IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

WATERBERG BIG GAME HUNTING PTY LTD (hereinafter referred to as the “Company,” the “Controller,” or “Wabi”), with its registered office in NAMIBIA, Otjahewita, Waterberg, PO Box 973, tax code 00041443-01-5, in its capacity as Controller, manages the website *** and its connected subdomains (the “Website”), as well as its social media pages (hereinafter referred to as the “social media pages”).

This Privacy Notice (the “ Privacy Notice”) details how the Company collects and processes your personal data, as well as the rights you have as a data subject and how you can exercise them, in accordance with Regulation (EU) No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as national legislation (hereinafter referred to as the “GDPR”), and legislation concerning the protection of privacy in the electronic communications sector.

For any information or requests regarding the processing of personal data, or to exercise your rights as a Data Subject in relation to Wabi, please contact us at the following email address:  dataprotection@tiriacgroup.ro.

 

THIS PRIVACY NOTICE IS ADDRESSED TO

This Privacy Notice is addressed to visitors of the Website and Social media pages, as well as to individuals who contact us using other available means of communication, such as by phone or email.

 

SOURCE OF PERSONAL DATA

We collect your personal data when you interact with our Website and social media pages (for example, when you fill out a form available on our Websites /social media pages), or when you contact us by phone or email.

We may also collect personal data when you provide a review of your stay and/or our services in a public space (for example, on Tripadvisor.com, Booking.com).

In some circumstances, we may receive personal data about you from third-party sources, such as travel booking platforms (e.g., Booking) or travel agents.

We note that these third parties are independent controllers in relation to Wabi, and therefore any data processing carried out by them is done in accordance with their own policies, which you can access on their websites.

To ensure that the data collected is accurate and up to date, please notify us of any changes you are aware of regarding the personal information you have provided to us or that has been provided by third parties. We also recommend that you limit the data you submit strictly to what is necessary for the stated purposes.

 

PERSONAL DATA PROCESSED, THE PURPOSE AND THE LEGAL BASIS OF THE PROCESSING

We collect the personal data described below exclusively for the purposes and on the legal grounds specified in this Privacy Notice. If we intend to process this data for other purposes, we will inform you in advance accordingly and take all necessary actions to comply with the personal data protection regulations.

Personal data is processed as follows:

MANAGEMENT OF REQUESTS SUBMITTED BY YOU

When you choose to fill out a form available on our Website, through social media pages, or contact us by email or phone, we will process your identification data (first and last name), your contact details (email address, phone number), as well as details regarding your specific request. Additionally, if you decide to enjoy the facilities of WABI Luxury Game Reserve, we will process further data related to your bookings (e.g., booking number, stay dates, rate).

 

The aforementioned data will be processed for:

 

1. Carrying out the steps prior to concluding a contract, including providing additional information regarding the services we offer within WABI Luxury Game Reserve, and communicating our availability of accommodation/packages.

 

2. Managing contractual relationships, namely the booking, registration, and management of guest accommodation, as well as the provision of accommodation, restaurant, and event services.

 

For the purposes outlined set out in points 1) and 2), the legal basis for processing is:

• taking steps at your request to submit an offer/conclude and perform a contract, in accordance with Article 6(1)(b) of the GDPR or
• when you act as the legal representative or designated contact person of a legal entity, based on our legitimate interest to take steps to conclude a contract with that legal entity and to conclude and perform such contract, in accordance with Article 6(1)(f) of the GDPR.

 

3. Handling any other requests, you send us, such as transportation requests from the airport to the WABI Luxury Game Reserve location, or special services related to your stay.

The legal basis is our legitimate interest in responding to the request addressed to us, in accordance with article 6(1)(f) of the GDPR.

 

INTERACTIONS THROUGH SOCIAL MEDIA PAGES

In the context of using social media platforms, we process your data for the purposes described below.

1. When managing the Wabi pages created on these platforms, we process the interactions of individuals interested in our activities, products, and services (such as comments, likes, tags, reposts, etc.), as well as the identification data of followers (e.g., name, surname, username).
   The legal basis for this processing is our legitimate interest in using such pages to ensure our visibility and presence in the online environment, in accordance with Article 6(1)(f) of the GDPR.
2. In order to conduct analyses and statistics regarding general public opinion, we process the feedback expressed on these platforms or in other publicly available online environments by individuals interested in Webi’s services.

The legal basis for this processing is our legitimate interest in improving the experience of customers and potential customers, in order to better meet their needs, in accordance with Article 6(1)(f) of the GDPR.

The website contains links to our social media pages, such as Facebook, Instagram, Google Business, and LinkedIn. In this case, Facebook and/or Instagram and/or Google Business and/or LinkedIn may process your personal data as independent data controllers, in accordance with their own privacy policies, which you can access on their respective pages.

 

STATISTICAL ANALYSES AND IMPROVEMENT OF THE WEBSITE NAVIGATION EXPERIENCE”

When you visit our website, we will process personal data through cookies and other similar technologies. For more details, please refer to the Cookie Policy available on the website.

 

OTHER PURPOSES

In addition, we will process your personal data for the purpose of satisfying our legitimate interests, namely

1. The preparation of statistics and aggregated reports aimed at developing and improving our activities and services, increasing the efficiency of how activities are managed, optimizing processes, centralizing operations, and maintaining an internal database, as well as analyzing and minimizing financial and reputational risks to which we are exposed in connection with our operations.

The legal basis is the legitimate interest of ensuring proper business management, in accordance with Article 6(1)(f) of the GDPR.

In this case, the data is processed in anonymized form, and only exceptionally and when necessary, in identifiable (clear) form.

