Your privacy.

Who we are

Kyalami Creek is owned and run by VCR Properties (Pty) Ltd (company registration number 2006/020400/07), trading as Kyalami Creek Luxury Apartments, established in 2006. We let 30 furnished apartments for short stays (Kyalami Creek Luxury Apartments) and 73 unfurnished homes on monthly leases, all in one complex.

Under the Protection of Personal Information Act (POPIA, Act 4 of 2013), we are the “responsible party” for the personal information described here. That means we decide how it is used, and we are responsible for looking after it.

• Street address: 8 Lyndore Avenue, Willaway, Midrand 1684
• Postal address: Postnet Suite 155, Private Bag X1028, Lyttelton 0140
• VAT number: 4890190855
• Stays: reservations@kyalamicreek.co.za, WhatsApp 082 774 6198
• Rentals: rentals@vcrproperties.co.za

Our Information Officer

Our Information Officer makes sure we follow POPIA and the Promotion of Access to Information Act (PAIA), and handles any request or concern about your information.

• Name: Celeste van der Berg, General Manager
• Email: celeste@kyalamicreek.co.za
• Phone: 082 774 6198
• Post: Postnet Suite 155, Private Bag X1028, Lyttelton 0140

By law, the head of a company (its chief executive officer or equivalent officer) is its Information Officer, and may authorise someone else in writing to do the job. Our head, director Frans van der Berg, has authorised Celeste. Frans signed the written authorisation on 15 October 2026.

What we collect and why

We only collect what we need to look after you, run the complex safely and meet our legal duties. You need to give us your ID or passport and your contact details to stay or rent a home with us; without them we can’t take the booking or the lease. Anything else you share is up to you.

When you enquire or book with us directly

The booking box on this website does not store anything. It opens WhatsApp or an email with your dates and number of guests filled in, and you choose whether to send it. When you message or email us, we receive your name, phone number or email address, your dates and anything else you tell us. We use it to reply, quote and take your booking. Direct bookings are captured in Semper, our booking system, where we also prepare your invoice.

When you book online or through a booking site

Online bookings on this website are made through NightsBridge, which collects your details and payment under its own privacy policy and passes the booking to us. If you book on Booking.com, LekkeSlaap, Expedia or TravelIT, that site shares your name, contact details and booking with us. We use them to prepare for your stay and to contact you about it.

When you arrive and stay

• Your ID or passport: we copy it at check-in, before we hand over your keys, so we know who is staying in each apartment.
• Gate access: our security company, TRSS, runs the gate and registers every visitor, so it sees visitor details. Guests use an access code to enter. This keeps everyone in the complex safe.
• CCTV: our parking areas, the gym and the gate are monitored by CCTV for safety and security. CCTV is used in shared areas only, never inside the apartments or homes, and the cameras are clearly visible. Signs are being put up at each camera area.
• During your stay: your arrival time, parking bay, any special requests and the messages you send us, so we can look after you.

When you pay

You can pay by EFT, by card through a Payfast payment link, PayGate’s online card payment page or our card machine at the office, or in cash. We never ask for your card number on WhatsApp, by email or on this website: card details are entered on Payfast’s, PayGate’s or NightsBridge’s own secure payment page, or on the card machine. We never take card numbers over the phone or by message, and we don’t write card numbers down or keep copies of them. We keep payment records, bank references and card machine slips so we can match payments to bookings and keep proper accounts.

When your company books

For corporate stays we collect the company’s name, billing and VAT details, and the name and contact details of the person booking and of each guest. Some companies need to book through a BEE supplier: in that case your booking and invoice details are shared with our BEE partner company, which invoices your company.

When you rent a home

• Enquiries: your name, contact details, the type of home you want and your move-in date, so we can arrange a viewing.
• Applications: we send you our application form by email. It asks for the information needed to vet an application, such as your ID and proof of income. Please don’t upload ID documents or payslips through this website.
• Vetting: your application is sent to our managing agent, Pretor, who checks it through TPN, a credit bureau for rentals. Pretor then tells us whether the application is approved.
• Your lease: your lease, deposit, rent payments and any arrears, inspection reports and photos of the home, and maintenance requests you email to us.
• Access to the complex: residents use the Cloudsell access app for visitor codes and notices, and a fingerprint or an RFID tag to come and go. Only tenants’ fingerprints are held, in the gate access system; short-stay guests use access codes instead. A fingerprint is special personal information under POPIA, so we only use it for access, with your consent. You can ask for an RFID tag instead (R100, refundable).

Reviews and photos

After a stay we may ask you to review us on Google or the site you booked on. We only quote a review on this website, or show a photo of you, with your permission.

When you visit this website

See cookies and this website below.

Our reasons in law

POPIA lets us use personal information only for a lawful reason. Ours are:

• To carry out our agreement with you: your booking or your lease, and the steps before it, such as a quote or an application.
• Because the law requires it: for example tax and accounting records.
• Our legitimate interests, or yours: keeping guests, residents and staff safe, preventing fraud and looking after the buildings, in ways you would reasonably expect.
• Your consent: for analytics cookies, using your review or photo, fingerprint access and marketing messages where consent is needed (when you book, you can tell us you don’t want these messages). You can withdraw consent at any time; this doesn’t affect anything we did before.

