Privacy policy

Who is responsible for your information

This policy explains how AfriQuintus Guest House, Norkem Park, Kempton Park, Gauteng, South Africa, handles your personal information under the Protection of Personal Information Act, 2013 (POPIA). AfriQuintus Guest House is the responsible party for the information described here.

What we collect

We collect only what we need to take a booking and look after you during your stay.

When you book	First name, surname, email address, mobile number, country, your arrival flight or time if you give it, special requests, the dates and room booked, the extras you choose, and whether you ticked the box for offers.
When you pay	The bank transfer reference and amount as they appear on our bank statement. We do not see or store card numbers.
At check-in	We look at the ID that matches the booking name.
When you message us	Your name, email, phone number and the message, through the contact form, WhatsApp, email or phone.
When you visit this website	Standard server logs (IP address, browser, pages visited, time) kept for security, and the cookies described in section 7.

We do not collect your physical address, company details or ID number when you book. We do not collect special personal information (such as health or religion) unless you choose to tell us something we need to know for your stay, for example a dietary need.

Why we use it

• To hold, confirm and manage your booking and payment, and to contact you about your stay (directions, check-in, shuttle, changes).
• To answer a question you send us.
• To meet legal duties: tax and accounting records, and any lawful request from a public body.
• To keep the guest house, our guests and our website safe (security logs, fraud checks on payments and refunds).
• To send you occasional offers by email or WhatsApp, only if you ticked the box. You can opt out at any time by replying “stop” or emailing us.

We do not use your information for automated decision-making and we do not sell it.

Our lawful basis under POPIA

• Performing a contract: your booking and stay (section 11(1)(b) of POPIA).
• Legal obligation: tax and accounting records (section 11(1)(c)).
• Legitimate interest: security and fraud prevention (section 11(1)(f)).
• Consent: replying to a message you send through the contact form, and marketing messages. You can withdraw consent at any time (sections 11(1)(a) and 69).

How long we keep it

Booking and payment records	At least 5 years after your stay, because tax law requires accounting records to be kept for that long.
Contact-form messages	Deleted from this website automatically 90 days after you send them.
WhatsApp and email enquiries	Until your question is answered and any follow-up is finished.
Marketing consent	Until you withdraw it.
Server logs	30 days, for security.

Who sees it

Your information is seen only by the people who run the guest house and the service providers below, who act on our instructions.

• Our booking system (VikBooking) runs on this website’s own server, hosted with Vultr in Johannesburg, South Africa. Bookings are stored there, not with a third-party booking platform.
• Email from the guest house is sent from our own mailbox on the same server ([email protected]) through a mail delivery service. Your email provider receives the messages we send you.
• Backups of the server are kept with Vultr, our server provider, and with Backblaze, a backup-storage provider that keeps them in the Netherlands (European Union).
• WhatsApp (Meta Platforms): if you message us on WhatsApp, your messages go through WhatsApp under its own privacy policy.
• Cloudflare protects and speeds up this website; traffic to the site passes through its network.
• Our bank sees the payment reference and amount when you pay or we refund.
• Our website agency, Muriendas Web Solutions Ltd, maintains the website and booking system on our instructions and may see booking records while doing so. The agency is based in Kenya, so this is a transfer of information outside South Africa under section 72 of POPIA.
• Public bodies when the law requires it.

If you book a stay with us through another platform (for example Airbnb or Booking.com), that booking is also governed by the platform’s own privacy policy.

Cookies and consent

This website sets only the cookies it needs to work, such as the booking system’s session cookie (so your search and selection are remembered while you book) and security cookies from Cloudflare. We do not run advertising cookies and we do not run analytics.

If we add analytics later, it will load only after you accept it, and this policy will say so.

How we protect it

• The website and booking system use HTTPS; data is encrypted in transit.
• Access to bookings needs a login and is limited to the people who run the guest house and the agency’s maintenance staff.
• The server is kept up to date, sits behind a firewall, and is backed up to a separate location.
• If a breach ever affects your information, we will tell you and the Information Regulator as POPIA (section 22) requires.

Your rights

Under POPIA you can, free of charge unless the law allows a fee:

• Ask what we hold about you and get a copy (section 23).
• Correct or delete information that is wrong, out of date or no longer needed (section 24).
• Object to our using it for a legitimate interest, or for marketing at any time (sections 11(3) and 69).
• Withdraw consent at any time; this does not affect what we did before.
• Complain to the Information Regulator (section 74).

Email [email protected] with “POPIA request” in the subject. We may ask you to prove who you are before we release or change anything. We answer within a reasonable time and in any case within the period POPIA sets.

Complaints and the Information Regulator

If you are not happy with how we handled your request, you can complain to the Information Regulator (South Africa).

Changes to this policy

We will update this page when our practices change, and change the “Last updated” date at the top. If a change affects how we use information you have already given us, we will tell you by email.