Last updated: July 1, 2026
Welcome to Tramonto Lodge (“we”, “us”, “our”). We are committed to protecting your privacy and ensuring that your personal information is collected, used, and stored in a lawful, fair, and transparent manner in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
By using our website, contacting us, placing an order or creating an account you acknowledge that your personal information may be processed as described in this Privacy Policy.
This Privacy Policy serves as the notification required by section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). The information required under section 18 is provided throughout this Privacy Policy, including details of the personal information we collect, the purposes for which it is processed, whether the provision of information is voluntary or mandatory where applicable, the consequences of failing to provide information, recipients of personal information, international transfers, and your rights as a data subject.
By accessing or using our website, contacting us, or making use of our services, you acknowledge that you have read this Privacy Policy and understand how your personal information may be collected, used, disclosed, stored and protected as described herein.
Where your consent is required by POPIA or any other applicable law for a specific processing activity, we will obtain your consent separately before processing your personal information for that purpose.
If you have any questions about how your personal information is processed, please contact us using the details provided in this Privacy Policy.
This Privacy Policy applies to all individuals whose personal information we process in the course of our business operations.
This includes, but is not limited to:
This Privacy Policy applies to personal information collected through our website, contact forms, email communications, WhatsApp /telephone interactions, booking enquiries, and any related services operated by us.
To make this Privacy Policy easier to understand, the following key terms are used:
Personal Information
Any information relating to an identifiable, living natural person or juristic person, as defined under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
POPIA
The Protection of Personal Information Act 4 of 2013, which regulates how personal information is collected, used, stored, and shared in South Africa.
Responsible Party
The entity that determines the purpose and means of processing personal information. In this case, Tramonto Lodge.
Operator
A third party who processes personal information on behalf of the Responsible Party under contract and instruction.
Country
Refers to the Republic of South Africa.
Processing
Any operation or activity performed on personal information, including collection, storage, use, transfer, alteration, or deletion.
Consent
Any voluntary, specific, and informed expression of will in terms of which permission is given for the processing of personal information.
Services
The products, website features, customer support, marketing communications, and related services offered by Tramonto Lodge.
Website
The official website operated by us, accessible at https://tramontolodge.co.za.
Usage Data
Data collected automatically when using our website or systems, including IP address, browser type, device information, pages visited, booking interactions, and system performance data.
You / Data Subject
Any individual accessing or using our services, including guests, visitors, customers, participants, employees, contractors, or any person whose personal information we process.
This Privacy Policy explains how we collect, use, and protect personal information in accordance with POPIA.
We act as the Responsible Party when processing personal information for our own business purposes, including handling enquiries, managing accommodation bookings, customer communication, marketing, and website operations.
Where we engage third-party service providers to assist in delivering our services, such providers act as Operators and process personal information on our behalf in accordance with POPIA.
Tramonto Lodge is the Responsible Party for purposes of POPIA.
Company Details
The company details are as follows:
Information Officer
The Information Officer is responsible for overseeing compliance with POPIA and handling all requests relating to personal information.
They are appointed in accordance with the requirements of the Protection of Personal Information Act 4 of 2013 (“POPIA”).
We collect personal information directly from you when you interact with our website or services, including when you submit a contact form, make a booking enquiry, subscribe to communications, or contact us for support.
Where required by law, or where you have given us your consent, we may process your personal information in order to provide our services, manage bookings and respond to enquiries or communicate with you regarding your stay or request.
When you interact with us directly, we may collect personal information such as:
We collect this information to respond to your enquiries, process bookings, and provide accommodation services.
When you browse our website, we may automatically collect certain technical information about your device and browsing activity. This may include your IP address, browser type, device information, website usage activity, cookie identifiers, and referral sources.
We collect this information to understand how visitors use our website, to improve its performance and usability, and to support the proper functioning of our services.
We do not process or store payment card information through our website.
Our website is used to receive accommodation enquiries, booking and general enquiries. Once a booking has been confirmed, payment may be made by electronic funds transfer (EFT), card payment at the lodge, approved third-party payment service providers, or any other payment methods that we may make available.
