Privacy Policy

This policy explains how Atlantic Forest (Pty) Ltd t/a Atlantic Palms (“Atlantic Palms”, “we”, “us”) collects, uses, shares and protects personal information, and the rights you have in relation to it. It is written to align with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

2. What we collect

2.1 Information you give us

• Identity and contact details — name, email address, telephone number, postal address, and nationality or country of residence.
• Reservation details — arrival and departure dates, room type, number and names of guests, and the age of any children travelling with you.
• Identification for check-in — identity document or passport details, where we are required to record them.
• Payment information — card details are captured and processed by our payment provider; we do not store full card numbers on our systems.
• Preferences and requests — dietary requirements, accessibility needs, room preferences, and special occasions.
• Correspondence — enquiries, reviews, feedback and messages you send us.

2.2 Information collected automatically

• Website usage data such as pages viewed, approximate location, browser and device type, collected through cookies and similar technologies.
• CCTV footage in public areas of the property, recorded for the safety and security of guests, staff and property.

2.3 Information from third parties

We receive booking information from online travel agents and booking platforms you choose to book through — for example Booking.com and other distribution partners — and from our channel management and reservations systems.

3. Why we use it, and on what basis

4. Marketing

We will only send you marketing about our rooms, dining and special offers where you have agreed to receive it, or where the law otherwise permits it in the context of an existing relationship. Every marketing message includes a way to unsubscribe, and you can opt out at any time by writing to admin@atlanticpalms.co.za. Withdrawing consent does not affect our ability to contact you about a booking you have made.

5. Who we share it with

• Payment providers — to process card transactions securely.
• Booking, channel-management and property-management providers — to receive and manage reservations across the platforms we list on.
• Service providers — including our website host, email provider, and any review or analytics tools we use, acting as operators on our instructions.
• Professional advisers and authorities — where we are required or permitted by law to disclose information.

We do not sell your personal information.

6. Who processes information on our behalf, and cross-border transfers

We use a small number of service providers (“operators” under POPIA) who process personal information on our instructions:

Some of these providers store information outside South Africa. Where personal information is transferred across a border, we take reasonable steps to ensure it receives protection comparable to that required by POPIA, whether through the recipient’s binding rules, the laws of the receiving country, or contractual undertakings.

7. How long we keep it

We keep personal information only as long as necessary for the purposes set out above, and for any period required by law — for example, records supporting financial and tax reporting are retained for the period prescribed by South African legislation. CCTV footage is retained for a limited period and then overwritten in the ordinary course. As a general rule we keep personal information only for as long as it is necessary for the purpose it was collected for, or for as long as we are required or permitted to keep it by law — whichever is longer — after which it is deleted, destroyed or de-identified. CCTV footage is kept only for a short period for security purposes and is then overwritten in the ordinary course, unless it is required for an investigation, a legal claim, or by law. You may ask us at any time what period applies to a particular category of information.

8. How we protect it

We maintain reasonable technical and organisational safeguards intended to protect personal information against loss, unauthorised access, and unlawful processing. These include restricting access to those who need it, using reputable providers, and securing the website over HTTPS. No system can be guaranteed completely secure, and we cannot warrant absolute security.

9. Your rights

Subject to POPIA, you have the right to:

• ask what personal information we hold about you, and request access to it;
• ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to processing based on legitimate interests, on reasonable grounds;
• withdraw consent where processing relies on consent;
• lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer using the details in section 1. A request for access is dealt with under the Promotion of Access to Information Act — see our PAIA Manual. A prescribed fee may apply.

9A. Children and minors

We do not knowingly collect personal information from children, and we do not market our services to them. You may, however, give us a minor’s details when making a reservation for a family. Where we learn that we hold a minor’s personal information without the consent of a competent person, we will take reasonable steps to delete it. If you believe we hold information about a child that we should not, please contact our Information Officer.

9B. If something goes wrong — security compromises

If personal information under our control is accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible after establishing what happened, as POPIA requires. The notification will describe what occurred, the likely consequences, and what we are doing about it. If you suspect a security compromise involving your information, tell us immediately at admin@atlanticpalms.co.za with as much detail as you can.

9C. Response times

We aim to respond promptly to any request about your personal information.

• Requests for access to a record are dealt with under PAIA, which allows 30 days to decide, extendable by a further 30 days in the circumstances the Act permits. You will be told of any extension and the reason for it.
• Requests to correct or delete personal information are dealt with under POPIA. Where we cannot agree to a correction, we will record that a correction was requested and refused.
• Objections to processing take effect once received in the prescribed form.

10. Cookies

Our website uses cookies and similar technologies to make the site work, remember your language preference, and understand how the site is used. You can control or delete cookies through your browser settings; blocking some cookies may affect how parts of the site function. This site runs no analytics or advertising tools of its own. The only third parties that set cookies are our booking engine (Profitroom / upperbooking.com, including its abandoned-booking reminder) and the GTranslate language switcher, which uses Google Translate. Where you choose “Essential only” in our cookie notice, the booking-related tracking is disabled.

11. Complaints to the Regulator

If you believe we have not handled your personal information lawfully, you may complain to:

12. Changes to this policy

We may update this policy from time to time. The version published on this page is the one that applies, and the date it was last updated appears below.

Atlantic Forest (Pty) Ltd t/a Atlantic Palms · 17 Venus Circle, Sunset Beach, Cape Town, 7441, South Africa
Last updated: 8 September 2026