Privacy Notice
Issued in terms of section 18 of the Protection of Personal Information Act 4 of 2013. Last reviewed August 2026. It is read together with the group's PAIA and POPIA Manual, which describes the group's processing operations in full.
1. Who is responsible for your information
The responsible party is The Dream Merchant Group (Pty) Ltd, registration number 2014/140602/07, registered in Pretoria, South Africa. The Information Officer is Cybil Rockefeller Naidoo, the head of the private body, reachable at hello@dreammerchants.co.za or +27 12 942 1000. Further particulars are set out in paragraph 12 of the manual.
2. What this website collects
This is a brochure website. It has no enquiry form, no newsletter sign-up, no account creation and no payment function. It does not ask you for your name, your contact details or any other personal information, and it has no field in which you could supply them.
What is collected is limited to what any web server records in order to serve a page and stay secure:
- Server logs. Your IP address, the date and time of the request, the page requested, the response code, your browser type and version, and the page that referred you. These are technical records, generated automatically by the server rather than collected from you.
- Basic aggregate statistics. Where visit statistics are collected, they are counts of page views and general geographic region, used to understand which pages are read. They are reported in aggregate and are never used to build a profile of an individual. This site runs no analytics script of its own.
Where an IP address can identify a person, it is treated as personal information and handled accordingly.
3. Whether supplying it is voluntary, and what happens if you do not
You supply nothing to this website, so nothing here is mandatory. Server logs are generated by the act of requesting a page and cannot be separated from it; the only way not to generate one is not to visit the site.
If you contact the group directly by telephone or email, giving us your details is voluntary. The consequence of withholding them is practical rather than legal: without a name and a return address we may not be able to answer you, verify who you are, or direct your enquiry to the right entity.
4. Whether any law requires the collection
No law requires the collection of the information described in paragraph 2. It is processed for the legitimate interests of operating the site, diagnosing faults, protecting against attack and abuse, and understanding at a general level how the site is used. That processing is permitted by section 11(1)(f) of POPIA.
Where the group holds personal information in its other capacities, as a taxpayer and a registered company, various statutes do require the collection and retention of specific records. Those statutes are listed in paragraph 4 of the manual.
5. What we do not do
We do not capture enquiries through this website. We do not sell, rent or trade personal information to anyone, in any circumstances. We do not build advertising profiles from visits to this site, we run no advertising or tracking pixels on it, and we do not enrich or append data about visitors from third-party sources.
If you contact the group directly, we process what you have chosen to send us for the purpose of answering you, and for no other purpose. If your enquiry is commercial we will normally refer you to Holiday Brokers, and we will tell you that we are doing so. Holiday Brokers is a separate entity with its own privacy notice, and once you deal with it directly, that notice governs.
6. Who else sees it
Personal information arising from this website may be handled by our website hosting and infrastructure providers, acting as operators and only to the extent needed to run the site. The group's standard is that an operator is engaged under a written contract meeting section 21 of POPIA. It may also be disclosed where we are required to do so by law, by a court order, or by a regulator acting within its powers. Otherwise it is not shared. The full list of recipients across all the group's processing is at paragraph 6.3 of the manual.
7. Information sent outside South Africa
This website is hosted in South Africa. Certain business systems, in particular email, productivity, backup and cloud infrastructure services, are provided by international providers and may process personal information on servers outside the Republic, including in the European Union and the United States.
The group's standard is that no such transfer is made unless section 72 of POPIA is satisfied, which ordinarily means the recipient is bound by a law, binding corporate rules or a written agreement that upholds principles for reasonable processing substantially similar to those in POPIA, including on onward transfer. No transfer is made for the purpose of marketing, profiling or sale.
8. How long we keep it
Server logs are retained for a limited operational period, ordinarily not longer than twelve months, and are then deleted or aggregated so that individuals can no longer be identified. Correspondence you send us is kept for as long as needed to deal with the matter, and thereafter for any period required by law.
9. How it is protected
The site is served over an encrypted connection. Access to server logs and to email accounts is restricted to those who need it and is protected by authentication controls including multi-factor authentication. The site and its infrastructure are kept updated. A fuller description is at paragraph 6.5 of the manual.
No system is perfectly secure and we do not claim otherwise. Where a compromise affecting personal information occurs we notify the Information Regulator and the affected data subjects as soon as reasonably possible, as section 22 of POPIA requires.
10. Direct marketing
The group does not send marketing communications from this website and collects no address from it that would allow it to.
Each trading entity within the group is a separate responsible party and its own privacy notice governs its marketing. This notice cannot speak for them. Where such an entity markets electronically it is required to do so on an opt-in basis under section 69 of POPIA: consent may be asked for once and only once, an opt-out does not amount to consent, and every marketing message must identify its sender and carry a working route to ask it to stop, as section 69(4) requires. Where a person is already a customer, marketing is confined to that entity's own similar products, with a free route to object in every message.
You may refuse, stop or pre-emptively block direct marketing under section 11 of the Consumer Protection Act 68 of 2008, at no cost, and any approach from a group entity must respect it. The prescribed contact hours are weekdays between 08h00 and 20h00 and Saturdays between 09h00 and 13h00, never on a Sunday or a public holiday, unless you have asked to be contacted outside those times.
11. Your rights
As a data subject you have the right to:
- Access. Ask whether we hold personal information about you and, if we do, ask for a record or description of it and for the identity of any third party that has had access to it. Section 23 of POPIA, exercised through PAIA.
- Correction and deletion. Ask us to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to delete or destroy information we are no longer authorised to retain. Section 24, which requires a response as soon as reasonably practicable. Use POPIA Form 2. We undertake to answer in writing within 30 days.
- Objection. Object, on reasonable grounds relating to your situation, to processing carried out on the legitimate interests basis. Section 11(3). Use POPIA Form 1, or simply write to us. We must then stop processing on that basis.
- Withdrawal of consent. Withdraw consent where processing rests on consent, without affecting processing already lawfully carried out.
- Complaint. Complain to the Information Regulator under section 74, and institute civil proceedings for damages under section 99, which do not require you to prove intent or negligence.
Exercising the right to object, correct or delete is free of charge and may be done by any reasonably accessible means, including email. You will not be charged for it and you do not have to use a form.
12. How to exercise those rights
Write to the Information Officer at hello@dreammerchants.co.za, or telephone +27 12 942 1000. Tell us which right you are exercising and give us enough detail to identify the information in question. We will ask you to verify your identity before we act, so that we do not disclose one person's information to another.
Requests for access to a record are dealt with under PAIA. The forms, the procedure, the statutory fees and the timelines are set out on our PAIA and POPIA page. A prescribed fee applies to a request for access to a record. Nothing else on this list costs anything.
13. The Information Regulator
You may complain directly to the supervisory authority. We would prefer you raised the matter with us first so that we have a chance to put it right, but that is your choice and not a precondition.
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone 010 023 5200 · Toll-free 0800 017 160
General enquiries enquiries@inforegulator.org.za
POPIA complaints POPIAComplaints@inforegulator.org.za
PAIA complaints PAIAComplaints@inforegulator.org.za
inforegulator.org.za
14. Changes to this notice
We will update this notice when the way the site operates changes, or when the law requires it. The review date at the top of this section shows when it was last considered.