Privacy Policy and PAIA Manual

Privacy Notice

Last Updated: May 31, 2021

Click to read the Special Notice for Collection of Personal Information Related to the COVID-19 Pandemic.

Introduction to this Privacy Notice

Vacation Rentals International (Pty) Ltd is a subsidiary of Travel + Leisure Co., and does business as "Panorama." Panorama’s business operations include many subsidiary entities and consists of brands including RCI, Panorama Travel Solutions, 7Across (formerly DAE), The Registry Collection, Extra Holidays, Love Home Swap, TripBeat, @Work International, and Alliance Reservations Network (collectively "Panorama," the “Panorama Group of Companies”we”, “us”, or “our”). We care about privacy issues and want you to be familiar with how we collect, disclose, and otherwise use (“Process”) information about you. This privacy notice (“Privacy Notice”) describes our practices in connection with information we collect through our websites (“Websites”), social media pages we control (“Social Media Pages”), and software applications we make available for use on or through computers and mobile devices (“Apps”), that include a link to this Privacy Notice, and through any of our offline activities, such as when you provide your information on the phone via our call centers or in person (“Offline Activities”) (collectively, including the Websites, Apps, Social Media Pages, and Offline Activities, the “Services”).

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements, such that our practices may be more limited in such jurisdictions.

Our privacy practices also may vary among entities within the Panorama Group of Companies as well as amongst and between Panorama and Travel + Leisure Co. and any of its other affiliated operating entities (excluding the Panorama Group of Companies, the “T + L Affiliates”) depending upon their function and their offered products and services. Please review the privacy notices linked to or referenced in their respective Services and note that the data controller of your Personal Information will be the T + L Affiliate or Panorama entity which provides the Services to you. The T+ L Affiliate brands can be found here. The Panorama brands can be found here.

 

California Residents: Click here to read about “Your California Privacy Rights”.

What Information Is Collected and How Is It Collected?

  1. We may collect “Personal Information” (information that identifies you or relates to you as an identifiable person) about you such as your:
    • Name
    • Postal address (including billing and shipping addresses)
    • Phone number
    • Email address
    • Credit or debit card number
    • Financial information in certain circumstances
    • Social media account information
    • Stay, trip, product or service information, such as your preferred location/facilities, dates and number of people/children travelling with you
    • Special needs or conditions that may impact your stay
    • Driver's license, government-issued ID, or passports
    • Geolocation information
    • Communication, product, service or other preferences
    • Your opinions, comments, suggestions, inquiries and other communications you provide to us
    • Demographic information
    • Audio/Visual recordings such as when you call our customer service phone number or participate in having a photo taken for an activity, resort, etc.
    • Internet Click Activity on our websites
    • IP address or Device ID
    • Subscribing Account or Membership ID
  2. We may collect information from you when you interact with us such as when you:
    • Register for, subscribe to, use, or make a payment for a product or service
    • Contact us with a question or request
    • Use our Services
    • Make a reservation
    • Stay at one of our affiliated resorts
    • Provide a testimonial or story, or post or submit a photo, review or comment
    • Participate in a competition, promotional activity or sweepstakes
    • Provide feedback or participate in a survey
    • Participate in any loyalty or other programs
    • “Like”, “Follow” or otherwise connect with or post to one of our Social Media Pages
    • Provide goods or services to us (for example, as a vendor or contractor)
  3. We may collect information from you when you interact with us such as when you:
    • Cookies: Our Services may use “cookies” and similar technologies (collectively, “cookies”). Cookies are small text files this Website sends to your computer for recordkeeping purposes; this information is stored in a file on your computer's hard drive. Cookies make web surfing and browsing easier for you by saving your preferences so we can use these to improve your next visit to our Website.
      • One purpose of cookies is to simplify the use of the Website. For example, cookies may save a user's login details, so that they do not need to login every time.
      • Cookies may be either “persistent” or “temporary” (or “session”) cookies. A persistent cookie retains user preferences for a particular Website allowing those preferences to be used in future browsing sessions and remains valid until its set expiry date (unless deleted by the user before the expiry date). A temporary cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
      • Cookies are also used for statistical or marketing purposes, to determine how the Website is used. These cookies are provided by us or by third parties (e.g., advertising partners). While we do not control or have access to the advertiser cookies we do permit them to be used on this Website to facilitate tailored advertising and monitor patterns of buying specific goods or interest in - for example, holidays or hobbies. These cookies run advertisements tailored to the user based on your online buying habits.
  • From Other Sources:We may receive your Personal Information from other sources, such as public databases, joint marketing partners, data firms, social media platforms, from people with whom you are friends or otherwise connected on social media platforms, as well as from other third parties.
  • Mobile Devices:When you use or access our Services from a mobile device, we may collect information such as your unique device ID and your location. If you download and use an App, we and our service providers may track and collect App usage data, such as the date and time the App on your device accesses our servers and what information and files have been downloaded to the App based on your device number, as well as any other Personal Information specified by the App in its terms or notices.
  • Google Analytics:We use Google Analytics to help us get a better understanding of how visitors use this Website and to facilitate interest based advertising associated with your Google Account and other devices you use. The information generated by the Google Analytics cookie about your use of this Website is transmitted to and stored by Google. If you do not want your activity on this Website to be tracked by Google Analytics, you may opt out by using this link: http://tools.google.com/dlpage/gaoptout?hl=en.
  • Internet Based Advertising:We may use third-party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use our Services and other websites, apps or online services, based on information relating to your access and use of our Services and other websites, apps and services on any of your devices, as well as information received from third parties. To do so, these companies may place or recognize a unique cookie on your browser (including through the use of pixel tags). They may also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop. If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Notice, please visit aboutads.info and www.networkadvertising.org to opt out in mobile apps. You may also opt out in Twitter by going to your account privacy settings and unchecking the box next to “Tailor ads based on information shared by ads partners.”
  • Do Not Track Signals: At this time, we do not respond to browser ‘do not track’ signals, as we await the work of interested stakeholders and others to develop standards for how such signals should be interpreted. Third parties, including our service providers, may collect information about your online activities over time and across different websites, including when you visit our website. You can learn about how to exercise choice regarding the collection of information about your online activities over time and across third party websites or online services by visiting http://www.aboutads.info/ and http://www.networkadvertising.org/.
  • Data Collected Automatically:In addition to any Personal Information or other information you choose to provide to us or that we otherwise collect about you as described in this Privacy Notice on the Services, we and our third-party service providers may use a variety of technologies, now and hereafter devised, that automatically collect certain website usage information whenever you visit or interact with the Services. This information may include browser type, operating system, the page served, the time, the source of the request, the preceding page view, and other similar information. We may use this usage information for a variety of purposes, including to enhance or otherwise improve the Services. In addition, we may also collect your IP address or some other unique identifier for the particular device you use to access the Internet, as applicable. When analyzed, usage information helps us determine how our Services are used, such as what types of visitors arrive at the Services, what type of content is most popular, what type of content you may find most relevant and what type of visitors are interested in particular kinds of content and advertising. We may associate your website usage information with the Personal Information you provide, but we will treat the combined information as Personal Information.

