GDPR, CCPA/CPRA, and Caribbean Data-Privacy Compliant
This Privacy Policy explains how The Retreat (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit our website or engage with our services.
We value your privacy and adhere to global best practices, including:
The General Data Protection Regulation (GDPR) for EU/UK residents
The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
Applicable Caribbean data-protection standards, including those common across Turks & Caicos, OECS, and CARICOM jurisdictions.
By using this website, you acknowledge and agree to the terms outlined here.
This Policy is effective as of January 1st,2026 and may be updated periodically. Any changes will be published on this page.
1. Information We Collect
We may collect the following categories of information:
Personal Information
Name, title, and contact details.
Mailing address, email address, phone number
Identification information is provided during bookings.
Guest preferences and special requests
Payment details (processed securely through PCI-compliant providers)
Reservation & Operational Data
Check-in/check-out dates
Room preferences
Special offers or packages selected.
Communication history
Technical & Usage Data
IP address
Browser type and device information
Website pages viewed and interaction patterns.
Cookies and tracking identifiers
Marketing Preferences
Newsletter subscriptions
Offers opt-ins.
Communication preferences
We do not intentionally collect the data of children under 18 years old unless required for a reservation and provided by an adult.
2. Legal Basis for Processing (GDPR)
If you are in the EU/UK, we process your data under the following lawful bases:
Performance of a contract – to manage reservations and guest services.
Consent – for marketing, cookies, newsletter subscriptions
Website optimization and user-experience improvements
Internal analytics, reporting, and forecasting
Compliance with legal, regulatory, or security obligations
4. Sharing Your Information
We do not sell personal data.
We may share information only with:
Service Providers
Booking platforms
Payment processors
Marketing platforms
IT and website support providers
These partners may process data on our behalf under strict confidentiality and data-protection agreements.
Legal Authorities
If required to comply with applicable laws, court orders, or government requests.
Affiliated Hospitality Partners
Only when needed to deliver guest services (e.g., excursions, transportation, or third-party amenities), and only with consent where required.
5. International Data Transfers
If personal information is transferred outside your country of residence (including transfers to the Caribbean, U.S., or EU/UK), we use appropriate safeguards such as:
Standard Contractual Clauses (GDPR)
Data-processing agreements
Secure encrypted transmission
6. Your Rights
A. GDPR Rights (EU/UK Residents)
You may exercise the following rights:
Right to access – request a copy of your personal data
Right to rectification – correct inaccurate information
Right to erasure – request deletion (“right to be forgotten”)
Right to restrict processing
Right to data portability
Right to object – including to direct marketing
Right to withdraw consent
Requests can be submitted using the contact information at the bottom of this page.
B. CCPA/CPRA Rights (California Residents)
California residents have the right to:
Know what personal data is collected, used, or shared
Request deletion of personal information
Opt-out of “sale” or “sharing” of data (we do not sell data)
Request correction of inaccurate information
Limit the use of sensitive personal data
Exercise rights without discrimination
A “Do Not Sell or Share My Personal Information” link can be added to your website if desired.
C. Caribbean Data-Protection Rights
Aligned with regional laws, guests have the right to:
Access and review their data
Request correction or deletion
Withdraw consent for marketing or optional processing
Be informed of cross-border transfers
Expect secure handling of personal information
7. Cookies & Tracking Technologies
We use cookies and similar tools to:
Enhance website functionality
Analyze traffic and visitor behavior
personalize the online experience
Support advertising and retargeting
You may refuse cookies through your browser settings, though some features may not function properly.
A Cookie Banner is recommended for full GDPR compliance.
8. Data Retention
We retain personal information only as long as:
Necessary to complete the purpose collected.
Required by law (e.g., tax, tourism, audit regulations)
Useful for legitimate business needs (e.g., guest history)
After these periods, data is securely deleted or anonymized.
9. Data Security
We implement reasonable administrative, technical, and physical safeguards, including:
Encryption
Secure payment gateways
Access-control restrictions
Firewall and antivirus protection
Staff confidentiality agreements
No system is 100% secure, but we follow industry best practices to protect your data.
10. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.
11. Contact Us
For questions, concerns, or to exercise your privacy rights, please contact:
The Retreat
Email: info@theretreattci.com
Phone: +1 649 346 1055
Address: The Retreat, Bonaventure Cres, Grace Bay TKCA1ZZ Turks & Caicos Islands
EU/UK residents may also contact their local Data Protection Authority.
California residents may submit CCPA requests by email or phone.
