Privacy Policy | Quirvanda

1. What this notice covers

Quirvanda operates as an editorial directory and enquiry service covering resort hotels and hospitality destinations. Protecting the personal information readers entrust to us, and being transparent about how it is handled, is a standing obligation across every part of the service.

What follows describes how Quirvanda collects, structures, uses, shares, and secures your details as you navigate the catalogue, review destination ratings, set up a guest profile, or complete an accommodation request.

2. Categories of information gathered

Delivering accurate lodging information, verified reviews, and dependable enquiry handling requires us to process the following categories:

Personal identity and contact information: Your name, title, language preference, country or region, email contact, and telephone details provided during profile creation or enquiry submission.
Reservation preferences: Check-in and check-out dates, room type and bedding choice, suite tier, dietary requirements, accessibility needs, and hotel loyalty references.
Billing verification records: Cardholder name, truncated card indicators, billing address, and transaction confirmation tokens handled by accredited payment processors. Full card numbers are never stored on Quirvanda servers.
Technical metadata: IP address, browser version, operating system, referring pages, time zone, device identifiers, and interaction timestamps.

3. Legal grounds and operational purposes

Processing takes place only under an established lawful ground — contractual necessity, legitimate interest, legal obligation, or consent you have given. Those grounds support the following purposes:

Enquiry fulfilment: Transmitting itinerary details to the partner resort so a room hold and arrival preparations can be arranged.
Editorial personalisation: Adjusting the rankings and guides we surface to match the destinations and property styles you have shown interest in.
Security and verification: Keeping the infrastructure secure, verifying that requests are legitimate, and preventing unauthorised access to reader profiles.
Operational communication: Sending enquiry updates, confirmations, itinerary reminders, and necessary customer service notices.
Meeting legal obligations: Meeting accounting, tax reporting, and record-keeping requirements set by the applicable administrative authorities.

4. Authorised disclosures

We do not sell, rent, or lease personal identifiers to unconnected commercial parties. Transfers happen only under contractual safeguards, and only to the following categories of recipient:

Hospitality partners: Resorts receive the guest name, dates, and accommodation specifics strictly necessary to respond to a request or honour a reservation.
Certified payment gateways: Billing information travels encrypted to accredited payment gateways that maintain current PCI-DSS validation.
Infrastructure providers: Enterprise-grade data centres and delivery networks store encrypted backups to maintain uptime and disaster resilience.
Courts and regulators: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies, storage, and analytics

Cookies and browser storage let us recognise repeat visitors, remember currency and layout preferences, evaluate site performance, and preserve session integrity. You retain complete control through your browser, but switching off essential cookies degrades enquiry functionality.

6. Storage protection and retention

Protection is layered across administrative, technical, and physical measures: encrypted transport under TLS 1.3, AES-256 encryption at rest, isolated database clusters, and credentials restricted by role.

We retain data only for the time required to fulfil the request, handle follow-up questions, meet audit standards, or comply with a retention schedule set in law. After that, records are deleted or anonymised beyond recovery.

7. Rights and choices available to you

Depending on where you live, and after identity verification, you can exercise these rights:

Access and inspection: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Correction: Have inaccurate, incomplete, or outdated details corrected without undue delay.
Right to erasure: Have your data removed once processing is no longer required by law or by the purpose it served.
Restriction: Restrict our use of your data during any dispute over accuracy or over our grounds for processing.

Choices you can exercise

Control over the collection and use of your personal information rests with you. Where local law provides for it, the following choices apply:

Data sharing and sale: Under the CCPA/CPRA and equivalent statutes elsewhere, you may refuse the sale or sharing of your personal information with third parties. Although we do not sell personal information in the traditional sense, limited data may reach trusted partners so that we can provide or improve our services.
Cookie controls: Use your browser's settings, or the consent tool on this site, to manage or reject cookies and other tracking technologies.
Promotional email: Promotional email and newsletters can be discontinued through the unsubscribe link in any message or by contacting us directly.
Withdrawing consent: Any consent you have given may be withdrawn at any point. Doing so does not render unlawful the processing that occurred before withdrawal.

Requests to exercise these rights, or to opt out, can be sent to [email protected] or submitted through our contact form.

8. Revisions

We may update this notice as regulations or our systems change. Significant revisions are published here with a fresh effective date; continuing to use the site afterwards signifies acceptance.