Privacy Policy

This policy explains what personal information Exotic Vacations collects when you use our website, enquire or book a holiday, why we need it, who we share it with, and your rights under the Protection of Personal Information Act (POPIA).

Who is responsible for your information

Exotic Island and Ski Holidays CC, trading as Exotic Vacations, is the responsible party for your personal information under POPIA.

  • Registration number: 2010/020819/23
  • VAT number: 4740204955
  • Physical address: 4 Estuary Heights, Knysna, 6570, South Africa. We work online, so this is not a walk-in office.
  • Members: Marthinus Johannes Strydom and Heidi Ingrid Strydom
  • Email: info@exoticvacations.co.za
  • Phone and WhatsApp: 062 082 1262, Monday to Friday, 08:30 to 17:00

Our Information Officer

Our Information Officer is Marthinus Strydom, registered with the Information Regulator (registration number 2026-071538). He makes sure we comply with POPIA and handles privacy questions, requests and complaints. You can reach him at info@exoticvacations.co.za; please put "Privacy" in the subject line.

What we collect, and when

When you visit our website

Our website records each visit:

  • your IP address and the type of browser you use;
  • the page you arrived on and the website that sent you;
  • the campaign tags in the web address, and an ad-click code if you came from an online ad.

The pages you look at are held for 24 hours. They're saved only if you send an enquiry, and then they stay with your enquiry.

Google Analytics and Google Ads also collect information through their cookies, and every visit passes through Cloudflare, which protects our website. See "Cookies and browser storage" below.

When you send an enquiry

Through our enquiry form, our online Beachcomber booker, Eva, email, WhatsApp or phone:

  • your name, email address, phone number and town or city;
  • your travel plans: destination, hotel, dates and how flexible they are, departure airport, cabin class, meal plan, budget and any special occasion;
  • how many adults and children are travelling, and the children's ages;
  • your message, and whether you ticked the box to hear about our travel deals (see "Marketing messages").

Our enquiry form and the last step of our Beachcomber booker use Cloudflare's bot check, which sees your IP address and browser.

When you chat with Eva, our website assistant

  • Eva is an AI assistant. What you type goes to our AI provider, xAI, so that she can answer. "How we use AI" below says exactly what is sent.
  • Before she logs an enquiry or emails you a quote, Eva asks for your first name, email address and phone number.
  • We don't keep the conversation itself. We record when the chat started and when the last message was sent, the holiday you were looking at, how many messages were sent, your IP address, your browser type and, if the chat led to an enquiry, which one.
  • If you make an enquiry, Eva's summary of the chat becomes your enquiry message.
  • Please don't give Eva passport numbers, card details or health information.

When you book

For each traveller:

  • title, full names as in the passport, date of birth, gender and nationality;
  • South African ID number, and passport number, issuing country, issue date and expiry date;
  • a copy of the passport, if you upload one;
  • frequent-flyer numbers, and their relationship to the lead traveller.

For the lead traveller: phone numbers, email addresses and home address, and an emergency contact's name, relationship, phone number and email address.

Your requests: room preferences, dietary requirements, mobility needs, special occasions (such as wedding details for a honeymoon) and notes, and the name you type to sign the booking form.

When you pay

  • Card payments are made on Yoco's own secure payment page. You type your card details there, so we never see or store your card number. We send Yoco only the amount and our own references for the invoice and booking, and Yoco tells us when the payment has gone through.
  • EFT payments: our bank, Investec, shows us the payer's name, the reference and the amount, which we match to your booking.
  • If you pay a hotel, airline or tour operator directly, that payment is between you and the supplier.

Special personal information

When you complete our booking form, we keep a record of your acceptance of our booking terms and this privacy notice: when you accepted, from which internet address, and which version of the terms. If you remove a traveller or replace a passport scan, we delete the scan file.

Dietary requirements can reveal your religion (halal or kosher meals, for example), and mobility or medical needs are health information. POPIA calls this special personal information. We ask for it only so that the hotel, airline or tour operator can look after you, and we use it for nothing else. The booking form asks for your consent, and you don't have to give it.

