Privacy Policy | Hastovena

1. Scope and application

Hastovena operates as an editorial directory and enquiry service covering resort hotels and hospitality destinations. Protecting the personal information readers entrust to us, and being transparent about how it is handled, is a standing obligation across every part of the service.

What follows describes how Hastovena collects, structures, uses, shares, and secures your details as you navigate the catalogue, review destination ratings, set up a guest profile, or complete an accommodation request.

2. Categories of information gathered

The following categories are collected so that we can provide accurate availability, verified editorial assessments, and reliable confirmations:

Who you are and how to reach you: Full name, form of address, preferred language, region of residence, email address, and any telephone number you supply when registering or submitting an enquiry.
Reservation preferences: Dates of travel, room configuration and category, bedding selection, dietary and accessibility requests, and loyalty programme identifiers.
Billing verification records: Cardholder name, truncated card indicators, billing address, and transaction confirmation tokens handled by accredited payment processors. Full card numbers are never stored on Hastovena servers.
Device telemetry and technical metadata: Your IP address, browser build, operating system, the page that referred you, time zone setting, device identifiers, and timestamps for page interactions.

3. Lawful bases and purposes

Hastovena processes records only where a recognised legal basis applies: performance of a contract, legitimate business interest, compliance with a statutory duty, or your explicit consent. The operational purposes are:

Passing on your request: Forwarding your stay details to the relevant property so it can respond on availability and prepare for arrival.
Content customisation: Adjusting the rankings and guides we surface to match the destinations and property styles you have shown interest in.
Security and verification: Safeguarding digital infrastructure, validating the legitimacy of transactions, and shielding users from unauthorised profile access.
Operational communication: Sending enquiry updates, confirmations, itinerary reminders, and necessary customer service notices.
Regulatory compliance: Meeting accounting, tax reporting, and record-keeping requirements set by the applicable administrative authorities.

4. Who receives your information

There is no sale, rental, or leasing of personal identifiers to unrelated commercial entities. Disclosures occur strictly under contractual protection to the parties below:

The hotels themselves: Listed hotels receive the minimum needed — name, travel dates, and room requirements — to process your request.
Accredited payment intermediaries: Where payment is involved, encrypted billing details are routed to PCI-DSS validated processing partners.
Technical infrastructure partners: Encrypted database backups sit with tier-1 hosting and content distribution providers to ensure availability.
Legal and regulatory authorities: Information may be released where a lawful subpoena, court order, or official mandate requires it, or to protect vital interests.

5. Cookies and analytics

Cookies and browser storage let us recognise repeat visitors, remember currency and layout preferences, evaluate site performance, and preserve session integrity. You retain complete control through your browser, but switching off essential cookies degrades enquiry functionality.

6. Safeguards and how long we keep records

Protection is layered across administrative, technical, and physical measures: encrypted transport under TLS 1.3, AES-256 encryption at rest, isolated database clusters, and credentials restricted by role.

Retention lasts no longer than the enquiry, any related correspondence, audit obligations, or a statutory holding period demand. At expiry, records are erased permanently or anonymised irrevocably.

7. Rights and choices available to you

Where your jurisdiction provides them, and once we have verified who you are, the following rights are available:

Right of access: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Right to correction: Request prompt correction of profile information that is wrong, partial, or out of date.
Erasure: Ask for records to be deleted where no statutory or contractual basis for keeping them remains.
Right to restrict processing: Limit how we process your data while accuracy or a legitimate interest is being examined.

Choices you can exercise

How your personal information is gathered and used remains under your control. Subject to your location and the applicable legislation, you may exercise these opt-outs:

Data sharing and sale: Under the CCPA/CPRA and equivalent statutes elsewhere, you may refuse the sale or sharing of your personal information with third parties. Although we do not sell personal information in the traditional sense, limited data may reach trusted partners so that we can provide or improve our services.
Cookies and tracking: You can manage or refuse cookies and tracking technologies through your browser settings, or through the cookie consent tools provided on this site.
Marketing communications: Promotional email and newsletters can be discontinued through the unsubscribe link in any message or by contacting us directly.
Withdrawal of consent: Consent given earlier can be withdrawn whenever you choose, without affecting the lawfulness of any processing that took place while the consent was in force.

To exercise any of these rights, or to make an opt-out request, please contact us at [email protected] or use our contact form.

8. Revisions

Hastovena may revise this notice to reflect regulatory developments or changes to the service. Material amendments appear on this page with a new effective date, and continued use of the site after publication indicates acceptance of the revised terms.