Privacy Policy | Vermolina

1. Scope and application

Vermolina publishes hospitality reviews and passes reservation enquiries to properties. Guarding personal data and explaining our handling of it clearly is an obligation we hold across all reader touchpoints.

Below we explain the categories Vermolina gathers, the purposes they serve, the parties they may reach, and the safeguards applied — whether you are reading rankings, creating a profile, or sending a stay enquiry.

2. What we collect through the service

To return accurate availability, verified assessments, and reliable enquiry confirmations, we handle several categories of record:

Personal identity and contact information: Your name, title, language preference, country or region, email contact, and telephone details provided during profile creation or enquiry submission.
Stay preferences and requirements: Arrival and departure dates, room and bed configuration, suite category, dietary notes, accessibility requests, and any loyalty membership reference.
Billing verification records: The cardholder's name, masked card identifiers, billing location, and confirmation tokens issued by certified payment intermediaries. Complete card numbers never reach Vermolina systems.
Technical metadata: IP address, browser version, operating system, referring pages, time zone, device identifiers, and interaction timestamps.

3. Legal grounds and operational purposes

Processing takes place only under an established lawful ground — contractual necessity, legitimate interest, legal obligation, or consent you have given. Those grounds support the following purposes:

Handling enquiries: Forwarding your stay details to the relevant property so it can respond on availability and prepare for arrival.
Editorial personalisation: Presenting hospitality rankings and reviews aligned with the regions and property categories you browse.
Protecting the service: Keeping the infrastructure secure, verifying that requests are legitimate, and preventing unauthorised access to reader profiles.
Keeping you informed: Delivering enquiry acknowledgements, booking references, travel reminders, and critical service messages.
Meeting legal obligations: Meeting accounting, tax reporting, and record-keeping requirements set by the applicable administrative authorities.

4. Who receives your information

Personal identifiers are never sold, rented, or leased to unaffiliated businesses. Data moves only where a contract governs it, and only to these recipients:

Partner properties: Selected properties are given only the name, arrival dates, and room details required to answer an enquiry or hold a room.
Accredited payment intermediaries: Encrypted billing data passes to certified financial gateways operating to current PCI-DSS validation standards.
Infrastructure providers: Enterprise-grade data centres and delivery networks store encrypted backups to maintain uptime and disaster resilience.
Legal and regulatory authorities: Information may be released where a lawful subpoena, court order, or official mandate requires it, or to protect vital interests.

5. Cookies, storage, and analytics

Digital identifiers and local storage support returning-visitor recognition, preference retention, performance measurement, and session continuity. Control rests with you via browser configuration; blocking essential cookies will impair some features.

6. Safeguards and how long we keep records

Layered administrative, technical, and physical controls protect records against unauthorised access, loss, alteration, or extraction. These include TLS 1.3 in transit, AES-256 at rest, segregated database clusters, and role-restricted credentials.

Retention lasts no longer than the enquiry, any related correspondence, audit obligations, or a statutory holding period demand. At expiry, records are erased permanently or anonymised irrevocably.

7. Your rights

Depending on where you live, and after identity verification, you can exercise these rights:

Access and inspection: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Rectification: Have inaccurate, incomplete, or outdated details corrected without undue delay.
Erasure: Have your data removed once processing is no longer required by law or by the purpose it served.
Limiting processing: Limit how we process your data while accuracy or a legitimate interest is being examined.

Opt-out and your choices

You have the right to control how your personal information is collected and used. Depending on your location and the laws that apply to you, the following opt-out choices are available:

Sharing and sale of your data: Where the CCPA/CPRA in California or similar laws in other jurisdictions apply, you can opt out of your personal information being sold or shared with third parties. We do not sell personal information in the ordinary meaning of the term, though some data is shared with trusted partners to deliver or improve the service.
Cookie controls: You can manage or refuse cookies and tracking technologies through your browser settings, or through the cookie consent tools provided on this site.
Promotional email: Opt out of promotional messages and newsletters using the unsubscribe link in any communication, or by writing to us.
Withdrawal of consent: Where you previously consented to processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Requests to exercise these rights, or to opt out, can be sent to [email protected] or submitted through our contact form.

8. Revisions

This notice may be refined periodically in line with legal or architectural change. Any material modification is reflected on this page with an updated date, and further use of the service constitutes acknowledgement.