Privacy Policy | Estarvio

1. Scope of this notice

Estarvio publishes hospitality reviews and passes reservation enquiries to properties. Guarding personal data and explaining our handling of it clearly is an obligation we hold across all reader touchpoints.

Below we explain the categories Estarvio gathers, the purposes they serve, the parties they may reach, and the safeguards applied — whether you are reading rankings, creating a profile, or sending a stay enquiry.

2. What we collect through the service

The following categories are collected so that we can provide accurate availability, verified editorial assessments, and reliable confirmations:

Personal identity and contact information: Full name, form of address, preferred language, region of residence, email address, and any telephone number you supply when registering or submitting an enquiry.
Reservation preferences: Check-in and check-out dates, room type and bedding choice, suite tier, dietary requirements, accessibility needs, and hotel loyalty references.
Payment verification data: Cardholder name, truncated card indicators, billing address, and transaction confirmation tokens handled by accredited payment processors. Full card numbers are never stored on Estarvio servers.
Device telemetry and technical metadata: Your IP address, browser build, operating system, the page that referred you, time zone setting, device identifiers, and timestamps for page interactions.

3. Legal grounds and operational purposes

Estarvio processes records only where a recognised legal basis applies: performance of a contract, legitimate business interest, compliance with a statutory duty, or your explicit consent. The operational purposes are:

Handling enquiries: Relaying your dates and requirements to the property's reservations desk so it can answer with current availability.
Content customisation: Shaping featured rankings and travel guidance around your preferred destinations and resort types.
Security and verification: Safeguarding digital infrastructure, validating the legitimacy of transactions, and shielding users from unauthorised profile access.
Keeping you informed: Sending enquiry updates, confirmations, itinerary reminders, and necessary customer service notices.
Regulatory compliance: Fulfilling financial disclosure rules, tax obligations, and other legal mandates that apply to our operations.

4. Disclosure and partners

Personal identifiers are never sold, rented, or leased to unaffiliated businesses. Data moves only where a contract governs it, and only to these recipients:

Partner properties: Listed hotels receive the minimum needed — name, travel dates, and room requirements — to process your request.
Payment processors: Billing information travels encrypted to accredited payment gateways that maintain current PCI-DSS validation.
Technical infrastructure partners: Tier-1 data centres and content delivery networks hold encrypted backups so the service stays available and recoverable.
Authorities where the law requires: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies, storage, and analytics

Cookies and browser storage let us recognise repeat visitors, remember currency and layout preferences, evaluate site performance, and preserve session integrity. You retain complete control through your browser, but switching off essential cookies degrades enquiry functionality.

6. Storage protection and retention

Protection is layered across administrative, technical, and physical measures: encrypted transport under TLS 1.3, AES-256 encryption at rest, isolated database clusters, and credentials restricted by role.

Records are held only as long as needed to complete an enquiry, resolve a question, satisfy audit requirements, or meet a statutory retention period. Once that period ends, records are permanently erased or irreversibly anonymised.

7. Rights and choices available to you

Subject to verification of your identity and the law in your jurisdiction, you may exercise the following:

Access: Request a transferable copy of your stored records and verify our handling procedures.
Rectification: Have inaccurate, incomplete, or outdated details corrected without undue delay.
Erasure: Request deletion of your records where we no longer have a legal reason to retain them.
Restriction: Restrict our use of your data during any dispute over accuracy or over our grounds for processing.

Your opt-out options

How your personal information is gathered and used remains under your control. Subject to your location and the applicable legislation, you may exercise these opt-outs:

Sharing and sale of your data: Under the CCPA/CPRA and equivalent statutes elsewhere, you may refuse the sale or sharing of your personal information with third parties. Although we do not sell personal information in the traditional sense, limited data may reach trusted partners so that we can provide or improve our services.
Cookies and tracking: Use your browser's settings, or the consent tool on this site, to manage or reject cookies and other tracking technologies.
Promotional email: You can stop receiving promotional email or newsletters at any time by using the unsubscribe link in any message, or by contacting us directly.
Withdrawing consent: Consent given earlier can be withdrawn whenever you choose, without affecting the lawfulness of any processing that took place while the consent was in force.

Requests to exercise these rights, or to opt out, can be sent to [email protected] or submitted through our contact form.

8. Changes to this notice

This notice may be refined periodically in line with legal or architectural change. Any material modification is reflected on this page with an updated date, and further use of the service constitutes acknowledgement.