Privacy Policy

The Gauteng Tourism Authority (the "GTA", "we", "us") is the responsible party for personal information processed through Visit Gauteng (the "Platform"), under the Protection of Personal Information Act 4 of 2013 ("POPIA"). The GTA is a provincial public entity established under section 3 of the Gauteng Tourism Act 10 of 2001.

The GTA appoints a service provider to develop, host and maintain the Platform. That provider processes personal information only on the GTA's instructions, under a written agreement that requires it to keep the information secure and confidential. It is an "operator" as defined in POPIA.

The GTA's Information Officer is its Chief Executive Officer, assisted by the Deputy Information Officer (Company Secretary and General Counsel). Their contact details are in section 3 of the PAIA Manual.

Account information

• Name, email address, username and password (stored only in hashed form).

• Optional profile details: photo, phone number, bio, general location, website and travel interests.

• If you sign in with Google, Facebook or Apple: your name, email address, profile picture and an account identifier from that provider. We never receive your password for those services.

Bookings, enquiries and orders

• Booking requests: the experience, dates, number of guests, your contact details and any special requests you type in.

• Business venue enquiries: your organisation, event details and contact details.

• Marketplace orders: items bought, delivery or collection details (name, address and phone number), order and payment status, returns and refund requests, including any photos you upload.

• Event tickets, where offered: ticket holder names and contact details.

Vendors, organisers and listing partners

If you apply to sell or list on the Platform, we also collect your business and contact details, registration and VAT numbers, identity number or passport number, banking details for payouts, supporting documents (such as an ID document, company registration document and bank confirmation letter), and the results of checks we run to verify your identity and bank account. For consigned stock, we also keep collection addresses, contact details and stock records.

Content and messages

Posts, comments, likes, photos, reviews and direct messages you send on the Platform.

Communication records

Records of the emails and notifications we send you and your communication preferences.

Technical and usage information

Device and browser type, IP address, pages visited and error reports needed to keep the Platform working and secure.

If you accept analytics cookies, we also use Google Analytics 4 to see which pages and features are used. It records pages viewed, time on page, what sent you to us, and your device, browser and language, and uses your IP address to estimate your city without storing it. It does not tell us who you are, and we do not use it for advertising. You can withdraw this at any time through "Cookie preferences" in the footer. See the Cookie & Tracking Notice.

Location

Some tools (for example "nearby" search and sharing your location from the Safety Hub) use your device's location, but only when you choose to use them and your device allows it. We use your location to deliver the result and do not store it in your profile.

Records of your acceptance

When you accept our terms or make a cookie choice, we record the document, its version, the date and time, and the IP address and device used, as proof of your choice.

Mostly from you. We also receive information from the sign-in provider you choose, from payment and courier partners about the status of your payment or delivery, from verification providers when we verify vendors, and from businesses you book with about the status of your booking. The Live feed may show public social media posts about Gauteng, which include the author's public name or handle.

POPIA allows us to process personal information only where we have a lawful basis (section 11). We rely on the following:

• To provide the services you ask for (accounts, booking requests, enquiries, orders, delivery, returns, tickets, vendor and organiser tools): because it is necessary to carry out our agreement with you.

• To verify vendors and organisers, prevent fraud and keep the Platform secure: in our legitimate interests and those of our users, and to meet legal obligations.

• To keep tax, financial and other records the law requires: to comply with the law.

• To promote tourism in Gauteng and run the Platform as a public service: as part of the GTA's public law duty under the Gauteng Tourism Act.

• To personalise the Platform (for example recommendations based on the interests you choose): in our legitimate interests. You can change or remove your interests at any time. Personalisation does not produce decisions with legal effects for you.

• To send you marketing and to use analytics and marketing cookies: only with your consent.

We send marketing messages (newsletters, offers, promotions) by email, SMS, push notification or WhatsApp only if you have opted in, or, where the law allows, about similar services if you are an existing customer. Every marketing message includes a simple way to opt out, and you can change your preferences at any time in your account. Service messages about your account, bookings and orders are not marketing and are sent as needed.

We share personal information only as needed for the purposes above:

• Businesses you deal with: when you send a booking request, enquiry or order, the business concerned receives your name, contact details and the details of your request.

• Payment processing: Paystack processes payments made through the Platform.

• Couriers: receive the delivery name, address and phone number to deliver your order or collect a return.

• Verification providers: help us verify vendors' identity and bank account details.

• Service providers acting for the GTA: the GTA's appointed Platform provider, and providers of hosting, cloud storage, email delivery, error monitoring, analytics, maps and address lookup, and similar technical services. They may use the information only to provide their service to us.

• Google Analytics, but only if you accept analytics cookies. Google processes that information on our instructions. It deletes the detailed records of individual visits after 2 months, and keeps visitor-level information for 14 months from your most recent visit.

• Other users: your display name, profile photo and the content you post publicly are visible to others. Direct messages are visible to the people you send them to.

• Authorities: where the law requires it, or to protect someone's safety.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Some of our service providers store or process information outside South Africa, including in the European Union and the United States (for example for cloud storage, email delivery, error monitoring and sign-in services). We transfer information only where POPIA permits (section 72), for example where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA.

• Account information: while your account is open. When you close it, we delete or de-identify it within 30 days, except for the records below.

  • Orders, payments, refunds and payouts: 5 years after the transaction, as tax law requires.

  • Vendor and organiser verification records: 5 years after the relationship ends.

  • Records of acceptance and consent: as long as needed to prove the consent, and at least as long as the related account or transaction record.

  • Security and server logs: up to 90 days, unless needed to investigate an incident.

  • Backups: deleted information may remain in encrypted backups until they are overwritten, within 90 days.

As a public entity, the GTA may also have to keep certain records under public records and archives legislation. Where we must keep information, we restrict access to it and use it only for that purpose.

We use reasonable technical and organisational measures, including encryption in transit, hashed passwords, restricted access to identity and banking information, role-based administrator access, and security monitoring. Our service providers must meet the same standards under written agreements. No system is perfectly secure.

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.

Under POPIA you may:

• ask whether we hold your personal information and request a copy of it;

• ask us to correct or update inaccurate information;

• ask us to delete information we no longer have a lawful reason to keep;

• object to processing based on our legitimate interests, and to direct marketing at any time;

• withdraw consent you have given (this does not affect processing before you withdrew it); and

• lodge a complaint with the Information Regulator.

To exercise these rights, email admin@visitgauteng.net. We may need to confirm your identity first. We respond within 30 days. Requests for access to records can also be made under PAIA (see the PAIA Manual).

Visit Gauteng is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

We use cookies and similar technologies as explained in the Cookie & Tracking Notice. Non-essential cookies are used only with your consent.

The Platform links to websites and services we do not control, including businesses' own websites and social media. Their privacy practices are their own.

When we make material changes we update the effective date and tell you in the app or by email. The current version is always at visit.gauteng.net/privacy.