Under review. This notice is published in good faith and is currently under legal review; it may be updated. Last updated 5 November 2026.
1. Who we are
This website, Fynbos & Gold, is operated by Cape Colony, a trading name based in South Africa. Cape Colony is the responsible party (POPIA) and controller (GDPR) for the personal information described here. For any privacy question or request, including to reach our Information Officer, email [email protected].
2. What we collect and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Your name, email address and message when you email us | Replying to you, including adding you to the newsletter launch notice if you ask | Legitimate interests in answering enquiries; consent where you ask to be notified (GDPR Art. 6(1)(a) and (f); POPIA s.11(1)(a) and (f)) | Up to 12 months after our last exchange, or until you ask us to delete it |
| Technical server logs kept by our hosting provider (IP address, browser, pages, time) | Security and keeping the site running | Legitimate interests (GDPR Art. 6(1)(f); POPIA s.11(1)(f)) | As set by the hosting provider; the current retention period has not been verified |
This site has no account system, sign-up forms or comment sections. The reviewed source does not contain a separate first-party analytics service or advertising pixel, but it does include a third-party Stay22 integration on the older page templates. This is not a no-tracking website assurance. The external script is requested when a page containing it loads, not only after a booking-link click.
3. Booking links and the Stay22 integration
Manually tagged affiliate links may attribute a qualifying booking to us. When you follow a link to Viator, GetYourGuide, Klook, Expedia, Booking.com or another provider, that provider's privacy notice and cookie practices apply. Booking platforms may set cookies or use other attribution technology on their own sites.
Some of our page templates load Stay22's letmeallez.js script with a site integration identifier. It may process visitor information or change eligible accommodation links before you click them. The installed code alone does not establish which Stay22 features are enabled, whether an account is active, or whether a specific link earns commission.
Stay22's privacy policy describes automatic collection from visitors to its clients' websites, including IP address, browser/device and operating-system information, time zone, region and use of booking platforms. It also describes booking information obtained from partners, such as transaction value, dates, destination, traveller count and length of stay. These are categories described by Stay22, not a claim that every category is collected for every visitor here. We cannot promise that all processing is anonymous or that reports contain only aggregated data.
The reviewed site code does not specify the full runtime data flow or cookies used by Stay22. It has no on-site consent or cookie-preference interface that delays this script. We do not claim that such controls or legally required consents have been implemented. Integration settings, runtime behaviour and notice/consent requirements remain under review. Browser controls may restrict cookies, but are not a guarantee that all third-party processing stops.
4. Service providers and international transfers
The site is hosted on Cloudflare Pages (Cloudflare, Inc.). Email is handled by Google (Gmail). Stay22 provides a third-party accommodation-link integration where its script is included; booking providers operate separately when you use their sites. Stay22's privacy policy describes service-provider sharing and processing outside Canada, including in the United States. Cross-border processing may therefore occur. The exact arrangements and any required safeguards for this website remain subject to review; this notice does not certify them.
For Stay22's published responsibilities and practices, see its privacy policy and terms. Stay22's separate cookie policy is scoped to stay22.com; it is not a verified cookie inventory for this website.
5. Your rights
Under GDPR you can request access, rectification, erasure, restriction and portability, and object to processing; you may withdraw consent at any time without affecting prior processing. Under POPIA you can request access to and correction or deletion of your personal information, and object to processing, including for direct marketing. To exercise any right, email [email protected].
You can complain to the Information Regulator (South Africa), to your local EU data-protection authority, or in the UK to the Information Commissioner's Office (ICO).
6. Security and breaches
We use reasonable technical and organisational measures. If a breach affecting your data occurs we will notify you and the relevant regulator where the law requires (POPIA s.22; GDPR Arts. 33–34).
7. Children
This site is intended for adults planning travel. We do not knowingly collect children's data.
8. Changes
We will post any changes on this page with a new date. Last updated: 5 November 2026.