Privacy & Cookies Policy

Privacy & Cookies Policy

Cango Wildlife Ranch (Pty) Ltd | Last updated 21 October 2026

This policy has two parts. Part A covers our websites, cookies and newsletters. Part B is our Privacy Notice for bookings, stays and programmes, which applies when you book or stay with us as a volunteer, intern or BOA Pods guest. Your rights, and how to contact our Information Officer, are set out in Part B and apply to both parts.

PAIA Manual: our manual under the Promotion of Access to Information Act explains how to request access to records we hold. Download the PAIA Manual (PDF).

Part A: Websites, cookies and newsletters

Applies to: www.cangowildlife.com, www.cango.co.za, www.wildanimalvolunteers.com, the Cango Digest newsletter and the Cheetah Chatter newsletter.

Responsible party: Cango Wildlife Ranch (Pty) Ltd, 191 Baron van Reede Street, Oudtshoorn, 6620, South Africa.

What we collect

  • When you visit our websites: your IP address, browser and device type, the pages you view, the site that referred you and the time of your visit. We collect this through cookies, log files and similar technologies.
  • When you sign up for a newsletter: your name and email address, and your phone number if you choose to give it.
  • When you contact us: the information you send us by form, email or social media.
  • Day-visit tickets and experiences bought online are processed by Activitar on our behalf.

How we use it

  • To send the newsletters you signed up for
  • To answer your enquiries
  • To understand how our websites are used and to improve them
  • To keep our websites secure and prevent fraud
  • To show you relevant advertising on other websites and social media, where your cookie settings allow it

Cookies

We use cookies to make our websites work, to measure traffic (Google Analytics) and to support social media and advertising features. You can block or delete cookies in your browser settings. Our websites will still work, although some features may not. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Who we share it with

  • Springnest, our website provider
  • Google, for analytics and advertising
  • Activitar, for online ticket sales
  • Meta (Facebook and Instagram), for social media features and advertising
  • Our email newsletter service
  • Authorities, where the law requires it

Some of these providers store information outside South Africa. We transfer information only as POPIA section 72 allows (see Part B, section 7). We do not sell your information.

Newsletters

We send newsletters only to people who have signed up. Every newsletter has an unsubscribe link, and you can also unsubscribe by emailing operations@cango.co.za.

How long we keep it

Newsletter details: until you unsubscribe. Enquiries and website data: only as long as we need them for the purposes above, after which we delete or de-identify them.

Part B: Privacy Notice: bookings, stays and programmes

Download: Privacy Notice v1.0 (PDF)

Zindalo Group: Bookings, Stays and Programmes

Version 1.0 | Effective 19 October 2026 | Last updated 19 October 2026

This notice explains how we collect, use, share and protect personal information when you book or stay with us as a volunteer, intern or private guest at BOA Lodge and BOA Pods. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA) and, where they apply to you, the UK General Data Protection Regulation and the EU General Data Protection Regulation (GDPR).

1. Who we are

The party responsible for your information (the "responsible party" under POPIA, the "controller" under GDPR) is the company you book with:

  • Volunteer and Intern Programmes and BOA Lodge stays: Responsible party: Cango Wildlife Ranch (Pty) Ltd; Registration: 1988/003501/07; Address: 191 Baron van Reede Street, Oudtshoorn, 6620, Western Cape, South Africa
  • BOA Pods private stays: Responsible party: Zindagos Accommodation (Pty) Ltd, with Cango Wildlife Ranch (Pty) Ltd operating the Pods and handling your information on its behalf; Registration: 2026/432823/07; Address: 191 Baron van Reede Street, Oudtshoorn, 6620, Western Cape, South Africa
  • Placements arranged through Animal Volunteers Africa: Responsible party: Animal Volunteers Africa Ltd; Registration: UK company no. 16668863; Address: 15 Margaret Close, Bognor Regis, PO21 3AA, United Kingdom

Cango Wildlife Ranch (Pty) Ltd, Zindagos Accommodation (Pty) Ltd, Because of Animals Foundation NPC and Cango Academy (Pty) Ltd are companies in the Zindalo Group. Animal Volunteers Africa Ltd is a UK company outside the Zindalo Group that places volunteers and interns with us. In this notice, "we" and "us" mean these companies. Where they share information with each other, they do so under a written data-sharing agreement.

