Privacy notice

1. Who is responsible for your details

The owner of The Loft, Plot 2989 Madikwe Crescent, Extension 11, Gaborone, Botswana, is the data controller for the personal data collected through this website — the person who decides what is collected and why. The apartment is let directly by the owner, so the same person who takes your booking looks after your details and answers any request you make about them. That address is also the owner's principal place of business for this purpose.

You can reach the owner at [email protected], on +267 72 728 227, or on WhatsApp.

The Act allows a controller to appoint a data protection representative (section 36). The owner has not appointed one: the controller is established in Botswana, the site is run from Gaborone, and the owner handles data-protection requests personally rather than through an intermediary. Nothing in this notice depends on a third party, which is the point of keeping it this way.

2. What we collect and why

Only what a stay actually needs. The table below is the whole list, with the purpose for each item and the lawful basis the owner relies on under section 16 of the Act.

Nothing else. There is no newsletter unless you ask for one, no advertising pixel, no social-media tracking and no analytics of any kind on these pages.

3. The lawful basis we rely on

The Act permits processing only where one of the criteria in section 16 applies. Three of them are used here, and each is tied to a specific job rather than claimed in general terms:

• Your consent, in writing (s16(a)). The Act defines consent as a freely given, specific and informed expression of your wishes. Ticking the boxes in the booking form and typing your name is that expression: nothing is pre-ticked, the optional marketing box is separate and starts empty, and the version of each document you accepted is recorded with the time. Consent can be withdrawn at any time (s19) — see section 12.
• Performance of a contract (s16(b)). A booking cannot be held, confirmed, paid for or run without your name, contact details and dates. This is the basis for the booking itself, for messages about your stay, and for settling breakages and extras.
• Compliance with a legal obligation (s16(c)). Booking and payment records have to be kept for tax and accounting purposes, and a data-protection request has to be answered and evidenced.
• Legitimate interests (s16(f)). Used for two narrow things only: keeping the booking form free of automated abuse, and knowing that a confirmation email arrived. Neither overrides your rights — both are described in section 2, and you can object to either.

Your details are used only for the purposes stated above. They are not used for any other purpose without your consent or an authorisation in law (section 15).

4. What we do not collect

• Sensitive personal data — health, religion, political opinions, trade-union membership, sexual orientation, biometric or genetic data. The Act restricts this class of data (section 20) and a booking does not need any of it, so please do not send it. If it arrives in a message, it is deleted.
• Your identity-card or passport number. Photo ID is looked at in person at check-in and is not copied, scanned or stored here (section 27 restricts identity-card processing).
• Card numbers, expiry dates or security codes. They are typed on DPO's own pages and never reach this site.
• Anything used to make an automated decision about you. No scoring, no profiling, no automatic refusal: the owner decides, by hand, with the information in front of them.
• Your location, contacts, photos or address book. The site asks the browser for none of them.

5. Marketing and your right to object

There is no marketing list. If you tick the optional box in the booking form, the owner may email you occasionally about the apartment; if you do not tick it, nothing is sent beyond the messages about your own stay. You may object to marketing at any time and at no cost (section 18), and you may withdraw consent for it at any time (section 19) — by replying to any such email, or through the form in section 12. Once you object, no further marketing email is sent, and only the fact that you objected is kept, so that you are not written to again.

6. Who else sees your details

Beyond the owner, your details reach only the services needed to run the booking. Each is chosen for the guarantees it gives about security, and each is bound to the owner by written terms that limit it to the owner's instructions (section 32(3) of the Act):

Nobody else. Your details are not sold, rented, brokered or shared for advertising, and they are not passed to anyone who would use them for their own purposes. Should a booking record ever be needed by a court, a regulator or a lawful authority, only what is actually required is provided.

7. Details that leave Botswana

Two of the services above — the payment provider and the email service, and the data centres behind the hosting and database — may process personal data outside Botswana. The Act restricts that (section 48): a transfer to a country that does not ensure an adequate level of protection is prohibited, unless one of the exceptions applies.

Here the transfer is made on the basis that it is necessary for the performance of the contract you have entered into — a card payment cannot be taken and a confirmation cannot be delivered otherwise (section 48(5)) — and the owner requires the contractual safeguards described in section 48(6): the provider's data-processing terms, which limit use to the owner's instructions, require security measures, and require the provider to tell the owner about any breach. If you would prefer to avoid a transfer of this kind, tell the owner before booking and the stay can be arranged with payment by bank transfer instead; the owner will explain what changes.

