Privacy Policy | Ombrelisa

1. Scope and application

Ombrelisa is an editorial publication and reservation-enquiry directory for resort accommodation. We treat the safeguarding of personal records, and openness about how we use them, as a core commitment at every point of contact.

This notice covers the collection, organisation, use, transfer, and protection of your information across every part of Ombrelisa, from browsing ratings to submitting a room request.

2. What we collect through the service

Delivering accurate lodging information, verified reviews, and dependable enquiry handling requires us to process the following categories:

Personal identity and contact information: Your name, title, language preference, country or region, email contact, and telephone details provided during profile creation or enquiry submission.
Reservation preferences: Check-in and check-out dates, room type and bedding choice, suite tier, dietary requirements, accessibility needs, and hotel loyalty references.
Billing and payment confirmation records: Cardholder name, truncated card indicators, billing address, and transaction confirmation tokens handled by accredited payment processors. Full card numbers are never stored on Ombrelisa servers.
Technical metadata: Internet protocol address, browser and operating system version, referring URLs, regional time zone, device identifiers, and page interaction times.

3. Legal grounds and operational purposes

We rely on contractual performance, legitimate interests, statutory compliance, or explicit consent as our lawful grounds. Within those, records serve these purposes:

Enquiry fulfilment: Transmitting itinerary details to the partner resort so a room hold and arrival preparations can be arranged.
Tailoring what you see: Presenting hospitality rankings and reviews aligned with the regions and property categories you browse.
Protecting the service: Safeguarding digital infrastructure, validating the legitimacy of transactions, and shielding users from unauthorised profile access.
Keeping you informed: Issuing reservation updates, confirmation vouchers, itinerary reminders, and essential service notifications.
Statutory adherence: Satisfying accounting disclosure, tax reporting, and other duties imposed by the jurisdictions in which we operate.

4. Disclosure and partners

There is no sale, rental, or leasing of personal identifiers to unrelated commercial entities. Disclosures occur strictly under contractual protection to the parties below:

Hospitality partners: Selected properties are given only the name, arrival dates, and room details required to answer an enquiry or hold a room.
Certified payment gateways: Where payment is involved, encrypted billing details are routed to PCI-DSS validated processing partners.
Technical infrastructure partners: Enterprise-grade data centres and delivery networks store encrypted backups to maintain uptime and disaster resilience.
Legal and regulatory authorities: We disclose where compelled by subpoena, court order, or statutory mandate, or where vital individual interests are at stake.

5. Digital identifiers and measurement

Cookies and browser storage let us recognise repeat visitors, remember currency and layout preferences, evaluate site performance, and preserve session integrity. You retain complete control through your browser, but switching off essential cookies degrades enquiry functionality.

6. Storage protection and retention

We apply multi-layered administrative, technological, and physical defences — TLS 1.3 transport encryption, AES-256 storage encryption, separated database clusters, and access limited by role — to guard against unauthorised access, loss, or alteration.

We retain data only for the time required to fulfil the request, handle follow-up questions, meet audit standards, or comply with a retention schedule set in law. After that, records are deleted or anonymised beyond recovery.

7. Your rights

Subject to verification of your identity and the law in your jurisdiction, you may exercise the following:

Access and inspection: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Rectification: Have inaccurate, incomplete, or outdated details corrected without undue delay.
Right to erasure: Ask for records to be deleted where no statutory or contractual basis for keeping them remains.
Limiting processing: Restrict our use of your data during any dispute over accuracy or over our grounds for processing.

Choices you can exercise

You have the right to control how your personal information is collected and used. Depending on your location and the laws that apply to you, the following opt-out choices are available:

Data sharing and sale: Under the CCPA/CPRA and equivalent statutes elsewhere, you may refuse the sale or sharing of your personal information with third parties. Although we do not sell personal information in the traditional sense, limited data may reach trusted partners so that we can provide or improve our services.
Tracking technologies: You can manage or refuse cookies and tracking technologies through your browser settings, or through the cookie consent tools provided on this site.
Promotional email: You can stop receiving promotional email or newsletters at any time by using the unsubscribe link in any message, or by contacting us directly.
Consent withdrawal: Consent given earlier can be withdrawn whenever you choose, without affecting the lawfulness of any processing that took place while the consent was in force.

Write to [email protected], or use the contact form on this site, to exercise any right or lodge an opt-out request.

8. Updates to this document

This notice may be refined periodically in line with legal or architectural change. Any material modification is reflected on this page with an updated date, and further use of the service constitutes acknowledgement.