Privacy notice

The apartment at Embassy Towers is let directly by its owner. When you book, the owner is the responsible party under the Protection of Personal Information Act, 2013 (POPIA) — there is no agency in between, and nobody else is given your details to market to you.

The property, and the address for any request under this notice:

When you make a booking we ask for, and store:

• your name, email address and phone number;
• the dates you are staying, how many guests, and what you were charged;
• whether you agreed to hear from us about the apartment again;
• a reference for your payment.

We never see or store your card details. Payment is taken by Paystack in their own secure window; we are told only whether it succeeded and for how much.

The owner may add a short private note to your record — a late arrival, a preference for a particular room. You can ask what it says.

Separately from any of that, and only if you agree to it when asked, Google Analytics counts your visit: which pages you read, how you arrived, roughly where you are and what device you used. It is not joined to your booking and carries none of the details above. Say no, or change your mind later, on the cookie page.

To take your booking, hold your dates, take payment for them, and let you in. That is the contract between you and the owner, and none of it works without these details.

After your stay, the record of it — the dates, the amount, the payment — is kept because the South African Revenue Service requires the underlying records of a transaction to be retained. That is a legal obligation, not a choice.

We email you about your own booking: a confirmation, and anything that changes about your stay. We only send anything else if you ticked the box saying you were happy to receive it, and you can tell us to stop at any time.

Two services are handed anything you give us, each doing one job: Paystack takes the payment and Resend delivers the emails. Your details are not sold, rented, or shared with anyone for marketing, ever.

If you agree to analytics, Google receives the measurement described above — pages, referrer, approximate location, device. It receives nothing you typed into a booking: not your name, not your email address, not your phone number, not what you paid. Google holds it on their own terms and may do so outside South Africa.

The database is not a third service. It runs on the owner’s own server, hosted by Namecheap, who provide the machine it runs on and nothing more — your details are not passed to them to use.

The record of a stay is kept for five years after the tax year it falls in, which is what SARS requires. Your name, email address and phone number are not needed for that, so you can have them removed sooner — see below.

A booking that was never paid for is cancelled and kept only as a cancelled row; you can ask for it to be removed entirely.

Ask, and your name, email address, phone number and any note against your record are overwritten. They cannot be recovered afterwards. The stay itself — the dates and the amount — stays in the books, attached to nobody, because of the retention obligation above.

You can also ask to see what we hold, have something corrected, or object to being contacted about anything other than a booking you have made.

Speak to the owner first — it is one person and one apartment, and most things are settled in a message. If that does not resolve it, POPIA gives you the right to complain to the Information Regulator of South Africa.

By phone or WhatsApp on +27 83 781 6637, or by email at office@embassytowers-rentals.com. All the ways to get hold of us.