Privacy

Privacy Notice

In terms of the Protection of Personal Information Act 4 of 2013 (POPIA) · Last updated: 22 June 2026

This Privacy Notice explains how Midas Management Systems collects, uses, stores, and protects your personal information when you participate in a guest satisfaction survey through our Guest Survey Platform. We are committed to processing your information lawfully and transparently, in accordance with POPIA.

1. Who We Are

Midas Management Systems is the responsible party for personal information processed through the Guest Survey Platform (guestsurvey.co.za). We are a South African company providing survey technology to hotel groups across South Africa.

Our hotel group clients ("Hotels") make use of our Platform to invite guests to share feedback about their stay. While Hotels provide us with your contact details to facilitate surveys, Midas is the responsible party for how that information is processed within the Platform.

2. What Personal Information We Collect

When a Hotel uses our Platform in connection with your reservation, we may process the following categories of personal information:

Identification information: Your full name as provided to the Hotel at check-in.
Contact information: Your email address, used solely to deliver the survey link.
Reservation details: Reservation number, room number, check-in date, and check-out date — used to verify the survey relates to an actual stay.
Survey responses: Your ratings and any written comments you voluntarily provide when completing a survey.
Technical information: IP address and browser/device type at the time of survey submission, collected for security and fraud prevention purposes.

We do not collect sensitive personal information (as defined in POPIA), financial information, identity numbers, or any information about children.

3. Why We Collect Your Information

We collect and process your personal information for the following lawful purposes:

Delivery of the survey: To send you a unique, personalised survey link relating to your stay at the relevant Hotel, and to record your responses once submitted.

Legitimate interest of the Hotel: To enable the Hotel to understand and improve guest experience. Your responses (including any written comments) are shared with the Hotel you stayed at.

Platform security and integrity: IP address and device information are collected to prevent fraudulent or duplicate submissions and to protect the Platform against misuse.

Legal compliance: To meet our obligations under applicable South African law, including POPIA.

4. Legal Basis for Processing

Under POPIA, we process your personal information on the following grounds:

Legitimate interest: The Hotel has a legitimate interest in understanding the experience of guests who have recently stayed at their property. Survey participation is entirely voluntary — you are under no obligation to complete the survey and there are no consequences for declining.
Contractual necessity: Where you engage with the Platform (by opening or submitting the survey), processing is necessary to perform the service you are participating in.

5. How We Use Your Information

Your personal information is used only for the purposes described in Section 3. Specifically:

Your name, email, and reservation details are used to create and deliver a personalised survey link.
Your survey responses are made available to the Hotel whose property you stayed at, displayed within their password-protected manager dashboard.
We do not use your information for direct marketing, profiling, or automated decision-making.
We do not sell, rent, or share your personal information with any third party for commercial purposes.

6. Who We Share Your Information With

We limit disclosure of your personal information to the following parties:

The Hotel: The hotel group whose property you stayed at has access to your survey responses (including written comments) through our manager dashboard. They do not have access to your email address through the dashboard.
Our hosting provider: Your information is stored on servers managed by our South African hosting provider. Our hosting agreement includes appropriate data protection obligations.
Legal authorities: We may disclose personal information where required to do so by law, court order, or a request from a competent authority.

We do not transfer your personal information outside the Republic of South Africa.

7. How Long We Keep Your Information

We retain your personal information for as long as reasonably necessary for the purposes described in this Notice, and in accordance with our legal obligations:

Survey records (including your name, reservation details, and responses) are retained for a maximum of 36 months from the date of submission, after which they are permanently deleted from our systems.
Technical logs (IP address, device information) are retained for 12 months for security and audit purposes.
Where a Hotel requests earlier deletion, we will action this request within 30 days.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights in relation to your personal information:

Right of access You may request a copy of the personal information we hold about you.

Right to correction You may request that inaccurate personal information be corrected or updated.

Right to deletion You may request that your personal information be deleted, subject to our legal retention obligations.

Right to object You may object to the processing of your personal information on grounds of legitimate interest.

Right to complain You may lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated.

Right to withdraw Where processing is based on consent, you may withdraw consent at any time without penalty.

To exercise any of these rights, please contact our Information Officer using the details in Section 10.

9. How We Protect Your Information

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or alteration. These measures include:

All survey links and dashboard access are served exclusively over HTTPS (encrypted connections).
Each hotel group's data is stored in a separate, isolated database — no cross-group access is possible by design.
Dashboard access is password-protected and rate-limited to prevent brute-force attacks.
API credentials are stored outside the web root and are never exposed to guests.
Database credentials are never embedded in publicly accessible files.

While we implement appropriate safeguards, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected individuals in accordance with POPIA's requirements.

10. Information Officer

Midas Management Systems has appointed an Information Officer as required by POPIA. All queries, requests, and complaints relating to the processing of your personal information should be directed to:

Information Officer — Midas Management Systems

Email: hello@midasman.co.za

Website: www.midasman.co.za

We will respond to all requests within 30 days of receipt, as required by POPIA.

11. The Information Regulator

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint directly with the Information Regulator of South Africa:

Website: inforegulator.org.za
Email: inforeg@justice.gov.za

12. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal obligations. The date of the most recent revision is shown at the top of this page. We encourage you to review this Notice periodically. Where changes are material, we will take reasonable steps to notify affected parties.