2. Ensuring the security of the systems, networks, and equipment used, as well as their maintenance.

The legal basis is our legitimate interest in ensuring the security and proper functioning of systems, equipment, and networks, in accordance with Article 6(1)(f) of the GDPR.

3. Compliance with the legal obligations imposed on us by law (for example, obligations under tax legislation, archiving requirements, data protection obligations, etc.), including reporting to certain institutions and/or public authorities. We will also retain the personal data contained in the records that Wabi is required to maintain in accordance with the applicable legislation of Namibia.”

The legal basis is the fulfillment of our legal obligations, under Article 6(1)(c) of the GDPR.

4. The defense, exercise, or establishment of rights, as well as the resolution of disputes.

The legal basis for processing is our legitimate interest in requesting the establishment of rights, exercising or defending our rights, in accordance with Article 6(1)(f) of the GDPR.

 

USE OF THE WEBSITE AND THIRD-PARTY PLUG-IN/WEBSITES TECHNOLOGIES

The website contains links to social media networks or third-party websites that you can access directly.

In this case, the respective social media networks or third-party websites may carry out personal data processing activities that are not under our control. Thus, the operators of the social media networks and third-party websites act as independent controllers and have their own policies regarding how they process personal data, including through cookies.

Please consult the privacy policies of the social media networks, as well as those of the third-party websites, for complete information regarding their processing of your personal data.

 

DATA RECIPIENTS

Personal data may be disclosed, strictly to the extent necessary for the purposes detailed above or in cases where this is required by law or when we have a legitimate interest that is well justified, to the following categories of recipients who may act as independent controllers/joint controllers or processors, as follows:

1. Service providers
2. business management and consultancy services;
3. transport services;
4. tourism services;
5. travel booking services;
6. personal data protection services;
7. IT system development, technical support, and maintenance services;
8. cybersecurity services;
9. electronic communications services;
10. archiving services;
11. audit services;
12. software solutions, platforms, or other IT systems, such as those used to manage information collected through websites, marketing platforms, etc.;
13. cloud/hosting services;
14. social media platforms;
15. external consultants we engage in specific situations (e.g., lawyers, advisors, experts);
16. Public authorities and bodies, including investigative authorities, courts of law, or institutions with powers to carry out inspections and audits of the operator’s activities and assets, to the extent that the transfer of data to them is required by law and/or necessary in the event of litigation or dispute resolution, as well as in cases of audits where we are obliged to provide such data (for example, the National Supervisory Authority for Personal Data Processing);
17. Persons expressly designated by you;
18. Third-party acquirers, to the extent that our business is transferred (in whole or in part), and the data of the Data Subjects is inherently linked to the assets that are the subject of such a transaction.

 

TRANSFERS OF PERSONAL DATA

As a rule, we will not transfer your personal data processed outside the European Economic Area. However, in cases where the transfer of your personal data outside the European Economic Area is necessary, it will be carried out only with the application of appropriate safeguards in accordance with the specific legal provisions on personal data protection, and with appropriate notification to you.

 

DURATION OF THE PROCESSING OF YOUR PERSONAL DATA

The personal data mentioned in the sections above will be processed only for the period necessary to fulfill the purposes mentioned in this Privacy Notice.

Subsequently, we will remove or delete personal data from our systems and records and/or take steps to anonymize it so that you can no longer be identified. We will also take all reasonable steps to ensure that personal data transmitted to third parties or made public for the purposes mentioned above is deleted.

Thus, the periods for processing personal data are as follows:

1. If you submit a request to us, we will process your data throughout the period of resolving your request, as well as for a period of 3 years from the date of the last interaction, both for statistical analysis and reporting purposes and to defend ourselves in the event of disputes.
2. If you benefit from our services, your data will be processed during the execution of the contract, as well as for the periods provided by applicable laws, such as, but not limited to, financial and accounting legislation, after which the data will be archived for the duration of the general statute of limitations, and subsequently deleted/destroyed from our database.
3. When you interact with our social media pages, interactions, posts, and comments on our page will be retained until you exercise your option to delete them.
4. Regarding the data collected through cookies, they are retained for the duration defined, in each case, in the Cookies Policy section.
5. Personal data processed in the context of disputes, litigations, or conciliations will be retained beyond the durations mentioned in the previous point, until their resolution, and also afterwards, in accordance with the applicable limitation periods.

 

YOUR RIGHTS REGARDING PERSONAL DATA

1. Right to be informed, according to art. 13 and art. 14 of the GDPR, as per this document.
2. Right of access, according to art. 15 of the GDPR.
3. Right to rectification, according to art. 16 of the GDPR.
4. Right to erasure/right to be forgotten, according to art. 17 of the GDPR.
5. Right to restriction of processing, according to art. 18 of the GDPR.
6. Right to data portability, according to art. 20 of the GDPR.
7. Right to object, according to art. 21 of the GDPR.

 

When you send us a request to exercise this right, please also mention the grounds related to your particular situation. We will no longer process your personal data, unless we demonstrate that (i) we have legitimate grounds for processing your data that override your interests, rights, and freedoms or that (ii) the purpose of the processing is the establishment, exercise, or defence of legal claims.

8. Right not to be subject to a decision based solely on automated processing, including profiling, according to art. 22 of the GDPR. The personal data referred to in this Privacy Notice is not subject to automated decision-making processes.
9. The right to lodge a complaint with the supervisory authority, in accordance with Article 13(2)(d) and Article 14(2)(e) of the GDPR.

Without prejudice to your right to contact the supervisory authority at any time, we kindly ask that you contact us first regarding the exercise of the above-mentioned rights.

If you believe that we have not fully addressed your requests or if you are not satisfied with our responses, you may contact the competent supervisory authority. A list of competent authorities can be found at the following link: Data protection around the world | CNIL, or you may file a complaint with the competent court of law.