Privacy Policy
This Privacy Policy applies to all natural persons whose personal information is collected, used, or otherwise processed by Vernora Boutique Hotel (Pty) Ltd (Proprietary Limited), trading as Vernora ("Vernora", "the Boutique Hotel", "the Company", "we", "us"), in connection with the website located at imbranom.com, the contact form hosted thereon, and the email subscription service offered to visitors. This Policy is issued in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), and takes effect from 2026-01-01. It applies to all visitors to the website, all persons who submit information through the contact form, and all persons who subscribe to receive email communications from Vernora, regardless of whether they ultimately become guests of the hotel.
1. Introduction and Interpretation
1.1. Vernora is a boutique hotel offering hospitality services, and this document describes how personal information submitted through its website is collected, stored, used, and protected. It does not describe the processing of personal information collected through means other than the website, such as during an in-person check-in, unless expressly stated.
1.2. Terms used in this Policy that are defined in POPIA, including "personal information", "processing", "data subject", "responsible party", and "operator", bear the meanings assigned to them in that Act unless the context indicates otherwise.
1.3. Where this Policy refers to "the website", it means the site located at imbranom.com and all subdomains and pages forming part thereof.
2. The Two Ways in Which the Website Collects Personal Information
2.1. The contact form. The website provides a contact form through which visitors may submit enquiries regarding reservations, events, or general questions. The form requires the visitor to provide a name, an email address, and a message, and may optionally request a telephone number and preferred dates of stay. Information submitted through this form is transmitted to Vernora's reservations and guest relations staff for the sole purpose of responding to the enquiry. The legal basis for this processing is that it is necessary for the conclusion or performance of a contract with the data subject, or, where no booking results, that it is necessary for Vernora's legitimate interest in responding to enquiries directed to it, an interest that is not overridden by the data subject's own interests given the limited and relevant nature of the information requested.
2.2. The email subscription. The website offers visitors the option to subscribe to receive periodic email communications concerning Vernora's offers, seasonal packages, and news. Subscription requires only an email address and, where voluntarily supplied, a first name. The legal basis for this processing is the data subject's consent, obtained at the point of subscription by way of a clear affirmative act. The data subject may withdraw this consent at any time by using the unsubscribe link included in every marketing email or by contacting Vernora directly using the details in clause 9.
2.3. In both cases, Vernora also automatically records the date and time of submission and the IP address from which the form was submitted, for the purposes of security, abuse prevention, and record-keeping, on the basis of Vernora's legitimate interest in maintaining the integrity and security of its systems.
3. Other Personal Information Processed
3.1. Where a data subject proceeds to make a reservation, whether through the website, by telephone, or in person, Vernora will additionally collect information necessary to fulfil the accommodation contract, including identity document or passport details as required for guest registration, payment card information (processed via a third-party payment processor and not stored by Vernora in full), and any special requirements communicated by the guest. Such processing is necessary for the performance of the accommodation contract and, in respect of identity verification, to comply with legal obligations applicable to accommodation establishments in South Africa.
3.2. Vernora does not knowingly collect personal information relating to children through the website's contact form or subscription mechanism, and any such information received will be deleted upon discovery unless processing is otherwise authorised under section 35 of POPIA.
4. Cookies and Similar Technologies
4.1. The website uses cookies and similar tracking technologies. A separate Cookie Policy, available at imbranom.com/cookies, describes in detail the categories of cookies used, being strictly necessary cookies, analytics cookies, and marketing cookies, the purposes for which each category is used, and the manner in which a data subject may accept or decline non-essential cookies through the website's consent mechanism.
5. Hosting and Third-Party Processing
5.1. The website and the data submitted through it are hosted on servers operated by a third-party hosting provider engaged by Vernora as an operator within the meaning of POPIA. Vernora has satisfied itself that its hosting provider maintains appropriate technical and organisational security measures and processes personal information solely on Vernora's instructions and for no purpose other than that for which it was engaged.
5.2. Email subscription communications are dispatched using a third-party email service provider, which similarly acts as an operator and processes subscriber email addresses solely for the purpose of transmitting the communications authorised by this Policy.
5.3. Payment information submitted in connection with a reservation is processed by a third-party payment services provider. Vernora does not store complete payment card numbers on its own systems.
5.4. Where any operator engaged by Vernora is located outside the Republic of South Africa, Vernora will ensure that such cross-border transfer complies with section 72 of POPIA, including by satisfying itself that the recipient jurisdiction affords an adequate level of protection or that the transfer is otherwise subject to a binding agreement providing equivalent safeguards.
6. Retention of Personal Information
6.1. Vernora retains personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following table summarises the applicable retention periods.
| Category of Personal Information | Retention Period |
|---|---|
| Contact form submissions (enquiries not resulting in a booking) | 24 months from the date of submission |
| Email subscription data | Until the data subject unsubscribes or withdraws consent, plus 30 days to process the request |
| Reservation and guest registration records, including identity document details | 5 years from the date of departure, in accordance with applicable South African financial and tax record-keeping obligations |
| Payment transaction records held by the payment processor | As determined by the payment processor's own retention policy, typically 5 years |
| Server and security logs (IP addresses, timestamps) | 12 months from the date of creation |
6.2. Upon expiry of the applicable retention period, Vernora will delete or de-identify the personal information concerned, save where continued retention is required by law or is necessary for the establishment, exercise, or defence of a legal claim.
7. Security Safeguards
7.1. In accordance with section 19 of POPIA, Vernora has implemented appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession or under its control, including restricted access controls, encrypted transmission of form submissions, and regular review of its security arrangements with its hosting and email service providers.
7.2. In the event of a security compromise where there are reasonable grounds to believe that personal information of a data subject has been accessed or acquired by an unauthorised person, Vernora will notify the Information Regulator and the affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA.
8. Rights of the Data Subject
8.1. Any data subject whose personal information is processed by Vernora has the right, subject to the conditions and limitations set out in POPIA, to:
- 8.1.1. be notified that personal information about them is being collected;
- 8.1.2. request access to the personal information Vernora holds about them, free of the first request and subject to a reasonable fee for subsequent requests as prescribed by regulation;
- 8.1.3. request the correction, updating, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
- 8.1.4. object, on reasonable grounds, to the processing of their personal information;
- 8.1.5. object to the processing of their personal information for purposes of direct marketing, including by unsubscribing from Vernora's email communications at any time;
- 8.1.6. withdraw consent to processing, where processing is based on consent, without affecting the lawfulness of processing carried out prior to withdrawal;
- 8.1.7. lodge a complaint with the Information Regulator of South Africa regarding the alleged interference with the protection of their personal information; and
- 8.1.8. institute civil proceedings regarding the alleged non-compliance with the protection of their personal information.
8.2. A data subject wishing to exercise any of these rights may do so by contacting Vernora using the details set out in clause 9. Vernora will respond to any such request within a reasonable time and, in any event, within the timeframes prescribed by POPIA.
8.3. The contact details of the Information Regulator of South Africa are: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; [email protected].
9. Contacting Vernora
9.1. Requests, queries, or complaints concerning this Privacy Policy or the processing of personal information by Vernora should be directed to:
Vernora Boutique Hotel (Pty) Ltd (Proprietary Limited), trading as Vernora
214 Lois Avenue, 0181 Pretoria, South Africa
Email: [email protected]
Telephone: +27 12 393 3465
Company registration number: 7112156821
10. Changes to this Policy
10.1. Vernora may amend this Privacy Policy from time to time to reflect changes in its processing activities or in applicable law. The version published on the website at any given time governs, and material changes will be indicated by an updated effective date at the head of this document.