Privacy policy - Stay At Nawaya

1. Who we are

Nawaya Retreat Village is a small, privately operated retreat located in Makunduchi, on the southern tip of Zanzibar, Tanzania. It is owned and operated by [YOUR FULL LEGAL NAME], a sole trader registered in Croatia, acting as the data controller for all personal information collected through this website and through direct contact.

If you have any questions about how your personal data is handled, please contact us directly at talk.to.nawaya@gmail.com.

2. What information we collect and why

We collect personal information in three ways.

Information you provide through the enquiry or booking form. When you submit an availability request or contact us through the website, we collect your name, email address, travel dates, group size, and any details you choose to include in your message. We use this information to respond to your enquiry and, if applicable, to manage your booking. The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR) — or, where no booking follows, our legitimate interest in responding to enquiries made to us (Article 6(1)(f) GDPR).

Booking-related correspondence. If you proceed with a booking, we will exchange emails or WhatsApp messages with you to confirm details, coordinate your arrival, and support your stay. This information is retained for the duration of our relationship and for as long as required by applicable law. The legal basis is the performance of a contract (Article 6(1)(b) GDPR).

Information collected automatically when you visit the website. When you browse this website, certain technical data is collected automatically. This may include your IP address, browser type, device type, pages visited, time spent on the site, and the source through which you arrived.

[Placeholder: specify which analytics tools are active — e.g. Google Analytics 4, Meta Pixel — or state that no third-party tracking is currently in use. Each tool must be listed with its purpose and legal basis.]

Where analytics tools are used, the legal basis is your consent (Article 6(1)(a) GDPR), obtained through the cookie consent mechanism on this website.

3. Cookies

This website uses cookies — small text files placed on your device — to help the site function and to understand how it is used.

[Placeholder: once the cookie setup is finalised, list each cookie category: essential, analytics, marketing. For each, state the name of the cookie, its purpose, who sets it, and how long it lasts. Essential cookies do not require consent. Analytics and marketing cookies do.]

You can withdraw or manage your cookie consent at any time through the cookie settings on this website, or by adjusting your browser settings. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

4. Marketing communications

We do not send marketing emails or newsletters. The only emails we send are directly related to your enquiry or booking. We will not add you to any mailing list without your explicit consent.

5. Payment

No payments are processed through this website. Bookings are confirmed and payment is arranged directly between you and Nawaya — by bank transfer or by agreement at the time of booking. We do not collect or store any card or payment details.

6. Who we share your data with

We do not sell your personal data. We do not share it with third parties for marketing purposes.

We may share limited data with third parties only where necessary to deliver our services. This currently includes:

Website hosting provider — [Placeholder: name of hosting provider and country of servers]
Email service provider — standard email infrastructure used to receive and respond to enquiries
Analytics providers — [Placeholder: list once confirmed, e.g. Google Ireland Ltd for Google Analytics]

Where any of these providers are located outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with GDPR requirements — for example, Standard Contractual Clauses or an adequacy decision.

7. International transfers

Nawaya operates physically from Tanzania, which is outside the European Economic Area. When you contact us or make a booking, your personal data will be transferred to and processed in Tanzania for the purpose of managing your stay.

This transfer is necessary for the performance of a contract with you (Article 49(1)(b) GDPR). We handle all data with the same care and security regardless of where it is processed.

8. How long we keep your data

Data type	Retention period
Enquiry data (no booking made)	12 months from last contact
Booking and guest correspondence	5 years from the date of stay
Analytics data	[Placeholder: per tool settings, e.g. 14 months for GA4]
Cookie consent records	1 year

After these periods, data is deleted or anonymised.

9. Your rights under GDPR

As a resident of the European Union or European Economic Area, you have the following rights in relation to your personal data:

Right of access — you may request a copy of the personal data we hold about you
Right to rectification — you may ask us to correct inaccurate or incomplete data
Right to erasure — you may ask us to delete your data, subject to legal retention requirements
Right to restriction — you may ask us to limit how we use your data in certain circumstances
Right to data portability — you may request your data in a structured, machine-readable format
Right to object — you may object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at talk.to.nawaya@gmail.com. We will respond within one month.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Croatian supervisory authority:

Agencija za zaštitu osobnih podataka (AZOP) Selska cesta 136, 10 000 Zagreb, Croatia Website: azop.hr Email: azop@azop.hr

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. As a small operation, data is handled by a limited number of people and is not stored in large shared systems.

No method of transmission over the internet is completely secure. If you have concerns about a specific communication, please contact us directly.

11. Children

This website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page. Material changes will be communicated where we have a means of reaching you.