made available to a data broker, advertiser, or list-buyer.

7Information that leaves South Africa

Some of the services we rely on — email, cloud document storage, and the international booking platforms — store data on servers outside South Africa. This is a transborder flow under section 72 of POPIA.

We only use providers that are subject to a law, binding corporate rules or a binding agreement that upholds principles for the lawful processing of personal information substantially similar to POPIA's conditions, and that includes similar restrictions on onward transfer. Where a transfer is instead necessary to perform your booking contract, it is permitted on that basis.

8How long we keep it

Section 14 of POPIA says we may not keep records longer than necessary. Our retention periods:

Record	Retention period
Booking records, invoices, receipts and payment records	5 years from the end of the tax year in which the stay took place, as required for tax and accounting records.
Copies of ID and passport documents	5 years, stored with the booking record, then permanently deleted.
General guest correspondence (email, WhatsApp, platform messages)	Up to 3 years after your stay, unless it forms part of a booking or payment record.
Enquiries that never became a booking	12 months, then deleted.
Records relevant to an active dispute, insurance claim, legal claim or investigation	Until the matter is finally resolved, plus the applicable prescription period.
A record that you have asked never to be contacted	Kept indefinitely, in minimal form, so that we can honour it.

When a retention period expires, we delete the record or de-identify it so that it can no longer be linked to you.

9How we keep it safe

Section 19 of POPIA requires us to secure the integrity and confidentiality of your information with appropriate, reasonable technical and organisational measures. What we actually do:

Guest records and ID copies are held in access-controlled cloud storage, not on unsecured devices or in printed files.
Accounts used to access guest data are protected with strong, unique passwords and multi-factor authentication where the provider supports it.
Our website is served over HTTPS, so information you submit through the booking form is encrypted in transit.
Access is limited to the people who genuinely need it — the Information Officer and, for Retreat on 3rd, our co-host.
We do not retain what we do not need, which is the most effective safeguard of all.

No system is perfectly secure. We keep our measures under review and update them as risks and available technology change.

10If something goes wrong

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA obliges us to notify both the Information Regulator and you, as soon as reasonably possible after discovering it. Our notification to you will describe what happened, the likely consequences, what we are doing about it, and what we recommend you do to protect yourself.

11Your rights

Under Chapter 3 Part B and Chapter 2 of POPIA you have the right to:

Be told whether we hold personal information about you, and to be given a description of it and of the third parties who have had access to it (sections 23 and 25).
Ask for a copy of the personal information we hold about you. We may charge the prescribed fee for this, and we will tell you the amount before we start.
Have it corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (section 24).
Object, on reasonable grounds, to our processing of your information where we rely on legitimate interests (section 11(3)).
Withdraw consent at any time, where our processing was based on your consent. This does not affect processing already lawfully carried out.
Refuse direct marketing — although, as set out in section 5 above, we do not send any (section 69).
Not be subject to a decision that affects you significantly and is based solely on automated processing. We do not make any such decisions.
Complain to the Information Regulator, and to institute civil proceedings, if you believe we have interfered with the protection of your personal information (sections 74 and 99).

Exercising any of these rights is free of charge, except where the prescribed fee applies to a request for a copy of your records. We will never treat you differently as a guest because you exercised a right.

12How to exercise your rights

Email our Information Officer at [email protected] with the subject line "POPIA request". Please include:

Your full name and the email address or phone number you booked with;
The approximate dates of your stay or enquiry, so we can find your record;
What you would like us to do — tell you what we hold, send you a copy, correct something, or delete something;
Proof of identity, so that we do not hand your information to someone impersonating you.

We will acknowledge your request within 5 business days and respond substantively within 30 days. If we need longer, we will tell you why and give you a revised date. If we decline all or part of a request, we will tell you which provision of POPIA or PAIA we are relying on, and how to challenge that decision.

You may also use the Information Regulator's prescribed forms if you prefer: Form 1 to object to processing, and Form 2 to request correction or deletion. Both are available at inforegulator.org.za/popia-forms. We accept plain-language email requests just as readily.

13Complaints

If you are unhappy with how we have handled your personal information or your request, please raise it with us first — most issues are a misunderstanding we can fix quickly. Email [email protected] with "POPIA complaint" in the subject line.

You are entitled to go directly to the Information Regulator at any time, using Form 5:

The Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 · Toll free 0800 017 160
POPIA complaints: [email protected]
General enquiries: [email protected]
Website: inforegulator.org.za

14Our website, cookies and analytics

Our website is a brochure and booking-enquiry site. It does not require you to create an account and it does not track you across other websites.

Booking and contact forms: what you type is emailed to us and stored with your booking record. Nothing more.
Server logs: our hosting provider records standard technical data — IP address, browser type, pages requested, timestamps — for security and troubleshooting. These logs are retained for a short period and are not used to build a profile of you.
Cookies: we use only cookies strictly necessary for the site to function. We do not run advertising or cross-site tracking cookies.
External links: when you click through to Airbnb, Lekkeslaap or Google Maps, you leave our site and their privacy policies apply. We have no control over what they collect.

15Children's information

We do not knowingly collect personal information directly from children. Where children stay with you, we record only that a child is part of the booking party and their age where it affects the booking. A competent person — normally the parent or guardian making the booking — provides this. If you believe we hold information about a child that we should not, tell us and we will delete it.

16Changes to this notice

We will update this notice when our practices, our service providers, or the law changes. The current version and its effective date are always shown at the top of this page. Material changes affecting how we use information we already hold about you will be communicated to you directly.

If you have any question at all about this notice, email [email protected]. We would rather answer a question than have you wonder.