PrimeStays Privacy Policy

Effective 8 September 2026

Effective Date: 8 September 2026

This Privacy Policy explains how PrimeStays collects, uses, shares and protects your personal information when you use the PrimeStays website, make a booking, or stay at a property advertised on the PrimeStays platform.

PrimeStays processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECT Act"), and the Consumer Protection Act 68 of 2008 ("CPA"), where applicable.

This Policy should be read together with the PrimeStays Terms and Conditions.

Where any provision of this Policy conflicts with a mandatory provision of applicable law, the applicable law will prevail.

1. Who We Are

PrimeStays is the responsible party for the personal information described in this Policy.

PrimeStays
Website: https://primestays.co.za
Email: [email protected]

[TO BE COMPLETED: registered legal entity name, company registration number and registered physical address.]

[TO BE COMPLETED: name and contact details of the appointed Information Officer, as required by section 55 of POPIA.]

For the purposes of POPIA, a "responsible party" is the party that determines the purpose of and means for processing personal information.

2. What We Mean by Personal Information

"Personal information" means information relating to an identifiable, living natural person, as defined in POPIA.

In this Policy, "you" and "your" refer to any person who visits the PrimeStays website, creates an account, makes a booking, or stays at or visits a property under a booking.

3. Personal Information We Collect

3.1 Information you give us when booking

To make and service a booking, we collect:

your full name;
your email address; and
your telephone number.

We also record the details of the booking itself, including the property, the check-in and check-out dates, the number of guests and the total price.

3.2 Account and profile information

If you create a PrimeStays account, we collect and hold:

your username;
your first name and last name;
your email address;
your contact number;
whether your email address and contact number have been verified; and
the access permissions associated with your account.

We do not store your account password. Authentication is handled by our authorisation service, which stores credentials in a hashed form.

3.3 Communications

We keep a record of communications between you and PrimeStays, including messages sent by email or WhatsApp relating to a booking, an enquiry or a complaint.

3.4 Payment information

Where a payment is required, payment details are collected and processed by our payment provider. PrimeStays does not store your full card number or card security code.

We may retain limited payment-related information, such as the amount paid, the date of payment and a payment reference, in order to administer your booking and comply with our record-keeping obligations.

3.5 Technical information

Our hosting and infrastructure providers process standard technical information necessary to deliver the website securely, which may include your IP address, browser type and the pages you request.

3.6 Information we do not seek

We do not knowingly collect special personal information as defined in POPIA, such as information about your health, race, religious beliefs, biometrics or criminal history, and you should not send us such information unless we specifically request it for a lawful purpose.

4. How We Collect Personal Information

We collect personal information:

directly from you, when you complete a booking form, create an account, or contact us;
from booking platforms, where your reservation originates on a third-party platform such as Airbnb or Booking.com;
automatically, through the technical operation of the website; and
from members of your booking party, where the person making the booking provides their details.

Where you provide us with personal information about another person, such as another member of your booking party, you confirm that you are entitled to do so and that they are aware of this Policy.

5. Why We Process Your Personal Information

We process your personal information for the following purposes:

to confirm, administer and service your booking;
to identify you as the guest and communicate with you about your stay;
to send you booking confirmations, payment confirmations, check-in instructions and property information;
to arrange access to the property and coordinate with the accommodation provider and caretakers;
to respond to your enquiries, requests and complaints;
to process payments, refunds and any charges permitted under the Terms and Conditions;
to keep records required for accounting, tax and legal purposes;
to prevent, detect and investigate fraud, unauthorised transactions and misuse of the platform;
to maintain the security and integrity of the website and our systems; and
to comply with our legal obligations.

6. Lawful Basis for Processing

We process your personal information on one or more of the following bases recognised in POPIA:

Performance of a contract — processing is necessary to conclude or perform the booking agreement with you.
Legal obligation — processing is necessary to comply with an obligation imposed by law.
Legitimate interests — processing is necessary for the legitimate interests of PrimeStays, the accommodation provider or you, including protecting property, preventing fraud and keeping our systems secure.
Consent — where we rely on your consent, we will ask for it separately and you may withdraw it at any time.

Withdrawing consent does not affect processing already carried out lawfully, and it may mean we can no longer provide part or all of a service to you.

7. Communications About Your Booking

By making a booking, you agree to receive the electronic communications necessary to service that booking, including confirmations, check-in instructions, amendments, cancellation notices and customer service messages.

These are service communications rather than marketing, and you cannot opt out of them while a booking is active without affecting our ability to provide the accommodation.

8. WhatsApp Communications

PrimeStays uses WhatsApp to coordinate stays.

Where you provide a telephone number, your name and telephone number may be used to:

send you booking and check-in information by WhatsApp;
add you to a WhatsApp group created for your stay, together with the accommodation provider and any caretaker responsible for the property; and
send you messages during and shortly after your stay relating to the property, cleaning arrangements and your stay generally.

WhatsApp is operated by a third party. Where information is sent through WhatsApp, that provider processes it under its own terms and privacy policy, and it may store or process the information outside South Africa. See the section on cross-border transfers below.

If you do not wish to be contacted by WhatsApp, please tell us and we will use email or telephone instead.

9. Marketing

We will only send you marketing communications about PrimeStays properties and offers where you have agreed to receive them, or where we are otherwise permitted to do so by law.

Every marketing message will include a way to unsubscribe. You may also ask us to stop sending marketing communications at any time by contacting us at [email protected].

