Privacy Policy (POPIA)

This notice explains how we handle your personal information under the Protection of Personal Information Act (POPIA), in plain language. It applies to everything you do on mydreamholiday.

Who is responsible for your information

Leisure Options (Pty) Ltd ("Leisure Options" or "LO"), which operates the mydreamholiday platform, is the responsible party for your personal information under POPIA. You can reach our Information Officer at hello@mydreamholiday.co.za.

What we collect

Account and contact details: your name, email address, phone number, and city.
Identity information: your South African ID number, collected for FICA verification at your first commitment and stored encrypted. We never ask for it just to browse.
Your activity on the platform: listings, offers, bids, purchases, the declarations and mandates you sign, and the resorts, regions, dates and other criteria you save in a wishlist or a wishlist alert.
Technical information: your IP address and security logs, used to protect your account and the platform.
Documents and signing records: copies of your ID or passport and other documents you upload (such as letters of executorship), your physical address, and the signature, IP address and time recorded when you sign a declaration or mandate.
Payment: your card details are handled by our payment processor and are never stored by us.
Push notifications: if you turn on alerts, we keep your device's push address and keys so we can send them. They are delivered by the push service of your device's maker (Apple, Google, Mozilla or Microsoft), which may process them outside South Africa. We delete the address when you turn alerts off or the service tells us it is no longer valid.

Signing in with Google

If you choose "Sign in with Google" or "Sign up with Google", Google shares your name, email address and profile picture (if you have one) with us. We use them only to create your mydreamholiday account and to sign you in. We do not use information from Google for advertising, we do not sell it, and we share it only with the service providers that run our website, as described below. You can remove mydreamholiday's access at any time at myaccount.google.com/permissions; your mydreamholiday account stays until you ask us to close it. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Why we use it, and our lawful grounds

POPIA requires a lawful ground for every use. Ours are:

To run the marketplace and complete your transactions — performing our contract with you.
To verify identity, prevent fraud, and keep required records — complying with our legal obligations under FICA, the Property Practitioners Act, and tax law.
To secure the platform, investigate misuse, and improve how the platform works — our legitimate interests, applied without overriding your rights.
To send you marketing — only with your consent, which you can withdraw at any time. We rely on consent for marketing only.

How we use your wishlists

We use what you save in a wishlist for two things. First, to tell you when a listing matches it — that is what you asked us for. Second, in anonymous and combined form only, to see which resorts buyers are looking for, so we know where to go and find stock. That second use tells us a number, never a person: we do not identify you to a seller, a managing body, or anyone else, and we never record or reveal what you are willing to pay. You can delete a wishlist at any time from your dashboard, and it stops being used for either purpose.

How we count visits to the website

We count how many people visit the website and which pages they look at, so we can see what buyers are interested in and improve the website. We do this without cookies and without identifying you: we do not store your IP address, your name or your account, and we cannot follow you from one day to the next. For each page you view, we record the page, the website or link that brought you to us (for example Google, Facebook or a link we shared), whether you used a phone, tablet or computer, and your country. We keep these records for 13 months. If your browser sends a "do not track" or Global Privacy Control signal, we do not count your visit. We rely on our legitimate interest in running and improving the website.

Selfie and face checks

Before your first bid, listing or purchase we confirm your identity with a photo of your ID document and a live selfie, taken with your camera while you do a gesture we show you. We do this only with your explicit consent, which you give on the screen before your camera opens.

What we collect: your ID photo, your selfie, the gesture we asked for, the time, your IP address and your device details. Our server puts them together into one encrypted image.
Face match: our own server compares the faces in the two photos and gives our team a match score. We use no outside face-recognition service. The score is only a hint: a person in our team always decides, and no decision about you is made by a computer alone.
Who sees it: only LO staff who check identities, and every time one of them opens it is recorded.
Where it is kept: with our hosting provider in Frankfurt, Germany (European Union), where data-protection law gives at least the protection POPIA does.
How long: we delete your ID photo and selfie as soon as you are verified. If the check fails or we suspect fraud, we keep them only for as long as we need them to deal with that and the law requires.
Your choice: you may refuse, or withdraw your consent before the check is done. You can still browse, and our team will confirm your identity another way before you bid, list or buy.

One account per person

To make sure each person holds only one account, we keep a protected code made from your ID or passport number. The code is created with a secret key that only we hold. It cannot be turned back into your number, and we use it only to find accounts that share the same number. We delete it at the same time as your ID number.

Service providers who process information for us — our payment processor, email provider, and hosting providers — each processing it only on our instruction, and only for the purposes described here.
The relevant managing body (share block, body corporate, points membership operator or resort), where needed to verify ownership or complete a transfer.
Credit providers named on a financed lot, if you apply for finance through mydreamholiday — your application and their decision only.
Regulators, law enforcement, or a court, where the law requires it.

We never sell your personal information.

Where it is stored

Some of our service providers store information on servers outside South Africa. Where that happens, we transfer information only as POPIA allows — to providers bound by law or by agreement to a standard of protection substantially similar to POPIA.

How long we keep it

FICA identity records: five years from the end of the transaction or relationship, as FICA requires.
Trust-account records: as required by the Property Practitioners Act.
Business and tax records: for the periods our record-keeping laws require.
Your account information: while your account is active, and afterwards only as long as one of the periods above applies.

When we no longer need information, we delete it or de-identify it.

Your rights

You may ask us, at any time, to:

confirm what personal information we hold about you and give you access to it;
correct information that is wrong or incomplete;
delete information we are not required by law to keep;
stop using your information for a particular purpose, where POPIA gives you the right to object;
withdraw a consent you gave us, including for marketing — every marketing email also has an unsubscribe link.

Write to hello@mydreamholiday.co.za and we will respond as POPIA requires. If you are not satisfied, you may complain to the Information Regulator (South Africa) — inforegulator.org.za.

How we protect it

We use encryption, strict access controls, and multi-factor authentication for staff access. Your ID number and card details never appear in links or logs. Access to identity documents is restricted — staff must pass a second authentication step to open one — and the links we generate to view them expire after a few minutes.

Children

The platform is for people 18 and older. We do not knowingly collect children's personal information.

Changes and contact

If we change this notice, we publish the new version on this page. Questions and requests: hello@mydreamholiday.co.za.