8. How long we keep it

Personal data must not be kept longer than the purpose requires (section 14(h)). These are the periods actually applied in the system, not aspirations:

The clean-up is run by the owner from the private console, so nothing is deleted behind their back, and it is idempotent — running it twice deletes nothing extra. Ask for your details to be deleted sooner and they are, unless a record still has to be kept for tax or accounting reasons; in that case the identifiers are removed and only the amounts, dates and what was paid remain, which is what section 14(h) and section 30 strike between your rights and the owner's record-keeping duty.

9. How your details are protected

The Act requires appropriate technical and organisational security measures, having regard to the nature of the data and the risks involved (section 32). These are the measures actually in place:

• Every page is served over an encrypted connection, and the browser is told not to cache booking responses.
• The database is reachable only through the booking function, using a key that is held on the server and never sent to the browser. Database access rules keep the records closed to direct public queries.
• The owner's console needs a named account and a password stored only as a salted hash, plus a proof-of-work challenge and rate limits before a session is issued.
• Connection addresses are stored only as one-way hashes, so a booking or a signature can be tied to the session that made it without keeping the address itself.
• No card details are held at any point, which removes the largest category of risk from the site entirely.
• Guest photographs and documents sit in private storage and are served through short-lived signed links, never as public files.
• Access to the console is limited to the owner and to the named people the owner creates, and is withdrawn when it is no longer needed.
• Please do not email card numbers, passwords or a copy of your ID. If identity has to be checked for a request, the owner will ask for it in a safer way.

10. If something goes wrong

The Act requires a controller to notify the Commissioner of any breach of the security safeguards without delay (section 33), and requires a processor to notify the controller just as promptly. In practice: if the owner becomes aware of a breach affecting personal data, the Commissioner is notified without delay, and — where the breach is likely to harm you — you are told what happened, what was involved, and what to do about it, without waiting for a perfect picture. The same applies if a provider reports a breach to the owner.

11. Your rights

The Act gives you direct rights over your personal data. None of them need a lawyer and none of them cost anything here.

Withdrawing consent does not affect anything done lawfully before you withdrew it, and it does not cancel a booking — the stay itself rests on the contract, not on consent.

12. Making a request

Use the form below, reply to your booking confirmation, or write to [email protected]. Quote your booking reference if you have one — it begins LOFT- and is on your confirmation and your guest link. Every request is given a reference beginning DSAR-, and a written answer is due within 30 days of the day it was received; the date is fixed when the request is logged, not when it is remembered.

To protect your data, the owner checks that a request came from you before releasing or erasing anything: usually a reply from the email address on the booking, or the details of the payment that confirms it is you. If a request cannot be met in full — because a tax record must be kept, for example — you are told which part, and why.

13. Cookies and your own browser

This site sets no cookies. One preference is saved in your browser's local storage: the currency you choose on the rate card, so the indicative prices remember your choice when you come back. It stays on your device, holds nothing that identifies you, and you can clear it at any time in your browser settings.

If you add the site to your home screen, a service worker caches the pages and photographs so they open with a poor connection. That cache is on your device only. The read receipt described in section 2 sits in the email the owner sends you, not in these pages, and stores nothing on your device. The owner's private console keeps its session in that browser tab only, and it disappears when the tab is closed; it is not part of the guest site.

14. Guests under 18

The apartment is let to adults, and the person who books must be 18 or older. No information about children is collected beyond a count of guests, and no account, profile or password is ever created for a guest of any age.

15. Changes and version history

If the way your details are handled changes, this page is updated and the version below changes with it. A booking is handled under the version in force when it was made, and the version you accepted is recorded against your booking — so what you agreed to can always be identified exactly.

16. Questions and complaints

If something about your data is not right, say so — to [email protected] or on +267 72 728 227. A data-protection request is answered within 30 days; a complaint about a stay gets a written answer within 5 business days.

If you are not satisfied, the Act gives you the right to complain to the Information and Data Protection Commission, the regulator established under section 4 of the Act (complaints are dealt with under section 42). Its current contact details are published by the Commission, and the owner will send them to you on request. Complaining to the Commission does not affect any other right you have.