Vacationist Pty Ltd (“Vacationist”) is committed to protecting the personal information of all its stakeholders, including guests, property owners, employees, and service providers, in compliance with the Protection of Personal Information Act, 2013 (“POPIA”). This manual outlines our approach to collecting, processing, storing, and securing personal information in line with legal and industry best practices.

The purpose of this manual is to:

• Ensure Vacationist compliance with POPIA.
• Provide clarity on how personal information is managed.
• Establish procedures for handling data access requests and complaints.
• Protect the rights of individuals regarding their personal information.

This manual applies to all personal information processed by Vacationist, including but not limited to:

• Guest booking details
• Property owner information
• Employee records
• Supplier and service provider data

Vacationist has appointed an Information Officer responsible for:

• Ensuring compliance with POPIA.
• Managing data access requests.
• Conducting regular privacy audits.
• Providing training and awareness on data protection.

Contact Details:
Name: Scott Rethman
Email: info@soughted.com
Phone: 087 094 3276

Vacationist collects the following types of personal information:

• Guests: Names, contact details, payment information, stay history.
• Property Owners: Names, contact details, banking details for payments.
• Employees: ID numbers, payroll details, emergency contacts.
• Suppliers: Business information, banking details for payments.

Personal information is collected and processed for the following reasons:

• Managing guest bookings and stays.
• Facilitating payments to property owners and suppliers.
• Employee payroll and HR administration.
• Legal compliance and security purposes.

Vacationist ensures that personal information is processed lawfully and with consent where required. Individuals are informed of their rights, including:

• The right to access their information.
• The right to request corrections or deletion.
• The right to object to processing.

To protect personal information, Vacationist implements the following security measures:

• Encryption of sensitive data.
• Access controls and restricted data access.
• Regular security audits and risk assessments.
• Secure cloud storage solutions.

Vacationist only shares personal information with third parties under the following conditions:

• When required for business operations (e.g., payment processors, booking platforms).
• When legally obligated to share data.
• With service providers under strict data protection agreements.

Personal information is retained only for as long as necessary to fulfill its intended purpose, after which it is securely deleted or anonymized.

• Guest and booking data: Retained for operational and reporting purposes.
• Employee records: Retained as per legal requirements.
• Financial records: Retained in compliance with tax and regulatory obligations.

Individuals may request access to their personal information by submitting a written request to the Information Officer. Complaints regarding data handling will be addressed promptly in accordance with POPIA guidelines.

In the event of a data breach, Vacationist will:

• Immediately assess and contain the breach.
• Notify affected individuals and relevant authorities where required.
• Implement corrective measures to prevent future breaches.

This manual will be reviewed regularly to ensure compliance with legal and operational changes. Any updates will be communicated to relevant stakeholders.

Approved by:
Vacationist Pty Ltd Management
Date:
10/09/2025