We use information in a variety of ways, including to analyze site traffic, understand customer needs and trends, carry out targeted promotional activities and to improve our services.

As aggregated, de-identified or anonymized information does not constitute Personal Information, we may use it for any purpose.

 

Why and How We Use Your Information

We may Process Personal Information in connection with any of the following:

  1. Our business transactions with you, including, but not limited to:
    • Entering into or performing a contract with you
    • Responding to your inquiries and fulfilling your requests
    • Sending administrative information to you, for example, information regarding the Services or an event you are attending
    • Completing and fulfilling any purchases or requests for services
  2. For our legitimate business interests, including, but not limited to:
    • Personalizing your experience on the Services by presenting products and offers tailored to you
    • Allowing you to participate in sweepstakes, contests, and similar promotions, and administering such activities (each of which may have additional rules and could contain additional information about how we Process your Personal Information)
    • Facilitating social sharing functionalities of your social media account(s)
    • Carrying out data analysis, audits, fraud monitoring and prevention, internal quality assurance, developing new products, enhancing, improving or modifying our Services, identifying usage trends, auditing use and functionality of our Services, helping enforce compliance with our Terms of Use, helping protect our Services, determining the effectiveness of our promotional campaigns and operating and expanding our business activities
    • Subject to your marketing preferences (which may include consent to marketing under applicable law), sending you newsletters or marketing communications we believe may interest you, for our own products and services, and on behalf of our Panorama Group of Companies, T + L Affiliates or selected third parties, in accordance with applicable law.
  3. In accordance with any consent you may have provided. You have the right to decline to provide your consent and, if consent is provided, to withdraw it at any time.
  4. As necessary or appropriate for legal reasons, including, but not limited to:
    • Under applicable law
    • Complying with legal process
    • Responding to requests from public and government authorities, including those outside your country of residence
    • Enforcing our terms and conditions in connection with the Services
    • Protecting our operations or those of any of the Panorama Group of Companies or T + L Affiliates or other third parties
    • Protecting our rights, privacy, safety or property, or that of the Panorama Group of Companies, T + L Affiliates, RCI affiliated resorts, you, or other third parties
    • Allowing us to pursue available remedies or limit damages we, the Panorama Group of Companies, the T + L Affiliates, RCI affiliated resorts or other third parties, may sustain

 

When We Disclose Your Information

We may disclose your information as follows:

  • T + L Affiliates and Entities with the Panorama Group of Companies: We may disclose your Personal Information within the Panorama Group of Companies for the purposes described in this Privacy Notice, including under “Why and How We Use Your Information”, unless otherwise prohibited by applicable law or by specific contractual agreement with our vendors, service providers or other third-parties. In addition, we may disclose your Personal Information to any T + L Affiliate for the purposes described in this Privacy Notice, including under “Why and How We Use Your Information”, unless otherwise prohibited by applicable law or by specific contractual agreement with our vendors, service providers or other third-parties. You can find more information about our primary operating T + L Affiliates in our Annual Report as of the date the Annual Report was published or by contacting us at the contact information set forth below in the section titled “How Can You Contact Us?”.
  • Vendors and Service Providers: We may disclose your Personal Information to vendors and service providers we retain in connection with our business such as: travel services companies, financial services companies, property owners' associations, vacation insurance companies, website hosting, data analysis, payment processing, order fulfillment, magazine publishers, information technology and related infrastructure provision, customer service, email delivery, credit card processing, tax and financial advisers, legal advisers, accountants, auditing services or others.
  • Business Partners, Sponsors, and Other Third Parties: We may disclose your Personal Information to business partners, co-sponsors of promotions, and other third parties in order to provide you with services that may interest you. For example, we may share your Personal Information with the owners and operators of affiliated and unaffiliated hotels and resorts, airlines, car rental services, activity or excursion providers, travel insurance providers, credit agencies, retail stores, magazine publishers, and other third parties to facilitate reservations, to offer you products or services, or in connection with any loyalty program we may provide or a loyalty program of one of our partners. We may also co-sponsor promotions, sweepstakes, or other events with a third party and may share your Personal Information in connection with these events. Further, we may share your Personal Information with third party providers located on-site at hotels or resorts, such as time-share, spa, golf, concierge, and dining providers. If you provide additional information to any of these third parties, such information provided to these third parties will be subject to each third party's privacy practices and policies.
  • Resorts or Business Partners: We may share Personal Information with RCI affiliated resort operators in order to provide you with services, facilitate a booking you requested, generate leads in connection with their offers to sell timeshares to you, to facilitate their understanding of their owners’ exchange history and utilization, or to respond to your inquiry for further information about mini-vacations at resorts where a resort tour is either required or requested of you by the resort operator.
  • Message Boards: We may make reviews, message boards, blogs, and other such user-generated content facilities available to users. Any information disclosed in these areas becomes public information and you should always be careful when deciding to disclose your Personal Information. We are not responsible for privacy practices of other users including website operators to whom Personal Information is disclosed.
  • Change in Control: We may disclose your Personal Information to a third party (e.g., prospective buyers and insolvency practitioners) in connection with any change in control of any part of our business or the business of any T + L Affiliate or entity within the Panorama Group of Companies, including, without limitation, merger, consolidation, divestiture, spin-off, purchase of all or a substantial portion of our assets, dissolution, liquidation, administration, receivership or other form of insolvency.

