Cookie notice

What we set

Session cookie (essential). When you sign in or create an account we set one cookie, pp_session, so the app knows it is you. It is:

• HttpOnly, so scripts on the page cannot read it;
• SameSite=Lax, so it is not sent with requests from other websites;
• Secure on the live site, so it is only sent over HTTPS;
• valid for up to 14 days, and it ends sooner if you sign out or are inactive for 72 hours.

This cookie is strictly necessary: without it you cannot stay signed in, so there is nothing to switch off. We store only a random value in it, not your details.

Cookies from others

• Google reCAPTCHA v3. When you submit the sign-up, sign-in, resend-code, password-reset, event-enquiry, event-registration or guest-checkout forms, the app loads Google reCAPTCHA to check you are a person. Google may set its own cookies and receives information such as your IP address and how your browser behaves. This is governed by Google's privacy policy and terms.
• PayFast. When you pay or save a card, you are sent to PayFast's own page, which has its own cookies and privacy policy.
• Google Fonts and icons. Every page loads its typefaces and icons from Google (fonts.googleapis.com and fonts.gstatic.com). No cookie is set by us for this, but each page load is a request to Google, which therefore receives your IP address and browser details.

Browser storage

• While you pay as a guest, your browser keeps a short-lived entry (sessionStorage key pp_guest_checkout) with a reference to the payment in progress and the details needed to send you to PayFast, which can include your name and email address. It is removed when your booking is confirmed, and your browser discards it when the tab closes.
• If you switch on push notifications, your browser registers a small background program (a service worker) so the app can show notifications. It does no tracking.
• Only inside the iPhone and Android apps: if you allow notifications, the app keeps your device's notification address and the account it belongs to in local storage (key pp.deviceToken), so it registers it with us at most once a day. It is removed when you sign out. The website itself does not use localStorage.
• Nothing in browser storage is used for analytics or advertising.

What we do not use

Today there are no analytics cookies, no advertising cookies and no social-media tracking pixels. If that ever changes, this page will be updated and we will ask for your consent first where the law requires it.

Controlling cookies

You can block or delete cookies in your browser settings. If you block the session cookie you will not be able to sign in. Blocking Google reCAPTCHA may stop sign-up, sign-in and guest-checkout forms from working, because they need that check.

More about what we do with personal information is in the Privacy Policy.