Privacy Policy

1. Who is responsible for your information?

Twinpeaks Investment [CONFIRM: full registered legal form and company number] operates the SurePlace website and related services and is the intended data controller for personal information described in this policy. Registered address: [REPLACE: ADDRESS, ESWATINI]. Privacy requests: support@sureplace.twinpeaksinvestment.com. Confirm that this mailbox is active and monitored before publication.

No Data Protection Officer or separate privacy lead has been designated yet. Confirm with Eswatini counsel whether an appointment is required for the organisation and processing activities; if one is appointed, add their name and contact details here. This policy must be completed against SurePlace’s actual data flows, service providers and legal obligations before adoption.

• Eswatini Data Protection Act, 2022 (Government Gazette)

2. Information we collect

Depending on the features you use, we may process the following categories:

• Account and identity details such as name, email, telephone number, credentials and account status.
• Profile and listing details you provide, including descriptions, location, photographs, contact details, agency/team information and property or stay characteristics.
• Messages, enquiries, viewing requests and booking-request details, including guest contact information, dates, room selection, price calculations and request status.
• Verification material submitted for identity, agency, business or listing checks. This may contain identity documents or other sensitive personal information and is restricted to authorised review and operational purposes.
• Technical and usage information such as IP address, device/browser characteristics, access logs, security events, and information held in browser storage for authentication, preferences and service operation.
• Information received from other users or service providers when they interact with your listing, submit a report, deliver email or help us protect the Platform.

3. How and why we use information

We use information to provide the features you request, maintain accounts and listings, route enquiries and booking requests, process verification, send service notices, respond to support and safety reports, prevent fraud and misuse, secure and troubleshoot the Platform, meet legal obligations and establish or defend legal claims.

Before publication, SurePlace must document and confirm the applicable lawful basis for each purpose, including any separate condition required for sensitive personal information under applicable law. Do not rely on consent where another lawful basis is required or more appropriate.

4. When information is shared

We share information only as needed for the purposes above and subject to appropriate safeguards. Depending on your use, recipients include:

• Other users: listing contact details are displayed with listings; messages and booking-request details are shared with the relevant provider or guest so they can respond.
• OpenStreetMap Foundation: when a map is displayed, the browser loads map tiles from OpenStreetMap servers. As an independent service, it may receive technical request information such as your IP address, browser details and referring page. Its own privacy policy applies to its service.
• Cloudinary: used by the production backend to store public listing images, stay images, avatars and agency logos. It also stores identity and verification documents as authenticated private assets; these are not exposed as public URLs and are streamed only after the application authorizes access.
• Bird: used by the production backend to deliver transactional email. Recipient addresses and message content needed to deliver those emails are shared with Bird.
• Other hosting, database, backup, queue, security and support providers: [REPLACE: identify the actual vendors, purposes, processing locations, safeguards and privacy terms for the hosted deployment].
• Authorities, courts, professional advisers or a business successor where disclosure is necessary and permitted or required by applicable law.

• OpenStreetMap Foundation Privacy Policy

5. International processing

OpenStreetMap map tiles are served through a global cache network, and the location of the responding cache may vary. SurePlace also uses Bird for transactional emails and Cloudinary for media storage. Confirm their configured service regions and the hosting, database, backup and queue locations for the live environment; identify the relevant data categories and transfer safeguards; and publish the completed processor and location list here: [REPLACE: PROCESSOR LIST / PRIVACY CONTACT].

6. Retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including account operation, verification, dispute handling, safety, security, legal obligations and recordkeeping. Different categories may have different periods.

A formal retention schedule has not yet been set. Before publication, approve and insert periods for: [REPLACE: account and profile data]; [REPLACE: listings and uploaded media]; [REPLACE: messages, viewing requests and booking records]; [REPLACE: verification documents and decision records]; [REPLACE: security and audit logs]; and [REPLACE: backup deletion cycle]. Also define account closure, deletion/anonymisation and legal-hold exceptions.

7. Security and incidents

We use administrative, technical and organisational measures designed to protect information against unauthorised access, alteration, loss or disclosure. No online service can promise perfect security. Access to identity and verification documents should be limited to authorised personnel and protected according to their sensitivity.

If a personal information security compromise occurs, SurePlace will assess it, take steps to contain and remedy it, and provide notices to affected people and the competent authority as required by applicable law.

8. Your choices and rights

Depending on applicable law, you may have rights to be informed, request access to or correction of information, challenge processing, object or withdraw consent where consent is the basis, request deletion or restriction where available, and complain to the competent authority. Some rights are subject to legal exceptions and identity verification.

To make a request, contact support@sureplace.twinpeaksinvestment.com. We will respond within the applicable legal time. Confirm that this mailbox is active, monitored and routed to someone who can handle privacy requests. You may also contact the Eswatini Communications Commission / Eswatini Data Protection Authority through its current official channels.

• Eswatini Data Protection Act, 2022 (Government Gazette)

9. Children

The Platform is not designed for children to create accounts or submit listings. Do not knowingly provide a child’s personal information unless the feature requires it and all applicable legal requirements, including any required guardian involvement, have been met. If you believe a child’s information was submitted improperly, contact [REPLACE: PRIVACY EMAIL].

10. Cookies and browser storage

The Platform uses browser storage for essential operation. In this release, authentication tokens are stored in local or session storage depending on the “remember me” choice, and the cookie-preference choice is saved in local storage. Browser storage is not technically the same as a cookie, although this policy groups related technologies for clarity.

The preference interface includes optional functional, analytics and marketing categories; optional analytics and marketing tracking are not currently enabled by the application. See the Cookies Policy and use Cookie preferences in the footer to review or change your choice.

11. Changes and contact

We may update this policy to reflect changes in the Platform, our practices or legal requirements. We will update the “Last updated” date and provide additional notice for material changes where required.

Privacy questions and requests: support@sureplace.twinpeaksinvestment.com. Postal address: [REPLACE: REGISTERED ADDRESS]. No separate Data Protection Officer or privacy lead has been designated yet; confirm whether one must be appointed and provide those details if applicable.