Disclosure Permitted by Law: We may disclose your Personal Information to law enforcement authorities, government or public agencies or officials, regulators, and/or to any other person or entity having appropriate legal authority or justification for receipt of your information, if required or permitted to do so by law or legal process, to respond to claims, or to protect our rights, interests, privacy, property or safety, and/or that of any T + L Affiliates or entities within the Panorama Group of Companies, you or other third parties.

 

How Do We Safeguard Your Information?

  • We will take reasonable steps to protect the information you provide us from loss, misuse and unauthorized access, disclosure, alteration and destruction. We have implemented appropriate physical, electronic and managerial procedures to help safeguard and secure your information from loss, misuse, unauthorized access or disclosure, alteration or destruction. Unfortunately, no security system is 100% secure, thus we cannot ensure the security of all information you provide to us via the Services.

Other Important Information

  • Information Provided on Someone Else's Behalf: If you provide us with information about someone else, please ensure you have the person's permission to do so for the purposes detailed in this Privacy Notice.
  • Links to Websites: The Services may have links to other websites that are not operated by us; we have no control over how these websites may collect your information and no liability for the practices, policies and security measures implemented on these websites. You should read the privacy notices on those other websites before you submit your information through them.
  • Social Media Sites: Please note that we are not responsible for the collection, usage and disclosure policies and practices (including data security) of other organizations, such as Facebook, Apple, Google, Microsoft, Blackberry, Twitter or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including any Personal Information you disclose to other organizations through or in connection with the Apps or our Social Media Pages. Any posts you make on our Social Media Pages may be available to others who use those pages. Never include sensitive personal, financial, or other confidential information such as your social security number, address, phone number or email address when posting or commenting online. Please refer to the privacy policies of our social media partners when you interact with them online.
  • Changes to Our Privacy Notice: From time to time we may revise this Privacy Notice. Updated versions will be posted on the respective Services.
  • Minors: We do not knowingly collect, maintain or use Personal Information provided by individuals under 18 years of age in connection with, and no part of our Websites, Social Media Pages, and Apps is directed to, individuals under the age of 18. If we do discover we have collected Personal Information from minors in violation of applicable law, we will delete it.
  • International Transfers: We are an international company and we may, subject to applicable law, transfer your information, to any T + L Affiliates, the Panorama Group of Companies or selected third parties outside the country where you are located and where information protection standards may differ (e.g., your information may be stored on servers located in other jurisdictions). We will utilize appropriate safeguards governing the transfer and usage of your Personal Information.
  • Retention Period: We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law.

 

Your Choices and Rights

  • Changes to Your Marketing Preferences: You can change your marketing preferences by:
    • Using the unsubscribe function in the email you receive from us;
    • Logging into your account (if the Service offers an account with such functionality); or
    • Contacting us as set forth under “How Can You Contact Us?” below.
  • Withdrawing Your Consent: You may withdraw any consent you have provided to us to Process your information at any time.
  • Accessing your Information: In accordance with applicable law, you may access the Personal Information we Process about you. Any request to access or obtain copies of your Personal Information must be made in writing by contacting us as set forth under “How Can You Contact Us?” below. We may also ask you to log into your account, to verify your identity and to provide further details relating to your request.
  • Correcting your Information: We will take reasonable steps to ensure the accuracy of the Personal Information we retain about you. It is your responsibility to ensure you submit true, accurate, and complete information to us, and timely update us in the event this information changes. You may request that any inaccurate or incomplete Personal Information held by us or on our behalf is corrected, by contacting us as set forth under “How Can You Contact Us?” below.
  • Deleting your Information: Under certain circumstances, you may request we delete Personal Information we hold about you by contacting us as set forth under “How Can You Contact Us?” below. We will assess your request and determine, under applicable law, whether we are required to delete this information.
  • Objecting to Processing: If you would like us to stop the Processing of your Personal Information, you can request this by contacting us as set forth under “How Can You Contact Us?” below. We will assess your request and determine, under applicable law, whether we have any justification for the continued Processing.
  • Transferring your Information: Under certain circumstances, you may receive your Personal Information in a format that allows you to send it to another company or to direct us to transfer it directly to another company.

