What we hold, and why

Bayete Estate and Spa is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act.

Where your information came from

If you have stayed with us, booked a treatment, or signed up on our previous website, your contact details were already on file. When we moved off that website we brought the contact list with us. We did not buy it, and we did not add anyone who had not already given us their details.

What is actually stored

For a member account, the record holds:

• your email address, which is also how you sign in
• your first and last name, where we have them
• whether you have agreed to marketing email, and when that last changed
• the date the original record was created, and the date it moved across

That is the whole record. You can download it at any time from your account page and see exactly what is there.

Signing in

There is no password. You give us your email address and we send a six digit code. A few things about that are worth saying plainly:

• The code itself is never stored. We keep a one-way hash of it, which cannot be turned back into the code.
• It stops working after ten minutes, or as soon as it has been used once.
• Staying signed in uses a random token in a cookie. It expires after thirty days, and signing out destroys it on our side, not just in your browser.
• Asking for a code tells you nothing about whether an address is on our list. The answer is identical either way, so the form cannot be used to find out who our guests are.

Marketing

We only send marketing email to people who agreed to it. That agreement came across from the old site exactly as it stood, rather than being assumed. If it was not a clear yes, it was imported as a no.

You can turn it on or off yourself on your account page and it takes effect immediately. It has nothing to do with signing in, and we will still email you about a booking you have actually made.

Who else can see it

• Brevo sends the sign-in codes and any marketing email, so they process your email address and name.
• Netlify hosts this site and stores the member records.

We do not sell your information, and we do not share it for advertising.

Your rights

Under POPIA you can ask us to show you what we hold, correct it, or delete it. You do not need to ask:

• See it — download the full record from your account page.
• Correct it — edit your name there and save.
• Delete it — there is a delete button on the same page. It removes the record and every active session. It cannot be undone, and you will not be able to sign in again afterwards.

If you would rather we did it, or you want your email address changed, write to dayspa@bayeteestate.com.

How long we keep it

Member records are kept until you delete them or ask us to. Sign-in codes are deleted once used or expired, and old sessions and codes are cleared out automatically every hour.

Complaints

If you are unhappy with how we have handled your information, tell us first at dayspa@bayeteestate.com. You also have the right to complain to the Information Regulator of South Africa.