Information about other people

If you book for other travellers, or name an emergency contact, you give us their personal information. Please make sure they agree, and point them to this policy.

Do you have to give it?

  • You can browse our website without telling us who you are.
  • To answer an enquiry, we need a way to contact you and an idea of your travel plans.
  • To book, the airlines, hotels and tour operators need each traveller's name as in the passport, date of birth and passport details. Without them, we can't book or ticket your holiday.
  • The law requires us to keep records of our bookings, invoices and payments for tax purposes.

Why we use it, and on what grounds

POPIA lets us process personal information only on the grounds the Act lists (section 11).

What we use it for Our ground under POPIA
Answering your enquiry and preparing quotes Steps you asked us to take before a contract, section 11(1)(b)
Booking, ticketing and managing your holiday; sending your documents, reminders and travel tips; helping you while you're away Carrying out our contract with you, section 11(1)(b)
Passing dietary, mobility or medical needs to the suppliers of your trip Your consent, section 27(1)(a)
Children's details, for their travel Consent of a parent or guardian, section 35(1)(a)
Accounting and tax records The law requires it, section 11(1)(c)
Keeping our website secure, counting visits, and learning which pages and ads lead to enquiries and bookings Our legitimate interest in running and improving our business, section 11(1)(f)
Asking how your trip went, and asking for a review Our legitimate interest in running and improving our business, section 11(1)(f)

We use your information only for these purposes, or for purposes compatible with them. We do not sell your personal information.

How we use AI

We use one AI provider at a time. Today it is xAI, the company behind Grok, in the United States. Our back-up provider, used only if xAI is unavailable, is Anthropic, the company behind Claude, also in the United States. Either way, what we send leaves South Africa.

  • Eva, the chat on our website. She appears on our deals pages and on quotes we send you. xAI receives everything you type to her. Before she logs an enquiry or emails you a quote, Eva asks for your first name, email address and phone number, and these go to xAI with the chat. If you chat with her on a quote we've sent you, xAI also receives that quote, including your name.
  • Tools our staff use in our admin system. Our consultants can ask the AI to find client, enquiry, quote and booking details; what it finds goes to xAI so that it can answer. They can also ask it to draft a reply to your enquiry, and then xAI receives your name, email address, phone number, message, travel plans and the pages you viewed on our website. And they can paste an email in and ask for a draft reply, and then xAI receives that email.
  • Switched off today: automatic AI replies to enquiries, and AI scoring of enquiries.

Who we share it with

  • The suppliers of your holiday: hotels, airlines, tour operators (such as Beachcomber Tours, WLH and Holiday Factory), the travel wholesalers we book hotels through, transfer companies and, where we arrange it, travel insurers. Each gets only what it needs to deliver its part of your trip. Our consultants send most of them your booking details by email.
  • Beachcomber Tours, in Mauritius, receives bookings through its own booking system: the lead traveller's name, email address and mobile number; each traveller's title, names, gender, date of birth, age and phone number; wedding details for a honeymoon; and the completed booking form, passport details included.
  • Sure Travel, which issues the air tickets on the packages we put together ourselves. On tour-operator packages, the tour operator issues them.
  • Payment providers: Yoco for card payments, and our bank, Investec, for EFTs (see "When you pay").
  • Google: Google Analytics and Google Ads, which measure how our website and our ads perform; Google Fonts, which supplies our website's fonts and sees your IP address; and Google Workspace, which runs our email, so it holds every email between you and us.
  • xAI, our AI provider (see "How we use AI").
  • SMTP2GO, which delivers the emails our booking system sends: it handles the recipient's name and address, the message, and attachments such as quotes, invoices and booking forms.
  • Cloudflare, which protects our website and admin system. Every visit passes through it, and its bot check runs on our forms.
  • Linode, part of Akamai, which hosts our website, booking system and database, and keeps backup copies of them.
  • WhatsApp: if you message us on WhatsApp, WhatsApp (Meta) carries those messages under its own privacy policy.
  • Authorities, when the law requires us to.

