Privacy & Cookie Policy

Last updated: 4 September 2026

This policy explains what personal information Leisure Isle Accommodation collects when you visit this site, why we collect it, how long we keep it, who else sees it, and what you can require us to do about it. It is written to meet the notification requirements of section 18 of South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

Leisure Isle Accommodation is an independent travel guide and affiliate publisher. The operator of this site is the responsible party — POPIA's term for the person who decides what is collected and why.

For anything to do with your personal information, contact us through the contact form.

Not yet published. We have not yet set out the operator's registered trading name and a postal address for formal notices. We would rather leave that blank than print something approximate on the page that tells you how to exercise your rights. Everything in section 8 still applies, and the contact route above reaches the person responsible.

Information Officer

Under POPIA the head of a private body is automatically its Information Officer, so the person who runs this site holds that role. Your questions come straight to them — there is nobody else here for them to come to.

Outstanding before launch. POPIA requires an Information Officer to be registered with the Information Regulator before taking up their duties. That registration has not yet been done for this site, and we would rather say so than imply a compliance step we have not taken. It does not limit any of your rights below, and it does not stop you complaining to the Regulator.

2. Which law applies

South African law — POPIA. This site is run from South Africa and it is about accommodation in Knysna, in the Western Cape. POPIA applies to whoever is responsible for personal information wherever they are domiciled, so it covers everything described on this page, and it covers it whether you are reading from Cape Town or from Canada. The Information Regulator supervises us.

If you are in Europe or the United Kingdom, your own data protection law may also reach us, because we offer information about services to you. Rather than work out where you are and apply a different standard to each reader, we apply the same one to everybody: every right in section 8 is yours whichever regime turns out to bite, and section 9 gives you a complaint route in each direction.

Nothing on this page has been reviewed by an attorney. It is a careful draft written against what the site actually does, not legal advice.

3. What we collect

a) When you write to us

The contact form asks for your name, email address, a subject line and your message. You give us all of it directly. We collect none of it from anywhere else.

That message is sent to our inbox as an email. It is not written to any database, we do not add you to any mailing list, and we do not use your address for anything except replying to you.

b) When you click a link to Booking.com

Affiliate links pass through our own redirect before forwarding you on. This is how we tell which pages are actually useful. Each click records:

• which link or banner it was, and which page it was on;
• a truncated IP address — only the first three parts, for example 197.234.61 instead of your full address. On the newer IPv6 addressing we keep the first three groups, which is a slightly narrower slice. We treat what is left as personal information and justify it in section 4, rather than claiming it could never point back to anyone;
• a device class — desktop, mobile or bot — not your full browser user-agent string;
• a one-way hash combining the truncated prefix, the device class and the date. It exists purely to stop one person's repeated clicks being counted several times, it cannot be reversed, and it changes every day so it can't follow you between visits.

We do not record your full IP address, your name or your email against a click, and the redirect places no cookie on your device. Traffic we identify as automated is discarded before anything is written down.

One caveat we would rather state than hide: because the site sits behind a content delivery network, the address we see is sometimes the network's rather than yours. That makes our click figures approximate, which is fine, because they are only ever used in aggregate.

c) Your cookie choice

When you answer the cookie banner we store your answer in a cookie so we don't ask again on every page. Details are in the cookie section below.

d) Server logs

Our hosting provider keeps short-lived technical logs of requests to the site — IP address, time, page requested, browser — as every web server does. These are used to keep the site running and to investigate abuse or faults, and they age out automatically. We don't mine them and we don't connect them to anything else.

e) If you accept the analytics cookie

We use Google Analytics 4 to count visits and see which pages are actually read, so we know what to write more of. It runs only if you accept the analytics category in the cookie banner. If you don't, the Google Analytics software is never fetched, so nothing about your visit reaches Google at all — that is a stronger position than the usual arrangement, where the software loads immediately and is merely told not to store anything.

If you do accept, Google Analytics records:

• which pages you look at, in what order, and how long you stay;
• a randomly generated number stored in a cookie on your device, which tells your browser apart from other browsers on return visits. It is not your name and we cannot look you up by it, but it is persistent, so we describe it as personal information rather than calling it anonymous;
• roughly where you are — country, and usually city — worked out by Google from your IP address;
• your device, browser and screen size, and the site or search that sent you;
• when you click one of our Booking.com links: which link, on which page, and what kind of page it was. This is the one measurement the site genuinely runs on, since it is how we know which pages are worth writing.

