Privacy Policy | Clostavia

1. Scope of this notice

As an editorial catalogue and booking-enquiry directory for premier accommodation, Clostavia takes on a firm duty to protect individual records and to maintain transparency wherever readers interact with the service.

This document sets out what Clostavia collects, how it is organised and used, when it is transferred, and how it is protected when you browse the catalogue, read ratings, register a profile, or submit an accommodation request.

2. Information we collect

Delivering accurate lodging information, verified reviews, and dependable enquiry handling requires us to process the following categories:

Who you are and how to reach you: Your name, title, language preference, country or region, email contact, and telephone details provided during profile creation or enquiry submission.
Reservation preferences: Dates of travel, room configuration and category, bedding selection, dietary and accessibility requests, and loyalty programme identifiers.
Payment verification data: The cardholder's name, masked card identifiers, billing location, and confirmation tokens issued by certified payment intermediaries. Complete card numbers never reach Clostavia systems.
Technical and device data: IP address, browser version, operating system, referring pages, time zone, device identifiers, and interaction timestamps.

3. Why we process, and on what basis

We rely on contractual performance, legitimate interests, statutory compliance, or explicit consent as our lawful grounds. Within those, records serve these purposes:

Handling enquiries: Relaying your dates and requirements to the property's reservations desk so it can answer with current availability.
Editorial personalisation: Presenting hospitality rankings and reviews aligned with the regions and property categories you browse.
Fraud prevention and security: Defending the platform's infrastructure, checking that submissions are genuine, and protecting profiles from unauthorised access.
Service messages: Delivering enquiry acknowledgements, booking references, travel reminders, and critical service messages.
Meeting legal obligations: Meeting accounting, tax reporting, and record-keeping requirements set by the applicable administrative authorities.

4. Who receives your information

There is no sale, rental, or leasing of personal identifiers to unrelated commercial entities. Disclosures occur strictly under contractual protection to the parties below:

Partner properties: Selected properties are given only the name, arrival dates, and room details required to answer an enquiry or hold a room.
Certified payment gateways: Where payment is involved, encrypted billing details are routed to PCI-DSS validated processing partners.
Infrastructure providers: Enterprise-grade data centres and delivery networks store encrypted backups to maintain uptime and disaster resilience.
Authorities where the law requires: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies, storage, and analytics

We use cookies and local storage to recognise returning readers, retain display preferences, measure performance, and keep sessions intact. Browser settings give you full control over these, though disabling essential cookies will limit parts of the enquiry process.

6. Safeguards and how long we keep records

We apply multi-layered administrative, technological, and physical defences — TLS 1.3 transport encryption, AES-256 storage encryption, separated database clusters, and access limited by role — to guard against unauthorised access, loss, or alteration.

Records are held only as long as needed to complete an enquiry, resolve a question, satisfy audit requirements, or meet a statutory retention period. Once that period ends, records are permanently erased or irreversibly anonymised.

7. Rights and choices available to you

Where your jurisdiction provides them, and once we have verified who you are, the following rights are available:

Right of access: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Correction: Ask us to fix any record that is inaccurate, incomplete, or no longer current.
Erasure: Have your data removed once processing is no longer required by law or by the purpose it served.
Limiting processing: Limit how we process your data while accuracy or a legitimate interest is being examined.

Choices you can exercise

You have the right to control how your personal information is collected and used. Depending on your location and the laws that apply to you, the following opt-out choices are available:

Sale or sharing of personal information: Where the CCPA/CPRA in California or similar laws in other jurisdictions apply, you can opt out of your personal information being sold or shared with third parties. We do not sell personal information in the ordinary meaning of the term, though some data is shared with trusted partners to deliver or improve the service.
Tracking technologies: Cookies and similar tracking tools can be managed or declined via your browser configuration or the consent controls published on this website.
Promotional email: You can stop receiving promotional email or newsletters at any time by using the unsubscribe link in any message, or by contacting us directly.
Withdrawal of consent: Any consent you have given may be withdrawn at any point. Doing so does not render unlawful the processing that occurred before withdrawal.

Write to [email protected], or use the contact form on this site, to exercise any right or lodge an opt-out request.

8. Changes to this notice

Clostavia may revise this notice to reflect regulatory developments or changes to the service. Material amendments appear on this page with a new effective date, and continued use of the site after publication indicates acceptance of the revised terms.