Card payments made at the lodge are processed securely using approved payment terminals provided by our authorised payment service providers. We do not store guests’ full credit card or debit card details. Any payment card information is processed directly by the relevant payment service provider in accordance with applicable payment security standards and its own privacy policies.
For accounting, booking administration, legal compliance, and record-keeping purposes, we may retain limited payment-related information, including payment confirmations, invoices, transaction reference numbers, billing details, the payment method used, and records of amounts paid. This information is processed only for lawful purposes, retained only for the period required by applicable legislation or our legitimate business needs, and protected by appropriate technical and organisational safeguards in accordance with the Protection of Personal Information Act, 2013 (POPIA).
Where you communicate with us via messaging platforms such as WhatsApp or similar services, we may process the content of those communications, including text messages, images, documents, and voice notes, in order to respond to enquiries, manage bookings, provide customer support, confirm services, and maintain records of our interactions with you.
These communications may be stored and retained as part of our business records and are subject to the same security, access control, and retention principles set out in this Privacy Policy.
In some circumstances, you may provide us with personal information relating to another individual, such as a spouse, partner, family member, dependant, employee, authorised representative, recipient of a delivery, or emergency contact.
By providing us with another person’s personal information, you confirm that you are authorised to do so and, where required by law, that you have informed the individual about the collection and processing of their personal information and have obtained any necessary consent.
We will process such personal information in accordance with this Privacy Policy and applicable data protection laws.
We may collect personal information through closed-circuit television (CCTV) systems and other physical security monitoring measures when you visit our premises. This may include video footage and related time and location data captured in and around entrances, reception areas, public spaces, parking areas, and other designated security zones.
We use CCTV monitoring for security, crime prevention and detection, protection of property and individuals, staff and guest safety, operational management, and compliance with legal obligations.
CCTV footage is stored securely and access is restricted to authorised personnel only. Footage is retained only for as long as reasonably necessary for security, investigation, or legal purposes, after which it is securely deleted or overwritten.
Where required, CCTV footage may be shared with law enforcement authorities, insurers, or legal representatives in connection with investigations, incidents, or legal proceedings.
We generally collect personal information directly from you when you contact us via our website, email, telephone or make a booking. However, in certain circumstances, we may receive personal information from other lawful sources, including:
Where personal information is not collected directly from you, we will process such information in accordance with POPIA and this Privacy Policy.
We collect personal information in several ways when you interact with our business.
This includes when you:
We process personal information for legitimate, specific, and lawful business purposes in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
We may process personal information for the following purposes:
We process personal information in accordance with the applicable conditions for lawful processing under the Protection of Personal Information Act 4 of 2013 (“POPIA”), including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.
We may process your personal information where:
Where processing is based on consent, you may withdraw your consent at any time.
Certain personal information is required in order for us to provide products or services, verify payments, comply with legal and regulatory obligations, and communicate with you effectively. Where the provision of personal information is mandatory for these purposes and you choose not to provide such information, we may be unable to provide certain products, services, support, or complete booking and transactions.
In certain cases, we may also be legally required to collect and retain personal information in accordance with applicable tax, consumer protection, accounting, fraud prevention, or other regulatory obligations.
Where we process personal information based on legitimate interests, we ensure that these interests do not override your rights and freedoms in accordance with POPIA principles.
We apply data minimisation principles by limiting the collection, use, and retention of personal information to what is reasonably necessary for the lawful purposes described in this Privacy Policy.
We may process personal information where reasonably necessary to detect, prevent, investigate, or respond to fraud, unauthorised activities, security incidents, or other unlawful conduct affecting our business, customers, employees, or service providers.
To support these activities, we use appropriate access controls, monitoring, and security measures designed to help protect personal information and identify unauthorised or suspicious activity. Where appropriate, we may use automated systems to assist in detecting potentially fraudulent transactions or activities. Such systems are used to support decision-making and are not intended to replace appropriate human oversight where required.