It is not used to advertise to you. “Google Signals” — the setting that would let Google tie your visit to your Google account and follow you across devices for advertising — is switched offon our property, and we have no Google Ads account linked to it. We also do not run ads anywhere, so there is nothing for a profile to feed. Google holds the data for 14 months and then deletes it.

f) What we do NOT collect

It is worth being specific, because many sites of this kind do all of these and say so only in the small print. We do not:

• run a newsletter or hold a subscriber list;
• send direct marketing of any kind — no SMS, no marketing email, no “we noticed you were looking at” messages. POPIA is strict about unsolicited electronic marketing and the simplest way to comply is not to do it;
• run advertising trackers. There is provision in the code for a Meta (Facebook) pixel, but it is not switched on, and it could only ever run after you had granted marketing consent;
• sell, rent or share your information with anyone for their own marketing;
• collect special personal information — health, race, religion, political persuasion, sexual life, biometrics — or knowingly collect anything from children;
• make any automated decision about you. Nothing here profiles you, scores you or decides anything about you without a person involved.

4. Why we are allowed to hold it

POPIA requires a justification for each use of personal information. Ours are:

Where we rely on a legitimate interest we have weighed it against your rights and concluded it does not override them — largely because we collect so little. You can object at any time (section 8), and for the click log you can ask us to stop entirely.

5. Who else sees it

POPIA calls them operators: businesses that process information on our instructions and may not use it for their own purposes. Ours are:

• Our hosting provider — serves the site and holds the short-lived server logs.
• Supabase — the database holding the property listings, the articles, and the anonymised click log.
• Resend — delivers your contact-form message to our inbox as an email.
• Cloudflare — sits in front of the site as a content delivery network and handles DNS.
• Google (Google Analytics) — only if you accept the analytics cookie. Google processes the visit data on our instructions and may not use it for its own advertising purposes; “Google Signals” is switched off on our property and no Google Ads account is linked to it. If you refuse analytics, no data reaches Google at all.

Where you go next: Booking.com and CJ Affiliate

These two are not our operators, and the difference matters to you. An operator works on our instructions and may not use your information for its own purposes. Booking.com and the affiliate network CJ Affiliate are nothing of the kind: they decide for themselves what to collect and why, and they are answerable for it in their own right.

Once you follow one of our links you are on their site, under their privacy policy, not ours. CJ records that a click came from us so Booking.com can attribute a booking, and Booking.com will set its own cookies and collect its own information. We have no control over or visibility into any of it. If that matters to you, read their policies before booking.

Beyond that, we disclose personal information only where we are legally obliged to, for instance on a valid order from a court or a regulator.

6. Information leaving South Africa

Our providers operate internationally, so your information will in practice be stored on servers outside the Republic — principally in the United States and Europe. POPIA permits that where the recipient is bound by rules or a contract providing an adequate level of protection, and we rely on the data-processing agreements and standard contractual clauses our providers publish.

Given how little we hold — a message you chose to send us, and a partial IP address — the practical exposure is small. But you are entitled to know it happens rather than discover it later, which is why it is stated plainly here instead of being buried. If you would like to know which safeguard applies to a particular provider, ask and we will tell you.

7. How long we keep it

8. Your rights

POPIA gives you the rights below, and we will honour all of them for every reader whether or not POPIA is the law that happens to cover you.

• To be told what we hold about you and why. That is what this page is, and you can ask for more.
• To ask for a copy of the personal information we hold about you, and to be told who we have given it to.
• To have it corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• To object to processing we base on a legitimate interest, including the click log.
• To withdraw consent at any time, where we relied on it. Withdrawing doesn't undo what was lawful beforehand.
• To object to direct marketing at any time. We send none, so there should never be anything to object to — but the right stands.
• Not to be subject to a decision made only by automated means that affects you significantly. We make none.
• To complain to the Information Regulator, or to bring a civil claim — see section 9.

Ask through the contact form. It is free, and we will respond in writing within 30 days, which is the deadline the POPIA Regulations set us. We may need to check you are who you say you are before handing over personal information — that protects you, not us.

One honest limitation: if you only ever clicked an affiliate link, we most likely cannot find “your” records, because we never held anything that identifies you — a truncated IP prefix and a daily hash don't single you out. That is a feature of the design rather than an evasion, and we'll explain it rather than stall you.

