Privacy Policy

Straightforward information about how Lumavery handles your personal information.

Contents

• 1. Who we are
• 2. What personal information we collect, and how
• 3. Why we are allowed to process it
• 4. Cookies and similar technology
• 5. Who else sees your information
• 6. Where your information is stored
• 7. How long we keep it
• 8. How we protect it
• 9. Your rights under POPIA
• 10. Complaints to the Information Regulator
• 11. Changes to this policy

1. Who we are

Lumavery is operated by Lumavery Boutique Hospitality (Pty) Ltd, and this notice tells you what we do with your information.

Lumavery Boutique Hospitality (Pty) Ltd (Proprietary Limited (Pty Ltd)), trading as Lumavery, a boutique hotel, is the responsible party for the processing of personal information described in this notice, as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA"). Our registered address is 48 Belgravia Crescent, Quigney, 5201 East London, South Africa, our company registration number is 5883159125 (CIPC), and our tax reference number is 6880523638. You can reach us by email at [email protected] or by telephone on +27 43 258 5228 for any question about this notice or about our handling of your personal information.

2. What personal information we collect, and how

We collect what you give us through our contact form and our email subscription — nothing more.

We collect personal information through two channels on the lumavery.site website:

• The contact form. When you use our contact form to make an enquiry about a stay, an event, or a booking, we collect your name, email address, telephone number (where you provide one), and the content of your message. This information is sent to our reservations and guest relations team and is used solely to respond to your enquiry.
• The email subscription. When you sign up to receive news and offers from Lumavery, we collect your email address and, if you provide it, your first name. We use a double opt-in process, meaning you will receive a confirmation email before you are added to our mailing list.

We do not collect payment card details through the website; any booking payment is processed through a separate, secured booking channel governed by its own terms.

3. Why we are allowed to process it

We rely on your consent, our legitimate business interests, or the steps needed to answer your enquiry.

We process contact-form submissions on the basis that doing so is necessary to take steps at your request before entering into a possible agreement with you (a prospective booking or event), or to pursue our legitimate interest in responding to enquiries about our hotel. We process email subscription data on the basis of your consent, given through the double opt-in process described above, which you may withdraw at any time as set out in section 9.

4. Cookies and similar technology

Our website uses cookies; details of what they do and how to control them are in our separate Cookie Policy.

The lumavery.site website uses necessary, analytics, and marketing cookies. A full description of each category, the individual cookies used, their duration, and how to manage your preferences is set out in our Cookie Policy, which forms part of this notice.

5. Who else sees your information

We share information only with service providers who help us run the hotel and the website, and only where legally required.

We may share personal information with: our email service provider, engaged to send subscription communications on our behalf; our website hosting and IT support providers; and, where relevant to a specific enquiry, our reservations or events team. Any such service provider is bound by written terms requiring it to process personal information only on our instructions and to apply appropriate security measures, in accordance with section 20 of POPIA. We may also disclose personal information where required by law, by court order, or to protect our legal rights.

We do not sell personal information to third parties.

6. Where your information is stored

Our website and mailing list are hosted using reputable providers; where information leaves South Africa, we make sure it is protected.

Personal information collected through the website may be stored on servers located outside South Africa, including servers operated by our hosting or email service providers. Where this occurs, we ensure the transfer takes place in accordance with section 72 of POPIA — for example, because the recipient is subject to laws, binding corporate rules, or contractual terms that provide an adequate level of protection substantially similar to POPIA, or because you have consented to the transfer.

7. How long we keep it

We keep enquiry records for as long as reasonably needed to deal with them, and subscriber details until you unsubscribe.

Contact-form enquiries and any related correspondence are retained for as long as necessary to handle the enquiry and for a reasonable period afterwards for record-keeping purposes, ordinarily not exceeding twenty-four months from the last contact, unless a longer period is required to comply with a legal obligation or to establish, exercise, or defend a legal claim. Email subscription data is retained for as long as you remain subscribed and is deleted or anonymised within a reasonable period after you unsubscribe.

8. How we protect it

We take reasonable technical and organisational steps to keep your information secure.

In accordance with section 19 of POPIA, we have implemented appropriate technical and organisational measures to secure the integrity and confidentiality of personal information in our possession, including access controls, encryption in transit for our website forms, and confidentiality obligations placed on staff and service providers who handle personal information.

9. Your rights under POPIA

You can ask us what we hold, correct it, delete it, object to its use, or withdraw your consent — just email us.

Subject to the conditions and exceptions set out in POPIA, you have the right to:

• be notified that we hold personal information about you;
• request access to the personal information we hold about you;
• request that we correct or update inaccurate, incomplete, or outdated personal information;
• request that we delete or destroy personal information that we are no longer authorised to retain;
• object to the processing of your personal information, including for direct marketing purposes;
• withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before the withdrawal — for example, by using the "unsubscribe" link in any marketing email; and
• submit a complaint to us or to the Information Regulator regarding the alleged breach of any condition for the lawful processing of your personal information.

To exercise any of these rights, please contact us at [email protected] or +27 43 258 5228. We may need to verify your identity before acting on your request, and we will respond within a reasonable time.

10. Complaints to the Information Regulator

If you are unhappy with how we have handled your information, you may complain to South Africa's Information Regulator.

If you believe we have processed your personal information in breach of POPIA, you have the right to lodge a complaint with the Information Regulator (South Africa), whose contact details are published at inforegulator.org.za. We would, however, appreciate the chance to address your concern directly first, at [email protected].

11. Changes to this policy

We may update this notice from time to time; the current version is always available on this page.

We may amend this privacy notice periodically to reflect changes in our practices or in the law. The version published on lumavery.site at any given time is the version that applies. This notice was last updated in 2026.