Legal
Privacy policy
What we do with personal information — ours to explain, in the terms we would want explained to us.
Last updated 31 August 2026. Prepared under the Protection of Personal Information Act, 4 of 2013.
1. Who we are
- Responsible party: Terroirsbookings
- Registration number: 2026/101900/07
- Address: 44 Wellington Road, Centurion, Gauteng, South Africa
- Information Officer: Gregory Dearham
- Email: gregory.dearham@gmail.com
2. Two different roles — which one applies matters
POPIA distinguishes between deciding why information is processed and processing it for somebody else. We do both, for different information, and your rights differ accordingly.
Where we are the responsible party
Your enquiry, your account details, your Information Officer's contact details, and your billing information. We decide why we hold these — to answer you, run your account and invoice you — so this policy governs them.
Where we are only the operator
The consent records collected from our customers' websites. Those belong to the customer, who decides why they are collected; we store and protect them on that customer's instruction under a written operator agreement, as sections 20 and 21 require.
If you are a visitor to one of our customers' websites and want to know what is held about you, ask that business. The consent banner also has a "What do you hold about me?" control that shows your own record directly.
3. What we collect, and why
| Information | Why we hold it | How long |
|---|---|---|
| Name, email, business name, website — from the enquiry form | To reply to you and, if asked, to review your existing manual | 24 months from last contact |
| Account details, questionnaire answers, Information Officer contact details | To generate your documents and run the service | 90 days after cancellation |
| Billing records | To take payment and to meet tax obligations | As long as tax law requires |
| Consent records (as operator): an opaque visitor ID, one-way digests of address and browser, page, choices, timestamp | To give our customer provable evidence of consent | As instructed by that customer |
4. What we never collect
- Card details. Payfast handles payment; we never see or store them.
- Names, email addresses or IP addresses of your website visitors in readable form. Addresses and browser details are stored as salted one-way digests and cannot be turned back.
- Anything from a tracking cookie of our own. This website does not run analytics or advertising tags.
5. Who else processes it for us
| Provider | What they handle |
|---|---|
| Hostinger | Hosting for this website and the client portal, including the database |
| Payfast | Payment processing. South African. |
| Our email provider | Delivery of account emails and replies to enquiries |
We do not sell personal information, and we do not share it for anyone else's marketing. Where a provider is outside South Africa, section 72 applies and we are confirming the position for each one.
6. How we protect it
- HTTPS everywhere, on both this site and the portal.
- Addresses and browser details stored as salted one-way digests, never in the clear.
- Consent records sealed in sequence, so an alteration after the fact is detectable.
- Access to your account data requires a signed-in session. The public key that runs the banner on your site cannot read it.
- Rate limiting and origin checks on the public endpoints.
If we have reasonable grounds to believe personal information has been accessed by an unauthorised person, we will notify the Information Regulator and the people affected, as section 22 requires. Where we hold that information as an operator, we notify our customer immediately so they can meet their own duty.
7. Your rights
- Ask what we hold about you, and get a copy.
- Have it corrected or deleted where we have no lawful reason to keep it.
- Object to processing based on our legitimate interests.
- Withdraw consent where consent is what we relied on.
- Complain to the Information Regulator, whether or not you complain to us first.
Email the Information Officer at gregory.dearham@gmail.com. We reply within 30 days, usually far sooner. Our PAIA manual sets out the formal request procedure.
8. Marketing — we will not email you unasked
Section 69 of POPIA prohibits unsolicited electronic direct marketing without consent or an existing customer relationship, and we keep to it.
If you send us an enquiry you get a reply, not a subscription. If you become a customer we email you about your own account — documents ready, a payment that failed, a service about to lapse — and nothing else. There is no newsletter and no list.
9. Cookies on this website
This site sets no analytics or advertising cookies. Your browser stores one small item locally if you dismiss the announcement bar, so it stays dismissed. That never leaves your device.
The portal sets a session cookie when you sign in, which is strictly necessary and expires when you sign out.
10. The Information Regulator
You may complain to the Information Regulator of South Africa at inforegulator.org.za. You do not have to raise it with us first, though we would like the chance.
11. Changes
If we change this policy materially we will email account holders and update the date at the top. Superseded versions are kept, because a policy you agreed to two years ago is the one that applied then.