Privacy Policy

This Privacy Policy explains how Destinito and its affiliated partners ("we," "us," or "our") collect, use, and protect personal data when you use our websites, mobile applications, or interact with our services (collectively, our "Services").

1. Who Is Responsible for Your Data?

Destinito is the data controller responsible for processing your personal data. This means we determine how and why your personal data is processed and are responsible for ensuring compliance with applicable data protection laws.

If you interact with a business listed on our platform, that business may also process your personal data as a separate data controller according to their own privacy practices.

2. What Personal Data We Collect

We collect different types of personal data depending on how you interact with our Services:

• Identity and Contact Information: Your name, email address, phone number, and customer account details.
• Travel Information: Your travel preferences, visitor type, and island interests.
• Account Information: Username, password, profile photo, and preferences if you create an account.
• Usage Data: Browsing history, saved businesses, reviews, and interactions with our platform.
• Communications: Records of your correspondence with our support team.
• Technical Data: IP address, browser type, device information, and browsing activity on our website.

We do not intentionally collect sensitive personal data such as health information, religious beliefs, or biometric data. Please refrain from sharing such information with us.

2a. Anonymous incident reports (Island Reports)

Some pages let you report something happening on the island — a power cut, an accident, flooding, a blocked road — or confirm that someone else's report is accurate. These reports are anonymous. We do not ask for, and do not store, your name, your email address or an account, and you never need to sign in to submit one.

To stop one person submitting the same report over and over, each submission is stored with a submitter key. This key is a one-way cryptographic hash of your IP address and browser user-agent string, combined with a secret that changes every day. In practice this means:

• Your IP address and user-agent are never stored on a report — only the hash is, and a hash cannot be reversed back into them.
• Because the secret rotates daily, today's key for you does not match tomorrow's. The key cannot be used to recognise you across days, or to link your reports to anything else you do on the site.
• The key is stored only on report and confirmation rows. It is never written to our analytics, never joined to a browsing session, and never shared.
• It is deleted once the report it belongs to has closed and a short moderation window (seven days) has passed. The report itself may remain, without any identifier, so we can show statistics such as which districts lose power most often.

Our lawful basis for this narrow, short-lived use is legitimate interest: preventing abuse of a public form that has no sign-in. It is separate from the analytics described elsewhere in this policy — submitting a report is something you actively choose to do, and it does not change how we handle passive measurement of page views.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

• Providing Our Services: To personalize your experience, show relevant businesses and activities, and facilitate bookings or reservations.
• Customer Support: To respond to your inquiries, handle complaints, and provide assistance.
• Account Management: To create and manage your account, including your preferences and visit history.
• Legal Compliance: To meet our legal and regulatory obligations.
• Security: To protect our Services, detect fraud, and ensure the safety of our systems and users.
• Marketing: With your consent, to send you promotional communications about deals, events, and offers. You can opt out at any time.
• Service Improvement: To analyze how our Services are used and make improvements to enhance your experience.

4. Who We Share Your Data With

We may share your personal data with:

• Listed Businesses: Businesses on our platform when you make a reservation, inquiry, or review.
• Service Providers: Companies that help us operate our Services, including hosting, payment processing, email delivery, and analytics.
• Airport Partners: Where applicable for airport portal services.
• Legal and Regulatory Bodies: Where required by law or to protect our legal rights.

We do not sell your personal data to third parties for their marketing purposes.

5. International Data Transfers

As we operate across multiple islands and jurisdictions, your personal data may be transferred to and processed in countries outside your country of residence. When we transfer your data internationally, we implement appropriate safeguards to protect your information.

6. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account information is retained while your account remains active and for a reasonable period afterward.
• Usage data and analytics are retained in anonymized form.
• Marketing preferences are retained until you withdraw your consent.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data in certain circumstances.
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain types of processing, including direct marketing.
• Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, please contact us using the details in Section 10 below.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience, analyze site traffic, and personalize content. Essential cookies — used to keep you signed in, maintain your session, and remember your cart or table — are required for the site to function. You can manage or block cookies through your browser settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, and regular security assessments. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Email: hello@destinito.com

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date above. We encourage you to review this policy periodically.