Book

Privacy Policy

1. Introduction

This Website Privacy Policy (“Policy”) describes how the following companies operating under the Lantana brand collect, use, store, share, and protect personal data:

  • Lantana Hospitality Ltd
  • Lantana Villas Management Ltd
  • Lantana Services Ltd

(collectively referred to as “Lantana”, “we”, “us”, “our”) acting as Data Controller when determining the purposes and means of processing personal data collected through this website and associated digital services.

Lantana is committed to processing personal data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (GDPR) and applicable Cyprus data protection laws.

This Policy applies solely to data collected through the Lantana website, mobile application, and digital forms.

2. Definitions

For the purposes of this Policy:

  • “Personal Data” means any information relating to an identified or identifiable natural person.
  • “Processing” means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
  • “Data Controller” means the entity determining the purposes and means of processing.
  • “Data Processor” means an external party processing data on behalf of Lantana.
  • “Data Subject” means any natural person whose personal data is processed by Lantana.

3. Personal Data We Collect

We may collect the following categories of personal data depending on your interaction with our services:

3.1. Information You Provide Directly

  • Name and surname
  • Email address
  • Telephone number
  • Country of residence
  • Booking details (dates, preferences, group size)
  • Payment information (processed by a secure external provider; not stored by Lantana)
  • Messages submitted through website forms
  • Information related to property rental or purchase inquiries
  • Information shared voluntarily in communication with our team

3.2. Account Information

If you create a guest or booking account, we collect:

  • Full name
  • Email
  • Password
  • Country
  • Communication preferences
  • Booking history
  • Activity or service reservations (spa, fitness, childcare, etc.)

3.3. Automatically Collected Data (Cookies & Analytics)

  • IP address
  • Browser type
  • Device identifiers
  • Pages viewed
  • Time spent on the website
  • App interaction data

Collected through cookies, tracking pixels, and analytics tools. See Section 11 (Cookies).

3.4. Call Recordings

Calls made to our landline may be recorded for training and quality monitoring and are retained for up to six months.

4. Legal Bases for Processing (GDPR Article 6)

We process personal data based on one or more of the following legal grounds:

  • Contract performance — to manage bookings, reservations, and service requests.
  • Legitimate interests — improving services, ensuring security, preventing fraud.
  • Legal obligation — tax, accounting, compliance, reporting.
  • Consent — where explicitly provided (e.g., newsletter subscription, cookies).

Where processing is based on consent, you may withdraw consent at any time.

5. Purposes of Processing

Lantana processes personal data in order to:
• Respond to inquiries and requests
• Manage bookings for villas, suites, hotel rooms, and on-site activities
• Facilitate secure payments through authorised third parties
• Create and manage user accounts
• Provide customer support and essential pre-arrival information
• Give access to spa, fitness, and other services
• Improve the performance and usability of the website
• Comply with legal and regulatory obligations

We do not process personal data for purposes incompatible with those listed above.

6. Sharing of Personal Data

6.1. Service Providers

We may share personal data with third-party Data Processors where necessary, including:
• Payment processors
• IT hosting and cloud service providers
• Booking platform providers
• Communication tools and mailing systems
• Security and surveillance service providers

All processors are bound by GDPR-compliant contractual obligations.

6.2. Legal Authorities

Data may be disclosed where required by law, regulation, or lawful request from public authorities.

6.3. Hotel Management Partners

If you choose to complete a hotel reservation via an external booking engine, that provider becomes the Data Controller responsible for the associated personal data.

We do not sell or rent personal data.

7. International Transfers

When personal data is transferred outside the European Economic Area (EEA), Lantana ensures appropriate safeguards such as:
• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Explicit consent when required

8. Data Retention

Personal data is retained only as long as necessary for the purposes described in this Policy or as required by law.
Examples of typical retention periods include:
• Inquiries via contact forms: 12 months
• Guest account data: for as long as the account is active
• Booking records: 7 years
• Call recordings: up to 6 months
• Cookie data: according to the Cookie Policy

Data is securely deleted or anonymised when no longer required.

9. Data Security

Lantana applies appropriate technical and organisational measures to safeguard personal data, including:
• Encryption
• Access controls
• Secure servers and hosting environments
• Regular audits and monitoring
• Staff confidentiality agreements
• Data minimisation practices

While no system can guarantee absolute security, we take all reasonable steps to protect personal data.

10. Your Rights

Under GDPR, data subjects have the following rights:
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to object
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

Requests can be submitted via our Data Subject Request Form or by contacting us using the details below.

11. Cookies and Tracking Technologies

Lantana uses cookies to:
• Enable essential website functions
• Improve user experience
• Analyse website performance
• Personalise content

Types of cookies used may include essential, functional, analytics, and marketing cookies. Cookies requiring consent will be used only if you opt in. You can control cookie settings in your browser.

A detailed Cookie Policy is available upon request.

12. Children’s Data

We do not knowingly collect personal data from children under the age of 16 without parental consent. Any such data identified will be erased promptly.

13. Changes to This Policy

Lantana may update this Privacy Policy periodically. Updates will be published on the website with a revised effective date.

14. Contact Information

For questions regarding this Policy or to exercise your rights, please contact:

Data Protection Officer (DPO)
Lantana Hospitality