Your South Africa Rights

  • Applicability of this Section: This section of Our Privacy Notice applies specifically to persons located in South Africa. If you are located in South Africa, to the extent of any inconsistency between this section of Our Privacy Notice and the other sections of Our Privacy Notice, this section will prevail.
  • Protection of Personal Information Act 2013: For persons located in South Africa, this Privacy Notice shall be read in conjunction with the Protection of Personal Information Act, 2013 (No. 4 of 2013) (“POPIA”).
  • Scope of Privacy Notice: In South Africa, this Privacy Notice applies to information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person.
  • Consent to Process Personal Information: By providing Personal Information to Us, you consent to Our collection, use and disclosure of your Personal Information in accordance with this Privacy Notice and any other arrangements that apply between us. We may change Our Privacy Notice from time to time by publishing changes to it on Our website. We encourage you to check Our website periodically to ensure that you are aware of Our current Privacy Notice.
  • Personal Information Collection Method: In the course of providing you with products or services, We collect Personal Information in a variety of ways. Unless it is unreasonable or impracticable to do so, We collect your Personal Information from you directly. In some cases, however, We will collect information about you from a third party. For example, We may collect Personal Information about you from third party service providers, affiliates or agents assisting Us to provide products or services to you.
  • Other Entities: The privacy and collection practices of entities to which We disclose Personal Information are governed by their own privacy policies and collection notices.
  • Overseas disclosure of Personal Information
    • As part of a global business, We may disclose your Personal Information to recipients that are located outside of South Africa.
    • When you provide Personal Information to Us, you consent to the disclosure of such Personal Information outside of South Africa and acknowledge that We are not required to ensure that overseas recipients handle that Personal Information in compliance with the POPIA and the associated Conditions for Lawful Processing of Personal Information (“Conditions”). We will, however, take reasonable steps to ensure that any overseas recipient will deal with such Personal Information in a way that is consistent with the Conditions.
  • Correcting Personal Information
    • You accept the responsibility for keeping Personal Information that you provide to Us up to date, and undertake to inform Us of any changes to Personal Information. If you believe that the Personal Information we hold about you is inaccurate or incomplete, please contact Us and we will use all reasonable efforts to correct the information. 
    • If, on receipt of a request from you to correct or delete your Personal Information, We do not believe the Personal Information We hold about you to be incorrect, We will retain your Personal Information in its original form but We will take reasonable steps at your request to add a statement to the Personal Information stating that you believe the information is inaccurate, incomplete or out of date.
  • Consequence of Withdrawal of Consent: If the processing of your Personal Information is based on consent, you may withdraw consent granted at any time. We will delete your Personal Information within a reasonable time after you withdraw your consent, but We may not be able to continue providing the Services to you thereafter. Please note that the withdrawal of your consent does not affect Our right to continue to collect, use and disclose your Personal Information where such collection, use and disclosure without consent is permitted or required under the applicable laws.
  • Accessing your Information: If you wish to access your Personal Information you are able to do so by:
    • Logging into your account (if the Service offers an account with such functionality) and viewing a copy of your Personal Information; or
    • Contacting us as set forth under “How Can You Contact Us?” below.

Your Nevada Privacy Rights

Notice to Nevada Residents: If you are a resident of Nevada, under certain circumstances, Nevada Civil Code Section NRS 603A.340 allows you to request operators of websites not to sell your Personal Information. To make such a request, please send an email to our Privacy Group at compliance@endlessholidays.co.za or send a letter to (please indicate the Panorama entity or brand you typically do business with):

Endless Holidays

The Core

Corner Kikuyu & Leeuwkop Roads

Sunninghill, South Africa, 2157

 

Your California Privacy Rights

  1. Shine the Light Law: If you are a resident of California, California Civil Code Section 1798.83 allows you to request information regarding the Personal Information we collected and third parties to whom we disclosed your Personal Information for the third parties' direct marketing purposes during the preceding calendar year. To send this request, you may contact us using one of the methods in the “How Can You Contact Us?” section of this Privacy Notice.
  2. California Consumer Privacy Act (“CCPA”): This section 2 is intended to satisfy the requirements of the California Consumer Privacy Act (“CCPA”). This section supplements our Privacy Notice. The rights herein are in addition to any other rights applicable to you in this Privacy Notice. Where there is a conflict between this section and other provisions of this Privacy Notice, this section will prevail for California residents and their rights under the CCPA and applicable California law.
    1. Personal Information Definition:For the CCPA, “Personal Information” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
    2. Exclusions: Some Personal Information is not subject to the CCPA such as consumer credit reports and background checks, publicly available data lawfully made available from state or federal government records, Personal Information governed by the Gramm-Leach Bliley Act, the Fair Credit Reporting Act, the California Financial Information Privacy Act, and any other Personal Information exempt from the CCPA. This CCPA section does not apply to our employees. A separate privacy notice applies to our employees.
    3. The Categories of Personal Information We Collect and Why We Collect Them. Generally, where applicable, in our role as a “Business” under CCPA, we may collect the following categories of Personal Information (as set forth in the CCPA) about you for the following purposes:

Personal Information Category

Identifiers: Identifiers such as your real name, alias, title, military or other service rank, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, account number, rewards program number, and other similar identifiers.

Purposes of Collection

We may collect this information to establish a business record of you, setup rewards and other accounts, create login credentials for you, and for similar reasons.

We may collect this information to communicate to you about your purchases, transactions, contracts, our business relationship with you, and for similar reasons.

We may collect this information to provide you with surveys for quality assurance, product development and more.

We may collect this information to facilitate communications to you regarding products/services that may be of interest to you.

We may collect this information to provide a list to resorts, homeowner's associations ("HOAs"), and third party partners related to your transactions, election activities, ownership and more.

We may collect this information to verify your identity such as when you request access to your Personal Information or apply for financing.

We may collect this information such as government id related information in order to process your financing application or provide information to a travel provider such as an airline pertaining to your reservation.

We may collect this information to provide a list of your emergency contacts.

We may collect this information to meet a legal requirement such as recording a title or similar functions.

We may collect your signature on documents like contracts, financing terms, waivers, etc.

Personal Information Category

Customer Records: Paper and electronic records containing Personal Information, such as name, signature, physical characteristics or description, address, telephone number, education, current employment, employment history, social security number, passport number, driver’s license or state identification number, insurance policy number, bank account number, credit or debit card number or any other financial or payment information, medical information or health insurance information. Some information in this category may overlap with other categories.

