Privacy Policy

1. Who we are

Information Officer

Under POPIA, every organisation that processes personal information must have a designated Information Officer, responsible for compliance and for handling requests and complaints regarding personal information.

2. What personal information we collect

2.1 Information you give us when booking

When you make a booking through our website, we collect:

• Full name
• Email address
• Phone number
• Your chosen visit date and details of your booking (number of guests, package selected, hut or table selection, party details, and similar booking preferences)

A booking may only be made by an adult. Graceland Venues does not knowingly collect personal information directly from children through our website — see section 8 (Children) below.

2.2 Proof of payment (EFT bookings)

If you choose to pay by manual EFT, we ask you to upload a proof of payment. This document may show your bank name and, depending on your bank's statement format, a partially masked account number. We store this proof solely to verify and process your payment.

2.3 Card and payment information (PayFast)

If you pay by card, your payment is processed directly by PayFast (Pty) Ltd, our third-party payment gateway. Graceland Venues does not receive, see, or store your card number, expiry date, or CVV. PayFast processes this information under its own privacy policy and security standards.

2.4 Website usage information (cookies and analytics)

Our website uses:

• Vercel Web Analytics and Speed Insights — to count visitors and measure how quickly our pages load. These tools do not use cookies and do not identify you: they record aggregated information such as the pages visited, the referring website, country, and device and browser type.
• Google Analytics — only if you accept analytics cookies when you first visit our website. It helps us understand how visitors find and use our website, by recording information such as the pages you visit, how you arrived at our website, your approximate location (city and country), and your device and browser type. It uses cookies to recognise return visits (see section 9). We have switched off Google's advertising features, and we do not send your name, email address, phone number or booking reference to Google.
• Sentry — if something goes wrong on our website, a technical error report (the page, browser and device type, and what went wrong) is sent to Sentry so we can fix it. It is configured not to include your booking or payment details.

We do not use advertising cookies. Google Analytics cookies are only set if you accept them, and you can change your choice at any time (see section 9).

2.5 CCTV

Our premises are monitored by CCTV for the safety and security of our visitors, staff and property. Footage may capture your image while you are on site. CCTV footage is used only for safety, security, and incident-investigation purposes, is stored securely, and is only accessed by authorised personnel.

3. How we use your information

We use the personal information we collect to:

• Process and confirm your booking, and send you booking confirmations, tickets (including QR codes), and payment-related communication
• Verify manual EFT payments against the proof of payment you upload
• Communicate with you about your booking, including changes, cancellations, or issues that require your attention
• Allow our staff to check you in at the venue using your ticket's QR code
• Maintain the security of our website and premises
• Understand and improve how visitors use our website, using the analytics tools described above
• Comply with our legal, financial and tax record-keeping obligations

3.1 We do not use your information for marketing

4. Who we share your information with

We do not sell your personal information. We share personal information only with the following categories of third-party service providers, strictly to the extent necessary to operate our booking system:

We may also disclose personal information where required by law, to comply with a legal process, to protect our rights or property, or to protect the safety of our visitors, staff or the public.

4.1 Cross-border transfer of information

Some of the service providers listed above may store or process personal information on servers located outside South Africa (for example, in the United States or the European Union). Where this occurs, we take reasonable steps to ensure that these providers apply an adequate level of protection to your personal information, consistent with the requirements of POPIA, including relying on providers with recognised international security and data protection standards.

5. How long we keep your information

We keep booking and customer information, including proof-of-payment documents, only for as long as we need it: to provide your booking, to deal with queries, refunds and rebooking vouchers (which are valid until the end of the season they are issued in), and to meet our legal obligations, such as tax and financial record-keeping (South African law generally requires these records to be kept for five years). When we no longer need information, we securely delete or anonymise it. You may ask us to delete your information sooner (see section 7), unless we are required to keep it. Google Analytics data is kept for no longer than 14 months and is then deleted automatically. CCTV footage is retained for a limited period necessary for security purposes and is then automatically overwritten or deleted, unless required for an ongoing investigation.

6. How we protect your information

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure, including:

• Encrypted transmission of data (HTTPS) between your browser and our website
• Access controls restricting staff access to personal information based on role
• Secure, access-controlled storage of proof-of-payment documents
• Not storing your card details on our own systems — these are handled directly by PayFast

No method of transmission or storage is completely secure. While we work to protect your personal information, we cannot guarantee its absolute security.

7. Your rights under POPIA

Subject to POPIA, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate, outdated, or incomplete personal information
• Request deletion of your personal information, subject to our legal and financial record-keeping obligations
• Object to the processing of your personal information in certain circumstances
• Withdraw consent where our processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint with the Information Regulator of South Africa if you believe your personal information has been processed unlawfully

To exercise any of these rights, please contact us at support@gracelandvenuespaarl.co.za. We will respond to your request within a reasonable time, and in any event within the timeframes required by POPIA.

7.1 Complaints to the Information Regulator

You have the right to lodge a complaint with South Africa's Information Regulator if you are unhappy with how we have handled your personal information:

8. Children

Our booking system is designed to be used by adults. A booking may only be made by an adult, who is responsible for the accuracy of the information provided, including details relating to any children included in the booking party. We do not knowingly collect personal information directly from children through our website. If you believe a child has provided us with personal information directly, please contact us at support@gracelandvenuespaarl.co.za and we will take steps to delete it.

9. Cookies

Cookies are small text files placed on your device when you visit our website. We do not use advertising cookies.

• Analytics cookies (optional). When you first visit our website, we ask whether you accept Google Analytics cookies. Only if you accept, Google Analytics sets cookies named _ga and _ga_…, which recognise return visits and last for up to 2 years. If you decline, no analytics cookies are set. Your choice is remembered in your browser's local storage.
• Cookie-free analytics. Vercel Web Analytics and Speed Insights (section 2.4) work without cookies.
• Booking details. While you make a booking, your browser keeps your booking details in its own session storage so they are not lost if you are sent to PayFast and back; this is cleared when you close the browser tab.
• Staff sign-in. Staff who sign in to our staff portal receive a sign-in cookie, which is strictly necessary for that portal to work. Google Analytics never runs on the staff portal.

You can change or withdraw your analytics choice at any time: change my cookie choice. You can also delete cookies in your browser settings.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or legal requirements. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this Policy periodically.

11. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us: