Privacy Policy

Last Updated: July 17, 2026

1. Overview & Scope

This Privacy Policy explains how Booking·Tours (Pty) Ltd, trading as BookingTours ("we", "us", "our"), collects, uses, processes, and protects personal information. It applies to the entire BookingTours application and all of its surfaces, including:

• Our marketing and information website at bookingtours.co.za.
• The operator platform and dashboard used by tour operators to manage bookings, availability, payments, and customers.
• Customer-facing online booking pages hosted on our platform.
• Our WhatsApp Business booking bot, an AI-assisted assistant that handles booking inquiries and notifications.
• Related payment, notification, and integration services that support the above.

Because the WhatsApp bot is deployed both under the BookingTours name and as sub-branded instances for individual tour operators, this is the policy of record for any specific bot instance submitted for Meta App Review, as well as for the platform generally.

2. Our Role (Controller vs. Processor)

The capacity in which we handle your data depends on who you are:

• For website visitors and for tour operators who hold a BookingTours account, we act as the responsible party (under POPIA) / data controller (under the GDPR). We decide how and why that data is processed.
• For end-customers who book a tour through an operator using our platform, the tour operator is the responsible party / controller, and we act as an operator / data processor, processing that data on the operator's behalf and on their documented instructions to deliver the booking service.

3. Information We Collect

We collect the minimum personal information necessary for each part of the service.

3.1 Website visitors

• Usage & device data: Aggregated analytics about how the site is used (pages viewed, approximate region, browser/device type).
• Cookies: Essential, preference, and analytics cookies — see our Cookie Policy for the full list and how to turn them off.
• Enquiry & demo forms: Name, email address, business name, phone number, and any message you choose to send when contacting us or requesting a demo.

3.2 Tour operators & platform account holders

• Identity & contact: Name, business/trading name, email address, and phone number.
• Account credentials: Login details managed through our authentication provider. Passwords are hashed and are never stored or visible to us in plain text.
• Business & payout details: Banking / payout details, VAT or tax registration numbers, and other information needed to settle payments to you. These are encrypted at rest.
• Platform activity & audit logs: A record of admin actions taken within the dashboard, kept for security and accountability.

3.3 End-customers (people booking a tour)

• WhatsApp phone number: To route messages and verify your conversation thread.
• Message history: The text and contents of your messages to the bot, to understand your intent and generate automated responses.
• Booking details: Name, email address, party size, selected tour, and date/time that you provide to make a booking.
• Payment events: Transaction status, amounts, and payment references. Card and banking details are entered directly with our payment gateways and are never stored on our servers.

4. How We Use Your Information & Legal Basis

We process personal information only where we have a lawful basis to do so. Each purpose below is tied to a specific legal basis under the GDPR (and the equivalent justifiable-processing conditions under POPIA):

• To run and secure our website and measure how it performs — consent (for non-essential analytics cookies, where required) and legitimate interest (for essential operation and security).
• To respond to enquiries and demo requests — steps taken at your request prior to entering a contract.
• To create and operate an operator's account, and to provide the dashboard and booking tools — performance of a contract.
• To answer questions about tour details, pricing, availability, and policies — steps taken prior to entering a contract.
• To hold, create, confirm, modify, or cancel bookings — performance of a contract.
• To issue payment links, process transactions, and provide receipts and invoices — performance of a contract and compliance with a legal obligation (tax record-keeping).
• To send transactional notifications, including day-before reminders and weather-related alerts — performance of a contract.
• To detect fraud, prevent abuse, and keep audit logs — legitimate interest in keeping the service secure.
• To send non-transactional marketing or promotional messages, where offered — consent, which you may withdraw at any time (see Section 13).

5. Cookies & Analytics

Our website uses a small, deliberate set of cookies and uses Google Analytics (on bookingtours.co.za only) to measure site performance in aggregate. We do not use third-party advertising cookies or cross-site tracking pixels, and we do not sell behavioural data. You can control or block cookies in your browser at any time. Full details are in our Cookie Policy.

6. Data Sharing, Sub-Processors & Cross-Border Transfers

We do not sell, rent, or trade your personal information. We share it only with trusted service providers necessary to operate the platform, each bound by confidentiality and data-processing agreements:

• The Selected Tour Operator: To fulfil the booking and provide the tour activity (for end-customer data).
• Meta Platforms, Inc.: As the underlying provider of the WhatsApp Business API.
• Hosting & infrastructure providers: Our platform, database, and application infrastructure run on Supabase and Vercel in the South Africa region; our marketing website is hosted on Google Firebase Hosting.
• AI language model processor: A third-party AI language model provider processes message text to generate automated responses, under a data-processing agreement that prohibits use of your data to train its models.
• Payment gateways: Yoco and Paysafe securely process card and banking transactions, so that full payment details never reach our servers.
• Analytics provider: Google Analytics, for aggregated website measurement only.

