Privacy Policy

Who is responsible

The controller responsible for your personal data is:

Company

Onivest (Mauritius) Ltd, trading as Maison Tropical

Address

Avenue des Canaries 112, Flic en Flac 90511, Mauritius

Phone

+230 5259 7958

Email

info@maisontropical.com

Director

Joao Santos Costa

For any question about your data, or to exercise your rights, simply write to info@maisontropical.com.

In short

• Visitor statistics only with your consent: if you accept in our cookie banner, Google Analytics measures how our website is used. No advertising cookies: we do not follow you across other websites and build no profiles.
• Fonts and photos, including our Instagram pictures, are served from our own website.
• The contact page shows a Google map, which your browser loads from Google.
• We use your data only to answer you, to handle your booking and to keep the website secure, and we never sell it.
• We make no automated decisions about you and do no profiling.

Visiting the website (server logs)

Our website is delivered by Cloudflare, Inc. (USA), which also protects it against attacks. When you open a page, your browser automatically sends technical data: your IP address, the date and time, the page requested, the page you came from and your browser and operating system (user agent). Cloudflare processes this data on our behalf to deliver the website and keep it secure, and keeps it only for a short time. Strictly necessary security cookies may be set for this purpose. Legal basis: our legitimate interest in a secure, working website.

Enquiry form

When you send us an enquiry with the form on our contact page, we receive your name, your email address, your travel dates and your message. We use them only to answer your enquiry and, if you wish, to prepare your stay. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering messages.

The form passes your enquiry to our mailbox through Resend, Inc. (USA), which delivers the email on our behalf as our processor. To keep out spam robots, the form is protected by Cloudflare Turnstile (Cloudflare, Inc.), which checks that it is used by a person. Turnstile starts only when you begin to fill in the form, and for this processes technical data about your browser and device, including your IP address. Turnstile is not used for advertising or tracking. Legal basis: our legitimate interest in protecting the form against abuse.

We delete enquiries that do not lead to a booking no later than 12 months after our last exchange.

Bookings

Bookings are made in the booking engine of Little Hotelier (SiteMinder) at direct-book.com. When you press a booking button, our website takes you there with the dates and number of guests you chose. The details you enter there, such as your name, contact details and payment details, are processed by SiteMinder; its own privacy policy, available on direct-book.com, applies. We receive your booking details to prepare and provide your stay. Legal basis: performance of a contract. We keep booking records for as long as the law requires, for example under tax and accounting rules.

Contact by email, phone or WhatsApp

When you write to us or call us, we use your details and your message only to reply and to deal with your request. If you contact us on WhatsApp, the service is provided by WhatsApp (Meta), whose privacy policy applies to your use of WhatsApp. Legal basis: steps taken at your request before a contract, or our legitimate interest in answering you.

Map on the contact page

The contact page shows a map from Google Maps (Google LLC, USA; for visitors in Europe, Google Ireland Limited). To display it, your browser connects to Google when the page loads. Google then receives your IP address and technical data about your browser, and may set cookies. Legal basis: our legitimate interest in showing guests where to find us. Google’s privacy policy applies.

Visitor statistics (Google Analytics, only with your consent)

If you click “Accept” in our cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA), to understand how our website is used: for example which pages are viewed, how visitors found us, which country and type of device they use, and how often booking searches, enquiries and our contact links are used. Google Analytics stores cookies (_ga, _ga_…) in your browser and receives your IP address, which Google uses to estimate your location and does not store. Google processes this data on our behalf as our processor.

We have switched off Google signals and all advertising features: the data is not used for advertising or to build profiles across other websites. Without your consent, Google Analytics is not loaded at all and no data is sent to Google for this purpose.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the “Cookie settings” link at the bottom of every page: the statistics stop at once and the Google Analytics cookies are deleted. The cookies expire after 13 months at most. We keep your choice in your browser for six months, then ask again. Google keeps the statistics for 14 months. Google’s privacy policy applies.

Instagram photos and social media links

The Instagram pictures on our pages are copies stored on our own website: viewing them sends no data to Instagram. The Instagram, Facebook, Tripadvisor, YouTube, TikTok and WhatsApp icons are simple links. These services receive data only when you click a link and visit their website, whose own privacy policy then applies.

Legal bases

We process personal data in accordance with the Data Protection Act 2017 of Mauritius and, for visitors in the European Union or the European Economic Area, the EU General Data Protection Regulation (GDPR). Depending on the purpose, we rely on your consent (Art. 6(1)(a) GDPR), on the performance of a contract or steps taken at your request before entering into one (Art. 6(1)(b)), on a legal obligation (Art. 6(1)(c)) or on our legitimate interests (Art. 6(1)(f)), such as answering enquiries and keeping the website secure.

Service providers and transfers outside Mauritius and the EU

We share data only with the service providers needed for the purposes above. Cloudflare, Inc. (hosting, security, spam protection), Resend, Inc. (sending the enquiry form) and, if you accept visitor statistics, Google Ireland Limited (Google Analytics) act as our processors under data processing agreements; SiteMinder (bookings), Google (map) and WhatsApp (Meta) process data only when you use their services. Some of these providers are based in the United States. Where data is transferred there, it is protected by appropriate safeguards, such as the European Commission’s standard contractual clauses or, where the provider is certified, the EU–US Data Privacy Framework.

How long we keep data

• Server logs: only for a short time, unless they are needed to investigate a security incident.
• Enquiries that do not lead to a booking: no later than 12 months after our last exchange.
• Bookings: as long as tax, accounting and other legal rules require.
• Visitor statistics (Google Analytics, only with your consent): 14 months; your cookie choice: six months, in your browser.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before. To exercise these rights, simply email info@maisontropical.com.

You also have the right to lodge a complaint with the Data Protection Office of Mauritius and, if you live in the European Union or the European Economic Area, with the data protection authority of your country.

Security

Our website is delivered only over an encrypted connection (HTTPS), and we take appropriate technical and organisational measures to protect your data.

Changes to this policy

We update this policy when our website or the law changes. The current version is always available on this page.