Privacy notice

The short version: we collect what you type into the brief form, we email it to ourselves, and we use it to answer your brief and run your clients' programme. We set no tracking cookies and we run no analytics. That is genuinely all of it.

Who we are

Escapeades (Pty) Ltd, a company registered in the Republic of South Africa, registration number TODO, of TODO registered address. We supply ground services to tour operators, travel designers and agents.

For the information about you and your business, we are the responsible party, which is what POPIA calls the person who decides why and how information is used. Under the GDPR the equivalent term is data controller.

For your clients' information, which you send us so that we can deliver a booking, we act on your behalf and on your instructions. POPIA calls that an operator and the GDPR a processor. You remain responsible to your clients for it, and we handle it as this notice describes.

The information officer for the purposes of POPIA is TODO name, who can be reached at TODO email address. Write to that address about anything on this page.

What we collect

Only what you give us. Through the brief form that is: the kind of help you need, your name, company, email address and country, your website and telephone number if you choose to give them, and anything you write in the free-text field. For a client booking it also includes the regions you select, approximate dates and length, the number of adults and children and the children's ages, and the level of property. A brief does not need to identify your clients, and we would rather it did not until a booking goes ahead.

When a booking goes ahead, you will send us what it actually requires about your clients: full names as they appear in passports, dates of birth where a supplier needs them, flight details, an emergency contact, travel insurance details where a supplier requires them, dietary requirements, and any medical condition, allergy or mobility limitation relevant to the programme.

If you email or telephone us instead, we hold whatever you tell us in that exchange.

Health information, and why we ask

Information about health, dietary needs and disability is what POPIA calls special personal information and the GDPR calls a special category. We ask for it only where a trip genuinely requires it: a kitchen that needs to know about a nut allergy, a boat operator that needs to know about a heart condition, a lodge that needs a ground-floor room. We rely on the traveller's explicit consent, which you obtain from your clients before you send it to us, and we pass it only to the specific supplier who needs it.

Our lawful basis

For answering your brief and supplying a booking, we rely on the performance of our contract with you and on steps taken at your request before entering into one. For keeping booking records after the trip, we rely on our legal obligations under South African tax and company law. For special category information, we rely on the traveller's explicit consent, which they may withdraw at any time, although withdrawing it during a trip may mean an activity cannot safely go ahead.

What we do not collect

We do not use analytics, advertising pixels, session recording or third-party tracking on this website. Nothing you enter into the enquiry form is ever placed in a web address, so your answers do not appear in browser history, in server logs or in any referrer header sent to another site.

Cookies and what is stored on your device

We set no advertising cookies, no analytics cookies and no third-party cookies.

The only thing this website stores on your device is your answer to the cookie notice itself, kept in your browser's local storage so that we do not ask you the same question on every page. It contains a single value recording your choice and the date you made it. It is never sent to us or to anyone else, it identifies nobody, and clearing your browser data removes it. Storage of that kind is exempt from consent requirements under both POPIA and the ePrivacy rules, because without it we could not honour the choice you made.

If we ever add analytics, that notice is where you would be asked, and nothing would load unless you had said yes.

We also collect a hidden timestamp in the enquiry form, recording how long the form took to complete. It exists solely to reject automated spam submissions and is discarded on receipt.

How your enquiry reaches us

The form is submitted directly from your browser to Web3Forms, a form-delivery service, which forwards it to our email address. Their own privacy terms apply to that transit. Your enquiry then sits in our email, which is hosted outside South Africa, and in the booking file we keep for you.

Who else sees your information

Making the bookings your clients' programme requires means passing relevant details to hotels, airlines, charter and helicopter operators, and licensed activity providers. We pass on only what each supplier needs: a hotel gets names and dates, a shark cage operator gets the medical declaration it is required to collect, and neither gets anything else.

Some of those suppliers are outside your country, and some are outside South Africa. Where information crosses a border we send only what the booking needs, and we do not transfer information to any country or recipient that we would not be prepared to name to you.

We may also disclose information where the law requires it. We will not do so otherwise.

What we will not do

We will not add you to a mailing list without your asking. We will not sell, rent or share your details or your clients' for marketing, by anyone, ever. We will never contact your clients to market anything to them, ours or anyone else's. We will not use your brief for any purpose other than answering it and, if it goes ahead, running the programme.

How long we keep it

Enquiries that do not become bookings are deleted after twenty-four months. Booking records are kept for five years after the end of the trip, which is what South African tax and insurance requirements oblige us to do. Passport copies and medical declarations are deleted within three months of the trip ending, because nothing requires us to keep those.

Keeping it safe

Your file lives in password-managed accounts with two-factor authentication, and is seen by the people who run the company and the guide looking after your clients. We do not keep payment card details at any point. If a breach ever affected your information we would tell you and the Information Regulator, as POPIA requires.

Your rights

You may ask us what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for a particular purpose, or ask for a copy in a portable format. Write to TODO email address and we will act within thirty days. If one of your clients asks us about their information, we will tell you and help you answer them.

If you are unhappy with how we have handled your information, tell us first and give us the chance to fix it. You can also complain to the Information Regulator of South Africa, or, if you are in the United Kingdom or the European Union, to your own supervisory authority.

Children

This website is not directed at children and we do not knowingly collect information from them. Where you give us the ages of children travelling, we rely on you to have their parent's or guardian's agreement, and we use the ages solely to plan the programme safely and to cost it correctly.

Changes to this notice

If we change how we use your information we will change this page and move the date at the top of it. If the change is significant and you have a booking with us, we will email you about it rather than leaving you to notice.