Information Officer: Douglas Eriksen, operations@cango.co.za, +27 44 272 5593

Deputy Information Officer: Annelize Greeff, operations@cango.co.za

UK contact (Animal Volunteers Africa Ltd): Douglas Eriksen, douglas@zindalo.org

2. What we collect

From everyone who books

  • Name, email address, phone number, country of residence
  • Booking details: dates, accommodation, programme, price, payment status
  • Payment information. Card payments are handled by our payment providers, Stripe and Yoco. We do not see or store your full card number; we keep a secure reference (token) so that we can charge the card for amounts you have authorised (see your Terms & Conditions).
  • Messages you send us by email, WhatsApp, phone or social media
  • Records of the documents you accepted (version, date, time, IP address and device)

From volunteers and interns, in addition

  • Date of birth, nationality, passport or ID details (where needed for visa support letters)
  • Emergency contact details
  • Travel insurance details
  • Travel and arrival details
  • Health information in your Medical Declaration (for example allergies, conditions, medication, tetanus vaccination date, dietary requirements), and results of any alcohol or drug test carried out under the Code of Conduct
  • Criminal record declaration given at booking
  • Programme records: attendance, performance, incidents, certificates and references
  • Photographs and video, only if you agree (see section 5)

From private guests, in addition

  • Names of other guests in your booking and whether any guest is under 18
  • Dietary requirements, if you tell us, so that we can serve you safely
  • Room service, laundry and other extras charged to your stay

From everyone on our premises

  • CCTV footage of public areas, parking and access points
  • Incident and first-aid records if something happens during your stay

3. Why we use it, and our lawful basis

  • Taking and managing your booking, payment and stay: Performance of our contract with you
  • Running the programme, induction, supervision, certificates and references: Performance of our contract with you
  • Safety, emergencies, first aid and incident records: Contract; legitimate interest in keeping people and animals safe; protecting your vital interests in an emergency
  • Charging your card for authorised extras and damage: Contract
  • Tax, accounting and other legal record-keeping: Legal obligation
  • CCTV and site security: Legitimate interest in security, anti-poaching and the protection of people, animals and property
  • Handling complaints and legal claims: Legitimate interest in establishing, exercising or defending legal claims
  • Volunteer and Intern WhatsApp group: Contract (safety and day-to-day coordination)
  • Health information: Your explicit consent (POPIA s27(1)(a); GDPR Art 9(2)(a)), and protection of vital interests in an emergency
  • Criminal record declaration: Your consent (POPIA s27(1)(a))
  • Marketing messages: Your consent, which you can withdraw at any time
  • Photographs and video for marketing: Your consent, which you can withdraw at any time for future use

You can object to processing based on legitimate interest by contacting the Information Officer (POPIA s11(3)).

4. Special personal information and children

Health information. We use it only to keep you, other people and the animals safe, to plan your duties, and to deal with emergencies. Access is limited to the Volunteer and Intern Manager, your host and, in an emergency, the people who need it to help you.

Criminal record declaration. We use it only to confirm eligibility for the programme. We do not run criminal record checks without asking you first. We delete the declaration 12 months after your programme ends unless it is needed for a legal claim.

Children. Volunteers and interns must be 18 or older at booking. Private guests under 18 must stay with a parent, guardian or adult who has their parent's or guardian's permission. We process a child's information only with the consent of the person booking for them as parent or guardian, or with that parent's or guardian's permission (POPIA s35).

5. Your choices

  • Marketing by email and WhatsApp: How to give it: Optional tick box at checkout; How to withdraw it: "Unsubscribe" link, reply STOP on WhatsApp, or email operations@cango.co.za
  • Photographs and video for marketing: How to give it: Optional tick box in the Confirmation Form; How to withdraw it: Email operations@cango.co.za. We will stop new use; material already printed or published may remain.
  • Testimonials: How to give it: Optional tick box in the Confirmation Form; How to withdraw it: Email operations@cango.co.za

Saying no to any of these does not affect your booking.