We may use aggregated or pseudonymised data to understand how our website and services are used, in order to improve performance, functionality, and user experience.
Where required, we provide mechanisms for users to opt out of non-essential analytics processing and we limit the retention of analytics data to what is reasonably necessary.
We retain customer support communications where necessary to respond to enquiries, maintain service quality, and resolve disputes. These records are retained only for as long as reasonably necessary for these purposes and are subject to access controls, restricted internal access, and appropriate security safeguards.
We may send you direct marketing communications such as newsletters, promotional offers, product updates, or special promotions where:
Existing and past customers may receive marketing relating to our own similar products and services, subject to their right to opt out at any time. Where required by law, we will obtain your consent before sending direct electronic marketing communications.
You may opt out of receiving marketing communications at any time by:
Our website uses cookies and similar tracking technologies, including web beacons, tags and pixels, to improve website functionality, analyse website usage, remember user preferences, support booking or online enquiry activity, and, where applicable, deliver relevant marketing content.
Cookies may be temporary (session cookies), which are deleted when you close your browser, or persistent cookies, which remain on your device until they expire or are deleted.
Cookies may include:
Some cookies may be placed by third-party service providers such as analytics providers, advertising platforms, payment processors, or ecommerce service providers. Where our website includes embedded content or social media features, those third parties may also place cookies or collect information in accordance with their own privacy policies.
Where required, we use cookie consent mechanisms to allow users to accept or reject non-essential cookies. We may also use cookies to remember your cookie preferences and consent choices.
You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of the website.
Cookie Policy
For more detailed information about the cookies and similar tracking technologies we use, including third-party cookies where applicable, please refer to our Cookie Policy available at: https://www.tramontolodge.co.za/cookie-policy/.
We may share personal information with trusted third parties and authorised internal personnel where such sharing or access is reasonably necessary for the operation of our business, the provision of our services, compliance with legal obligations, security requirements, or the protection of our legitimate interests.
Categories of recipients may include website hosting providers, booking or reservation management platforms, email service providers, IT support providers, analytics providers, and legal or regulatory authorities where disclosure is required by law.
Personal information may also be accessed internally by authorised employees, management, contractors, or administrative personnel where such access is reasonably necessary for the performance of their duties, the provision of services, customer support, operational management, security, compliance, or other legitimate business purposes. Access is restricted to individuals who require the information for authorised purposes and is subject to appropriate confidentiality and security controls.
We only share the minimum amount of personal information necessary for these service providers to perform their functions. Where they process personal information on our behalf as Operators, we take reasonable steps to ensure that they process such information only for authorised purposes, maintain appropriate confidentiality, implement reasonable security measures, and comply with POPIA.
We do not sell, rent, trade, or otherwise make personal information available to third parties for their own independent commercial purposes.
We may disclose personal information where we are legally required or authorised to do so in order to comply with applicable laws, regulations, court orders, legal processes, or lawful requests from competent authorities.
This may include disclosures to law enforcement agencies, regulatory authorities, tax or financial authorities, courts, tribunals, or other public bodies.
We will take reasonable steps to verify the validity and legal basis of any request before disclosing personal information. Where legally permitted, we may notify affected individuals of such disclosures unless we are prohibited from doing so by law or court order.
Our website and business operations may make use of third-party ecommerce, analytics, advertising, payment processing, communication, cloud hosting, customer support, and marketing platforms.
These service providers may process personal information on our behalf as Operators in accordance with our instructions, POPIA, and any applicable contractual obligations. Where personal information is processed by third-party providers located outside South Africa, such processing will be subject to the safeguards described in Section 13 (International Transfers).
We may disclose, transfer, or make available personal information as part of a proposed or completed merger, acquisition, restructuring, reorganisation, financing transaction, sale of assets, change of ownership, joint venture, or other corporate transaction involving all or part of our business.
Where personal information is transferred as part of such a transaction, we will take reasonable steps to ensure that the recipient is bound by appropriate confidentiality, security, and data protection obligations. Any such transfer will be carried out only where it is lawful and necessary for the purposes of the transaction and subject to any applicable legal requirements.