Unsubscribing from marketing does not stop service communications about an active booking.

We share personal information only where it is necessary for the purposes described in this Policy. Recipients may include:

The accommodation provider and property caretakers — your name, contact details and booking details, so that they can prepare the property, provide access and assist you during your stay.
Booking platforms — where your reservation originates on or is managed through a platform such as Airbnb or Booking.com.
Messaging providers — WhatsApp, where used to communicate with you about your stay.
Payment providers — to process payments, refunds and chargebacks.
Hosting, infrastructure and IT service providers — who operate and support the website and our systems.
Professional advisers — such as accountants, auditors and attorneys, where necessary.
Authorities and third parties — where required by law, or where necessary to establish, exercise or defend a legal claim.

We do not sell your personal information.

Where a third party processes personal information on our behalf, we require it to process that information only for the agreed purpose and to apply appropriate security safeguards, as required by section 21 of POPIA.

11. Cross-Border Transfers

Some of the service providers we rely on, including messaging, hosting and payment providers, may store or process personal information outside the Republic of South Africa.

Where personal information is transferred across a border, we will only do so where permitted by section 72 of POPIA, including where:

the recipient is subject to a law, binding agreement or corporate rules providing an adequate level of protection;
the transfer is necessary to perform a contract with you, or to conclude one at your request;
the transfer benefits you and it is not reasonably practicable to obtain your consent; or
you have consented to the transfer.

12. How Long We Keep Your Personal Information

We keep personal information only for as long as necessary for the purposes described in this Policy, or for as long as required by law.

This means:

booking and payment records are retained for the period required by applicable tax, accounting and company law;
account information is retained while your account remains open, and for a reasonable period afterwards;
communications relating to a booking are retained for a reasonable period after the stay, so that we can deal with any query, complaint or claim; and
information no longer required is deleted, destroyed or de-identified.

[TO BE COMPLETED: confirm the specific retention periods applied to booking records, account records and communications.]

We may retain information for longer where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

13. How We Protect Your Personal Information

We take reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession, as required by section 19 of POPIA.

These measures include:

transmitting information between your browser and our systems over an encrypted connection;
storing authentication tokens in cookies that are not accessible to website scripts;
restricting access to personal information to those who need it to perform their duties;
storing account credentials in a hashed form rather than as readable text; and
requiring service providers who process personal information on our behalf to apply appropriate safeguards.

No system can be guaranteed to be completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator where POPIA requires us to do so.

14. Cookies

PrimeStays uses cookies that are strictly necessary to operate the website and keep you signed in.

These are:

a session cookie, which holds a random identifier that links your browser to your signed-in session on our servers; and
during sign-in, a short-lived login cookie, which holds a random identifier for a login attempt in progress and is removed once you have signed in.

Neither cookie contains your personal information or any access credential; each holds only a random identifier that is meaningless on its own. These cookies are required for the website to function. If you block or delete them, you will not be able to remain signed in.

We do not currently use advertising or third-party tracking cookies. If that changes, we will update this Policy and, where the law requires it, ask for your consent first.

15. Your Rights

Subject to the requirements of POPIA, you have the right to:

be told whether we hold personal information about you, and to request access to it;
request correction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
request deletion or destruction of personal information we are no longer entitled to retain;
object to the processing of your personal information on reasonable grounds, in the manner POPIA prescribes;
withdraw consent, where our processing relies on your consent;
object to direct marketing at any time; and
complain to the Information Regulator.

We may ask you to verify your identity before we act on a request, and a prescribed fee may apply to a request for access, as permitted by POPIA.

We will respond to your request within a reasonable period. Where we cannot give effect to a request, we will explain why.

16. How to Exercise Your Rights

To exercise any of the rights described above, contact us at:

Email: [email protected]

Please tell us what you would like us to do and include enough information for us to identify you and, where relevant, your booking reference.

Requests for access to, or correction of, personal information may need to be made on the forms prescribed under POPIA. We will tell you if that applies and help you with the process.

17. Complaints to the Information Regulator

If you believe we have not dealt with your personal information lawfully, you may lodge a complaint with the Information Regulator.

The Information Regulator (South Africa)

Website: https://inforegulator.org.za
General enquiries: [email protected]
POPIA complaints: [email protected]
Toll free: 0800 017 160
Telephone: 010 023 5200

We would appreciate the opportunity to resolve your concern first, so please consider contacting us before lodging a complaint.

18. Children

The PrimeStays website and booking service are intended for adults. Guests must be at least 18 years old to make a booking.

We do not knowingly collect personal information from children without the consent of a competent person. Where a child stays at a property as part of a booking, we process only the information necessary to administer that booking, and the person making the booking is responsible for providing it lawfully.

If you believe we hold information about a child that we should not, please contact us and we will investigate.

19. Automated Decision-Making

We do not make decisions about you based solely on automated processing that has legal consequences for you.

20. Links to Other Websites

The PrimeStays website may link to third-party websites, including booking platforms, map services and property review pages.

Those websites are operated independently and have their own privacy policies. This Policy does not apply to them, and we are not responsible for how they process your personal information.

21. Changes to This Policy

We may update this Policy from time to time.

The current version will always be published on the PrimeStays website, and the Effective Date at the top of this page shows when it last changed.

Where a change materially affects how we process your personal information, we will take reasonable steps to bring it to your attention.

22. Contact Us

If you have a question, concern or request about this Policy or your personal information, please contact us.