Shumba Valley Hotel
Last updated: 28 August 2026
Shumba Valley Hotel respects your privacy. This policy explains what personal information we collect, why we collect it, whether you have to give it to us, who we share it with, how long we keep it, and what you can ask us to do with it.
We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. WHO WE ARE
Shumba Valley Hotel is the party responsible for the personal information described in this policy.
| Trading name | Shumba Valley Hotel |
| Registered name | Shumba Valley Lodge and Conference Centre |
| Registration number | 1999/007215/07 |
| Address | 53 Boeing Street, Lanseria, 1748, Gauteng |
| Telephone | +27 (0)11 790 8000 |
| Information Officer | Godfrey Noge – IT Manager |
| Privacy enquiries | privacy@shumbavalley.co.za |
| PAIA manual | https://inforegulator.org.za/paia/ |
privacy@shumbavalley.co.za is monitored for privacy, POPIA and PAIA matters only. For bookings, enquiries or anything else, please use info@shumbavalley.co.za or call us.
2. WHO THIS POLICY APPLIES TO
This policy applies to you if you visit our website, enquire with us, book with us, stay with us, attend a conference or function here, use our facilities, or deal with us as a travel agent, corporate client or event organiser.
Personal information means information that identifies you or can be linked back to you. Under POPIA it also includes information about a company, close corporation or trust, so if you deal with us on behalf of your organisation, your organisation’s information is protected too.
Personal information does not include:
- information that has been de-identified to the point where it cannot be re-identified
- aggregate statistics that do not identify anyone
Information you have posted publicly, such as a review on a booking platform or a comment on our social media, is still your personal information. If we read, respond to or analyse it, we are processing it, and we do so on the basis of our legitimate interest in understanding and responding to guest feedback (section 11(1)(f)). We do not add people to marketing lists because they reviewed us.
What this policy does not cover. Applying for a job with us, and supplying goods or services to us, are covered by separate notices. Ask us and we will send you the relevant one.
Other people’s information. If you give us information about someone else, such as a fellow guest, a delegate or a family member, please make sure they know and are comfortable with it. We remain responsible for how we handle their information, and we will give them this policy if they ask.
3. WHAT WE COLLECT, WHY, AND WHETHER YOU HAVE TO GIVE IT TO US
What we collect depends on how you deal with us. In each section below we tell you whether the information is required or optional, and what happens if you do not give it to us.
3.1 When you book or stay with us
Required. We cannot accommodate you without it.
| What we collect | Why |
| Name, email address, telephone number and address | To confirm and hold your reservation and contact you about your stay |
| Identity or passport number, nationality, residence status, residential address and signature, and a copy of your identity document or passport | To keep the guest register the law requires us to keep |
| Names of everyone staying in your party, including children | Same register requirement |
| Arrival and departure dates, room type, rate and charges | To prepare your room, bill you correctly and issue an invoice |
| Payment details | To take payment and process any refund |
Our legal basis. Performing our contract with you (section 11(1)(b)); complying with obligations imposed by law (section 11(1)(c)), specifically section 40 of the Immigration Act 13 of 2002 read with regulation 36 of the Immigration Regulations, which requires lodges to keep a register of everyone who is given accommodation, to record the particulars listed above, and to safeguard that register through a person we authorise for the purpose; and tax and company law record-keeping obligations. Where the register includes a child, we rely on section 35(1)(b) of POPIA, because keeping the register is a legal obligation.
If you do not provide it, we cannot check you in. This is not a commercial choice on our part. Section 40 makes it an offence for both the establishment and the guest.
Optional. Your stay goes ahead without it.
| What we collect | Why |
| Dietary requirements and food allergies | So the kitchen can cater for you safely |
| Accessibility and mobility needs | So we can allocate a suitable room and assist you |
| Other special requests | So we can try to meet them |
| Vehicle registration number | Only if you park on the property, for security and access control |
Our legal basis. Your consent (sections 11(1)(a) and 27(1)(a)).
Please note what this information is. Allergies and mobility needs are health information. Dietary requirements can reveal religious or philosophical belief. Under POPIA these are special personal information (section 26), which the law protects more strictly than ordinary information. We therefore collect it only with your consent, use it only to deliver the service you asked for, never for marketing, and restrict access to the staff who need it to look after you: the kitchen, housekeeping and front office. You can withdraw your consent at any time by telling us, and we will delete it.
If you do not provide it, we cannot cater to your dietary needs, cannot guarantee an allergy-safe meal, and cannot prepare an accessible room. Please tell us if any of this matters to you.
A note on payment cards.
We do not store your full card number. Card payments are processed by our payment provider, which returns a secure token to us. We handle card payments in line with the Payment Card Industry Data Security Standard (PCI DSS). Please do not send us card details by email, WhatsApp or fax. If you do, we will delete them and ask you to use our secure payment link instead.
3.2 When you enquire with us
What we collect
- Name, email address and telephone number
- The dates, room type or package you are asking about
- The content of your messages, by web form, email, WhatsApp, Facebook, Instagram or telephone
- Your answers, where you complete a lead form on one of our Facebook or Instagram advertisements
Why
To answer your enquiry, send you the information, quote or package you asked for, and follow up with you about that enquiry.
Our legal basis. Taking steps at your request before entering into a contract (section 11(1)(b)), and our legitimate interest in responding to people who contact us (section 11(1)(f)). Where you ask us to follow up on WhatsApp, we do so on the consent you give on the form.
Required or optional. Your contact details are required, because we cannot answer you without them. Everything else is optional.
We will only contact you about the enquiry you made. Following up on your enquiry is not marketing. If you would also like to hear about our specials and offers, we will ask you separately, and you are free to say no without it affecting your enquiry. See section 6.
3.3 When you book a conference, function or event
What we collect
- Your name, job title, company name and business contact details
- Delegate names and numbers, where you or your organiser give them to us
- Delegate dietary and accessibility requirements
- Billing, VAT and purchase order details for your organisation
Why
To quote for, plan and run your event, cater for delegates, allocate rooms and invoice your organisation.
Our legal basis. Performing our contract with you or your organisation (section 11(1)(b)). Delegate dietary and accessibility information is special personal information and is handled as described in section 3.1, on the consent of the delegate concerned.
Required or optional. Contact and billing details are required. Delegate dietary and accessibility requirements are optional, but without them we cannot cater safely.
If you are an organiser, please make sure your delegates know their details are being shared with us and that this policy is available to them.
3.4 When you use our website
What we collect
- IP address, device type, browser and operating system
- The page that referred you, the pages you viewed and how long you spent on them
- Whether you started or completed a booking
- Cookie and pixel data, described in sections 4 and 5