Purposes of Collection

We may collect this information to set up ownership, membership, online and other accounts you request.

We may collect this information to process and/or administer your financing applications and financing, your contracts, your reservations, your loyalty and/or rewards accounts, and more.

We may collect this information to determine your eligibility for certain products or services.

We may collect this information to process payments and purchases of any of our products or services.

We may collect this information to verify your identity such as when you request access to your Personal Information or apply for financing.

We may collect this information if you engage in certain physical, sports or similar activities at our resorts and other properties.

We may collect this information to detect and prevent fraud.

We may collect this information to comply with applicable laws and to meet other legal obligations.

 

Personal Information Category

Commercial Information: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Purposes of Collection

We may collect this information to process and/or administer your financing applications and financing, your contracts, your reservations, your loyalty and/or rewards accounts, and more.

We may collect this information to personalize your services/products, provide helpful suggestions, respond to your commercial inquiries, and facilitate communications to you of products/services and related features that may be of interest to you.

We may collect this information to create efficiencies in managing reservations and recurring commercial interactions with you or otherwise managing our ongoing business relationship.

We may collect this information to maintain a record of your consuming history preferences and tendencies to better serve you, to personalize an experience for you, and to meet other needs of offering, providing and maintaining an ongoing service relationship with you.

We may collect your survey answers about events, products/services and more for quality assurance, product improvement, and to facilitate marketing that may be of interest to you.

 

Personal Information Category

Protected Classifications: characteristics of protected classifications under California or federal law such as race, color, sex, age, religion, national origin, disability, citizenship status, and genetic information.

Purposes of Collection

We may collect this information where needed for a legal or financial document such as when we collect your marital status for a financing application.

We may collect this information where needed for a reservation, such as where we may need your gender to report to the airlines. We may also collect this information like gender to address you with the proper salutation.

We may collect this information to provide you with the proper accommodations or assistance such as when you notify us of health related accommodations you require related to a reservation.

We may collect additional information in this category as appropriate.

 

Personal Information Category

Biometric Information: physiological, biological or behavioral characteristics that can be used alone or in combination with each other to establish individual identity, including fingerprint, faceprint, hand, palm, and voice recordings, and health or exercise data that contain identifying information.

Purposes of Collection

We may collect biometric information in order for you to access portions of a resort or property or to assist in a law enforcement investigation.

 

Personal Information Category

Internet Activity: Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a resident's interaction with an internet website, application, or advertisement, as well as physical and network access logs and other network activity information related to your use of any company device, network or other information resource.

Purposes of Collection

We may collect this information to improve our website functionality, improve transaction throughput, and personalize your experience. We may collect this information to determine what interests you to facilitate targeted communications of products and services to you. We may collect this information to judge the effectiveness of any online marketing campaigns.

 

Personal Information Category

Geolocation Data: General or precise geographic location information about a particular individual or device.

Purposes of Collection

We may collect your postal address and/or the location associated with your device to create demographic analysis of visits to our site, prevent fraud and promote interest in our products to better market to and understand our customers.

Your location may be used to send you messages or notifications depending on your jurisdiction and settings.

We may collect this information because of differences in jurisdictional laws to be sure we are compliant in our presentation of content.

 

Personal Information Category

Audio/Visual Data: audio, electronic, visual, thermal, olfactory, or similar information such as, CCTV images and photographs, and audio recordings (e.g., recorded meetings).

Purposes of Collection

We may collect this information for quality assurance of product/service presentations or communications, when you pose for videos/photos or provide audio recordings at our resorts or to us in any manner in order to improve our products and services, when you participate in activities or excursions or attend other events as part of service delivery.

We may collect this information in public areas of our facilities and online to provide safe and secure facilities and to ensure quality assurance.

 

Personal Information Category

Employment History: professional or employment-related information.

Purposes of Collection

We may collect details of your employment history such as job title and length of time at your employment to process a financing application. We may collect employment history as part of a larger analysis of you and what products/services would be well suited for you. We may collect details of your employment history as part of your credentials if you run for an elected position within the HOA of your vacation ownership property.

 

Personal Information Category

Education Information: information about education history or background that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).

Purposes of Collection

For example, we may collect this information in order to process financing, in order to match your potential interest and likelihood of purchasing certain products/services, and as part of any office election you may run for as a candidate related to an HOA.

 

Personal Information Category

Profiles and Inferences: inferences drawn from any of the information identified above to create a profile about a resident reflecting the resident's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Purposes of Collection

For example, we may infer what products or services may interest you, your predicted attachment to your purchased products, your likelihood of purchasing other products, your likelihood of exacting contract and financing terms, and more. We may collect demographic information about you, such as your age, income, etc.

 

OTHER PURPOSES FOR COLLECTING AND USING YOUR PERSONAL INFORMATION: Generally, we may use all of the above categories of Personal Information for the following purposes where applicable:

