Privacy Policy

This Privacy Policy explains how Destinito and its affiliated partners ("we," "us," or "our") collect, use, and protect personal data when you use our websites, mobile applications, or interact with our services (collectively, our "Services").

1. Who Is Responsible for Your Data?

Destinito is the data controller responsible for processing your personal data. This means we determine how and why your personal data is processed and are responsible for ensuring compliance with applicable data protection laws.

If you interact with a business listed on our platform, that business may also process your personal data as a separate data controller according to their own privacy practices.

2. What Personal Data We Collect

We collect different types of personal data depending on how you interact with our Services:

• Identity and Contact Information: Your name, email address, phone number, and customer account details.
• Travel Information: Your travel preferences, visitor type, and island interests.
• Account Information: Username, password, profile photo, and preferences if you create an account.
• Usage Data: Browsing history, saved businesses, reviews, and interactions with our platform.
• Communications: Records of your correspondence with our support team.
• Technical Data: IP address, browser type, device information, and browsing activity on our website.

We do not intentionally collect sensitive personal data such as health information, religious beliefs, or biometric data. Please refrain from sharing such information with us.

2a. Anonymous incident reports (Island Reports)

Some pages let you report something happening on the island — a power cut, an accident, flooding, a blocked road — or confirm that someone else's report is accurate. These reports are anonymous. We do not ask for, and do not store, your name, your email address or an account, and you never need to sign in to submit one.

To stop one person submitting the same report over and over, each submission is stored with a submitter key. This key is a one-way cryptographic hash of your IP address and browser user-agent string, combined with a secret that changes every day. In practice this means:

• Your IP address and user-agent are never stored on a report — only the hash is, and a hash cannot be reversed back into them.
• Because the secret rotates daily, today's key for you does not match tomorrow's. The key cannot be used to recognise you across days, or to link your reports to anything else you do on the site.
• The key is stored only on report and confirmation rows. It is never written to our analytics, never joined to a browsing session, and never shared.
• It is deleted once the report it belongs to has closed and a short moderation window (seven days) has passed. The report itself may remain, without any identifier, so we can show statistics such as which districts lose power most often.

Our lawful basis for this narrow, short-lived use is legitimate interest: preventing abuse of a public form that has no sign-in. It is separate from the analytics described elsewhere in this policy — submitting a report is something you actively choose to do, and it does not change how we handle passive measurement of page views.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

• Providing Our Services: To personalize your experience, show relevant businesses and activities, and facilitate bookings or reservations.
• Customer Support: To respond to your inquiries, handle complaints, and provide assistance.
• Account Management: To create and manage your account, including your preferences and visit history.
• Legal Compliance: To meet our legal and regulatory obligations.
• Security: To protect our Services, detect fraud, and ensure the safety of our systems and users.
• Marketing: With your consent, to send you promotional communications about deals, events, and offers. You can opt out at any time.
• Service Improvement: To analyze how our Services are used and make improvements to enhance your experience.

4. Who We Share Your Data With

We may share your personal data with:

• Listed Businesses: Businesses on our platform when you make a reservation, inquiry, or review.
• Service Providers: Companies that help us operate our Services, including hosting, payment processing, email delivery, and analytics.
• Airport Partners: Where applicable for airport portal services.
• Legal and Regulatory Bodies: Where required by law or to protect our legal rights.

We do not sell your personal data to third parties for their marketing purposes.

5. International Data Transfers

As we operate across multiple islands and jurisdictions, your personal data may be transferred to and processed in countries outside your country of residence. When we transfer your data internationally, we implement appropriate safeguards to protect your information.

Google Analytics. If you consent to analytics cookies, the data that Google Analytics collects may be transferred to and processed in the United States by Google LLC. Google LLC self-certifies under the EU–US Data Privacy Framework, and transfers are made on that basis; where the Framework does not apply, Google’s standard contractual clauses do. If you would rather your data were not transferred on that basis, decline analytics cookies or withdraw your consent at any time in Cookie settings — nothing about the site changes for you.

6. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account information is retained while your account remains active and for a reasonable period afterward.
• Usage data and analytics are retained in anonymized form.
• Marketing preferences are retained until you withdraw your consent.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data in certain circumstances.
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain types of processing, including direct marketing.
• Withdraw Consent: Where processing is based on consent, you can withdraw it at any time — open Cookie settings and turn analytics off. Withdrawing takes effect immediately and deletes the analytics cookies already on your device.

To exercise these rights, please contact us using the details in Section 10 below.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. Essential cookies — used to keep you signed in, maintain your session, remember your cart or table, and record your cookie choice — are required for the site to function and are always on.

One essential cookie is worth naming because it lasts a year: destinito_device_id. On our guest Wi-Fi it identifies your device to the network so you are authenticated onto it and your session is restored when you reconnect — the service you asked for. It is not used for analytics or advertising, and it is not removed when you decline or withdraw analytics consent, because deleting it would disconnect you from the Wi-Fi.

With your consent we also use analytics cookies: our own first-party measurement, which counts page views and how the site is used, and Google Analytics, which does the same and is a third party. Google Analytics data may be processed in the United States — see International Data Transfers above. Declining leaves every feature working.

We do not use advertising or ad-targeting cookies, and we do not run social-media tracking pixels. We previously ran a Meta (Facebook/Instagram) pixel; it was removed in September 2026, and the cookies it left on visitors’ devices are deleted automatically on their next visit.

You can change your choice at any time in Cookie settings, or manage and block cookies through your browser settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, and regular security assessments. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Email: hello@destinito.com

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date above. We encourage you to review this policy periodically.