Last Updated: July 2026
lunar-bamboo recognises the importance of the General Data Protection Regulation (GDPR) and is committed to protecting the personal data of individuals in the European Economic Area (EEA). This page provides specific information about how we handle data in compliance with GDPR requirements.
Data Controller
For the purposes of GDPR, lunar-bamboo acts as the data controller for personal information collected through this website. Our contact details are:
lunar-bamboo
42 Long Street
Cape Town, 8001
South Africa
[email protected]
Your Rights Under GDPR
If you are located in the EEA, you have the following rights concerning your personal data:
Right to Access
You have the right to request a copy of the personal information we hold about you. We will provide this information free of charge within one month of your request.
Right to Rectification
If the personal information we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to such requests within one month.
Right to Erasure
You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.
Right to Restriction of Processing
You may request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to our processing activities.
Right to Data Portability
Where technically feasible, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.
Rights Related to Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal effects or significantly affects you.
Legal Basis for Processing
We process personal data from EEA residents based on one of the following legal grounds:
- Consent: You have given explicit consent for us to process your data for specific purposes
- Contractual Necessity: Processing is necessary for the performance of a contract with you
- Legal Obligation: Processing is necessary for compliance with legal requirements
- Legitimate Interests: Processing is necessary for our legitimate business interests, balanced against your rights
International Data Transfers
As our business operates from South Africa, your personal data may be transferred to and processed in South Africa. South Africa has been recognised by some jurisdictions as providing adequate data protection, though it is not currently listed among the countries with an EU adequacy decision.
When we transfer personal data from the EEA, we implement appropriate safeguards, which may include:
- Standard contractual clauses approved by the European Commission
- Your explicit consent to the transfer
- Transfers necessary for the performance of a contract
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods include:
- Enquiry data: 3 years from last contact
- Booking records: 7 years for tax and legal compliance
- Marketing preferences: Until you withdraw consent
Exercising Your Rights
To exercise any of your GDPR rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases, we may extend this period by up to two additional months, and we will inform you of any such extension.
We may need to verify your identity before processing your request. This is to protect your data and ensure that requests come from the data subject or an authorised representative.
Complaints
If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. If you are located in the EEA, you can contact your local data protection authority.
Updates to This Information
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. We encourage you to review this page periodically.