    • Security and Monitoring. In order to monitor and secure our resources, network, premises and assets, including:
      • Monitoring for preventing, investigating, and responding to security and privacy incidents
      • Providing and managing access to physical and technical access controls
      • Monitoring activities, access and use to ensure the security and functioning of our systems and assets
      • Securing our offices, premises and physical assets, including through the use of electronic access systems and video monitoring
    • Auditing, reporting corporate governance, and internal operations. We process Personal Information for the purposes of performing audits of our business operations, performing security reviews, ensuring we are meeting legal obligations, managing your business record, and other auditing functions.
    • M&A and Other Business Transactions. For purposes of planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions.
    • Defending and Protecting Rights. In order to protect and defend our rights and interests and those of third parties, including to manage and respond to employee and other legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.
    • Compliance with Applicable Legal Obligations. Relating to compliance with applicable legal obligations (such responding to subpoenas and court orders) as well as assessments, reviews and reporting relating to such legal obligations.
  1. WHERE DO WE GET YOUR PERSONAL INFORMATION: We may collect all of the Personal Information categories above primarily from you such as when you fill out a form, contact us, submit documents to us, use our Websites or Mobile Apps, apply for financing, and interact with us in other ways. We may collect it from within the Panorama Group of Companies, T + L Affiliates, third party partners or data management companies. We may collect it from social media accounts such as when you connect to our Websites through such an account. We may collect it from travel agents who provide it to us on your behalf or other persons who provide your information.
  2. TO WHOM DO WE DISCLOSE YOUR PERSONAL INFORMATION?: We disclose Personal Information to T + L Affiliates, any entity within the Panorama Group of Companies, vendors and service providers, legal and regulatory agencies under certain circumstances, third party product and service providers, third party partners, and others under certain circumstances. Please see the “When We Disclose Your Information” section for more.
  3. SELLING YOUR PERSONAL INFORMATION: Based on the CCPA's broad definition of "sale," certain data collection on our sites and applications by third parties for purposes of internet-based advertising and social media tools, as well as some other activities involving the disclosure of personal information to another business or a third party, may be a "sale" under the CCPA even if we do not share your information for money. Under some circumstances as described below, we may "sell" or license your Personal Information under this broad definition.
  4. Partners: We may sell your Personal Information to sweepstakes, contest, promotion partners or other third parties so that they can market to you. This will only occur if you agree to participate in such a promotion and will be subject to your marketing preferences.
  5. T + L Affiliates and Entities within the Panorama Group of Companies: We may sell your Personal Information to T + L Affiliates or entities within the Panorama Group of Companies so that they can market to you their products and services provided that such sharing is subject to your marketing preferences.
    • Internet-Based Advertising/Social Media Tools: To the extent certain information collection on our sites and through third-party applications is considered a "sale" under the CCPA, you may either opt-out through the "Do Not Sell My Information" link or as provided in the section "Other information we collect about you" in our general Privacy Notice.
    • Opt-Out: You have the right to opt-out of having your Personal Information sold. Please see the section of this Privacy Notice: "California Rights". Once we share your Personal Information with another business or a third party for such purposes, the information shared becomes subject to such other business or third party's privacy practices.
  6. California Rights: If you are a California resident, you have certain rights with respect to your Personal Information as set forth below:
    • Right to Know: You have a right to know what Personal Information Categories we have collected, used, disclosed or sold about you in the previous 12 months and the purposes of such actions. You have a right to know the sources of collection of such information and to whom we have disclosed it to for business purposes or a sale. You also have a right to receive a list of the Personal Information we have collected about you in the last 12 months from the date of your request. You may request any or all of this information up to two times in a 12-month period. You may exercise this right by filling out and submitting a Privacy Rights Request Form where one is available (See ‘California Privacy Rights Request Form Link' below) or by contacting us using one of the methods listed in the “How Can You Contact Us?” section of this Privacy Notice.
    • Right to Delete: You have a right to instruct us to delete certain Personal Information we hold about you. We will assess your request and determine, under the CCPA, what Personal Information we are required to delete. If we retain any Personal Information, we will notify you of what we have retained and why. For information we delete, we will notify you of the method of deletion. You may exercise this right by filling out and submitting a Privacy Rights Request Form where one is available (See ‘California Privacy Rights Request Form Link' below) or by contacting us using one of the methods listed in the “How Can You Contact Us?” section of this Privacy Notice.
    • Right to Opt-Out of Sale of Your Personal Information: You have the right to instruct Us not to sell your Personal Information. You may exercise this right by filling out and submitting this Opt-Out Request Form (link here) or by contacting Us using one of the methods listed in the “How Can You Contact Us?” section of this Privacy Notice.
    • Nondiscrimination: You shall not incur or be subject to any price or quality of service difference from us for exercising any of your rights under the CCPA. If you feel you have been treated unfairly for exercising any of your rights under the CCPA, please contact us immediately using one of the methods listed in the “How Can You Contact Us?” section of this Privacy Notice.
    • Verification: We will require certain information from you to verify your identity as the requestor. Generally, we will ask you information that we have already collected about you to provide this verification. For instance, if you submit a “Right to Know” request, we may ask your name, address, email address, account number if applicable, and phone number. We reserve the right to ask additional questions and/or to contact you directly if in our discretion we determine we need additional verification.
    • Agents: You may have an agent exercise your rights on your behalf. If an agent provides a Power of Attorney in compliance with California Probate Code Sections 4000-4464, we will process such request. If however, your agent does not provide such Power of Attorney, we will need you to provide written permission to us of the agent's right to exercise your rights in this section on your behalf. Please include your full name, the address and email associated with your account with us, your member number if applicable, the agent's full name and address, and the agent's email. Please send this permission to privacy@rci.com. Furthermore, in addition to your written permission, we may contact you and/or your agent for further verification of your request.
    • California Privacy Rights Request Form Link:

Access/Delete Form

 

How Can You Contact Us?

If after reviewing this Privacy Notice, you have any questions, complaints or privacy concerns, or would like to make any requests in relation to your Personal Information, or obtain further information on safeguards used for international transfers, please send an email to our Privacy Group at compliance@endlessholidays.co.za or send a letter to (please indicate the entity within the Panorama Group of Companies or brand you typically do business with):

 

Endless Holidays

The Core

Corner Kikuyu & Leeuwkop Roads

Sunninghill, South Africa, 2157

If you have a complaint or concern about how we Process your Personal Information, we will work to address such concern(s). You may also direct your complaint/concern to the applicable data protection authority.

