Privacy Policy

1. Introduction

GHM Suite ("we", "us", or "our") is committed to protecting the personal information of our users in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa. This Privacy Policy explains what information we collect, how we use it, how long we keep it, who we share it with, and your rights in relation to it.

By using GHM Suite at ghmsuite.co.za, you agree to the collection and use of information as described in this policy.

2. Who We Are and Our Role Under POPIA

GHM Suite is a guest house management platform designed for South African guest house owners.

Under POPIA, the roles are as follows:

• GHM Suite is the operator — we process personal information on behalf of our customers (guest house owners) under their instruction and for the purposes they direct.
• Guest house owners (our customers) are the responsible party — they determine the purpose and means of processing personal information about their guests, and bear the primary compliance obligations under POPIA for that data.

For our customers' own account data (email address, subscription details), GHM Suite acts as the responsible party.

For details of our data processing obligations and your rights as a customer, see our Data Processing Agreement.

Contact: info@ghmsuite.co.za

3. Information We Collect

3.1 Account Information

When you register, we collect your email address and a password (stored securely in hashed form via Supabase Auth — we never store your password in plain text).

3.2 Guest Information (Processed on Your Behalf)

As part of managing your guest house, you may capture personal information about your guests, including:

• Full name and surname
• Email address
• Contact (cell) number
• ID verification status
• If you use the invoicing add-on and choose to record them: the guest's company name, VAT registration number and billing address, so that invoices can be addressed correctly

This data is processed by GHM Suite as your operator. You are the responsible party for this data and are responsible for obtaining appropriate consent from your guests before capturing their personal information in GHM Suite.

3.2A Invoicing Data (Processed on Your Behalf)

If you enable the invoicing add-on, GHM Suite stores each document you issue: the recipient's name, company, email address, VAT number and billing address as entered on the document; the line items and amounts; and a log of every email attempt (the address it was sent to, when, and whether it succeeded). Your own supplier details — legal name, registration and VAT numbers, banking details and logo — are stored against the property and copied onto each document at the moment it is issued.

PDF files are not stored; each is generated on demand from the stored data. Your logo, if uploaded, is stored at a publicly accessible address so that it can appear in the emails you send, and should not contain personal information.

3.3 Booking Data

We store booking records you create or import, including check-in and check-out dates, room assignments, rates, number of guests (pax), and booking source.

3.4 Calendar Sync Data

When you connect external calendars (Airbnb, Booking.com, LekkeSlaap), we import booking events from those feeds. This may include guest names, booking references, and stay dates provided by those platforms.

3.5 Payment Information

We do not store your full payment card details. Subscription payments are processed by a third-party payment provider. We only store your subscription status, amount paid (in cents), and expiry date.

3.6 Analytics & Cookies

With your explicit consent, we use Google Analytics 4 to collect anonymous usage data such as pages visited, session duration, and general navigation patterns. This helps us understand how GHM Suite is used so we can improve it.

Analytics data is only collected after you have opted in via the cookie consent banner shown when you first visit the site. You can change your preference at any time in Settings → Cookie Preferences.

We use the following storage items:

• ghm_consent_v1 — a localStorage entry storing your cookie consent preference (necessary; never expires; contains only your opt-in/opt-out choice and the date it was set).
• _ga, _gid, _ga_BQ59NGM17S — cookies set by Google Analytics only if you have consented. They expire after 2 years, 24 hours, and 2 years respectively. They collect anonymised data and do not identify you personally.

We do not use cookies for advertising or profiling purposes.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the GHM Suite platform
• Authenticate your account and keep it secure
• Sync booking data from connected external calendar feeds
• Send subscription, billing, and service notifications by email
• Respond to support requests
• Improve the platform using anonymised analytics (with your consent)
• To generate invoices, pro formas and credit notes and email them to the recipients you specify, when you instruct us to through the invoicing add-on

We do not sell, rent, or share your personal information with third parties for marketing purposes.

5. Data Storage, Hosting, and Cross-Border Transfers

5.1 Infrastructure

Your data is stored using Supabase, a managed database platform that implements row-level security (RLS). This means only your account can access your guest house data — no other GHM Suite user can view your records.

5.2 Hosting Location and Cross-Border Transfers

Supabase may host data on servers located outside South Africa, including in the European Union or United States. This constitutes a cross-border transfer of personal information under POPIA.

Supabase operates under its own Privacy Policy and Data Processing Agreement, which provides appropriate safeguards for the transfer and processing of personal data, including Standard Contractual Clauses where applicable.

By using GHM Suite, you consent to the transfer of your data to Supabase's hosting infrastructure as described above.

5.3 Encryption

We use industry-standard encryption (HTTPS/TLS) for all data in transit. Data at rest is encrypted by Supabase's infrastructure.

6. Subprocessors

GHM Suite uses the following third-party subprocessors to deliver the service. Each processes data only as necessary to provide the relevant function:

Calendar data is fetched from iCal feeds provided by Airbnb, Booking.com, and LekkeSlaap at your direction. GHM Suite does not share your data with those platforms.

7. Data Retention

We retain data as follows:

• Active accounts: Your account data, guest records, and booking history are retained for as long as your account remains active.
• Paused accounts (subscription lapsed): Data is retained indefinitely until you request deletion or reactivate your account. We will not delete data solely because of non-payment.
• After account termination / deletion request: We will delete your personal information and your guests' personal information within 30 days of a confirmed deletion request, except where we are required by law to retain records for a longer period (e.g. financial records may be retained for up to 5 years for tax purposes).
• Issued invoices, pro formas and credit notes: Documents issued through the invoicing add-on are tax records. They are retained, together with the recipient details as they appeared on them, for 5 years from the date of issue, as permitted by section 14 of POPIA for records that must be kept by law. When we act on a deletion request for a guest, we remove any draft documents that were never issued and delete or de-identify the guest's own record; the details already printed on an issued document are kept with that document for the retention period.
• Analytics data: Google Analytics data is retained for 14 months, as configured in our Analytics settings.
• Support communications: Emails sent to us are retained for 12 months.

To request deletion of your account and all associated data, contact us at info@ghmsuite.co.za.

8. Data Breach Notification

In the event of a security compromise that involves personal information, we will:

• Investigate and contain the breach as quickly as possible
• Notify affected customers by email as soon as reasonably possible and within the timeframes required by POPIA (which requires notification without unreasonable delay where there is a real risk of harm)
• Notify the Information Regulator of South Africa as required by section 22 of POPIA
• Provide details of what data was affected, what steps we have taken, and what you should do to protect yourself

If you suspect a security issue with your GHM Suite account, contact us immediately at info@ghmsuite.co.za.

9. Your Rights Under POPIA

As a data subject under South African law, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate or outdated information be corrected
• Deletion — request that your personal information be deleted (subject to legal retention requirements)
• Objection — object to the processing of your personal information
• Restriction — request that we limit how we use your information while a dispute is resolved
• Complaint — lodge a complaint with the Information Regulator of South Africa at justice.gov.za/inforeg

To exercise any of these rights, contact us at info@ghmsuite.co.za. We will respond within 30 days of receiving your request.

10. Children's Privacy

GHM Suite is intended for use by adult business owners (18 years or older). We do not knowingly collect personal information from persons under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are material, we will notify you by email. Continued use of GHM Suite after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

GHM Suite
Email: info@ghmsuite.co.za
Website: ghmsuite.co.za