Prana Lodge (Pty) Ltd ("Prana", "we", "us") respects your privacy and is committed to protecting your personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, how we use and protect it, and your rights.

Who is responsible for your information

The responsible party is Prana Lodge (Pty) Ltd, Chintsa Drive, Chintsa East, Chintsa, 5275, South Africa. For any privacy question or request, contact our Information Officer at privacy@authenticretreats.com.

Information we collect

• Information you give us: your name, contact details (email, phone, postal address), booking dates and details, the number and names of guests, dietary needs and special requests, and anything else you choose to share when you enquire, book, visit or stay with us.
• Payment information: when you pay online, your card details are entered directly with our payment provider. We do not see or store your full card number.
• Information collected automatically: when you use our website we may collect your IP address, approximate location, device and browser type, and the pages you view, through cookies and similar technologies (see "Cookies" below).

Why we use your information

• To process and manage your booking and provide the accommodation, treatments and services you have requested;
• To communicate with you about your reservation, treatment or visit;
• To take payment and help prevent fraud;
• To meet our legal obligations (for example, guest records and tax records);
• With your consent, to send you news, offers and marketing — you can withdraw consent at any time using the unsubscribe link in our emails.

Who we share it with

We share your information only as needed to run our business, with:

• our booking and channel-management systems;
• our payment provider, to process payment;
• our guest-communication and enquiry system (Verandah);
• analytics and advertising providers (such as Google and Meta) that help us understand and improve our website and reach new guests;
• service providers and authorities where we are required to by law.

We do not sell your personal information.

Cross-border transfers

Some of these providers may process information outside South Africa. Where that happens, we take reasonable steps to ensure your information is protected to a standard comparable with POPIA.

How we protect it

We use appropriate technical and organisational measures to keep your information secure. Card payments are handled by a PCI-DSS-compliant payment provider.

How long we keep it

We keep your personal information only as long as necessary for the purposes above and to meet legal and accounting requirements, after which it is securely deleted or anonymised.

Your rights under POPIA

You have the right to ask what information we hold about you, to ask us to correct or delete it, to object to its processing, and to withdraw consent to marketing. To exercise any of these, contact our Information Officer at the address above. You also have the right to complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za.

Cookies

Our website uses cookies to make the site work, remember your preferences, measure traffic, and support our advertising. You can control cookies through your browser settings; blocking some cookies may affect how the site works.

Changes to this policy

We may update this policy from time to time. The latest version will always appear on this page.

Last updated: June 2026.