PRIVACY POLICY

This Privacy Policy explains how OPLANLA ("we", "us", or "our") collects, uses, stores, and protects your personal information when you use our website and mobile application (collectively, the "Platform").

We are committed to protecting your privacy and ensuring compliance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African data protection laws.

1. Information We Collect

1.1 From Customers (Guests)

When you create an account or make a booking, we collect only the following personal information:

• Full name
• Email address

We do not collect or store:

• Government-issued identification numbers
• Physical addresses (unless required for specific bookings, with consent)
• Payment card details (payments are processed securely via third-party gateways such as PayGate, Peach Payments, or Stripe; we never see or store your full card information)

1.2 From Accommodation Providers

For property listings, we collect and display:

• Business or property name
• Description of the accommodation (provided by the provider or written by us)
• Photographs — taken exclusively by our team during on-site visits. Providers do not submit photos, and we do not use third-party or copyrighted images without proper licensing.

We do not collect personal contact details of property owners unless voluntarily provided for operational coordination (e.g., phone number for booking confirmation), and only with explicit consent.

2. Purpose of Processing Personal Information

We process your personal information only for legitimate business purposes, including:

• Creating and managing your user account
• Confirming and managing bookings
• Communicating booking updates, changes, or cancellations
• Improving our services and user experience
• Complying with legal and regulatory obligations

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Legal Basis for Processing (POPIA Compliance)

Under POPIA, we process your information based on:

• Consent: You provide your name and email to use our service.
• Contractual necessity: To fulfill your booking request.
• Legal compliance: To meet tax, consumer protection, or regulatory requirements.

You may withdraw consent at any time by deleting your account (see Section 7).

4. Data Sharing & Third Parties

We do not share your personal data with accommodation providers beyond what is necessary to fulfill your booking (e.g., your name and booking dates may be shared with the property for check-in purposes).

We use trusted third-party service providers for:

• Payment processing (e.g., PayGate, Peach Payments) — they process payments but do not use your data for their own purposes.
• Cloud hosting and infrastructure (e.g., AWS, Google Cloud) — data is stored in secure, POPIA-compliant environments.
• Email delivery (e.g., SendGrid, Mailgun) — used only to send booking confirmations and updates.

All third parties are bound by data processing agreements that ensure POPIA-level protection.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (SSL/TLS)
• Secure authentication protocols
• Regular security reviews
• Limited internal access to personal data (on a need-to-know basis)

While no system is 100% immune to risk, we take reasonable steps to prevent unauthorized access, loss, or misuse.

6. Data Retention

We retain your personal information only as long as necessary:

• Active users: While your account is active
• After account deletion: We anonymize or delete your data within 30 days
• Booking records: Retained for 24 months to comply with the Consumer Protection Act and financial record-keeping requirements

Photographs and property details remain on the Platform as long as the accommodation is listed, but can be removed upon provider request.

7. Your Rights Under POPIA

As a data subject, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and data (subject to legal retention obligations)
• Object to processing in certain circumstances
• Lodge a complaint with the Information Regulator of South Africa

To exercise these rights, contact us at: support@oplanla.com

We will respond to all verified requests within 30 days.

8. International Data Transfers

Your data is primarily stored and processed within South Africa. If we ever transfer data outside South Africa (e.g., to a cloud provider with global servers), we will ensure adequate safeguards are in place in accordance with POPIA Section 72.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our Platform with a revised "Effective Date." Continued use of the Platform constitutes acceptance of the changes.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Information Officer:

You may also lodge a complaint directly with the Information Regulator of South Africa:

• www.justice.gov.za/inforeg/
• complaints.IR@justice.gov.za