Effective Date: 1 August 2025

1. Introduction

Back Room Bookings Pty Ltd (“we”, “our”, or “us”) is committed to protecting your privacy and processing your personal information responsibly. This Privacy Policy applies to all users of our platform, including Guests and Hosts, regardless of their location whether in South Africa or abroad.

This Policy complies with the Protection of Personal Information Act, 4 of 2013 (POPIA) and aligns with international data protection laws, including the EU General Data Protection Regulation (GDPR) and other applicable legislation in jurisdictions where our users are based.

2. Scope

This Privacy Policy applies to all personal data collected:

• Via our website and mobile applications
• Through user registrations, listings, bookings, and communications
• From users both within South Africa and outside the country

By using our platform, you consent to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy.

3. What Information We Collect

We may collect the following categories of personal information:

3.1 Information You Provide

• Full name, email, phone number, and address
• Profile details, including photos, language preferences, and travel or hosting preferences
• Property details and descriptions (for Hosts)
• Identity verification documents
• Bank or payment details (processed securely by third parties)
• Reviews, messages, and support queries

3.2 Information We Collect Automatically

• IP address, browser type, device info, and geolocation data
• Access times and pages viewed
• Cookies and similar tracking data

4. Purpose of Collection and Legal Basis

We process your personal information for the following purposes, and in accordance with the lawful bases under POPIA, GDPR, and similar frameworks:

You have the right to object to processing based on legitimate interests or withdraw consent at any time.

5. Data Sharing

We do not sell your data. However, we may share your information with:

• Other users (Hosts/Guests) for confirmed bookings
• Trusted third-party service providers (e.g., payment processors, hosting providers)
• Regulatory authorities, courts, or law enforcement (when required)
• In connection with business transfers or restructuring (with notice)
• Cross-border partners, with adequate data protection safeguards in place

6. Cross-Border Data Transfers

As we operate globally, your information may be transferred to and stored on servers outside your country of residence, including outside South Africa.

For users in South Africa, this is permitted under section 72 of POPIA, where:

• The foreign country has laws that provide an equivalent level of protection; or
• The data subject consents to the transfer; or
• Adequate contractual safeguards are in place

For users in the EU, GDPR-compliant Standard Contractual Clauses (SCCs) may be used where required.

7. Your Rights

If You Are in South Africa (POPIA):

You have the right to:

• Access your personal information
• Request correction, deletion, or restriction of your information
• Object to certain processing
• Withdraw consent at any time

If You Are in the EU (GDPR) or Other Jurisdictions:

You may also have the right to:

• Data portability
• Lodge a complaint with your local data protection authority

8. Data Retention

We retain your information only as long as necessary to:

• Fulfil the purpose it was collected for
• Comply with applicable laws (e.g., tax, financial regulations)
• Resolve disputes or enforce our Terms of Use

After this period, your information will be securely deleted or anonymise.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Authenticate users
• Track usage and site performance
• Store preferences
• Provide targeted advertising (only with consent)

You may manage your cookie preferences through your browser settings or opt-out where applicable.

10. Data Security

We take all reasonable and appropriate security measures to protect your data, including:

• Encrypted data transmission (SSL)
• Secure access controls
• Regular vulnerability monitoring
• Limiting access to authorised personnel only

Despite our efforts, no system is completely secure. You use the platform at your own risk.

11. Children’s Privacy

Our services are not intended for individuals under 18. We do not knowingly collect personal data from children. If you become aware of such data being submitted, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. We will notify you of material changes via email or through our platform.

13. Compliance

Agreement to Know Your Customer (KYC) & Know Your Business (KYB) checks and cooperation with investigations.

14. Contact Us

If you have any questions about this Privacy Policy, would like to access your information, or lodge a complaint, please contact info@backroombookings.co.za