Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how Kilima Franschhoek (“we“, “us“) collects, uses, shares and protects your personal information when you visit kilimafranschhoek.co.za, make an enquiry or booking, or otherwise deal with us. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA“).

1. Who we are (the Responsible Party)

Responsible Party: [LEGAL ENTITY NAME] (Registration No. [REG NO]), trading as Kilima Franschhoek, part of the Murchison Group of Companies.
Address: 21 Roux Street, Franschhoek, 7690, South Africa
Telephone: +27 71 915 0423
Email: gm@kilimafranschhoek.co.za

Information Officer: The General Manager, reachable at gm@kilimafranschhoek.co.za.

2. What personal information we collect

Depending on how you deal with us, we may collect:

Identity and contact details: name, email address, telephone number, country of residence.
Booking and stay details: dates, room preferences, number of guests, special requests, dietary or accessibility needs you choose to tell us about, and, where required for check-in, identity or passport details.
Payment information: processed by our booking and payment providers. We do not store full card numbers on this website.
Enquiry information: what you send us through contact forms, email, phone or social media.
Newsletter and marketing details: your email address and your consent choices.
Technical information: IP address, browser type, device, pages visited and cookies (see section 8).
Comments: the details in the comment form, plus IP address and browser user agent to help detect spam.

We collect information directly from you, automatically through the website, and from third parties you use to book with us (for example our online booking engine).

3. Why we process it, and our legal basis

We only process personal information for a specific, lawful purpose, and only what is adequate, relevant and not excessive for that purpose:

to respond to your enquiries and to make, manage and confirm bookings (performance of a contract, or steps you request before a contract);
to provide accommodation, events and related services, and to meet legal obligations such as guest registration, tax and accounting records (legal obligation);
to take payment and prevent fraud (contract and legitimate interest);
to keep the website secure, prevent spam and understand how the site is used (legitimate interest);
to send you newsletters, offers and updates, only where you have given consent or where the law otherwise permits direct marketing. You can opt out at any time (consent).

4. Direct marketing

We will only send you electronic marketing if you have opted in, or if you are an existing guest and we are marketing similar services to you and you have not objected. Every marketing message includes a way to unsubscribe. You can also email us at any time to opt out.

5. Who we share your information with

We do not sell your personal information. We share it only where needed and only with operators and parties who must keep it secure and use it only on our instructions, including:

our online booking and payment providers (for example the Upperbooking booking engine and payment gateways);
website hosting, email, analytics, anti-spam and security service providers;
other companies in the Murchison Group, where needed to run the business and provide services to you;
professional advisers, auditors, insurers, and authorities where the law requires or permits disclosure.

6. Transfers outside South Africa

Some of our service providers (for example Google, which provides analytics and spam protection) store or process data on servers outside South Africa. Where this happens, we take reasonable steps to make sure the recipient is bound by law, binding rules or an agreement that gives your information a level of protection substantially similar to POPIA, or we rely on your consent or another ground allowed under section 72 of POPIA.

7. How long we keep your information

We keep personal information only for as long as needed for the purpose it was collected, or as the law requires (for example, accounting and tax records are generally kept for five years or more). Enquiry data that does not lead to a booking is deleted or de-identified within a reasonable time. Marketing details are kept until you withdraw consent. After that we delete or de-identify the information.

8. Cookies and similar technologies

We use cookies and similar tools to make the website work, remember your preferences, measure traffic (for example Google Analytics) and protect forms from spam (for example Google reCAPTCHA). Strictly necessary cookies are always active. Where we use analytics or marketing cookies, we ask for your consent where required and you can change your choice at any time through the Privacy Preference Center link on the website or in your browser settings. If you leave a comment you may choose to save your name, email and website in cookies for one year. Logged-in users receive login cookies that last for up to two weeks.

The website may link to or embed content from other sites (such as Facebook, Instagram, YouTube or maps). Those sites have their own privacy policies and we are not responsible for their practices.

9. How we protect your information

We take reasonable technical and organisational measures to prevent loss, damage, unauthorised access to or unlawful processing of your personal information, including secure (HTTPS) connections, access controls, regular software updates and agreements with our service providers. If a security compromise occurs that affects your personal information, we will notify the Information Regulator and, where required, you, as soon as reasonably possible.

10. Your rights under POPIA

You have the right to:

ask us to confirm whether we hold personal information about you and to access it;
ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
object, on reasonable grounds, to the processing of your information, and object at any time to processing for direct marketing;
withdraw your consent at any time, without affecting processing already done on the basis of that consent;
not be subject to a decision based solely on automated processing that significantly affects you;
lodge a complaint with the Information Regulator.

To exercise any right, email our Information Officer at gm@kilimafranschhoek.co.za. We may need to verify your identity first. We will respond within a reasonable time and, where permitted, any fee will be explained beforehand.

11. Complaints

If you believe we have not handled your personal information properly, please contact us first so we can try to resolve it. You also have the right to complain to the Information Regulator (South Africa):

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: enquiries@inforegulator.org.za (general) and POPIAComplaints@inforegulator.org.za (complaints)
Website: inforegulator.org.za

12. Children

Our website and services are not directed at children under 18. We do not knowingly collect personal information of children without the consent of a parent or guardian.

13. Changes to this policy

We may update this policy from time to time. The latest version is always on this page with the “last updated” date at the top.