Privacy Policy

This privacy notice explains how personal data is processed when you visit www.ubomitravel.com, request a quote, submit an inquiry, or book Cape Town accommodation with Ubomi Travel. It is intended to meet the information duties under Article 13 GDPR where the GDPR applies (in particular for visitors/guests in the EU/EEA).

Last updated: 20 July 2026

1. Controller

Marcus Galli — Ubomi Travel
Postal address:
70 Prestwich Street
De Waterkant, Cape Town, 8001
South Africa
Email: info@ubomitravel.com
Bookings: booking@ubomitravel.com
Phone: +27 21 418 3000

Provider ID: see Impressum.

2. Categories of data

Depending on how you use the site, we may process:

  • Booking / quote data: name, email, phone, stay dates, guest counts (adults, children, infants, pets), and related reservation details.
  • Inquiry / contact data: name, email, phone, preferred dates, guest count, event type, and message content.
  • Payment-related data: when online payment is used, payment status and identifiers from the payment provider (card data is handled by the payment provider — not stored on this website).
  • Technical data: server logs such as IP address, browser/user agent, date/time, requested URL, and similar connection data needed to operate and secure the website.

Please do not include special-category data (health, etc.) in free-text fields unless it is necessary for your stay and you choose to provide it.

3. Purposes and legal bases

We process personal data for the following purposes:

  • Website operation and security (delivery of pages, abuse prevention, error diagnosis) — Art. 6(1)(f) GDPR (legitimate interests in running a secure website).
  • Responding to booking quotes, inquiries, and guest communication — Art. 6(1)(b) GDPR (steps prior to a contract / performance of a contract) and, where applicable, Art. 6(1)(f).
  • Processing and fulfilling reservations (availability, confirmation, stay coordination) — Art. 6(1)(b) GDPR.
  • Payment processing when you pay online — Art. 6(1)(b) GDPR.
  • Legal obligations (e.g. accounting/tax retention where applicable) — Art. 6(1)(c) GDPR.

We do not run marketing newsletters or advertising trackers on this website. Where consent would be required (e.g. non-essential cookies), we would ask for it separately — currently we do not use such tools.

4. Recipients / categories of processors

We share personal data only as needed for the purposes above, with recipients in the following categories:

  • Website hosting — servers in the EU that store and deliver the website and process access logs.
  • Email service / mailbox providers — to receive and respond to inquiries (e.g. to booking@ubomitravel.com).
  • Property management / booking systems and channel partners — infrastructure used to manage availability, quotes, reservations, and (where you book via an external channel) the relevant booking platform. Those platforms may also process data under their own privacy notices when you continue on their sites.
  • Payment providers (e.g. Stripe) — when online payment is offered/used, to process the transaction securely.
  • Map tile / map library providers (Mapbox) — when a map is displayed, your browser requests map resources; technical data (e.g. IP address) may be transmitted to Mapbox (see Mapbox’s privacy documentation: mapbox.com/legal/privacy).
  • Font and icon CDNs — Google Fonts and cdnjs (Font Awesome) load stylesheet/font assets; your browser may transmit technical data (e.g. IP address) to those providers when pages load.
  • Authorities or professional advisers — only if legally required or necessary to establish, exercise, or defend legal claims.

We do not sell personal data.

5. International transfers

The controller is based in South Africa. Guest communication and stay organisation therefore typically involve processing in South Africa. Website hosted in the EU.

Some recipients may process data in third countries (including the United States), in particular Mapbox, certain CDN/font providers, payment providers, and booking/channel infrastructure. Where the GDPR applies and a transfer to a third country occurs, we rely on appropriate safeguards offered by those providers (for example Standard Contractual Clauses and/or other lawful transfer mechanisms they publish), and we only use services necessary to operate the website and bookings.

6. Cookies and similar technologies

We do not currently use third-party advertising or analytics cookies (such as Google Analytics) on this website.

Essential technical storage may be used by the hosting environment or by integrated components (for example Mapbox) to deliver maps and basic site functionality. You can control cookies and site data in your browser settings.

7. Retention

We retain personal data only as long as needed for the purpose collected:

  • Inquiries — for handling the request and reasonable follow-up, then deletion or anonymisation unless a booking results or a longer retention is required.
  • Bookings / contracts — for the stay and guest communication, plus statutory retention periods that may apply (e.g. commercial/tax records).
  • Server logs — typically for a limited operational security period set by the hosting environment.

8. Your rights

Where the GDPR applies, you have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. For Germany, this is typically the data protection authority of the federal state (Landesbeauftragte/r) relevant to you; a list is available via the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).

South African POPIA rights may also apply depending on the context. To exercise rights, contact info@ubomitravel.com. We may need to verify your identity before responding.

9. Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. Transmission over the Internet is never completely risk-free; please use secure devices and strong unique passwords for any third-party booking accounts.

10. No automated decision-making

We do not use personal data on this website for automated decision-making producing legal effects concerning you within the meaning of Art. 22 GDPR.

11. Changes

We may update this privacy policy when our processing or legal requirements change. The “Last updated” date indicates the latest revision.

12. Contact

Privacy questions: info@ubomitravel.com or the postal address above. Booking questions: booking@ubomitravel.com.