Last Updated: 01.11.2026
1. Introduction
This Privacy Policy explains how personal data is collected, processed, stored, and protected when users access or interact with the MTP-Exchange Marketplace, available at https://mtpexchange.com ("Platform").
The Platform is operated by China Africa Meaningful Tourism Partnership NPC (CAMTP), based in Century City, South Africa ("Platform Operator").
We are committed to protecting personal data and processing it in accordance with applicable data protection legislation, including the South African Protection of Personal Information Act (POPIA) and the European Union General Data Protection Regulation (GDPR), where applicable.
This Privacy Policy applies to visitors, registered users, customers, and business representatives using the Platform.
2. Data Controller and Contact Information
For personal data processing activities under its responsibility, the data controller is:
Company Name: China Africa Meaningful Tourism Partnership NPC (CAMTP)
Location: Century City, South Africa
Postal Address: Postnet Suite 2029; Private Bag X2, Century City, 7446, South Africa
Email: mtpexchange@camtp.net
Data Protection Contact: mtpexchange@camtp.net
Depending on the specific processing activity, independent Sellers and other service providers may act as separate data controllers.
Where the Platform Operator processes personal data exclusively on behalf of another controller, the relevant contractual data processing arrangements apply.
3. Personal Data We Collect
Depending on how users interact with the Platform, the following categories of personal data may be processed.
3.1 Personal Identification Data
- First and last name.
- Email address.
- Telephone number.
- Postal address, where required.
- Country of residence.
- Other identification details necessary for specific bookings.
3.2 Account Information
- Account registration details.
- Login identifiers.
- Authentication and security information.
- User preferences and account settings.
- Account activity and access records.
3.3 Booking and Reservation Information
- Selected tourism products and services.
- Booking dates and reservation details.
- Number and categories of participants.
- Traveler information required by the Seller.
- Special requests and booking preferences.
- Booking confirmations, cancellations, and modifications.
Additional personal information may be required for certain services, depending on the Seller and the applicable legal requirements.
3.4 Payment and Transaction Information
The Platform integrates third-party payment service providers to facilitate transactions between customers and Sellers.
Customer payments are processed through the respective Seller's payment service provider account.
The Platform Operator does not receive customer payments into its own accounts.
Depending on the integration, the Platform may process transaction identifiers, payment status, amounts, currencies, and payment-related technical information.
Payment card information is handled by the relevant payment service provider according to its own security and data protection requirements.
3.5 Technical and Usage Data
When users access the Platform, technical information may be collected, including:
- IP address.
- Browser type and version.
- Device and operating system information.
- Access timestamps.
- Requested pages and resources.
- Technical error and security logs.
- Cookie identifiers and similar technical information, where applicable.
3.6 Communication Data
When users contact us, we may process their name, contact information, message content, and related correspondence to respond to inquiries and provide support.
4. Purposes and Legal Bases of Processing
Personal data is processed only where an applicable legal basis exists.
| Processing Purpose | GDPR Legal Basis |
|---|---|
| Providing user accounts and contractual Platform services | Article 6(1)(b), where processing is necessary for a contract |
| Processing bookings and reservations | Article 6(1)(b), where applicable |
| Responding to inquiries and providing support | Article 6(1)(b) or 6(1)(f), depending on the circumstances |
| Maintaining technical security and preventing misuse | Article 6(1)(f) |
| Fulfilling statutory accounting and legal obligations | Article 6(1)(c) |
| Optional analytics and marketing technologies | Article 6(1)(a), where consent is required |
| Improving Platform reliability and functionality | Article 6(1)(f), where a legitimate-interest assessment supports the processing |
Where consent is the legal basis, users may withdraw their consent at any time with effect for the future.
The applicable legal basis depends on the actual processing activity and the relationship between the parties.
5. Booking Data and Independent Sellers
MTP-Exchange provides the technical infrastructure through which independent Sellers offer tourism products and services.
When a customer makes a booking, personal data necessary for the transaction may be made available to the relevant Seller or contractual service provider.
The Seller uses this information to manage reservations, communicate with customers, fulfill contractual obligations, and deliver the purchased service.
Independent Sellers are responsible for their own data processing activities where they act as separate data controllers.
The Platform Operator may also process booking-related information for technical operation, transaction management, security, and other legally permitted purposes.
The allocation of data protection responsibilities depends on the actual processing activities and applicable contractual arrangements.
6. Payment Processing
Online payments are processed using external payment service providers integrated into the Platform.
Each Seller uses its own authorized payment service provider account and associated credentials.
The Platform Operator does not operate a shared merchant account for customer transactions and does not receive customer funds.
Payment service providers may process personal and financial information necessary to authorize, execute, and verify transactions.
The relevant payment service provider's privacy policy applies to its independent processing activities.
7. Cookies and Similar Technologies
The Platform may use cookies and similar technologies for authentication, session management, security, user preferences, and other permitted purposes.
