Legal

Privacy Policy

Last updated: 6 October 2026

1. Who we are

Pumba Collective ("we", "us") runs Pumba Lodge, Pumba Manor and Little Pumba in Hoedspruit Wildlife Estate, and this website. We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).

To ask about your information or to use any of your rights, message us on WhatsApp: +27 83 650 1241 (opens in a new tab)

2. This website

This website uses Google Analytics to understand how visitors use it. Google Analytics sets cookies (_ga and _ga_*) and records the pages you view, your approximate location, your device and browser, and the website you came from. When you click a booking or WhatsApp button we record which button and which lodge, never who you are.

Two strictly necessary cookies, a session cookie and a security token, keep the site working. Links from this site to our booking site carry tags that name this site and the button you clicked; they contain no personal information.

3. Booking with us

Bookings are made on our booking site, book.pumba-lodge.co.za, which runs on the zzzzebra booking platform. Apart from its own analytics, described below, zzzzebra processes personal information on our behalf as our operator. When you book we collect your name, email address, phone number, the details of your stay and any requests you make. Card payments are handled by a payment service provider.

The booking platform loads its own Google Analytics 4 and Meta Pixel on book.pumba-lodge.co.za, as well as our Google Analytics. These record the pages you view and the steps you take while booking. zzzzebra's own tags send this data to zzzzebra's Google and Meta accounts, which it uses for its own purposes, so for that data zzzzebra is the responsible party, not us.

During your visit the booking site notes how you first arrived: the domain of the website that referred you, the page you landed on, any campaign tags in the link, and whether an advertising click identifier was present (not the identifier itself). If you book, this is saved with your booking, together with your answer to the optional "How did you hear about us?" question. We use it to understand which channels bring us guests and keep it for 24 months.

4. Booking.com, Airbnb and other channels

If you book through Booking.com, Airbnb or another booking channel, that channel passes your booking details to us. We use them only to manage your stay, never for marketing. We do not send offers, sign-up links, review requests or discount codes to the email addresses or messaging services those channels provide.

5. Emails from us

We only send news and offers to people who ask for them. You can sign up on this website, at checkout on our booking site, or at the lodge.

  • Signing up is never pre-ticked. When you sign up we record the exact wording you agreed to, the date, and your IP address and browser as evidence of your consent.
  • Our sign-up forms use Cloudflare Turnstile to check that you are a person, then subscribe you straight away and send a welcome email with a one-click unsubscribe link, so you can undo a sign-up you didn't make.
  • If your address was unsubscribed or erased before, or our staff add you, we first email you a confirmation link and only subscribe you once you click it. The link expires after 7 days, and sign-ups that are never confirmed are deleted after 30 days.
  • Every email has an unsubscribe link that works in one click, and you can change your preferences at any time. After you unsubscribe we keep a record of that so we never email you again.
  • If you leave the box unticked at checkout, we record that you declined and won't ask again for that booking.
  • Addresses supplied by Booking.com, Airbnb and similar channels cannot be used to sign up.

6. At the lodge

At check-in we may show you a QR code, or leave a printed welcome card, that you can use to sign up for our emails. If you booked directly with us and sign our indemnity form online, you may also tick a box to sign up. Signing the indemnity form never signs you up on its own, and the same confirmation email applies in every case.

When you sign the indemnity form online we record your name, email address, IP address, the time you signed and the answers you give on the form, as evidence that you signed it.

7. Returning-guest codes

If you have signed up and stayed with us after booking directly, we may email you a personal code for a future stay. Each code is single use, works only with your email address and expires. It is stored with your contact record and deleted if you ask us to erase your details.

8. Reviews

After a stay booked directly with us, we may email you a link to review it. We only publish reviews from guests who booked directly; reviews left on Booking.com, Airbnb or other channels are not shown here.

  • If you submit a review we may publish it on this website and on book.pumba-lodge.co.za, with your display name (by default your first name and last initial), the month you stayed, your rating, your words and any reply from us.
  • We never publish your email address or booking details. You can choose to share your feedback with the hosts only, and it will not be published.
  • We hold back reviews that contain contact details or inappropriate language, and we remove a review if you ask us to. If you ask us to erase your details, your published reviews are anonymised.

9. Who we share information with

We do not sell or rent your personal information. We share it with:

  • zzzzebra, which runs our booking site and sends our emails on our behalf;
  • Cloudflare, which protects and delivers this website and our booking site, and so handles your IP address and anything you send through them, such as a sign-up, including the signals its Turnstile check uses to tell people from bots;
  • Channex, the channel manager that passes bookings, availability and messages between our booking site and Booking.com, Airbnb and other channels;
  • our email delivery provider;
  • Google (Google Analytics) and Meta (Meta Pixel on the booking site);
  • the payment service provider that processes card payments;
  • Anthropic, an AI service our booking platform may use to help draft replies to your messages and other messages about your stay;
  • professional advisers, and authorities when the law requires it.

Information sent outside South Africa

Google and Meta process analytics data in other countries, including the United States. Cloudflare may process your IP address and the requests you make outside South Africa. Channex may process booking details outside South Africa. Our email delivery provider may also process your email address outside South Africa. Anthropic may process your messages and booking details outside South Africa. We rely on these providers' data-protection terms to protect your information, as section 72 of POPIA requires.

10. Security and retention

We use appropriate technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure.

We keep personal information only as long as we need it. We keep how-you-found-us information for 24 months and unconfirmed sign-ups for 30 days. We keep booking records for at least 5 years, as South African tax law requires. Our booking platform does not delete them automatically after that, so ask us if you would like yours deleted once that period has passed.

11. Your rights

Under POPIA you may:

  • ask what personal information we hold about you and get a copy;
  • ask us to correct or delete it;
  • object to processing, including direct marketing, and withdraw your consent at any time;
  • complain to the Information Regulator.

12. Children

This website is not aimed at children under 18, and we do not knowingly collect their personal information without a parent's or guardian's consent.

13. Changes to this policy

We will post any changes on this page and update the date at the top.

← Back to home