Privacy Policy

Who we are

Diamond Tours (Pty) Ltd (registration number 2026/805009/07), trading as Diamond Tours, is a South African company that designs private diamond experiences. In this policy, "we", "us" and "our" mean Diamond Tours (Pty) Ltd, and "you" means anyone whose personal information we process: visitors to diamondtours.co.za, people who enquire or travel with us, newsletter subscribers and our business contacts.

We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). Our Information Officer is our Founder, who you can reach using the details in section 15.

This policy applies to our website, to enquiries and bookings, and to email and other contact with us. It should be read with our Terms & Conditions.

The information we collect

When you enquire or build a journey

The enquiry form asks for your name and email address, and you may add your phone or WhatsApp number, country of residence, travel dates or month, number of guests and a message. Depending on the experience, we also ask about your hotel or pickup area, interests, dietary needs, mobility or access needs, and add-ons. On our couples' experiences we may ask about the occasion, your interest in a ring and a jewellery budget, and whether the journey is a surprise.

If you use Build Your Journey, we receive your answers (interests, time available, additions and travel style) with your enquiry. We also record the language and currency you were using and the price shown to you, so your quote matches what you saw.

When you book and travel

To confirm and deliver a booking we may also need the names of everyone travelling, pickup addresses, flight or arrival times, special requests, and records of quotes, invoices and payments. We do not store card numbers. If you pay by card, the card details go directly to the bank or payment provider that processes the payment.

Special personal information

Information about health, mobility or disability, and some dietary needs (for example halal or kosher meals), is special personal information under POPIA. We ask for it only to make your day safe and comfortable, we use it only for that purpose, and we share it only with the partners who need it. By giving it to us, you consent to that use. You can withdraw that consent at any time, although we may then be unable to make certain arrangements.

Information about other people

If you book for others, or ask us to contact someone to help plan a surprise, please make sure they are happy for you to share their details with us. When a journey is a surprise, we contact only the people you name, and we never share the plans with the person being surprised.

Children

Our website is not aimed at children, and we do not knowingly collect information from anyone under 18. When children travel with their family, we collect only the details a parent or guardian gives us to plan the day, such as names and ages, with that parent's or guardian's consent.

Newsletter

If you subscribe, we keep your email address, preferred language, where on the site you subscribed and when you confirmed. A subscription starts only after you click the link in our confirmation email.

Travel trade and business contacts

We work with travel agencies, concierge desks and other travel businesses. We collect business contact details (name, role, work email, work phone and the public web page they came from) from business websites and other public sources, or when someone gives them to us. Section 7 explains how we contact businesses and how to opt out.

When you visit our website

• Analytics. Google Analytics and Vercel Web Analytics tell us which pages are visited, roughly where visitors are (country and city), the device and browser used, and how people found us. Vercel Web Analytics does not use cookies.
• Form protection. When you send a form, we briefly record your IP address to stop automated spam. We delete these records after two days.
• Preferences. Your browser remembers your chosen language and currency (see section 6).
• Server logs. Our hosting providers keep standard technical logs, such as IP address, time and page requested, to run and secure the service.

How and why we use it

POPIA allows us to process personal information only for a lawful reason. We use yours to:

• Answer your enquiry and plan your journey: to take steps you ask for before a contract (POPIA section 11(1)(b)).
• Confirm, deliver and invoice your booking: to perform our contract with you (section 11(1)(b)).
• Keep accounting, tax and company records: to comply with the law (section 11(1)(c)).
• Arrange dietary, health and access needs: with your consent (sections 11(1)(a) and 27(1)(a)).
• Send our newsletter: with your consent (sections 11(1)(a) and 69).
• Introduce our experiences to travel businesses, understand how our website is used, improve our service, and protect our website and business from fraud and misuse: for our legitimate interests, balanced against your rights (section 11(1)(f)).
• Establish, exercise or defend legal claims: for our legitimate interests and to comply with the law.

We do not use your information for a new purpose that is unrelated to the one we collected it for unless the law allows it or you agree.

Who we share it with

We never sell or rent your personal information. We share it only as follows.

The partners who deliver your experience

A journey brings together independent partners: drivers and transport operators, diamond workshops and jewellers, wine estates and restaurants, attractions such as the cableway, Robben Island, nature reserves and boat operators, and, for some experiences, photographers and event suppliers. We give each partner only what it needs to look after you, such as names, party size, pickup point, timing and relevant dietary or access needs. Partners then handle that information as responsible parties in their own right, under their own privacy policies.

Jewellery budgets. We never share your jewellery budget or ring preferences with a jeweller without your permission. Any purchase you make is between you and the jeweller, who will collect the details it needs for that sale.

Service providers (operators)

These providers process personal information on our behalf, under contracts that require them to keep it secure and confidential:

Others

• Our professional advisers, such as accountants, auditors, lawyers and insurers, under a duty of confidentiality.
• Government, regulators, courts or law enforcement, where the law requires it or to protect someone's safety.
• A buyer or successor if our business, or part of it, is sold or restructured, on condition that it keeps to this policy.

