POPI Act Compliance Statement

Protection of Personal Information Act, 2013 | Last Updated: February 2026

1. Overview and Commitment

Safari Options (Pty) Ltd ("Company," "we," "us," "our") is fully committed to complying with the Protection of Personal Information Act, 2013 (POPI), which is South Africa's primary legislation governing the lawful processing of personal information. This POPI Act Compliance Statement outlines our commitment to protecting personal information and explains how we comply with the principles and requirements of POPI.

POPI applies to the processing of personal information by Safari Options as a responsible party and regulates how we collect, use, disclose, store, and protect personal information of data subjects including customers, affiliates, employees, and service users.

2. POPI Principles and Our Compliance

2.1 Principle of Lawfulness and Transparency

  • We process personal information lawfully and transparently in accordance with POPI Section 6
  • We only process information for legitimate, specified, and explicit purposes
  • We provide clear notice of our data processing practices through this Privacy Policy and Terms of Service
  • We maintain records of all processing activities and data flows for accountability

2.2 Purpose Limitation Principle

  • We process personal information only for the specific, explicitly stated purposes communicated to data subjects
  • Further processing must be compatible with the original purpose or require renewed consent
  • We do not repurpose personal information without proper authorization and consent
  • Purposes include service provision, legal compliance, legitimate business interests, and data subject consent

2.3 Principle of Further Processing Limitation

  • Personal information shall not be further processed in a manner incompatible with the original purposes
  • We conduct compatibility assessments before using information for new purposes
  • Historical usage records are maintained to demonstrate consistent processing practices

2.4 Principle of Information Quality

  • We ensure that personal information is accurate, complete, not misleading, and kept up to date
  • We implement procedures for data validation at point of collection
  • Data subjects can request correction or update of inaccurate information
  • We regularly audit data quality and implement corrective measures

2.5 Principle of Accountability

  • Safari Options as the responsible party is accountable for all personal information processing
  • We maintain documentation of processing activities, legal basis, and safeguards
  • We have designated a Data Protection Officer responsible for POPI compliance oversight
  • We conduct regular compliance audits and assessments
  • We maintain incident response procedures and breach notification protocols

2.6 Principle of Openness

  • We provide accessible information about our data processing practices
  • Our Privacy Policy and this POPI Statement are available on our website
  • Data subjects can request access to information about how their personal information is processed
  • We respond to information requests within 20 business days as required by POPI

2.7 Principle of Security

  • We implement appropriate technical and organizational security measures to protect personal information
  • Security includes encryption, access controls, authentication, and regular security assessments
  • We protect against unauthorized access, alteration, loss, disclosure, or destruction
  • We maintain incident response procedures and notify affected parties of security breaches

2.8 Principle of Openness Regarding International Transfers

  • Personal information may be transferred internationally for service provision and processing
  • We ensure adequate safeguards are in place before transferring information to countries with inadequate protection
  • We conduct Data Transfer Impact Assessments (DTIA) for international transfers
  • Recipients are contractually bound to provide equivalent protection as POPI

3. Collection of Personal Information

We collect personal information directly from data subjects and from third parties in the following circumstances:

  • Direct Collection: Information voluntarily provided through registration, bookings, inquiries, forms, and communications
  • Automated Collection: Technical information collected through cookies, analytics, and tracking technologies
  • Third-Party Sources: Information from service providers, payment processors, affiliates, and third-party data sources

At the point of collection, we provide clear notice of the purpose, lawful basis, and intended recipients of personal information. Data subjects are informed of their rights under POPI.

4. Lawful Basis for Processing

Safari Options only processes personal information based on lawful grounds as specified in POPI Section 11:

  • Consent: Explicit consent for specific processing activities, freely given and informed
  • Contractual Performance: Processing necessary to fulfill booking contracts and service agreements
  • Legal Obligation: Compliance with tax, regulatory, and law enforcement requirements
  • Legitimate Interests: Protecting business interests, fraud prevention, security, and Platform improvement
  • Public Interest: Processing in the vital interests of data subjects or public welfare

5. Data Subject Rights and Requests

Safari Options recognizes and respects the following rights of data subjects under POPI Sections 18-23:

5.1 Right of Access

Data subjects have the right to request access to personal information we hold about them. We will provide information in a clear, intelligible, and generally understandable format within 20 business days.

5.2 Right to Correction

Data subjects may request correction or updating of inaccurate, incomplete, or misleading personal information. We will update records promptly and communicate changes to third parties where applicable.

5.3 Right to Deletion and Destruction

Data subjects may request deletion of personal information when no longer necessary for original purposes. We will comply subject to legal retention requirements and contractual obligations.

5.4 Right to Object to Processing

Data subjects may object to processing for direct marketing, research, or other purposes at any time. We will cease processing within 10 business days of receiving valid objections.

5.5 Right to Restrict Processing

Data subjects may request restriction of processing while accuracy is being verified or legality is being assessed. We will restrict processing as requested.

5.6 Right to Lodge Complaints

Data subjects have the right to lodge complaints with the Information Regulator if they believe their POPI rights have been violated.

5.7 Exercising Your Rights

To exercise any data subject rights, submit a written request to our Data Protection Officer:

Email: privacy@safariroptions.com
Phone: +27 (0) 21 710 7790
Mail: Safari Options, Cape Town, South Africa

We will respond to your request within 20 business days. If responding within 20 days is impractical, we will notify you and provide a reasonable extension.

