Privacy Policy

1. Who we are

Cape Mesa is owned and operated by Buchu Collection (Pty) Ltd (registration number 2025/102761/07), a company registered in the Republic of South Africa with its registered address at 22 Ave Des Huguenots, Fresnaye, Cape Town, 8005. We are the responsible party for the personal information described in this policy. Our Information Officer is A Stemmett, who can be reached at armand@buchucollection.com. References to "we", "us" and "our" are to Buchu Collection (Pty) Ltd trading as Cape Mesa.

2. What this policy covers

This policy explains how we collect, use, share, store and protect personal information when you browse our website, make an enquiry, book or stay with us, or otherwise deal with us. It applies to guests, website visitors and enquirers. It does not cover the practices of third parties we do not control, including the booking platforms through which you may reach us.

3. Personal information we collect

• Identity and contact details: name, surname, email address, phone number, home address, nationality.
• Identification documents: when you book on our website, the main guest uploads a copy of their passport or identity document before payment so we can verify the booking. We also record ID or passport details at check-in in the guest register required by the Immigration Act. Copies of identity documents are never shared with booking or marketing platforms.
• Booking information: dates of stay, party size, rate, special requests, dietary requirements, accessibility needs, and communications with us before, during and after your stay.
• Payment information: payments are processed by our payment provider, Stitch. We receive confirmation of your payment, but not your card details.
• CCTV: we operate CCTV at the property for the safety and security of guests, staff and the property. Cameras cover entrances and exterior areas only. No cameras are placed inside the house. Signage at the property indicates where CCTV is in operation.
• CCTV footage: retained for 30 days on a rolling basis, after which it is automatically overwritten, unless footage is needed to investigate an incident, support an insurance claim or comply with a legal obligation, in which case it is kept only as long as required for that purpose.
• Website and device information: IP address, browser type, pages visited and similar usage data, collected through cookies and similar technologies as described in our Cookie Policy.
• Marketing preferences: whether you have opted in to receive marketing from us.

4. Why we process your information and on what legal basis

We only process personal information where POPIA permits it. In most cases we rely on the performance of our contract with you or on a legal obligation, not on consent. Where we do rely on consent (such as direct marketing to new contacts), you can withdraw it at any time.

5. Who we share your information with

We do not sell personal information. We share it only with service providers who process it on our instructions (operators under POPIA), with booking platforms where your booking originates there, and with authorities where the law requires it. Our operators and recipients include:

• Property management system: Guesty (reservations and guest communications).
• Payment processing: Stitch (payment initiation and reconciliation).
• Accounting: Xero, and our internal billing and invoicing system.
• Booking platforms: Booking.com, Airbnb and similar channels, where you booked through them.
• Marketing and guest contact records: HubSpot.
• Website analytics: Google Analytics.
• Website hosting, development and marketing systems.
• Email and guest communication tools.
• Professional advisers (auditors, attorneys, insurers) where necessary.
• Regulators, law enforcement and courts where disclosure is required by law.

Each operator is bound by contract to process personal information only on our instructions and to keep it secure.

6. Transfers outside South Africa

Some of our service providers store or process information outside South Africa (for example, our property management system and elements of our payment and hosting infrastructure). Where personal information leaves South Africa, we only transfer it as permitted by section 72 of POPIA: to recipients bound by law or binding agreements that provide substantially similar protection, where the transfer is necessary to perform our contract with you, or with your consent.

7. How long we keep your information

• Financial records, including invoices: at least five years, as required by tax legislation.
• Booking and guest records: 5 years after your last stay.
• Guest register entries: the period required by the Immigration Act.
• CCTV footage, where in use: 30 days, unless needed for an incident.
• Marketing lists: until you opt out or we no longer have a basis to contact you.
• Copies of identity documents uploaded when booking: 5 years after your last stay, in line with our booking records.

When information is no longer needed, we delete it or anonymise it.

8. Direct marketing

We only send electronic marketing to new contacts who have opted in. Past guests may receive marketing about similar stays, with a simple opt-out in every message. You can opt out at any time by using the unsubscribe link or contacting us, and we will action the request promptly.

9. Your rights

Subject to POPIA, you have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update inaccurate information;
• ask us to delete information we are not required or entitled to keep;
• object to processing based on legitimate interests, and to direct marketing;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer at armand@buchucollection.com. We may take reasonable steps to verify your identity first. The Information Regulator can be contacted at: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; complaints: POPIAComplaints@inforegulator.org.za; enquiries: enquiries@inforegulator.org.za.

10. Security

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, including access controls, encryption in transit and vetted service providers. No system is completely secure, but if we become aware of a breach affecting your personal information we will notify you and the Information Regulator as required by POPIA.

Identity documents are kept in a private, access-controlled store. Only authorised staff can view them, and every view is recorded.

11. Cookies

Our website uses cookies and similar technologies. These are explained in our Cookie Policy, which forms part of this policy.

12. Children

Our website and marketing are not directed at children. We process children's personal information only where a booking includes minors, and then only as needed to host the stay, with the consent of a parent or guardian.

13. Changes to this policy

We may update this policy from time to time. The current version will always be published on our website, with the date of the last update shown at the top.

14. Contact us

Buchu Collection (Pty) Ltd trading as Cape Mesa, registration number 2025/102761/07

Address: 22 Ave Des Huguenots, Fresnaye, Cape Town, 8005. Email: enquiries@capemesa.com. Phone: 021 005 6328.