Some of our service providers, employees, directors, contractors, or authorised representatives may process, store, or access personal information from countries outside the Republic of South Africa in the course of our business operations.
Cross-border processing or access may occur where reasonably necessary for the operation of our business, including website hosting, cloud storage, email communications, payment processing, analytics, marketing services, remote working arrangements, or other operational requirements.
Where personal information is transferred outside South Africa or accessed from another jurisdiction, we take reasonable steps, where appropriate, to ensure that such processing complies with section 72 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) and to protect personal information through appropriate technical, organisational, contractual, or other lawful safeguards.
Some service providers may process personal information in jurisdictions outside South Africa where different data protection laws apply. We take reasonable steps, where appropriate, to protect personal information during such processing.
We take the security of your personal information seriously and implement reasonable technical and organisational measures to protect it.
We regularly review and update our security measures in order to identify and address reasonably foreseeable internal and external risks to personal information. These measures include secure hosting environments, SSL encryption for data transmission, password-protected systems, restricted administrative access, and the use of secure payment processing systems.
Although we take reasonable precautions to protect your personal information, no electronic system or internet-based transmission can be guaranteed to be completely secure.
We retain personal information only for as long as it is necessary to fulfil the purposes for which it was collected. This includes retaining information for the duration of your customer relationship with us and for as long as required by applicable tax, accounting, or legal obligations.
Certain categories of personal information may be retained for longer periods where required or permitted by law, or where retention is reasonably necessary to establish, exercise, or defend legal rights, resolve disputes, comply with regulatory, tax, accounting, or insurance obligations, investigate incidents, or protect our legitimate business interests.
Where personal information is no longer required for the purpose for which it was collected and there is no lawful basis requiring its continued retention, we will take reasonable steps to securely delete, destroy, anonymise, or de-identify such information in accordance with applicable legal requirements and our internal record management practices.
We respect your privacy and are committed to giving you appropriate control over your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
Under POPIA, you have the following rights:
Access:
You may request access to the personal information we hold about you.
Correction:
You may request that we correct or update any inaccurate or incomplete personal information.
Deletion / Destruction:
You may request that we delete or destroy your personal information where we are no longer legally required to retain it, or where continued processing is not justified.
Objection to Processing:
You may object to the processing of your personal information where such processing is based on our legitimate interests, or where it relates to direct marketing.
Withdrawal of Consent:
Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
Limitation of Processing:
Where permitted by POPIA, you may request that we limit or suspend the processing of your personal information in certain circumstances.
You may exercise any of your rights in relation to your personal information by submitting a request to our Information Officer using the contact details provided in this Privacy Policy.
Your request should include:
Your full name
Account / booking details (if applicable)
A clear description of your request
Proof of identity (for verification purposes)
Where applicable, requests for access, correction, deletion, objection, or other rights relating to personal information may be submitted using the prescribed forms issued under POPIA and PAIA. We may request that you complete or provide such forms where required by law or where reasonably necessary to process your request efficiently.
In order to protect personal information and prevent unauthorised access, disclosure, deletion, or alteration of personal information, we may require reasonable proof of identity before processing a request.
Where necessary, we may request additional information or documentation to verify the identity and authority of the person submitting the request.
We reserve the right to refuse or delay requests where adequate verification cannot be obtained.
We will acknowledge receipt of requests within a reasonable period and aim to respond to all requests as soon as reasonably possible.
We will generally respond to requests within 30 days of receipt. Where a request is complex, involves multiple records, requires additional verification, or cannot reasonably be completed within this period, we may extend the response period where permitted by law and will notify you accordingly.
Certain requests may be limited, deferred, or refused where we are legally entitled or required to do so.
We maintain internal procedures for the receipt, verification, assessment, tracking, and resolution of requests relating to personal information.
Requests may be logged and retained where necessary for compliance, audit, security, fraud prevention, dispute resolution, record-keeping, and to meet applicable legal, regulatory, contractual, tax, and accounting obligations.