6. Data Sharing and Recipients

We share personal information with third parties only for legitimate purposes and under appropriate safeguards:

  • Service Providers: Tour operators, accommodation providers, and travel partners for service delivery
  • Payment Processors: Financial institutions for payment processing and fraud prevention
  • Technology Providers: Cloud hosts, analytics providers, and software vendors
  • Legal and Government: Law enforcement and regulatory authorities as required
  • Marketing Partners: Selected partners for joint marketing (with consent)

All recipients are contractually bound to implement equivalent data protection measures and use information only for specified purposes.

7. Data Retention and Deletion

We retain personal information for as long as necessary to achieve the purposes of processing and comply with legal requirements:

  • Booking Records: 7 years (tax compliance requirement)
  • Payment Information: 7 years (tax and financial regulations)
  • Communication Records: 3 years unless required longer
  • Marketing Data: Until opt-out or revocation of consent
  • Website Analytics: 24-36 months
  • Legal Holds: For duration of litigation or investigation

After retention periods expire, personal information is securely deleted or anonymized. Data subjects may request earlier deletion, subject to legal obligations.

8. Security and Data Protection Measures

Safari Options implements comprehensive safeguards to protect personal information:

  • Technical Measures: SSL/TLS encryption, encrypted storage, secure firewalls, intrusion detection
  • Access Controls: Role-based permissions, two-factor authentication, audit logging
  • Data Minimization: Collection and retention of only necessary information
  • Staff Training: Regular POPI and data protection training for all employees
  • Vendor Management: Due diligence and contractual safeguards for all third-party processors
  • Incident Response: Procedures for detecting, responding to, and reporting security breaches

9. Data Breach Notification

In the event of a personal information breach, Safari Options will:

  • Investigate the breach promptly and determine scope and impact
  • Notify affected data subjects without undue delay if a breach poses a risk to their rights and freedoms
  • Notify the Information Regulator as required by POPI
  • Provide information on measures taken to mitigate the breach
  • Maintain documented records of all breaches and notifications

10. Data Protection Officer

Safari Options has designated a Data Protection Officer (DPO) responsible for ensuring POPI compliance and serving as the primary contact for data subject rights requests and privacy inquiries:

Data Protection Officer:
Safari Options
Email: privacy@safariroptions.com
Phone: +27 (0) 21 710 7790
Address: Cape Town, South Africa

11. International Data Transfers

Personal information may be transferred internationally to countries where Safari Options operates or has service providers. We ensure appropriate safeguards are in place:

  • Conduct Data Transfer Impact Assessments (DTIA) for transfers to countries with inadequate protection
  • Implement Standard Contractual Clauses (SCCs) with international service providers
  • Ensure recipients provide equivalent data protection as South African law
  • Notify data subjects of cross-border transfers and associated risks

12. Processing Activities and Records

Safari Options maintains comprehensive records of all data processing activities including:

  • Record of Processing Activities (ROPA) documenting all processing operations
  • Lawful basis and purposes for each processing activity
  • Categories of data subjects and personal information
  • Recipients and data retention periods
  • Data Protection Impact Assessments (DPIA) for high-risk processing
  • Contracts with processors and service providers

These records are available for inspection by the Information Regulator and are updated regularly.

13. Affiliate and Employee Privacy

Special provisions apply to affiliates and employees:

  • Affiliates: Business information is processed for affiliate program management, payment processing, and compliance verification. Affiliates have rights to request access, correction, and deletion of their information.
  • Employees: Employee personal information is processed for employment, payroll, benefits, and compliance purposes in accordance with POPI and employment law.

14. Consent Management

When POPI requires consent, Safari Options obtains clear, informed consent before processing:

  • Consent is provided separately from other terms and policies
  • Consent is explicit and voluntary, never pre-ticked or bundled
  • Data subjects can withdraw consent at any time without consequence
  • Records of consent are maintained for audit purposes
  • Alternative processing options are provided where consent is not obtained

15. Complaints and Enforcement

If you believe Safari Options has violated your POPI rights, you may lodge a complaint with:

Information Regulator of South Africa
Email: complaints.IR@justice.gov.za
Website: www.justice.gov.za/inforeg
Address: 184 Main Road, Observatory, Cape Town, 7925

You also have the right to lodge a complaint with Safari Options' Data Protection Officer and our internal dispute resolution process.

16. Accountability and Regular Assessment

Safari Options demonstrates ongoing POPI compliance through:

  • Annual POPI compliance audits and assessments
  • Privacy impact assessments for new systems and processing activities
  • Regular staff training and awareness programs
  • Periodic review and update of privacy policies and procedures
  • Monitoring of third-party compliance through contracts and audits

17. Contact Information

For questions about POPI compliance, to exercise data subject rights, or to report privacy concerns:

Safari Options - Data Protection Officer
Email: privacy@safariroptions.com
Phone: +27 (0) 21 710 7790
Address: Cape Town, South Africa

18. Final Statement

Safari Options is committed to maintaining the highest standards of data protection and privacy in compliance with the Protection of Personal Information Act, 2013. Our commitment extends to our staff, management, owners, and all stakeholders. We view privacy protection as integral to our business operations and customer trust. We will continue to evolve our practices in response to legal developments, technological advancements, and best practices in data protection.