1. Introduction

We value your privacy and are committed to protecting the personal data you share with us through our website, including contact form submissions and booking information. This policy explains what information we collect, how we use it, how long we keep it, and your rights under applicable data protection laws (e.g., the EU General Data Protection Regulation—or “GDPR”—and the California Consumer Privacy Act—or “CCPA”).

2. Data We Collect

• Contact Form Inquiries: Name, email address, phone number (optional), and any message content you provide.
• Booking Module: Name, email, phone number, postal address, payment details (processed securely by our payment provider), reservation dates, special requests, and stay history.
• Cookies & Tracking: We use cookies (strictly necessary, functional, analytics, and advertising) and similar technologies (e.g., Google Analytics) to improve site performance and tailor marketing. You can manage consent preferences via our cookie banner.

3. Purpose and Legal Basis for Processing

• Contact Inquiries: To respond to your questions and provide customer support (legitimate interest).
• Bookings & Payments: To fulfill reservations, process payments, send confirmations, and manage cancellations (contractual necessity).
• Marketing & Analytics: With your consent, to send newsletters and promotional offers, and to analyze website usage (consent).

4. Data Retention & Deletion We retain personal data only as long as necessary for the purposes listed, or as required by law. Specifically:

Data Type	Retention Period	Rationale
Contact Form Inquiries	3 years	For follow‑up, support history
Booking & Payment Records	7 years	Tax and accounting requirements
Analytics & Advertising Cookies	2 years	Standard industry practice

After each retention period expires, we will securely delete or anonymize your data.

5. Data Sharing & Transfers We may share your data with:

• Service Providers: Payment processors, email platforms, website hosting, and analytics providers—under strict confidentiality and data‑processing agreements.
• Legal Authorities: If required by law (e.g., tax authorities, courts).

Your data is stored on secure servers within the EU.

6. Data Security We implement appropriate technical (e.g., encryption in transit and at rest) and organizational measures (e.g., access controls, staff training) to safeguard your data against unauthorized access, alteration, or loss.

7. Your Rights Under GDPR/CCPA, you have the right to:

• Access, correct, or delete your personal data
• Restrict or object to certain processing
• Data portability
• Withdraw consent at any time (without affecting processing prior to withdrawal)
• Lodge a complaint with a supervisory authority

To exercise your rights, please contact us at info@thepinkbananacv.com .

8. Children’s Privacy Our site is not intended to be used by children under 16. We do not knowingly collect or store data from minors.

9. Changes to This Policy We may update this privacy policy periodically. Changes will be posted here with a revised “Last updated” date. We encourage you to review it regularly.