Privacy Policy

Last updated: September 2026

1. Who We Are

This website is operated by:

Our website address is: phoo-na.com

The operator of this website is responsible for the processing of personal data described in this Privacy Policy.

2. Personal Data We Collect

We only collect personal data where necessary to operate our website, communicate with guests, process enquiries and bookings, provide accommodation services, fulfil legal obligations, and maintain the security of our website.

Depending on how you use the website, we may collect:

• Name and contact details
• Email address
• Telephone number
• Address and country of residence
• Information submitted through enquiry or contact forms
• Booking and accommodation details, including arrival and departure dates and number of guests
• Information voluntarily provided in messages or special requests
• Payment and transaction information where applicable
• IP address, browser type, device information and technical website data
• Cookie and consent information
• Information required by law in connection with guest registration or accommodation

We do not intentionally collect sensitive personal information unless it is necessary for your request and you choose to provide it.

3. Enquiries and Contact Forms

When you contact us through our website, email, telephone or a contact form, we process the information you provide in order to respond to your enquiry.

This may include your name, email address, telephone number, requested dates, number of guests and the content of your message.

We retain correspondence only for as long as reasonably necessary to process your enquiry, maintain appropriate business records and comply with applicable legal requirements.

4. Reservations and Bookings

If you make or request a reservation, we process the information necessary to manage your booking and provide the requested accommodation.

This may include your contact information, booking dates, number of guests, booking preferences, payment information and other information required to fulfil the reservation.

Where bookings are handled through a third-party booking platform, payment provider or reservation system, that provider may process personal data according to its own privacy policy.

Booking system/platform used: email or booking.com

5. Payments

Where online payments are available, payment information may be processed by an external payment service provider.

We do not receive or store complete credit or debit card details where payment is handled directly by a third-party payment provider.

Payment provider: [at resort or online platform]

The respective provider’s privacy policy applies to its processing of payment information.

6. Cookies

Our website may use cookies and similar technologies.

Cookies are small files stored on your device that allow websites to function correctly, remember preferences and, where you have consented, collect information about website usage.

Cookies may include:

Essential cookies required for the operation and security of the website.

Preference cookies that remember choices you have made.

Analytics cookies that help us understand how visitors use the website.

Third-party cookies that may be created when external services such as maps, videos, booking systems or social-media content are integrated into the website.

Where required by applicable law, non-essential cookies are only activated after you have given your consent.

You can withdraw or modify your cookie consent at any time through the website’s cookie settings, where available.

7. Website Analytics

We may use analytics services to understand how visitors use our website and to improve its performance and content.

Depending on the service used, information such as visited pages, approximate location, device type, browser, time spent on the website and interactions with the website may be processed.

Where consent is legally required, analytics tracking will only be activated after you have provided your consent.

If Google Analytics is being used, this section should be expanded to specifically identify Google, the relevant data transfers and your consent mechanism.

8. Embedded Content and Third-Party Services

Our website may contain or integrate content and services from third parties, such as maps, videos, social-media services, booking systems or external widgets.

When such content is loaded, the third-party provider may receive technical information including your IP address and information about your browser or device. The provider may also use cookies or similar technologies.

Examples may include:

Google Maps – for maps and directions
YouTube/Vimeo – for video content

Only services actually used on the website should be listed here.

9. Server Logs and Website Security

When you visit our website, our web server may automatically record technical information necessary to deliver and protect the website.

This may include:

• IP address
• Date and time of access
• Requested page or file
• Browser and operating system
• Referring website
• Technical error and security information

This information may be processed to maintain website functionality, investigate technical problems, prevent misuse and protect the website against attacks.

10. Website Hosting

Our website is hosted by:

[Hostinger.com]

The hosting provider may process technical data, including IP addresses and server log information, as necessary to provide and secure the hosting service.

Where required, we maintain appropriate data-processing arrangements with service providers that process personal data on our behalf.

11. Who We Share Personal Data With

We do not sell personal data.

We may share personal information where necessary with service providers involved in operating our website and accommodation business, including:

• Website hosting and IT providers
• Email and communication providers
• Public authorities where disclosure is required by law

Service providers are only given access to information required to perform their respective services.

12. How Long We Keep Personal Data

We retain personal information only for as long as necessary for the purpose for which it was collected or as required by applicable law.

Enquiry information is generally retained only as long as necessary to handle the enquiry and related correspondence.

Booking, invoice and transaction records may be retained for longer periods where required by tax, accounting, accommodation or other legal obligations.

Technical and security logs are generally retained for a limited period unless longer retention is required to investigate a security incident.

13. Your Data Protection Rights

Depending on the laws applicable to you and to our business, you may have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data
• Request restriction of processing
• Object to certain processing
• Request portability of your personal data
• Withdraw previously given consent
• Lodge a complaint with the competent data-protection authority

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

14. Legal Basis for Processing

Where GDPR or comparable data-protection legislation applies, we process personal information on one or more of the following legal grounds:

Contractual necessity – where processing is required to respond to a booking request, administer a reservation or provide accommodation.

Legal obligation – where we are required to retain or disclose information under applicable law.

Legitimate interests – where processing is reasonably necessary to operate, secure and improve our website and business, provided those interests do not override your fundamental rights.

Consent – where you have expressly agreed to processing, for example certain analytics, marketing or non-essential cookies.

15. Data Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include encrypted HTTPS connections, controlled administrative access, software updates, backups, security monitoring and access restrictions.

No internet-based system can, however, guarantee absolute security.

16. Children’s Privacy

Our website and accommodation services are not designed to collect personal information directly from children without the involvement of a parent or legal guardian.

Where information concerning children is necessary for a reservation or legal guest-registration requirement, it should be provided by the responsible adult.

17. Links to Other Websites

Our website may contain links to external websites.

We are not responsible for the privacy practices or content of third-party websites. We recommend reviewing the privacy policy of any external website you visit.

18. Changes to This Privacy Policy

We may update this Privacy Policy when our website, services, legal obligations or data-processing practices change.

The latest version will always be published on this page together with the date of the most recent update.

25. Contact

For questions about this Privacy Policy or the processing of your personal information, contact:

info@phoo-na.com