The companies that run our systems for us (Linode, Cloudflare, Google, SMTP2GO and xAI) process your information only to provide their service to us, under data-processing terms we have accepted with each of them.

When you send us an enquiry or make a booking, we share your email address and phone number with Google in hashed (one-way encrypted) form, together with the identifier of the Google ad you clicked, which our website keeps in a cookie for up to 90 days, so Google can tell us which of our ads led to enquiries and bookings. Google does not receive your details in readable form and uses them only to measure our advertising.

The Google Ads tag on our website also lets Google add your browser to a list of people who have visited our website, which we can use to show our ads to past visitors.

Information sent outside South Africa

  • Your holiday. Your trip happens abroad, so we send travellers' details to the hotels, tour operators, airlines and transfer companies in the countries you visit, such as Mauritius, Tanzania (Zanzibar), the Seychelles, the Maldives, Thailand and Indonesia. Their data-protection laws may protect your information less than POPIA does. We send it because it is necessary to carry out the holiday you booked (section 72(1)(c) and (d)).
  • Our systems. Our website, booking system and database, and our previous booking system, run on Linode servers in London, in the United Kingdom, which has a data-protection law (the UK GDPR) similar to POPIA. Linode is part of Akamai, a US company. Our nightly backups are kept on the London server and copied to our own backup servers in South Africa, and Linode keeps daily and weekly copies of its own.
  • AI. What we send to xAI goes to the United States (see "How we use AI").
  • Other service providers. Google, Cloudflare and WhatsApp (Meta) are US companies, and SMTP2GO is a New Zealand company. They process information under data-processing terms we have accepted with each of them.

How long we keep it

We don't delete personal information automatically. Today:

  • Enquiries, quotes, bookings, invoices, payments and client records are kept with no end date. This includes client records copied from our previous booking system.
  • Travellers' details, including ID and passport numbers, passport copies and booking forms, are kept with no end date.
  • Copies of emails in our booking system, records of your visits to our website (IP address and browser) and Eva chat records are kept with no end date.
  • The pages you view are held for 24 hours, and kept only if you send an enquiry.
  • Our previous booking system still holds older client files. Once our consultants have finished with it, its records will be moved into our current system.
  • Backups: we back up our system every night and keep the first backup of each month with no end date. Information deleted from our system, even at your request, can still be in those backups.
  • Our servers' technical logs are overwritten within days to weeks.
  • On your device: see "Cookies and browser storage" below.

How we protect it

  • Our website uses encrypted (HTTPS) connections.
  • In our booking system, ID and passport numbers, and booking forms you haven't finished, are stored encrypted.
  • Passport copies can be opened only by our staff, after signing in.
  • Our staff sign in to reach client records, and each person's access matches their role.
  • Our booking system's database can't be reached from the internet.
  • If we believe someone has gained access to your personal information without authority, we will tell you and the Information Regulator, as POPIA requires.

Your rights

Under POPIA, you may:

  • ask whether we hold personal information about you, and ask for a copy of it;
  • ask us to correct or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained;
  • object to our use of your information for our legitimate interests, and object to direct marketing at any time;
  • withdraw your consent at any time (this doesn't affect what we did before);
  • complain to the Information Regulator.

To use these rights, email our Information Officer at info@exoticvacations.co.za. We'll confirm who you are before we act, and reply within a reasonable time. For an objection, or a request to correct or delete, you may use the Information Regulator's Form 1 or Form 2; ask us and we'll send them. We may have to keep records the law requires us to keep.

Our PAIA manual explains how to ask for records we hold, what it costs and how long it takes.

If you're unhappy with how we've handled your information, please tell us first so that we can put it right. You can also complain to the Information Regulator:

Cookies and browser storage

Cookies are small files a website stores in your browser. Our website also keeps some details in your browser's own storage: some only while the tab is open, some until you clear it. Google Analytics and Google Ads load on every page as soon as you open it.