9. Complaining

Please come to us first — most things are a misunderstanding we can fix the same day. But you never have to, and you can go straight to the regulator.

The Information Regulator (South Africa) supervises us under POPIA. To complain that your personal information has been mishandled, complete the Regulator's POPIA complaint form and send it to POPIAComplaints@inforegulator.org.za.

• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200 · Toll free: 0800 017 160
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• inforegulator.org.za

If you are in Europe or the United Kingdom you may instead complain to your own national data protection authority, and we will co-operate with it.

10. Do you have to give us anything?

No. You can read every page, every property and every guide on this site without telling us anything at all. The only information you actively hand over is what you type into the contact form, and that is entirely your choice — the only consequence of not doing so is that we can't reply to you.

11. Keeping it safe

The site is served over HTTPS throughout. Our database enforces row-level security on every table, so the public site can read published content and nothing else. The affiliate click log in particular is readable by nobody but us. Administrative access needs a separate login, restricted to the site's operator. Most of all, we collect as little as possible, which is the most reliable security measure there is: information you never held cannot leak.

No system is perfectly secure. If your personal information is ever accessed or acquired by someone unauthorised, POPIA requires us to notify the Information Regulator and you as soon as reasonably possible, and we will.

12. Children

This site is meant for adults planning a trip. We don't knowingly collect information about children. If you believe a child has sent us personal information, tell us and we will delete it.

13. Cookies

A cookie is a small file a site stores on your device. We use very few, and we ask before setting anything that isn't essential.

Why we ask. South Africa has no separate cookie statute the way the UK and the EU do, and we are not going to pretend one obliges us. What it has is POPIA, and a cookie that singles out your device is processing your personal information, which needs a justification under section 11. For anything that is not strictly necessary to make the site work, the honest justification is your consent under section 11(1)(a) — so we ask for it rather than assume it. The banner is our choice, made because it is the right way round, not because a regulator told us to.

a) Strictly necessary — no consent needed

b) Analytics cookies — only if you accept

We use Google Analytics 4. It is off until you accept the analytics category, and “off” here means genuinely off: the Google Analytics software is not fetched at all until you say yes. That is deliberately stronger than the usual arrangement, where the software loads on every page and is merely instructed not to store anything. Until you accept, your browser makes no request to Google, so no cookie can be set and nothing about your visit reaches them.

If you accept, two cookies are set, both by this website rather than by a third party:

“Up to” is doing real work in that table. Two years is Google's stated maximum, but browsers cut it shorter on their own: Chrome caps any cookie at 400 days, and Safari deletes it after 7 days if you don't come back. We would rather give you the number you will actually experience than the one on the label.

What Google records if you accept, and what it is not used for, is set out in section 3(e) above. You can change your mind at any time using Cookie Settings in the footer — we stop measuring immediately, and you can delete the two cookies in your browser as well.

c) Marketing cookies

None are currently in use. The code contains a consent-gated Meta (Facebook) pixel, but it is not configured and does not run. If we ever enable it, it will load only after you have granted marketing consent, and this section will be updated to name the cookies it sets before that happens.

Separately, Booking.com sets its own cookies once you arrive on their site after clicking one of our links. Those are theirs, governed by their privacy policy, and outside our control.

d) Changing your mind

Use the Cookie Settings link in the footer to change your choices at any time. You can also block or delete cookies in your browser settings — though blocking the strictly necessary ones means the banner will keep asking, because the cookie recording your answer is the very thing being blocked.

We honour the same choice everywhere on the site, and withdrawing consent is exactly as easy as giving it.

14. Access to records — PAIA

South Africa's Promotion of Access to Information Act gives you a route to request records we hold, separately from your POPIA rights above. Businesses are expected to publish a manual explaining what records they keep and how to ask for them.

Outstanding before launch. We do not yet have a PAIA manual. We would rather tell you that than link you to a document that does not exist. In the meantime, ask through the contact form and we will deal with your request directly — the absence of the manual does not stop you asking, and it does not affect any of your rights in section 8.

15. Changes to this policy

If what we collect changes, this page changes with it, and the date at the top tells you when. If a change is significant — a new tracker, a new purpose — we will re-ask for consent rather than quietly rely on the answer you gave to a different question.

16. Contact

Anything at all about this policy, or about information we hold: the contact form. We would genuinely rather hear from you than have you wondering.