 

PAIA Manual

Registration Number of Company: 2005/009353/07

 

VACATION RENTALS INTERNATIONAL (PROPRIETARY) LTD

(Operating as Endless Holidays)

 

PAIA MANUAL

Registration Number of Company: 2005/009353/07

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended)   

DATE OF COMPILATION: 01/10/2021

DATE OF REVISION: 28/12/2021

1.  LIST OF ACRONYMS AND ABBREVIATIONS

 “CEO” Chief Executive Officer

“DIO” Deputy Information Officer;

“IO“                Information Officer;

“Minister” Minister of Justice and Correctional Services;

“PAIA” Promotion of Access to Information Act No. 2 of 2000(as Amended;

“POPIA” Protection of Personal Information Act No.4 of 2013;

“Regulator” Information Regulator; and

“Republic” Republic of South Africa

2. PURPOSE OF PAIA MANUAL

This PAIA Manual is useful for the public to-

  •  check the categories of records held by a body which are available without a person having to submit a formal PAIA request;
  • have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject;
  • know the description of the records of the body which are available in accordance with any other legislation;
  • access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;
  • know the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it;
  • know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;
  • know the description of the categories of data subjects and of the information or categories of information relating thereto;
  • know the recipients or categories of recipients to whom the personal information may be supplied;
  • know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and
  • know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF ENDLESS HOLIDAYS

  • Chief Information Officer

Name:

Mrs Alyson Benjamin

Tel:

0861 438 246

Email:

compliance@endlessholidays.co.za

  • Deputy Information Officer

Name:

Mrs Leanne Bruwer

Tel:

0861 438 246

Email:

compliance@endlessholidays.co.za

 

Name:

Ms Sonnika Otto

Tel:

0861 438 246

Email:

compliance@endlessholidays.co.za

  • Access to information general contacts

Email:

compliance@endlessholidays.co.za

  • National or Head Office

Postal Address:

P.O. Box 783940 Sandton, 2146

Physical Address:

Endless Holidays, The Core, Corner Leeuwkop & Kikuyu Roads, Sunninghill, 2157, Johannesburg

Telephone:

0861 438 246

Email:

compliance@endlessholidays.co.za

Website:

endlessholidays.co.za

 

4. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE

  • The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.
  • The Guide is available in each of the official languages and in braille.
  • The aforesaid Guide contains the description of-
    • the objects of PAIA and POPIA;
    • the postal and street address, phone and fax number and, if available, electronic mail address of-
      • the Information Officer of every public body, and
      • every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA[1] and section 56 of POPIA[2];
    • the manner and form of a request for-
      • access to a record of a public body contemplated in section 11[3]; and
      • access to a record of a private body contemplated in section 50[4];
    • the assistance available from the IO of a public body in terms of PAIA and POPIA;
    • the assistance available from the Regulator in terms of PAIA and POPIA;
    • all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging-
      • an internal appeal;
      • a complaint to the Regulator; and
      • an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;
    • the provisions of sections 14[5] and 51[6] requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;
    • the provisions of sections 15[7] and 52[8] providing for the voluntary disclosure of categories of records by a public body and private body, respectively;
    • the notices issued in terms of sections 22[9] and 54[10] regarding fees to be paid in relation to requests for access; and
    • the regulations made in terms of section 92[11].
  • Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.
  • The Guide can also be obtained-
  • A copy of the Guide is also available in English, for public inspection during normal office hours at our office. When a copy in another official language is made available by the South African Human Rights Commission, we will also provide a non-English copy.

 

5. CATEGORIES OF RECORDS OF ENDLESS HOLIDAYS WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

This section of the PAIA Manual sets out the categories and descriptions of records held by Endless Holidays. Some of these records are not automatically available without a request in terms of PAIA. The inclusion of any category of records should not be taken to mean that records falling within that category will be made available under PAIA. In particular, certain grounds of refusal as set out in PAIA may be applicable to a request for such records.

Category of records

Type of records

Available on website

Availability may be requested

Public Affairs

Public Product Information

Public Corporate Records 

Media Releases

x

 

Finance

Financial records

Annual reports

Strategic Plans

Budgets

 

x

Information Technology

Contracts

Policies and Procedures

Insurance Records

License Records

Project Records

Reports

Product Development Records

 

x

Business Development  

Contracts

 

x

Marketing

Customer Database

Marketing Strategies

Sales records

Customer referrals

Policies and Procedures

Marketing Records

Reports

 

x

Marketing

Public product information

x

 

6. DESCRIPTION OF THE RECORDS OF ENDLESS HOLIDAYS WHICH ARE AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION

Pension Funds Act, Nr. 24 of 1956

Income Tax Act, Nr. 58 of 1962 (Section 75)

Companies Act, Nr. 61 of 1973

Copyright Act, Nr. 98 of 1978

Value Added Tax Act, Nr. 89 of 1991 (Section 65)

Occupational Health and Safety Act, Nr. 85 of 1993

Compensation for Occupational Injuries and Diseases Act, Nr. 130 of 1993 (Section 97)

Labour Relations Act, Nr. 66 of 1995

Basic Conditions of Employment Act, Nr. 75 of 1997 (Section 31)

Employment Equity Act, Nr. 55 of 1998 (Section 26)

Skills Development Act, Nr. 97 of 1998

Medical Schemes Act, Nr. 131 of 1998

Skills Development Levies Act, Nr. 9 of 1999

Unemployment Insurance Act, Nr. 63 of 2001

 

7. DESCRIPTION OF THE SUBJECTS ON WHICH THE BODY HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT BY ENDLESS HOLIDAYS 

 

Record Category

Business Development

Contracts

Finance

Annual Reports, Budgets, Financial Records, Strategic Plans

Information Technology

Contracts, Insurance Records, Licences, Policies and Procedures, Product Development,  Projects, Reports