Technologies that are strictly necessary for providing a service requested by the user may be used without consent where permitted by applicable law.
Optional analytics, advertising, or other non-essential technologies requiring consent will be activated only after the relevant consent has been obtained.
Further information is available in our Cookies Policy:
https://mtpexchange.com/Home/Cookies
8. Data Sharing and Recipients
Personal data may be disclosed to the following categories of recipients where necessary and legally permitted:
- Relevant Sellers and contractual service providers.
- Payment service providers.
- Hosting and cloud infrastructure providers.
- Technical service providers supporting Platform operations.
- Email and communication service providers.
- Professional advisers where necessary.
- Public authorities where disclosure is legally required.
We do not sell personal data to third parties.
Personal data is shared only where an appropriate legal basis exists and, where required, contractual data protection safeguards are in place.
9. International Data Transfers
The Platform may support transactions involving customers, Sellers, and service providers located in different countries.
Where personal data is transferred outside the European Economic Area, applicable GDPR requirements must be respected.
Depending on the circumstances, transfers may rely on:
- An adequacy decision adopted by the European Commission.
- Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.
- Another lawful transfer mechanism under Chapter V GDPR.
Where applicable, users may request further information about the safeguards used for international transfers by contacting mtpexchange@camtp.net.
10. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, subject to applicable legal retention requirements.
Retention periods depend on the type of data, the relevant processing activity, and applicable statutory obligations.
Account data is retained while needed to provide and administer the account, and thereafter only as required for legitimate purposes or legal obligations. Booking and transaction records are retained as necessary to administer bookings, resolve disputes, and comply with applicable accounting and other statutory requirements. Technical logs and support communications are retained for operational, security, and support purposes only for as long as necessary.
Where retention is no longer necessary and no legal obligation requires continued storage, personal data will be deleted or anonymized as appropriate.
11. Data Security
The Platform Operator implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.
Such measures may include access controls, encrypted communications, authentication mechanisms, monitoring, and other security procedures appropriate to the risks involved.
No internet-based system can guarantee absolute security. Security measures are reviewed and adjusted as appropriate.
12. Rights of Data Subjects
Under the GDPR, individuals may have the following rights, subject to applicable legal conditions:
- Right of Access: Request information about personal data being processed.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of personal data where the legal requirements are met.
- Right to Restriction: Request restriction of processing in certain circumstances.
- Right to Data Portability: Receive certain personal data in a structured, commonly used, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or to direct marketing.
- Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting the lawfulness of earlier processing.
Requests concerning processing performed by the Platform Operator may be submitted to:
mtpexchange@camtp.net
Where an independent Seller acts as the controller, requests concerning that Seller's processing may need to be addressed directly to the Seller.
13. Right to Lodge a Complaint
Individuals have the right to lodge a complaint with a competent data protection supervisory authority if they believe their personal data has been processed unlawfully.
For processing subject to South African law, complaints may be submitted to the SA Data Protection Authority: https://privacy-authority.sa.
This does not restrict the right to contact another competent supervisory authority under applicable law.
14. Marketing Communications
Where the Platform Operator sends marketing communications, personal data will be processed in accordance with applicable data protection and electronic communications laws.
Where consent is required, marketing communications will be sent only after valid consent has been obtained.
Recipients may withdraw their consent or object to direct marketing at any time using the available unsubscribe mechanism or by contacting mtpexchange@camtp.net.
15. Automated Decision-Making and Profiling
Where automated processing affects individuals, information about its purposes, significance, and available safeguards will be provided as required by applicable law. This notice does not assert that automated decisions with legal or similarly significant effects are currently used.
Where automated decision-making or profiling falls within Article 22 GDPR, the applicable information and safeguards will be provided as required by law.
16. Children's Personal Data
The Platform is primarily intended for adults making travel reservations or conducting tourism-related business activities.
Information about minors may be processed where necessary for travel bookings, subject to applicable law and the relevant contractual arrangements.
Where consent from a parent or legal guardian is legally required, appropriate authorization must be obtained.
17. External Websites and Third-Party Services
The Platform may contain links to external websites or integrate services operated by third parties.
These third parties may process personal data according to their own privacy policies.
Users should review the applicable privacy information before providing personal data directly to external services.
18. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect changes in legislation, Platform functionality, data processing activities, or technical operations.
The current version will be published at:
https://mtpexchange.com/Home/Privacy
Where required by law, users will be informed of material changes or asked to provide renewed consent.
19. Contact Information
For questions concerning this Privacy Policy or the processing of personal data, please contact:
Company: China Africa Meaningful Tourism Partnership NPC (CAMTP)
Location: Century City, South Africa
Postal Address: Postnet Suite 2029; Private Bag X2, Century City, 7446, South Africa
Phone: +27 77 265 82 93
General Contact: mtpexchange@camtp.net
Data Protection Contact: mtpexchange@camtp.net
Additional legal information is available in our Imprint:
https://mtpexchange.com/Home/Imprint
Last Updated: 01.11.2026