Where any of these processors are located outside South Africa or the European Economic Area (including Meta Platforms, Inc., our AI provider, and Google), we rely on standard contractual clauses, the processor's own adequacy certifications, and contractual confidentiality and security obligations to ensure your data receives an equivalent level of protection wherever it is processed.

7. AI-Generated Responses

Responses you receive from the WhatsApp Booking Bot are generated by an AI language model based on your message and available booking information. No fully automated decision made by the bot produces a legal effect or similarly significant effect on you (for example, we do not use AI to automatically approve or deny refunds, or to make any decision with legal consequences). You may request to speak with a human member of the operator's team at any time by asking to do so in the chat, or by contacting us using the details in Section 15.

8. Data Security and Encryption

We prioritise data security across the whole platform. Communications are encrypted in transit using TLS 1.2+ (TLS 1.3 where supported). Credentials, banking details, and sensitive records are encrypted at rest using AES-256 / pgcrypto AES-GCM. Access is controlled through role-based authentication with row-level security, so a tenant only ever sees its own data. Inbound webhooks are verified with HMAC-SHA256 signatures, every admin action is logged, and backups are taken hourly with 30-day retention. Access is limited strictly to authorised personnel.

9. Data Retention

We keep personal data only for as long as it is needed for the purpose it was collected for:

• Website analytics: Aggregated and anonymised; individual-level analytics data is retained no longer than 14 months.
• Enquiry & demo form data: Retained for up to 24 months from your last contact, then deleted if no account is opened.
• Operator account data: Retained for the life of the account and deleted or anonymised within a reasonable period after closure, except records we must keep for legal or tax reasons.
• Message history: Retained for 12 months after your last message, then permanently deleted or anonymised, unless it forms part of an active or disputed booking.
• WhatsApp phone number: Retained while needed to identify an active conversation thread, and deleted within 12 months of your last interaction if no booking is made.
• Booking details (name, email, party size, tour, date): Retained for 3 years after the tour date to handle post-tour customer service and complaints, then deleted or anonymised.
• Financial transaction records: Retained for 5 years to comply with South African tax law (SARS record-keeping requirements).

Any of these periods will be cut short earlier if you submit a valid deletion request under Section 10.

10. How to Delete Your Data

You can request deletion of your personal data at any time:

• End-customers — self-service: Reply with the word "DELETE" in your active WhatsApp conversation thread. This starts an automated deletion of your message history and stored booking details tied to that phone number.
• End-customers — email: Email dpo@bookingtours.co.za with your WhatsApp number and the phrase "Data Deletion Request". If the data was collected on behalf of an operator, we will action or forward the request accordingly.
• Operators & account holders: Request deletion or account closure from within the dashboard, or by emailing dpo@bookingtours.co.za.

We will complete all deletion requests within 30 days, except for data we are legally required to retain (such as financial records under Section 9).

11. Your Rights & Information Officer

Under applicable law (including POPIA and, where relevant, the GDPR), you have the right to request access to, correction of, objection to, or deletion of your personal data, to withdraw consent, to data portability, and to lodge a complaint with your local data protection regulator (in South Africa, the Information Regulator). To exercise any of these rights, contact our appointed Information Officer:

Information Officer: Gideon Langenhoven — info@capeweb.co.za

12. Children's Privacy

The BookingTours platform is a business tool intended for tour operators, and the WhatsApp Booking Bot is not directed at, or intended for use by, children under the age of 13 (WhatsApp's own minimum age requirement). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us using the details in Section 15.

13. Consent, Opt-In, and Opt-Out

By initiating a chat with the WhatsApp Booking Bot, opening an account, or opting in to receive communications, you consent to the collection, processing, and storage of your personal information as described in this policy.

You can withdraw consent and stop receiving non-essential communications at any time by:

• Replying with the word "STOP" in your active WhatsApp conversation thread.
• Using the unsubscribe link in any marketing email.
• Contacting our support team at support@bookingtours.co.za or info@capeweb.co.za.

Withdrawing consent does not affect essential transactional messages tied to an active booking (such as confirmations or safety-related alerts).

14. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last Updated" date above, and for material changes we will provide a more prominent notice (such as an in-app or email notification) where appropriate.

15. Contact Us

Booking·Tours (Pty) Ltd, Cape Town, Western Cape, South Africa.
General support: support@bookingtours.co.za
Data protection & deletion requests: dpo@bookingtours.co.za
Information Officer: Gideon Langenhoven — info@capeweb.co.za

This policy is designed to maintain compliance with POPIA, GDPR, and Meta Business Messaging Policies. For general questions about our booking software platform, please visit our main website.