What we keep,
and what we never do.

Who is responsible

The Bowtie Collective is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA). We operate from Bloubergstrand in the Western Cape, South Africa.

Questions, corrections and deletion requests all go to the same place: bookings@thebowtiecollective.co.za. A founder handles them personally.

What we collect, and only when you send it

We do not buy data and we do not build profiles. Everything we hold about you is something you typed into a form or sent us in a message.

• Guest enquiries: your name, email address, phone number, the dates and number of guests you are asking about, the occasion if you mention it, and your message.
• Owner enquiries: your name, email address, phone number, where the property is, its type and size, its current letting status, any listing link you share, your goals and anything you tell us about the house.
• General messages: your name, email address, optional phone number, the subject you choose and your message.
• Technical basics: our hosting provider keeps standard server logs (such as IP address and browser type) for security and to keep the site running. We do not use these to identify you.

Guest verification and identity documents

Once a booking is confirmed, we ask the lead guest to complete a short, secure verification before check-in. This is a separate step from the booking itself.

• Guest details: the lead guest’s full name, date of birth (we confirm the lead guest is at least 21), nationality, contact number, email, residential address, and the names of any other occupants.
• One identity document: a photo or scan of a South African ID or passport, together with the document number. It is uploaded over an encrypted connection and stored privately — never in a public location.
• Acceptance records: which version of each policy you accepted, with the date, time, IP address and browser, kept as proof of agreement.
• Security deposit: a record of the refundable deposit, its payment, any post-stay inspection outcome, and any deduction or refund.

How we protect and delete identity documents

Identity documents are visible only to the founders, and only to verify your booking. They are held no longer than necessary: by default they are scheduled for deletion 90 days after check-out, and we will delete one sooner on request unless a law requires us to keep it.

We never publish, sell or share your identity document, and we never use it for anything other than confirming your stay.

Why we hold it

One reason: to answer you, and to carry on that conversation if it becomes a booking or a management appointment. That is the entire purpose.

We rely on your consent — the tick box on each form — and, once a booking or management agreement exists, on the legitimate need to perform that agreement.

What we never do

• We do not sell, rent or trade your information.
• We do not add you to a mailing list. There is no newsletter to unsubscribe from.
• We do not use advertising or tracking cookies, and we do not run third-party ad pixels on this site.
• We do not send marketing about unrelated properties or services.

Who can see it

The two founders read every enquiry. Beyond that, information is shared only with the service providers needed to run the site and reply to you — our hosting and database provider, and the email service that delivers our notifications and replies. They process it on our instruction and for no other purpose.

If a booking proceeds, we may share the minimum needed with the property owner or a cleaning and maintenance provider — for example your arrival date and guest count. Never your message history.

Some of these providers operate servers outside South Africa. Where information leaves the country it is protected by the provider’s contractual safeguards, as POPIA requires.

How long we keep it

Enquiries that do not become bookings are kept for up to 24 months, so that we recognise you if you come back, and then deleted.

Where a stay or a management appointment goes ahead, we keep the records for as long as South African tax and accounting law requires — generally five years from the end of the relevant tax period.

You can ask us to delete your information sooner and we will, unless we are legally required to keep a specific record.

Your rights under POPIA

You have the right to ask what we hold about you, to have it corrected, to have it deleted, to withdraw your consent, and to object to how we are using it. Email us and we will respond within a reasonable period, at no charge for a straightforward request.

If you are unhappy with how we have handled your information, you may complain to the Information Regulator of South Africa. We would rather you told us first — but the right is yours either way.

Security, honestly stated

The site is served over HTTPS, form submissions are stored in an access-controlled database, and account passwords are hashed rather than stored. Only the founders hold administrative access.

No system is perfect. If a breach ever affected your information we would tell you and the Information Regulator, as POPIA requires, rather than hope you did not notice.

Children

This site is intended for adults arranging travel or property management. We do not knowingly collect information from children. If a child’s details reach us inside a booking enquiry, they are used only to prepare for the stay.

Changes to this notice

If we change how we handle information, we will update this page and the date below. We will not quietly broaden what we do with what you have already sent us.