Privacy Policy

Arabella is an independent day-experience booking agent based in Hermanus, South Africa, operating in partnership with Arabella Hotel & Spa and a curated network of licensed activity operators across the Overberg and Walker Bay region. This policy explains what personal information we collect from guests and vendors, how we use it, and the rights you have. It should be read together with our Terms & Disclaimer of Liability.

From guests making a booking: full name, email address, phone number, hotel room number (where relevant), guest count, ages of minors where an activity requires it, accessibility notes, dietary or medical information you choose to disclose, special requests, and — for company invoicing — company name, VAT number and billing address.

Payment data: payments are processed by our third-party payment provider. We receive only a payment reference, the last few digits of your card and the amount. We never see or store your full card number, CVV or expiry.

From vendors onboarding to the platform: business name, representative name, contact details, registration and VAT numbers, banking details (encrypted at rest), tax and BEE certificates, insurance and transport-compliance documents, and social-impact declarations (nonprofit status, minority-ownership flags, community role) where you choose to share them.

Automatically: minimal technical data (IP address, browser type, pages viewed) for security, fraud prevention and to keep the site running.

• To confirm and fulfil your booking, including sharing the necessary details with the operator who will run your activity.
• To send booking confirmations, itinerary updates, 24-hour reminders, weather/tide alerts and, on request, tax invoices.
• To enable vendors to manage their listings, capacity, availability and weekly payouts, and to issue commission and remittance documents.
• To operate the site, prevent fraud, and comply with legal obligations including tax and consumer-protection law.
• We do not sell your personal information, and we do not market to you without your explicit consent.

Activity operators: the specific operator running your booking receives only what they need — your name, contact details, guest count, ages of minors where relevant, and any accessibility or safety notes you provided.

Arabella Hotel & Spa concierge: where a booking is associated with a stay at the hotel, room number and guest name may be shared with the concierge team so they can assist with logistics.

Service providers: secure hosting, database, email delivery and payment processing — bound by data-processing terms.

Authorities: where legally compelled (subpoena, court order, SARS enquiry).

Booking records are retained for the period required by South African tax and consumer-protection law (currently five years from date of issue). Vendor accounts, contracts, banking details and payout records are retained for as long as the vendor operates on the platform and for five years after departure. Marketing preferences are honoured indefinitely once you unsubscribe.

The platform is served from Cloudflare's global network, and personal data is stored in a Supabase-managed PostgreSQL database. Email is sent through Resend, and card payments are processed by Paystack, who receive only what they need to take the payment. Personal data may be processed in South Africa and in other countries where these sub-processors operate; transfers outside South Africa are made only where appropriate safeguards under POPIA are in place.

We use industry-standard controls: encrypted database connections, row-level access rules that restrict each vendor to their own data, encrypted banking-detail storage, and audit logs on sensitive administrative actions. No system is perfectly secure — you are responsible for keeping your account password confidential and reporting any suspected unauthorised access to us immediately.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix inaccurate or incomplete information.
• Deletion — ask us to erase your information where we no longer have a legal basis to keep it (bookings within the tax-retention window cannot be erased until that window expires).
• Objection — object to processing for direct marketing at any time.
• Complaint — lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

We use only strictly-necessary cookies to keep you signed in and to keep your itinerary basket intact between page loads. We do not currently use advertising or cross-site tracking cookies.

The site is not directed at children under 18. Where a booking includes minors, the booking is made by a parent or guardian on their behalf and they accept these terms on the minor's behalf.

Privacy queries and rights requests: reach the Arabella concierge desk at Arabella Hotel & Spa, Kleinmond R44, Western Cape, South Africa, or via the WhatsApp concierge button on the site. We aim to respond within 30 days.