All requests are reviewed by authorised personnel and handled in accordance with applicable legal, regulatory, and security requirements. Where permitted or required by law, we may refuse, partially fulfil, limit, or defer certain requests. Where a request cannot be fully completed, we will provide reasons where legally required.
In accordance with the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) (“PAIA”), we maintain a PAIA Manual that sets out the categories of records we hold and the process for requesting access to those records.
A copy of our PAIA Manual is available on request. Requests for a copy of the PAIA Manual, or requests for access to records in terms of PAIA, may be directed to our Information Officer using the contact details provided in this Privacy Policy in Section 5.
In the event of a security compromise involving personal information, we will take immediate steps to investigate, contain, and mitigate the impact of the incident.
Where required under POPIA, we will notify affected individuals and the Information Regulator of South Africa as soon as reasonably possible. Such notification will include details of the nature of the breach, possible consequences, and measures taken or recommended to address the breach.
Notification does not constitute an admission of fault or liability.
Where you apply for employment with us, we may collect and process personal information provided during the recruitment process.
This may include your name, contact details, CV information, qualifications, employment history, and references.
Where necessary and permitted by law, we may conduct verification checks, which may include:
We process this information for the purposes of assessing suitability for employment or engagement, complying with legal obligations, and protecting the legitimate interests of the business.
Personal information collected during recruitment will only be retained for as long as necessary for recruitment purposes or as required by law. If your application is unsuccessful, we may retain your information for future opportunities only where you have consented or where lawful retention is permitted.
Our services may be used by children under the age of 18 where bookings, reservations, or related arrangements are made by a parent, legal guardian, or another authorised adult.
We may collect and process the personal information of children where it is necessary for accommodation bookings, guest registration, room allocation, the provision of requested services, safety and emergency management, compliance with legal or regulatory obligations, or any other lawful purpose permitted under the Protection of Personal Information Act, 2013 (“POPIA”).
Where we process the personal information of a child, we will do so in accordance with POPIA and only where the consent of a competent adult has been obtained or another lawful ground for processing applies, and we will take reasonable technical and organisational measures to protect such information and ensure it is processed only to the extent reasonably necessary for the purposes for which it was collected.
If a parent or legal guardian believes that we have collected or processed their child’s personal information unlawfully or without the necessary authorisation, they may contact our Information Officer using the contact details provided in this Privacy Policy. We will investigate the matter and, where appropriate, take reasonable steps to correct, delete, or otherwise deal with the information in accordance with POPIA.
Our website may contain links to third-party websites, applications, or services that are not operated or controlled by us.
These third parties operate independently and have their own privacy and data protection policies. If you choose to access or interact with these third-party services, any personal information you provide will be processed in accordance with their respective privacy policies.
We encourage you to review the privacy policies of any third-party websites or services before providing them with personal information.
While we take reasonable care in selecting trusted service providers and partners, we are not responsible for the privacy practices, security measures, or content of third-party websites or services and do not accept liability for how they handle your information.
Some third-party providers may be located in, or operate from, jurisdictions outside of South Africa. In such cases, your personal information may be subject to the data protection laws of those jurisdictions. Once you leave our website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our website’s Terms of Service.
We may update this Privacy Policy from time to time in order to reflect changes in our practices, services, or legal obligations.
Whenever we make changes, we will update the “Last Updated” date at the top of this policy. Any significant changes will be clearly communicated on our website. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.
If you believe that your personal information has been processed in a way that is not compliant with POPIA, we encourage you to contact us first so that we can attempt to resolve your concern.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa.
Website: https://inforegulator.org.za/
General Enquiries: enquiries@inforegulator.org.za
POPIA Complaints: POPIAComplaints@inforegulator.org.za
PAIA Complaints: PAIAComplaints@inforegulator.org.za
Telephone: 010 023 5200 / 0800 017 160
Physical Address:
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191
For privacy-related questions, requests, or complaints, please contact our Information Officer using the contact details set out in Section 5 of this Privacy Policy.