Discover Africa. Travel with confidence.Questions? info@trybookafrica.com
Legal & Policies

Data Processing Agreement

A data processing agreement that forms part of, and is read together with, the Supplier Agreement.

Data Processing Agreement

Effective Date: 01 November 2026
← All policiesDownload (.docx)

This Data Processing Agreement ("DPA") forms part of and must be read together with the Supplier Agreement entered into between TryBookAfrica (Pty) Ltd, registration number 2021/652846/07 (“TryBookAfrica”, “we”, “us” or “our”), and the relevant Supplier, technology provider or service provider ("Service Provider") identified in the applicable Supplier Registration and Onboarding Form or Supplier Agreement (“Supplier”, “you” or “your”).

Before these Commercial Terms become binding, the Supplier, technology provider or service provider ("Service Provider") full legal name, registration or identification details, and other required particulars must be recorded in the applicable agreement or onboarding records.

These Commercial Terms govern the commercial arrangements between TryBookAfrica and the Supplier in connection with the Supplier, technology provider or service provider ("Service Provider") use of the TryBookAfrica platform, including applicable commissions, fees, payment arrangements, promotional or preferential commercial terms, and related financial obligations.

Where a Supplier, technology provider or service provider ("Service Provider") is a company or other juristic person, the agreement must identify that entity by its registered legal name and applicable registration number. Where the Supplier, technology provider or service provider ("Service Provider") operates as an individual or sole proprietor, the agreement must identify the individual or proprietor contracting with TryBookAfrica and, where applicable, the registered trading name.

These Commercial Terms apply to the Supplier identified in the relevant agreement and do not create a separate agreement with any other person or entity unless expressly agreed in writing by the parties.

Definitions and interpretation

“Account” means a registered TryBookAfrica account used to access account features, bookings, saved information or supplier functionality.

“Booking” means a reservation, purchase request or confirmed transaction for a Product made through the Platform or through a booking route presented by the Platform.

“Booking Confirmation” means the electronic confirmation issued by TryBookAfrica, the Supplier or an authorised booking system after a booking has been accepted and, where required, paid or otherwise secured.

“Platform” means TryBookAfrica.com, associated websites, mobile applications, supplier portals, traveller accounts, booking interfaces, APIs and related digital services operated or authorised by TryBookAfrica.

“Product” means any accommodation, safari, tour, activity, attraction, restaurant experience, transport service, transfer, vehicle rental, travel service or other tourism-related offering displayed or bookable through the Platform.

“Supplier” means an independent tourism business, operator, establishment, service provider or other third party that lists or provides a Product through or in connection with the Platform.

“Traveller” or “you” means the person who accesses the Platform or makes, manages or is included in a Booking.

“TryBookAfrica”, “we”, “us” or “our” means the South African legal entity that owns and/or operates the Platform, together with authorised affiliates and service providers where applicable.

“Local Mandatory Law” means any law, regulation, consumer right, privacy rule, licensing requirement, tax rule, payment rule, tourism rule or court/authority requirement that applies to the relevant user, transaction, Product or jurisdiction and cannot lawfully be excluded by contract.

Unless the context requires otherwise, singular includes plural; headings are for convenience; references to legislation include amendments and replacements; and “including” does not limit the scope of the preceding words.

1. PURPOSE

This DPA governs the processing of Personal Information where one party processes Personal Information on behalf of another party.

The parties recognise that their respective roles may differ depending on the processing activity.

For example:

  • TryBookAfrica may act as a Responsible Party for Traveller account and Booking information;

  • a Supplier may act as a Responsible Party for information necessary to deliver its tourism service;

  • TryBookAfrica may act as an Operator when processing information strictly on a Supplier's documented instructions;

  • technology providers may act as Operators where they process Personal Information on TryBookAfrica's instructions.

The parties must not assume that one role applies to every processing activity.

2. POPIA

The parties agree to comply with the Protection of Personal Information Act, 2013 (POPIA) and applicable data-protection law.

POPIA establishes 8 conditions for lawful processing of personal information and imposes obligations on organisations processing such information.

3. PROCESSING INSTRUCTIONS

The Operator will process Personal Information only:

  • to provide agreed services;

  • according to documented instructions;

  • to comply with law; or

  • where otherwise legally authorised.

4. TYPES OF INFORMATION

Personal information may include:

  • names;

  • contact details;

  • Booking details;

  • travel dates;

  • accommodation information;

  • communication records;

  • payment transaction references;

  • Supplier information;

  • identification information where lawfully required;

  • technical information; and

  • other information necessary to provide the contracted service.

Personal information must only be processed where lawful and necessary.

5. SECURITY

The Operator must implement reasonable technical and organisational safeguards including, where appropriate:

  • access controls;

  • passwords;

  • encryption;

  • secure transmission;

  • backups;

  • logging;

  • malware protection;

  • staff confidentiality;

  • vulnerability management; and

  • incident-response procedures.

6. CONFIDENTIALITY

Persons authorised to process Personal Information must be subject to confidentiality obligations.

7. SUB-PROCESSORS

An Operator may not appoint a sub-processor to process Personal Information without appropriate authorisation from the Responsible Party.

Where approved, the Operator remains responsible for ensuring appropriate contractual protections.

8. DATA BREACHES

The Operator must notify TryBookAfrica without undue delay after becoming aware of a suspected or confirmed security compromise involving Personal Information.

The notification should include, where reasonably available:

  • nature of the incident;

  • information affected;

  • approximate number of data subjects;

  • likely consequences;

  • mitigation measures; and

  • contact person.

9. DATA SUBJECT REQUESTS

The Operator must reasonably assist TryBookAfrica in responding to lawful requests concerning:

  • access;

  • correction;

  • deletion;

  • objection;

  • restriction;

  • complaints; and

  • other applicable rights.

10. CROSS-BORDER PROCESSING

Cross-border transfers must comply with applicable the provisions of POPIAs and any other applicable law.

11. RETENTION

In terms of this agreement, the parties agrees that Personal Information will not be process for a longer period than reasonably necessary for the relevant purpose or as required by law.

12. RETURN OR DELETION

On termination, the Operator must, subject to legal retention requirements, return or securely delete/destroy Personal Information and provide written confirmation of such acts.

13. AUDIT

TryBookAfrica may request reasonable evidence of compliance where necessary.

14. LIABILITY

Each party remains responsible for its own acts and omissions.

Nothing in this DPA excludes liability that cannot legally be excluded.