Transfers outside South Africa

Some of our service providers store or process information outside South Africa, mainly in the European Union and the United States. Under section 72 of POPIA, we transfer personal information across borders only where the recipient is bound by law, binding corporate rules or a contract that gives protection substantially similar to POPIA, where you consent, or where the transfer is needed to perform our contract with you (for example, to send booking details to you while you are abroad).

Cookies and browser storage

Cookies and similar technologies are small files or entries stored by your browser. We use them sparingly:

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on. The website still works without them.

Marketing

Section 69 of POPIA sets strict rules for direct marketing by email and other electronic means, and we follow them.

• Newsletter. We send it only to people who sign up and confirm by email. Ticking the newsletter box on the enquiry form is optional and does not affect your enquiry.
• Guests. If you have travelled with us, we may tell you about similar experiences, and you can opt out every time we do.
• Travel businesses. We may send a business a short email introducing our experiences, addressed to its general address or to the person responsible for partnerships. Every such email tells you how to opt out, and if you do, we do not contact you again.

To stop any marketing, reply to the email with "unsubscribe" or "no thanks", or write to info@diamondtours.co.za. We act on your request promptly and keep your address on a do-not-contact list, so we do not contact you by mistake. Messages about a booking you have made are not marketing, and you will still receive them.

Some business emails contain a small image that tells us whether the email was opened, and which type of email program opened it. We use this only to avoid sending follow-ups that are not wanted. You can prevent it by turning off automatic image loading in your email program. Our newsletter and booking emails do not contain this image.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it for, or as long as the law requires:

• Enquiries that do not lead to a booking: up to two years after our last contact, so we can help if you return, then deleted or anonymised.
• Bookings, invoices and payments: for as long as tax and company law require, which is generally five to seven years after the end of the financial year concerned.
• Health, dietary and access information: deleted or anonymised once your journey and any follow-up are complete.
• Newsletter: until you unsubscribe. Sign-ups that are not confirmed are deleted after 30 days. After you unsubscribe, we keep only your email address on our do-not-contact list.
• Business contacts: while the relationship is relevant, and on our do-not-contact list if you opt out.
• Form protection records (IP addresses): two days.
• Analytics: according to the retention settings of Google Analytics and Vercel, after which they are deleted or aggregated.

We may keep information longer if we need it for a legal claim or complaint, or if you ask us to. We may keep anonymised information, which no longer identifies anyone, for statistics.

How we protect it

We take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing, as section 19 of POPIA requires. These include encrypted connections (HTTPS), access controls so that only team members who need information can see it, database rules that keep enquiry data out of public reach, protection against automated abuse of our forms, and contracts with our service providers.

No system is completely secure. If we have reason to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.

Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct information that is inaccurate, incomplete or out of date;
• ask us to delete or destroy information we are no longer allowed to keep;
• object to processing based on our legitimate interests;
• object to direct marketing at any time;
• withdraw your consent at any time, without affecting processing that took place before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects for you; and
• complain to the Information Regulator (section 15).

To make a request, email info@diamondtours.co.za with "Privacy request" in the subject line. We may ask you to confirm your identity before we act, and we respond within a reasonable time, normally within 30 days. Most requests are free. Requests for records under the Promotion of Access to Information Act 2 of 2000 ("PAIA") may carry the fees that PAIA prescribes, and we will tell you in advance. Our PAIA manual is available on request.

If we cannot meet a request, for example because the law requires us to keep a record, we will tell you why.

Visitors from outside South Africa

Many of our guests live abroad. If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation may also apply when we process your information. The reasons in section 3 are also our lawful bases under that law: contract, legal obligation, consent and legitimate interests. In addition to the rights above, you may ask us to restrict processing or to give you your information in a portable format, and you may complain to the data protection authority where you live.

Automated decisions and AI

We do not make decisions about guests by automated means alone. Our team uses AI tools to help research travel businesses from public sources and to draft emails to them. A member of our team reviews every result and every email before it is sent. We do not use guest enquiries or booking information to train AI models.

Other websites

Our website links to other sites, such as our partners' sites and image sources. We are not responsible for how they handle personal information, so please read their privacy policies.

Changes to this policy

We may update this policy when our services or the law change. We will post the new version here with a new "last updated" date and, if the changes are significant, we will tell guests and subscribers by email.

Contact us and complaints

For questions about this policy or your personal information, please contact our Information Officer:

Company

Diamond Tours (Pty) Ltd, registration number 2026/805009/07

Email

info@diamondtours.co.za

Address

47 Belgravia Road, Athlone, Cape Town, 7764, South Africa

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Regulator of South Africa:

Website

inforeg.org.za

Complaints

POPIAComplaints@inforeg.org.za

General enquiries

enquiries@inforeg.org.za

This policy is written in English. If we provide it in another language and there is a difference, the English version applies.