Privacy Policy | Draveluna

1. What this notice covers

Draveluna operates as an editorial directory and enquiry service covering resort hotels and hospitality destinations. Protecting the personal information readers entrust to us, and being transparent about how it is handled, is a standing obligation across every part of the service.

What follows describes how Draveluna collects, structures, uses, shares, and secures your details as you navigate the catalogue, review destination ratings, set up a guest profile, or complete an accommodation request.

2. What we collect through the service

Delivering accurate lodging information, verified reviews, and dependable enquiry handling requires us to process the following categories:

Who you are and how to reach you: Name, salutation, chosen language, residential region, the email address you authorise, and telephone contact points given at registration or enquiry.
Travel and room requirements: Arrival and departure dates, room and bed configuration, suite category, dietary notes, accessibility requests, and any loyalty membership reference.
Billing and payment confirmation records: Cardholder name, truncated card indicators, billing address, and transaction confirmation tokens handled by accredited payment processors. Full card numbers are never stored on Draveluna servers.
Technical metadata: Your IP address, browser build, operating system, the page that referred you, time zone setting, device identifiers, and timestamps for page interactions.

3. Legal grounds and operational purposes

Draveluna processes records only where a recognised legal basis applies: performance of a contract, legitimate business interest, compliance with a statutory duty, or your explicit consent. The operational purposes are:

Handling enquiries: Relaying your dates and requirements to the property's reservations desk so it can answer with current availability.
Editorial personalisation: Adjusting the rankings and guides we surface to match the destinations and property styles you have shown interest in.
Protecting the service: Keeping the infrastructure secure, verifying that requests are legitimate, and preventing unauthorised access to reader profiles.
Service messages: Issuing reservation updates, confirmation vouchers, itinerary reminders, and essential service notifications.
Statutory adherence: Satisfying accounting disclosure, tax reporting, and other duties imposed by the jurisdictions in which we operate.

4. Disclosure and partners

We do not sell, rent, or lease personal identifiers to unconnected commercial parties. Transfers happen only under contractual safeguards, and only to the following categories of recipient:

Partner properties: Selected properties are given only the name, arrival dates, and room details required to answer an enquiry or hold a room.
Accredited payment intermediaries: Billing information travels encrypted to accredited payment gateways that maintain current PCI-DSS validation.
Infrastructure providers: Encrypted database backups sit with tier-1 hosting and content distribution providers to ensure availability.
Authorities where the law requires: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies and analytics

Cookies and browser storage let us recognise repeat visitors, remember currency and layout preferences, evaluate site performance, and preserve session integrity. You retain complete control through your browser, but switching off essential cookies degrades enquiry functionality.

6. Security and retention

Protection is layered across administrative, technical, and physical measures: encrypted transport under TLS 1.3, AES-256 encryption at rest, isolated database clusters, and credentials restricted by role.

Retention lasts no longer than the enquiry, any related correspondence, audit obligations, or a statutory holding period demand. At expiry, records are erased permanently or anonymised irrevocably.

7. Individual rights

Subject to verification of your identity and the law in your jurisdiction, you may exercise the following:

Access: Obtain a portable copy of the personal records we hold and confirm how they are being handled.
Correction: Ask us to fix any record that is inaccurate, incomplete, or no longer current.
Erasure: Have your data removed once processing is no longer required by law or by the purpose it served.
Limiting processing: Limit how we process your data while accuracy or a legitimate interest is being examined.

Opt-out and your choices

Control over the collection and use of your personal information rests with you. Where local law provides for it, the following choices apply:

Data sharing and sale: Where the CCPA/CPRA in California or similar laws in other jurisdictions apply, you can opt out of your personal information being sold or shared with third parties. We do not sell personal information in the ordinary meaning of the term, though some data is shared with trusted partners to deliver or improve the service.
Cookie controls: You can manage or refuse cookies and tracking technologies through your browser settings, or through the cookie consent tools provided on this site.
Marketing messages: Promotional email and newsletters can be discontinued through the unsubscribe link in any message or by contacting us directly.
Withdrawal of consent: Where you previously consented to processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, or to make an opt-out request, please contact us at [email protected] or use our contact form.

8. Updates to this document

Draveluna may revise this notice to reflect regulatory developments or changes to the service. Material amendments appear on this page with a new effective date, and continued use of the site after publication indicates acceptance of the revised terms.