Name Kind What it's for How long Personal information?
ev_ad_click Our cookie, shared across our exoticvacations.co.za addresses Remembers which Google ad you clicked, and when, so that a later enquiry can be credited to that ad 90 days An ad-click code only
ev_enquiry_contact Browser tab storage Fills in the enquiry form for you Until you close the tab Yes: name, email address, phone number, town or city, children's ages, special occasion
ev_enquiry_prefs Browser storage Remembers your departure airport, flight class and meal plan Until you clear it No
ev_bc_booking_session Browser tab storage Fills in the online Beachcomber booker for you Until you close the tab Yes: your contact details, and travellers' names, dates of birth, phone numbers and frequent-flyer numbers
ev_bc_booking_prefs Browser storage Remembers your departure city, cabin class, and the number of adults and children Until you clear it No
ev_enquiry_session Browser tab storage A random code that links the pages you view on this visit and holds your enquiry list Until you close the tab A random code only
ev-attribution-sent Browser tab storage Makes sure the ad and website that brought you are sent to us only once per visit Until you close the tab No
eva_modal_shown Browser tab storage Shows Eva's chat pop-up only once per visit Until you close the tab No
ev.searchBar.lastSearch.v1 Browser storage Remembers your last holiday search Until you clear it No, though it may include children's ages
ev-booking-form:(your booking reference) Browser tab storage A copy of your booking form as you fill it in, so that nothing is lost if the connection drops Until you submit the form or close the tab Yes: names, dates of birth, ID and passport numbers, address, dietary and mobility needs
_ga and _ga_XYM82YKSZ1 Google Analytics cookies Count visits and show how our pages are used Up to 2 years A device code
_gcl_aw and other Google Ads cookies Google Ads cookies Tell us which ads led to enquiries and bookings About 90 days A device or click code
Cloudflare Turnstile Cloudflare's bot check, on the enquiry form and the last step of the Beachcomber booker Tells real visitors from bots As Cloudflare sets it Your IP address and browser signals
ev_access_token and ev_refresh_token Our cookies, for staff only Keep our staff signed in to our admin system. Never set for website visitors 30 and 60 days Staff sign-in only

Your form details stay in your browser tab. While you fill in an enquiry, a Beachcomber booking or our booking form, your contact and traveller details (on the booking form, passport numbers too) are kept in that tab so that you don't lose them. They're deleted when you send the form or close the tab. Between visits we remember only choices such as your departure city, cabin class and meal plan.

Our pages load their fonts from Google Fonts, which sees your IP address. Videos on our website use YouTube's privacy-enhanced mode and load only when you press play; YouTube then applies Google's privacy policy. We don't use the Meta (Facebook) pixel, Hotjar or Google Tag Manager.

You can delete cookies and stored site data in your browser's settings. You can also stop Google Analytics with Google's opt-out add-on, and manage the ads Google shows you in My Ad Center.

Marketing messages

  • We don't send newsletters or specials. Our enquiry form and online Beachcomber booker have a separate box to tick if you'd like to hear about our travel deals; we record your choice.
  • Some emails count as marketing: the welcome-back email after your trip, our request for a review, and follow-ups on a quote you haven't answered. Every one of them has a one-click unsubscribe link, which works immediately. You can also ask any of our consultants to switch them off.
  • Unsubscribing never stops emails about a booking: quotes, invoices, receipts, booking forms and travel reminders still reach you.

Children

  • Under POPIA, a child is anyone under 18.
  • We process children's information only when a parent or guardian gives it to us to plan or book the child's travel: names, dates of birth, ages and passport details. We do this with that parent or guardian's consent.
  • Our website and Eva are meant for adults. We don't knowingly collect information directly from children.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page, and the version on this page is the one that applies.

Contact us about privacy

  • Information Officer: Marthinus Strydom, info@exoticvacations.co.za (please put "Privacy" in the subject line)
  • Phone and WhatsApp: 062 082 1262, Monday to Friday, 08:30 to 17:00
  • Address: Exotic Island and Ski Holidays CC, trading as Exotic Vacations, 4 Estuary Heights, Knysna, 6570, South Africa