Who we share it with

We never sell your information. We share only what each party needs:

• Booking channels: NightsBridge, Booking.com, LekkeSlaap, Expedia and TravelIT, for bookings made through them.
• Our booking system: Semper, which stores bookings and invoices for us.
• Payment providers and our bank: Payfast, PayGate, NightsBridge and our bank, to take and match payments.
• Our BEE partner company: for corporate bookings made through it.
• For rentals: Pretor, our current managing agent, and TPN for tenant vetting; and the prepaid electricity and internet providers you sign up with.
• Security: TRSS, our security company, which runs the gate and sees visitor details, for visitor registration and access.
• Our accountant and auditor: who keep and audit our books.
• The authorities: the police, SARS, courts or other authorities when the law requires it, or to protect someone’s safety.

Companies that handle information on our behalf (POPIA calls them “operators”) must keep it confidential and secure.

Information stored abroad

Some of the services we use may store information outside South Africa, including:

• WhatsApp (owned by Meta), when you message us;
• Google, whose email and file storage we use, and Google Analytics (whose data is processed outside South Africa) if you accept analytics cookies;
• international booking sites such as Booking.com and Expedia;
• our online booking system, NightsBridge, whose privacy policy says it may send or store information outside South Africa.

POPIA allows this when the receiving company is bound by data-protection laws or agreements that give protection similar to POPIA, when it is needed for your booking, or when you agree to it. We choose established providers that publish how they protect personal information.

How long we keep it

We keep information only as long as we need it for the reason we collected it, or as long as the law requires.

• Bookings, invoices, payments and other financial and tax records: 7 years (the Companies Act requires 7 years for accounting records; tax law, at least 5 years).
• Guest ID copies: 12 months after check-out, unless we need them for an incident or a claim.
• Guest registration cards: 3 years after check-out, unless we need them for an incident or a claim.
• Enquiries that don’t lead to a booking: 12 months.
• Visitor and gate records: 12 months.
• CCTV recordings: 30 days, unless we need them for an incident.
• Tenants’ fingerprints: removed from the gate system within 30 days after the tenant moves out.
• Rental applications that don’t go ahead: 3 months.
• Leases, inspection reports and tenant files: 3 years after the lease ends (the financial parts, 7 years).
• Marketing contacts: until you opt out.

When we no longer need information, we delete or destroy it securely, or remove anything that identifies you.

How we keep it safe

• Only the people who need your information for their work can see it.
• Our systems and email accounts are protected with passwords, and our website runs on secure (HTTPS) connections.
• Our office computers have anti-virus software, and sensitive files on them are kept in an encrypted, password-protected folder. Our Google accounts need two-step sign-in with an authenticator app.
• We don’t take card numbers or ID copies by phone, WhatsApp, email or website forms.
• Paper records, such as copies of ID documents and card machine slips, are kept in the office where only our team can reach them, and shredded when we no longer need to keep them.

If we believe your information has been accessed by someone who shouldn’t have it, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

Messages from us

If you have stayed with us, we may now and then send you news about our own stays and offers, such as the Return Stay Club. Every message lets you opt out: reply STOP, or tell us on WhatsApp or by email, and we’ll stop. We only send marketing to anyone else if they have agreed to it first, for example by ticking the box when joining the Return Stay Club.

Messages about a booking you have made, such as your parking bay or Wi-Fi details, are part of your stay, not marketing.

Cookies and this website

• Essential: one small file (kc_consent) that remembers your cookie choice for 12 months. The site needs it to work, so it doesn’t ask.

• Analytics (only if you agree): Google Analytics tells us how many people visit, which pages they read, and which contact or booking links they click (WhatsApp, phone, email and Book online). It never receives what you write to us, your phone number or your email address. Its cookies (_ga and _ga_ followed by our ID) last up to 2 years. It only loads after you accept it on the cookie banner, and you can change your mind at any time. Change your cookie settings.

• Tap counts (no cookie): our own website counts how many times the WhatsApp, call, email and Book online buttons are tapped on each page each day. The count itself stores nothing about you: no IP address, no cookie and no details of your device.

• Server logs: like every website, our web host’s servers keep technical logs of requests, including IP addresses, to keep the site secure and working. We don’t use them for marketing or to identify visitors.

• Advertising: we don’t use advertising cookies.

Fonts: our fonts are hosted on our own site, so no font service sees your visit.

Links to other sites: WhatsApp, NightsBridge, Google Maps and booking sites have their own privacy policies, which apply once you go to them.

Children

Children are welcome to stay with a parent or guardian, who makes the booking. We only record what we need about a child for the stay. This website is not aimed at children, and we don’t knowingly collect information from them through it.

Your rights

Under POPIA you have the right to:

• Know whether we hold information about you, and ask for a copy of it;
• Correct information that is wrong, out of date or incomplete;
• Ask us to delete information we no longer need or are not allowed to keep;
• Object to us using your information, including for marketing;
• Withdraw your consent where we rely on it;
• Complain to the Information Regulator.

To use any of these rights, email our Information Officer at celeste@kyalamicreek.co.za. We may ask you to prove who you are first, so we never give your information to someone else. We’ll reply within 30 days. If we need more time, we’ll tell you why, and take no more than 30 days more. Some records, such as tax records, we must keep even if you ask us to delete them; if so, we’ll explain why.

Complaints

Please talk to us first; we would like the chance to put things right. If you’re still not happy, you can complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za, phone 010 023 5200 or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191

Our PAIA manual

The Promotion of Access to Information Act (PAIA) lets you ask for records we hold. Our PAIA manual explains what records we keep, how to ask for them, and any fees. Read our PAIA manual; you can print it or save it as a PDF. It is also available from our Information Officer, and at our office.

Changes to this notice

We will update this notice when the way we handle information changes. The date below shows the latest version. If a change affects you significantly, we’ll tell you directly.