Privacy Policy

1. Information We Collect

We collect personal information necessary to provide our booking and adventure services. This includes:

• Identity & Contact Details

  Full name, email address, phone number, and date of birth required to process bookings and communication.

• Emergency Contact Information

  Name and phone number of your emergency contact, used only in the event of an emergency during your experience.

• Medical Information (Optional)

  Health conditions relevant to diving safety. This sensitive information is collected with your explicit consent and processed strictly for safety purposes.

• Consent Records

  Records of your consent to our terms, liability waiver, and marketing communications, including timestamps and policy versions.

• Payment Information

  Processed securely by our payment providers. We do not store card numbers on our systems.

2. Legal Basis for Processing

We process your personal information under the following lawful bases under POPIA:

• Contract Performance

  To fulfil your booking, manage reservations, and provide our services.

• Legal Obligation

  To comply with safety regulations, liability requirements, and legal record-keeping.

• Consent

  For marketing communications, medical information (where provided), and waiver processing.

• Vital Interests

  To protect the safety of participants during adventures, including emergency contact usage.

3. How We Protect Your Data

We implement appropriate technical and organisational measures to secure your personal information:

• Encryption in Transit

  All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.

• Row-Level Security

  Database access is restricted by authenticated user identity through granular access policies.

• Limited Access

  Only authorised staff with a legitimate operational need can access customer data.

• Data Minimisation

  We only collect and process the minimum personal information required for each purpose.

• Input Sanitisation

  All data inputs are sanitised to prevent injection and XSS attacks.

4. Data Subject Rights

Under POPIA, you have the following rights regarding your personal information. To exercise any of these rights, contact our Information Officer at privacy@bundubazadventures.com:

• Right of Access (Section 23)

  Request a copy of all personal information we hold about you.

• Right to Rectification

  Correct or update inaccurate personal information we hold about you.

• Right to Deletion / Right to be Forgotten (Section 24)

  Request the deletion or anonymisation of your personal data where no longer necessary.

• Right to Object

  Object to the processing of your personal information for direct marketing.

• Right to Withdraw Consent

  Withdraw marketing consent at any time via the unsubscribe link in any email or by contacting us.

• Right to Lodge a Complaint

  Complain to the Information Regulator of South Africa at inforeg@justice.gov.za.

5. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected:

• Customer & Booking Records

  Retained for 7 years to comply with tax and legal requirements.

• Waiver Records

  Retained for 10 years to meet liability and insurance obligations.

• Marketing Consent

  Retained for 3 years after withdrawal, after which the record is anonymised.

• Inactive Customers

  Anonymised automatically after 3 years without activity.

6. Marketing Communications

We only send marketing communications where you have provided your explicit, informed, voluntary consent. Every marketing email includes a simple unsubscribe link. Withdrawing consent does not affect the lawfulness of prior processing.

7. Data Sharing

We do not sell or rent your personal information. We only share data with trusted service providers (e.g., payment processors, email providers) strictly necessary to deliver our services, under written agreements requiring them to comply with POPIA.

8. Automated Decision-Making

We do not use automated decision-making that produces legal effects or significantly affects you. All appointments and bookings are manually confirmed by our team.