Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Naicker Ventures (Pty) Ltd, registration number 2026/504261/07 ("Rumy", "we", "us", "our"), collects, uses, and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").

1. Responsible Party

Rumy is the responsible party for personal information processed through the Rumy platform. Our registered address is Durban, KwaZulu-Natal, South Africa. You can contact our Information Officer at privacy@rumy.co.za.

2. Information We Collect

2.1 Account and Property Information

When you sign up we collect your name, email address, and the details of your property (name, address, room types, floor and ceiling prices, and channel manager credentials). Channel manager credentials are stored encrypted (AES-256-GCM) and are never transmitted in plain text.

2.2 Reservation Pace Data (not guest PII)

To compute occupancy-driven pricing, Rumy fetches aggregated availability and booking-pace figures from your channel manager. We extract only the counts needed for pricing calculations: total units, available units, and stay dates. We do not collect, store, or process guest names, email addresses, phone numbers, payment card details, or any other guest personal information. This is a deliberate design choice to minimise POPIA exposure and reduce data risk.

2.3 Competitor and Market Rate Data

Rumy uses publicly available market and competitor rate information. This information relates to businesses, not natural persons, and does not constitute personal information under POPIA.

2.4 Signal and Environmental Data

We fetch demand signals such as public holiday schedules, school holiday dates, local events listings, weather forecasts, and loadshedding schedules. None of these signals contain personal information.

2.5 Usage and Technical Data

We collect standard server logs (IP address, browser type, pages visited, timestamps) and error logs to operate and improve the platform. We use cookies as described in section 10 below.

2.6 Communications

If you email us or submit a support request, we retain that correspondence to resolve your query and improve our support.

3. Purpose of Processing

We process personal information to:

• Create and manage your account and property configuration.
• Provide the autonomous pricing service, including computing and pushing rates to your channel manager.
• Send transactional communications (rate-push confirmations, monthly summaries, billing receipts).
• Process subscription payments via PayFast or EFT.
• Provide the Ruby AI assistant where activated.
• Comply with legal obligations, including tax and financial reporting requirements.
• Detect, investigate, and prevent fraud or security incidents.
• Improve and develop the platform using aggregated, anonymised analytics.

4. Lawful Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Contract performance: processing your account details, property configuration, and reservation-pace data is necessary to deliver the Service you subscribed to.
• Legitimate interest: security monitoring, fraud prevention, and platform improvement using anonymised analytics, where those interests are not overridden by your rights.
• Legal obligation: retaining billing records and responding to lawful requests from authorities.
• Consent: where we ask for your explicit consent (for example, optional marketing emails), you may withdraw that consent at any time by contacting us.

5. How We Share Your Information

5.1 Third-Party Processors

We share personal information only with service providers who process it on our behalf and under our instruction. Our current processors are:

• Cloud hosting and database providers: the platform and your data run on managed cloud hosting and database infrastructure. See section 6 for cross-border transfer disclosures.
• Email delivery provider: we use a transactional email provider to send account, billing, and summary emails.
• Payment gateway (PayFast): card payments for subscriptions are handled by PayFast, a South African payment gateway. Rumy never stores your card details; PayFast processes them under its own PCI-DSS certification.
• Your channel manager or property management system: using the credentials you provide, we fetch aggregated booking-pace figures and push rates. In relation to that connection we act on your behalf.
• AI provider (Ruby assistant): where you use the in-app assistant, only the information needed to answer your question is sent to our AI provider. We never send guest personal information.

We do not sell your personal information, and we do not share it for third-party advertising. We work only with reputable providers under data-processing terms, and we share the minimum information each one needs to perform its function. If you tick the separate, optional ad-measurement box on our sign-up or audit forms, we tell Meta Platforms (Facebook and Instagram, outside South Africa) that you signed up, sharing your email address in hashed form, your IP address, browser details and Meta cookie identifiers, so we can measure our own ads; if you do not tick it, no Meta pixel loads and nothing is sent to Meta.

5.2 Legal Disclosures

We may disclose personal information where required by law, court order, or the lawful request of a competent authority in South Africa.

5.3 Business Transfers

If Rumy is acquired or merges with another entity, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

6. Cross-Border Transfers

Some of our service providers are located outside South Africa, in the European Union and the United States. POPIA requires that personal information transferred abroad be protected to a standard substantially similar to POPIA. For providers in the European Union we rely on the GDPR's broadly equivalent protections; for providers in the United States we rely on contractual data-processing safeguards. In every case we transfer only the minimum information necessary.

We work towards hosting more data in South Africa as compliant infrastructure becomes commercially available.

7. Security

We implement appropriate technical and organisational measures to protect personal information, including:

• AES-256-GCM encryption for channel manager credentials at rest.
• TLS encryption for all data in transit.
• Access controls limiting which personnel can access production data.
• Regular security reviews and dependency updates.

No system is perfectly secure. In the event of a data breach that is likely to harm you, we will notify you and the Information Regulator as required by POPIA.

8. Retention

We retain your personal information for as long as your account is active and for a period thereafter as required by law or legitimate business need (typically 5 years for financial records under South African tax law). Rate-push audit logs are retained for 3 years to support dispute resolution. Anonymised aggregated data may be retained indefinitely.

When you close your account you may request deletion of your personal information, subject to our legal retention obligations. We will action your request within 30 days.

9. Your Rights Under POPIA

You have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion: ask us to delete your personal information (subject to legal retention obligations).
• Object: object to processing based on legitimate interest, or to direct marketing.
• Withdraw consent: where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact privacy@rumy.co.za. We will respond within 30 days.

10. Cookies

We use strictly necessary cookies to maintain your login session and your selected property preference. We do not use third-party advertising or tracking cookies. You can configure your browser to refuse cookies, but the platform will not function correctly without session cookies.

11. Right to Complain to the Information Regulator

If you believe we have processed your personal information unlawfully or in breach of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The latest version is always available at rumy.co.za/legal/privacy.

13. Contact

For any privacy-related queries, contact our Information Officer at privacy@rumy.co.za or by post to Durban, KwaZulu-Natal, South Africa.