Privacy Policy

River House Lodge respects your privacy. This policy explains, in plain language, how we collect, use, share and protect your personal information in line with South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).

Effective date: 23 October 2026

1. Who we are (the responsible party)

River House Guest Lodge (“River House Lodge”, “we”, “us”) is the responsible party for the personal information described in this policy.

• Address: 27 Visarend Street, Malelane, 1320, Mpumalanga, South Africa
• Phone: +27 (0) 13 790 1333
• Email: info@riverhouselodge.co.za
• Website: riverhouselodge.co.za

2. What personal information we collect

• Enquiries: your name, email address, phone number and the details of your enquiry when you contact us by phone, email, WhatsApp or social media.
• Bookings: names of guests, contact details, travel dates, room choices, number of guests, special requests (for example dietary needs or accessibility requirements) and booking history.
• Guest registration: on arrival we may record your full name, ID or passport number, nationality, address, vehicle registration and signature, as required for guest registers.
• Payments: online payments are handled by our booking provider and its payment processors. We do not see or store your full card details. We keep records of amounts paid, refunds and, for EFT payments, the banking details that appear on proof of payment.
• WhatsApp and email: the messages, contact details and any attachments you send us.
• CCTV: CCTV cameras operate in parts of the premises for safety and security, and record images of people on the property.
• Website: this website has no contact form and no user accounts. See section 10 on cookies and analytics.

We do not intentionally collect special personal information (such as health information) unless you choose to share it, for example a medical or dietary need, so that we can look after you. We only process children’s information as part of a booking made by a parent or guardian.

3. Why we use it

• to answer enquiries and give quotes;
• to make, manage, confirm and change bookings, and to process deposits, payments, cancellations and refunds;
• to register guests and meet our legal obligations, including accounting and tax requirements;
• to provide services during your stay, such as meals, transfers and activities you ask us to arrange;
• to keep guests, staff and property safe and secure (including CCTV);
• to handle complaints, disputes and legal claims.

We do not sell your personal information. We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

4. Legal basis for processing

Under section 11 of POPIA, we process your personal information because:

• it is needed to conclude or perform a contract with you (your booking and stay);
• it is required by law (for example tax and accounting records);
• it protects your legitimate interests or ours, such as the safety and security of guests and property; or
• you have given your consent, for example to marketing messages or to sharing special dietary or medical needs. You may withdraw your consent at any time.

5. Who we share it with

• Booking platforms: our online booking system, Nightsbridge, and any online travel agent or travel agent you book through.
• Payment processors and banks: to process payments and refunds.
• Service providers: for example our email and IT providers, website hosting, accountants, security and CCTV providers, and tour, game drive and transfer operators you ask us to book.
• Authorities: where the law requires it, for example the police or SARS.

We require our service providers to keep your information confidential and secure and to use it only for the services they provide to us.

6. Cross-border transfers

Some of our service providers, such as booking, payment, email or messaging platforms (including WhatsApp), may store or process information on servers outside South Africa. When this happens, we make sure that, as required by section 72 of POPIA, the recipient is bound by laws, binding rules or an agreement that give a level of protection substantially similar to POPIA, or that the transfer is needed to perform your booking or you have agreed to it.

7. How long we keep it

We keep personal information only for as long as we need it for the purposes above or as the law requires. Booking, payment and accounting records are generally kept for at least five years to meet tax and accounting laws. Enquiries that do not lead to a booking are deleted when no longer needed. CCTV footage is automatically overwritten after approximately 30 days, unless it is needed to investigate an incident. When information is no longer needed, we delete or destroy it securely.

8. How we protect it

We take reasonable technical and organisational measures to protect your personal information against loss, misuse and unauthorised access, including access controls and password protection on our systems, limiting access to staff who need it, and keeping paper registers secure. If we believe your information has been accessed by an unauthorised person, we will notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy of it;
• ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• object to the processing of your information on reasonable grounds, and to direct marketing at any time;
• withdraw your consent where we rely on consent;
• complain to the Information Regulator.

To exercise any of these rights, contact our Information Officer (section 11). We may ask you to prove your identity before acting on a request.

10. Cookies and analytics

This website does not use cookies, analytics, tracking or advertising tools, and it has no contact form. Like all websites, our web host records basic technical information (such as your IP address, browser type and pages visited) in server logs, for security and to keep the site running. Fonts on this site are loaded from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google. When you click “Book Now” you are taken to Nightsbridge’s booking website, which has its own privacy and cookie policy. Links to Instagram and Facebook are also governed by those platforms’ own policies.

11. Information Officer

Johan (Information Officer)
River House Guest Lodge, 27 Visarend Street, Malelane, 1320, Mpumalanga, South Africa
Email: info@riverhouselodge.co.za
Phone: +27 (0) 13 790 1333

12. Complaints

If you have a concern about how we handle your personal information, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za

13. Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with its effective date.