Privacy Notice · Curves in the Road

The short version. We collect the least we can get away with, we use it to run your trip and to talk to you, and we never sell or rent it to anybody. You can ask us what we hold, ask us to fix it, or ask us to delete it, at any time. If you only ever read one line: we will not email you marketing unless you actively ticked the box.

On this page

Who is responsible
What we collect
Why we collect it
Health information
Marketing and consent
Who we share it with
Sending data abroad
How long we keep it
How we keep it safe
Your rights
Cookies
Complaints
Changes

1Who is responsible for your information

The responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) is Abena Collective, trading as Curves in the Road, Cape Town, South Africa. For anything on this page, contact our Information Officer, Shafeeqah Isaacs, at hello@curvesintheroad.com.

2What we collect

If you only download the packing list

Your email address.
Whether or not you consented to further emails.

If you apply for a trip or book a service

Name, email address, phone or WhatsApp number, city.
Date of birth, nationality, passport number and expiry (needed for bookings and entry requirements).
Emergency contact name, relationship and number.
Travel insurance provider and policy number.
Dietary requirements, and any health or mobility information you choose to share.
Payment records: amounts, dates and references. We never see or store your card or banking login details.
Your answers on the application form, and correspondence between us.

3Why we collect it

To run your trip: making bookings, sharing rooming and dietary requirements with accommodation, arranging transport and guides.
To look after you: holding emergency contacts and insurance details, and being able to act if something goes wrong.
To meet our legal obligations: accounting records, tax, and the consumer protection requirements that apply to us.
To communicate with you: answering your questions, sending invoices, welcome packs and trip updates.
To send you marketing, but only if you have specifically consented. See section 5.

4Health information

Health information is special personal information under POPIA and we treat it that way. We ask for it only so we can support you properly on a trip, for example dietary needs, allergies, mobility considerations or anything you would want a host to know in an emergency.

We process it only with your explicit consent, given when you sign your booking agreement.
We share it only where necessary for your safety or care, for example telling a restaurant about an allergy, or giving information to medical staff in an emergency.
It is kept in a restricted file, is not stored in group chats or shared documents, and is deleted after the trip cycle closes.
You can decline to share it. We will simply not be able to accommodate needs we do not know about.

5Marketing and consent

Opt-in, always. Section 69 of POPIA requires your consent before we send you electronic direct marketing. When you request the packing list, we send you the packing list. We only add you to our list if you tick the consent box. Every email we send includes a one-click unsubscribe, and unsubscribing takes effect immediately. If you have booked with us, we may send you information relating to your booking regardless, because that is service communication rather than marketing.

6Who we share it with

We do not sell, rent or trade your personal information. Ever. We share it only with:

Suppliers who need it to deliver your trip: accommodation providers (name, and where required passport details for check-in), transport providers, and guides. Only what they need, nothing more.
Your emergency contact, if we cannot reach you or in an emergency.
Emergency and medical services, where necessary to protect your life or health.
Our service providers: email delivery, form hosting, cloud storage and accounting. These are contracted to process data on our instructions only.
Regulators or authorities, where the law requires it.

7Sending data abroad

Because we run trips outside South Africa, some information is necessarily shared with suppliers in the destination country, for example an accommodation provider in Egypt or Tanzania. Some of our software providers also store data outside South Africa. We share the minimum required, and only for the purposes described above. By booking a trip, you consent to this transfer as permitted under section 72 of POPIA.

8How long we keep it

Health and passport information: deleted within 3 months after your trip ends.
Booking and financial records: kept for 5 years, as required by South African tax and company law.
Marketing list: kept until you unsubscribe or ask us to delete it.
Correspondence: kept while it is useful, then deleted.

9How we keep it safe

We keep guest information in password-protected, access-restricted files, limit who can see it to those who need to, use reputable service providers, and never circulate personal details in group chats. We take security seriously, and we will tell you promptly if there is ever a breach affecting your information, as POPIA requires.

10Your rights

Under POPIA you have the right to:

Ask what personal information we hold about you, and get a copy.
Ask us to correct anything that is wrong or incomplete.
Ask us to delete information we no longer have a legal reason to keep.
Object to processing, and withdraw consent at any time.
Unsubscribe from marketing instantly.
Complain to the Information Regulator.

Email hello@curvesintheroad.com and we will respond within 30 days. There is no charge for a reasonable request.

11Cookies

This website is deliberately simple. It does not set advertising or tracking cookies. If we later add analytics or a booking system that requires cookies, we will update this notice and ask for your consent where required.

12Complaints

Please come to us first, at hello@curvesintheroad.com. We would much rather fix something than have you take it elsewhere unresolved. If you are not satisfied, you have the right to lodge a complaint with the Information Regulator of South Africa, whose current contact details are published at inforegulator.org.za.

13Changes to this notice

If we change how we handle personal information, we update this page and change the date at the top. If the change is significant and you are on our list or booked on a trip, we will tell you directly rather than expecting you to notice.