This notice explains how we handle your personal information under the Protection of Personal Information Act (POPIA), in plain language. It applies to everything you do on mydreamholiday.
Who is responsible for your information
Leisure Options (Pty) Ltd ("Leisure Options" or "LO"), which operates the mydreamholiday platform, is the responsible party for your personal information under POPIA. You can reach our Information Officer at privacy@mydreamholiday.co.za.
What we collect
- Account and contact details: your name, email address, phone number, and city.
- Identity information: your South African ID number, collected for FICA verification at your first commitment and stored encrypted. We never ask for it just to browse.
- Your activity on the platform: listings, offers, bids, purchases, the declarations and mandates you sign, and the resorts, regions, and other criteria you save in a wishlist or a "tell me when a week comes up" alert.
- Technical information: your IP address and security logs, used to protect your account and the platform.
- Payment: your card details are handled by our payment processor and are never stored by us.
Why we use it, and our lawful grounds
POPIA requires a lawful ground for every use. Ours are:
- To run the marketplace and complete your transactions — performing our contract with you.
- To verify identity, prevent fraud, and keep required records — complying with our legal obligations under FICA, the Property Practitioners Act, and tax law.
- To secure the platform, investigate misuse, and improve how the platform works — our legitimate interests, applied without overriding your rights.
- To send you marketing — only with your consent, which you can withdraw at any time. We rely on consent for marketing only.
How we use your wishlists
We use what you save in a wishlist for two things. First, to tell you when a listing matches it — that is what you asked us for. Second, in anonymous and combined form only, to see which resorts buyers are looking for, so we know where to go and find stock. That second use tells us a number, never a person: we do not identify you to a seller, a club, or anyone else, and we never record or reveal what you are willing to pay. You can delete a wishlist at any time from your dashboard, and it stops being used for either purpose.
Who we share it with
- Service providers who process information for us — our payment processor, email provider, and hosting providers — each processing it only on our instruction, and only for the purposes described here.
- The relevant club, share-block, or resort, where needed to verify ownership or complete a transfer.
- Regulators, law enforcement, or a court, where the law requires it.
We never sell your personal information.
Where it is stored
Some of our service providers store information on servers outside South Africa. Where that happens, we transfer information only as POPIA allows — to providers bound by law or by agreement to a standard of protection substantially similar to POPIA.
How long we keep it
- FICA identity records: five years from the end of the transaction or relationship, as FICA requires.
- Trust-account records: as required by the Property Practitioners Act.
- Business and tax records: for the periods our record-keeping laws require.
- Your account information: while your account is active, and afterwards only as long as one of the periods above applies.
When we no longer need information, we delete it or de-identify it.
Your rights
You may ask us, at any time, to:
- confirm what personal information we hold about you and give you access to it;
- correct information that is wrong or incomplete;
- delete information we are not required by law to keep;
- stop using your information for a particular purpose, where POPIA gives you the right to object;
- withdraw a consent you gave us, including for marketing — every marketing email also has an unsubscribe link.
Write to privacy@mydreamholiday.co.za and we will respond as POPIA requires. If you are not satisfied, you may complain to the Information Regulator (South Africa) — inforegulator.org.za.
How we protect it
We use encryption, strict access controls, and multi-factor authentication for staff access. Your ID number and card details never appear in links or logs. Access to identity documents is restricted — staff must pass a second authentication step to open one — and the links we generate to view them expire after a few minutes.
Children
The platform is for people 18 and older. We do not knowingly collect children's personal information.
Changes and contact
If we change this notice, we publish the new version on this page. Questions and requests: privacy@mydreamholiday.co.za.