6. Who we share it with

We share only what each recipient needs:

  • Other Zindalo Group companies, and Animal Volunteers Africa Ltd, to deliver your booking and programme
  • Service providers who process information for us ("operators" under POPIA, "processors" under GDPR), bound by written contracts:
    • Bookinglayer (booking system, hosted in the Netherlands)
    • Stripe and Yoco (card payments)
    • Microsoft (email)
    • Meta Platforms (WhatsApp) for messaging
    • Activitar for day experience bookings
  • Your referring agency, if you booked through one (for example Loop Abroad, GoEco), to coordinate your placement
  • Medical providers, emergency services, insurers and your emergency contact, when needed for your safety
  • Authorities, where the law requires it
  • Professional advisers (lawyers, auditors, insurers) where needed

WhatsApp group. If you are a volunteer or intern, you will be added to the programme WhatsApp group. Your name and number will be visible to other participants and hosts in that group. Tell us if you would prefer to receive messages directly instead.

We do not sell your information.

7. Transfers outside South Africa

Some recipients are outside South Africa, including Animal Volunteers Africa Ltd (United Kingdom), Bookinglayer (Netherlands), Stripe, Microsoft, Meta Platforms (WhatsApp), and referring agencies in your home country. We transfer information only where (POPIA s72):

  • the recipient is bound by law, binding corporate rules or a written agreement giving protection substantially similar to POPIA; or
  • the transfer is necessary to perform our contract with you (for example, communicating with your agency or insurer).

Where UK or EU GDPR applies, we use an adequacy decision or standard contractual clauses for transfers.

8. How long we keep it

  • Booking, payment and accounting records: 5 years after the end of the tax year (Tax Administration Act), or 7 years where the Companies Act requires
  • Accepted documents (Terms & Conditions, Volunteer and Intern Agreement, Code of Conduct) and acceptance logs: 5 years after your stay
  • Incident, injury and first-aid records: 5 years after the incident, or longer if a claim is made
  • Health information: 12 months after your programme ends, unless linked to an incident
  • Criminal record declaration: 12 months after your programme ends
  • CCTV footage: 30 days, unless needed for an incident or investigation
  • Marketing list: Until you unsubscribe
  • Photographs and video (with consent): Until you withdraw consent, for future use

After these periods we delete or de-identify the information.

9. How we protect it

Our accounting records are kept in Sage Pastel on our own computer systems. We use access controls, password-protected systems, encrypted payment processing through our payment provider, and staff confidentiality obligations. If a security compromise is likely to affect you, we will notify you and the Information Regulator as POPIA s22 requires.

10. Your rights

Under POPIA, and GDPR where it applies, you may:

  • ask whether we hold information about you and request a copy
  • ask us to correct, update or delete it
  • object to processing based on legitimate interest, and object to direct marketing at any time
  • withdraw consent at any time (this does not affect processing that already took place)
  • where GDPR applies, ask us to restrict processing or to transfer your information to you or another provider

Send requests to the Information Officer at operations@cango.co.za. We may need to confirm your identity. Requests for records may also be made under our PAIA Manual (PAIA Manual (PDF)).

We do not make decisions about you based solely on automated processing.

Complaints. Please contact us first so that we can try to resolve your concern. You may also complain to:

  • South Africa: the Information Regulator, www.inforegulator.org.za
  • United Kingdom: the Information Commissioner's Office, ico.org.uk
  • European Union: the data protection authority in your country of residence

11. Changes to this notice

We will publish any changes on this page with a new version number and date. If a change materially affects how we use information you have already given us, we will tell you.

12. Contact

Douglas Eriksen, Information Officer

operations@cango.co.za | +27 44 272 5593

191 Baron van Reede Street, Oudtshoorn, 6620, South Africa