Privacy & Data Protection Notice

Last updated: 3 September 2026

This notice explains how The Victoria Bed & Breakfast ("we", "us", "our") collects, uses, shares and protects your personal information when you use this website or enquire about, or stay with, us. We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

1. Who is responsible for your information

2. What personal information we collect

• When you make an enquiry or booking through the website, by email, phone or WhatsApp: your name, email address, phone or WhatsApp number, the dates you want to stay, the number of guests, and anything you tell us in your message.
• During your stay: booking and payment records, and any preferences or notes needed to host you.
• Automatically, when you visit the website: standard server logs — your IP address, browser type, the pages you view and the time of your visit — kept for security, troubleshooting and to keep the site running well.
• The embedded Google Map on our contact section is served by Google. When it loads, Google may receive your IP address and set its own cookies, governed by Google's Privacy Policy.

3. Why we use it, and our lawful basis

We use your personal information to respond to your enquiry, prepare a quote, confirm and manage your booking, host your stay, keep accounting and tax records, and to secure and improve the website. Under POPIA our processing is justified because it is necessary to take steps at your request before entering into a contract, to perform the accommodation contract, to comply with the law, and for our legitimate interest in operating the guest house.

Supplying your contact details and travel dates is voluntary, but we cannot respond to an enquiry or hold a room without them.

4. Who we share it with

We do not sell your personal information and we do not share it for anyone else's marketing. We share it only with:

• our website and email hosting provider (Afrihost), which stores the site and the enquiry mailbox on our behalf;
• a payment provider or an online booking channel, but only if you choose to pay or book through one;
• a person or authority to whom we are required by law to disclose it.

The website and its database are hosted in South Africa. We do not transfer your personal information outside South Africa, other than the limited data Google receives through the embedded map described above.

5. Cookies

This website does not use advertising or analytics cookies and does not track you across other sites. It uses only what is strictly necessary to display the page. The embedded Google Map may set cookies that are controlled by Google, not by us.

6. How long we keep it

• Enquiries that do not become a booking: up to 12 months, then deleted.
• Booking, guest and payment records: up to 5 years after your stay, to meet tax and legal record-keeping obligations, then deleted or anonymised.
• Server logs: a short rolling period for security and diagnostics.

7. How we protect it

The website is served over HTTPS so information you send is encrypted in transit. Booking data is held in an access-controlled database, and system credentials are stored outside the public web folder. We keep the number of people who can access your information to those who need it to do their job.

8. Your rights under POPIA

You have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update information that is wrong or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing based on our legitimate interest;
• withdraw any consent you have given for optional processing (such as marketing);
• complain to the Information Regulator.

To exercise any of these, email bookings@thevictoria.co.za. We will respond within a reasonable time and may need to verify your identity first.

9. Direct marketing

We will only send you special offers or news if you have specifically agreed to receive them. Every such message will include an easy way to unsubscribe, and you can opt out at any time by emailing us.

10. Children

The website is intended for adults making travel arrangements. We do not knowingly collect personal information from children without the consent of a parent or guardian.

11. Access to information (PAIA)

For requests for access to records held by the business under the Promotion of Access to Information Act, 2000 (PAIA), contact bookings@thevictoria.co.za.

12. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Significant changes will be posted on this page.