Marketing

Campaign planner, Customer Database, Customer Referrals, Marketing Strategies, Public Product Information, Reports

 

8. PROCESSING OF PERSONAL INFORMATION 

Purpose of Processing Personal Information

  • We may process personal information in connection with any of the following:
  • Our business transactions with you, including, but not limited to:
    • Entering into or performing a contract with you.
    • Responding to your inquiries and fulfilling your requests.
    • Sending administrative information to you, for example, information regarding the services or an event you are attending.
    • Completing and fulfilling any purchases or requests for services.
  • For our legitimate business interests, including, but not limited to:
    • Personalizing your experience on the services by presenting products and offers tailored to you.
    • Allowing you to participate in sweepstakes, contests, and similar promotions, and administering such activities (each of which may have additional rules and could contain additional information about how we Process your Personal Information).
    • Facilitating social sharing functionalities of your social media account(s).
    • Carrying out data analysis, audits, fraud monitoring and prevention, internal quality assurance, developing new products, enhancing, improving or modifying our services, identifying usage trends, auditing use and functionality of our services, helping enforce compliance with our Terms of Use (found on our website), helping protect our services, determining the effectiveness of our promotional campaigns and operating and expanding our business activities.
    • Subject to your marketing preferences (which may include consent to marketing under applicable law), to send you newsletters or marketing communications we believe may interest you, for our own products and services, and on behalf of our related companies or selected third parties in accordance with applicable law.
  • Description of the categories of Data Subjects and of the information or categories of information relating thereto  

Data Subject

Personal Information that is processed

Affiliate (Club and Resort)

Address

Company Registration Numbers

Name

VAT Registration Numbers

Service Provider / Supplier

Address

Bank Details

Company registration numbers

Email Address

Name

VAT registration numbers

 

Customer

Booking info

Identity number

Email Address

Name

Telephone Number

  

  • The recipients or categories of recipients to whom the personal information may be supplied 

Category of Personal Information

Recipients whom the Personal Information may be supplied to

Booking Information

Affiliates\Clubs

Payment Details

Bank or such other financial institution we work with

Redemption Reports

Partner and Service Provider

 

  • Planned transborder flows of personal information

International Transfers: We are an international company and we may, subject to applicable law, transfer your information, to our related companies or selected third parties outside the country where you are located and where information protection standards may differ (e.g., your information may be stored on servers located in other jurisdictions such as the United States of America and the United Kingdom) and your information will be transferred to your holiday destinations to facilitate your booking). We will utilize appropriate safeguards governing the transfer and usage of your Personal Information.

  • General description of Information Security Measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information

We implement various security safeguards, such as (a) encryption on certain personal information, (b) firewalls, (c) intrusion detection system on our network, (d) antivirus software, and (e) vulnerability scans. We also make use of segregation of duties so that personnel only accesses certain areas of information required for their work.

 

 9. AVAILABILITY OF THE MANUAL

  • A copy of the Manual is available-
    • on endlessholidays.co.za, if any;
    • head office of Endless Holidays for public inspection during normal business hours;
    • to any person upon request and upon the payment of a reasonable prescribed fee; and
    • to the Information Regulator upon request.
  • A fee for a copy of the Manual, as contemplated in annexure B of the Regulations, shall be payable per each A4-size photocopy made.

 

 10. UPDATING OF THE MANUAL

 The head of Endless Holidays will on a regular basis update this manual.

 

Issued by

Alyson Benjamin

Director, Endless Holidays

 

[1] Section 17(1) of PAIA- For the purposes of PAIA, each public body must, subject to legislation governing the employment of personnel of the public body concerned, designate such number of persons as deputy information officers as are necessary to render the public body as accessible as reasonably possible for requesters of its records.

 

[2] Section 56(a) of POPIA- Each public and private body must make provision, in the manner prescribed in section 17 of the Promotion of Access to Information Act, with the necessary changes, for the designation of such a number of persons, if any, as deputy information officers as is necessary to perform the duties and responsibilities as set out in section 55(1) of POPIA.

 

[3] Section 11(1) of PAIA- A requester must be given access to a record of a public body if that requester complies with all the procedural requirements in PAIA relating to a request for access to that record; and access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.

 

[4] Section 50(1) of PAIA- A requester must be given access to any record of a private body if-

  1. that record is required for the exercise or protection of any rights;
  2. that person complies with the procedural requirements in PAIA relating to a request for access to that record; and
  3. access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.

[5] Section 14(1) of PAIA- The information officer of a public body must, in at least three official languages, make available a manual containing information listed in paragraph 4 above.

 

[6] Section 51(1) of PAIA- The head of a private body must make available a manual containing the description of the information listed in paragraph 4 above.

 

[7] Section 15(1) of PAIA- The information officer of a public body, must make available in the prescribed manner a description of the categories of records of the public body that are automatically available without a person having to request access

 

[8] Section 52(1) of PAIA- The head of a private body may, on a voluntary basis, make available in the prescribed manner a description of the categories of records of the private body that are automatically available without a person having to request access

 

[9] Section 22(1) of PAIA- The information officer of a public body to whom a request for access is made, must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.

 

[10] Section 54(1) of PAIA- The head of a private body to whom a request for access is made must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.

 

[11] Section 92(1) of PAIA provides that –“The Minister may, by notice in the Gazette, make regulations regarding-

(a) any matter which is required or permitted by this Act to be prescribed;

(b) any matter relating to the fees contemplated in sections 22 and 54;

(c) any notice required by this Act;

(d) uniform criteria to be applied by the information officer of a public body when deciding which categories of records are to be made available in terms of section 15; and

(e) any administrative or procedural matter necessary to give effect to the provisions of this Act.”