Privacy Policy

Effective date: 12 July 2026

1. Who we are

iSimangaliso Wetland Park Authority (the Authority, we, us or our) is the responsible party for personal information processed through its official website, correspondence and services. This policy applies to www.isimangaliso.com and the iSimangaliso companion mobile application for Android and iOS (together, the Services).

The mobile app is developed and technically maintained by Pace Online (Pty) Ltd on behalf of the Authority. Where Pace Online processes personal information under the Authority's instructions, it acts as an operator and must protect that information in accordance with applicable law and its agreement with the Authority.

2. Information we process

Information you provide through official channels

If you contact us, subscribe to communications, request assistance, apply for a permit or use another official form or email channel, we may process:

• your name, email address, telephone number and organisation;
• permit or visit details, including dates, locations, group size and activity information;
• documents or other information you choose to attach; and
• your correspondence with the Authority or its authorised support provider.

We will indicate where information is required. If required information is not supplied, we may be unable to respond, process an application or provide the requested service.

Information entered in the mobile app

The current app lets you browse park information, save favourites and prepare permit details. Favourites are stored locally on your device using the operating system's app storage. Permit details typed into the current app are held temporarily in the active app session and are not sent to the Authority, Pace Online or any third party by the app. An application is only submitted when you use an official submission channel and receive an acknowledgement from the Authority.

The current app does not create user accounts, collect precise location, access contacts, use the camera or photo library, serve advertising, profile users, or use third-party analytics or tracking SDKs.

Website and network information

When you use the website, our hosting and security providers may automatically process limited technical information such as your IP address, browser and device type, requested page, date and time, referring page, and security or error logs. This information is used to deliver the site, prevent abuse, troubleshoot faults and maintain security.

External actions you initiate

The Services can open an external map, website, email, telephone or sharing application at your request. The selected provider may then process information under its own privacy policy. The iSimangaliso app does not automatically send your saved items or permit-form entries to those providers.

3. Why we process information

We process personal information only for a lawful and specific purpose, including to:

• respond to enquiries and provide visitor or stakeholder support;
• receive, assess and administer permit applications and related records;
• provide requested communications and allow you to unsubscribe;
• operate, secure, maintain and improve the Services;
• perform the Authority's statutory and public functions; and
• comply with legal, audit, records-management and regulatory duties.

Depending on the context, processing is based on your consent, steps taken at your request, performance of a contract, compliance with law, protection of a legitimate interest, or the proper performance of a public-law duty. We do not make decisions that produce legal or similarly significant effects about you solely by automated means.

4. Sharing and operators

We do not sell personal information. We may disclose only the information reasonably necessary to:

• authorised Authority employees and officials who need it for their work;
• contracted operators that provide hosting, security, technical support, communications or application services under appropriate confidentiality and data-protection obligations;
• park-management partners or public bodies where this is necessary to deal with your request or perform a lawful public function; and
• regulators, law-enforcement bodies, courts or other parties where disclosure is required or permitted by law.

Website delivery may involve Cloudflare and other content-delivery or infrastructure providers. Pages containing embedded maps or media may connect to the relevant provider when loaded. We require operators that access personal information to provide protection consistent with this policy and applicable law.

5. International processing

Some technology or communications providers may process information outside South Africa. Where personal information is transferred across borders, we take reasonably practicable steps to ensure that the recipient is subject to a law, binding agreement or corporate rules that provide an adequate level of protection, or that another lawful basis under POPIA applies.

6. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information, including encrypted web connections, access controls, service-provider controls, system monitoring and incident-response procedures. No internet or storage system is completely secure. If a security compromise affects your personal information, we will act and notify affected persons and the Information Regulator where required by law.

7. Retention and deletion

We keep personal information only for as long as necessary for the purpose for which it was collected, or as required by public-sector records, audit, legal or dispute-resolution obligations. When retention is no longer required, information is securely deleted, destroyed or de-identified.

Favourites saved by the app remain on your device until you remove them, clear the app's storage or uninstall the app. Permit details typed into the current app are not persistently stored by the app. You may request deletion of personal information held by the Authority, subject to lawful record-retention requirements and permitted exceptions.

8. Cookies and similar storage

The website and its service providers may use essential cookies, cache storage or similar technologies needed for delivery, security and user preferences. We do not use the mobile app for cross-app tracking or behavioural advertising. You can manage website storage through your browser settings, although blocking essential storage may affect site operation.

9. Children

The Services provide general travel and conservation information and are not directed to children for the purpose of collecting personal information. A person under 18 should ask a parent or competent guardian to contact us or submit an application on their behalf. We do not knowingly use children's personal information for advertising or profiling.

10. Your POPIA rights

Subject to applicable law, you may:

• ask whether we hold personal information about you and request access to it;
• ask us to correct, update, delete or destroy information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to processing in the circumstances provided by POPIA;
• withdraw consent where processing depends on consent, without affecting earlier lawful processing;
• opt out of direct marketing; and
• complain to the Information Regulator.

We may need to verify your identity before acting on a request. To exercise a right, contact the Authority using the details below and describe the information and action requested.

11. Contact and complaints

For technical questions about the mobile app, you may also contact Pace Online (Pty) Ltd at support@paceonline.co.za.

You may contact the Information Regulator (South Africa) through its complaints service, by email at enquiries@inforegulator.org.za, by telephone on 010 023 5200 or 0800 017 160, or at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

12. Changes to this policy

We may update this policy when the Services, our practices or legal requirements change. The current version will remain available on this page and its effective date will be updated. Material changes that affect app data practices will also be reflected in the app and relevant app-store disclosures before the changed processing begins.