Privacy Policy | Crunelva

1. Scope of this notice

Crunelva operates as an editorial directory and enquiry service covering resort hotels and hospitality destinations. Protecting the personal information readers entrust to us, and being transparent about how it is handled, is a standing obligation across every part of the service.

What follows describes how Crunelva collects, structures, uses, shares, and secures your details as you navigate the catalogue, review destination ratings, set up a guest profile, or complete an accommodation request.

2. Categories of information gathered

To return accurate availability, verified assessments, and reliable enquiry confirmations, we handle several categories of record:

Identity and contact details: Name, salutation, chosen language, residential region, the email address you authorise, and telephone contact points given at registration or enquiry.
Stay preferences and requirements: Dates of travel, room configuration and category, bedding selection, dietary and accessibility requests, and loyalty programme identifiers.
Billing and payment confirmation records: The cardholder's name, masked card identifiers, billing location, and confirmation tokens issued by certified payment intermediaries. Complete card numbers never reach Crunelva systems.
Device telemetry and technical metadata: Your IP address, browser build, operating system, the page that referred you, time zone setting, device identifiers, and timestamps for page interactions.

3. Lawful bases and purposes

We rely on contractual performance, legitimate interests, statutory compliance, or explicit consent as our lawful grounds. Within those, records serve these purposes:

Passing on your request: Transmitting itinerary details to the partner resort so a room hold and arrival preparations can be arranged.
Content customisation: Adjusting the rankings and guides we surface to match the destinations and property styles you have shown interest in.
Security and verification: Defending the platform's infrastructure, checking that submissions are genuine, and protecting profiles from unauthorised access.
Keeping you informed: Sending enquiry updates, confirmations, itinerary reminders, and necessary customer service notices.
Meeting legal obligations: Meeting accounting, tax reporting, and record-keeping requirements set by the applicable administrative authorities.

4. Disclosure and partners

There is no sale, rental, or leasing of personal identifiers to unrelated commercial entities. Disclosures occur strictly under contractual protection to the parties below:

The hotels themselves: Selected properties are given only the name, arrival dates, and room details required to answer an enquiry or hold a room.
Accredited payment intermediaries: Where payment is involved, encrypted billing details are routed to PCI-DSS validated processing partners.
Hosting and cloud services: Tier-1 data centres and content delivery networks hold encrypted backups so the service stays available and recoverable.
Legal and regulatory authorities: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies, storage, and analytics

Digital identifiers and local storage support returning-visitor recognition, preference retention, performance measurement, and session continuity. Control rests with you via browser configuration; blocking essential cookies will impair some features.

6. Security and retention

We apply multi-layered administrative, technological, and physical defences — TLS 1.3 transport encryption, AES-256 storage encryption, separated database clusters, and access limited by role — to guard against unauthorised access, loss, or alteration.

Retention lasts no longer than the enquiry, any related correspondence, audit obligations, or a statutory holding period demand. At expiry, records are erased permanently or anonymised irrevocably.

7. Individual rights

Subject to verification of your identity and the law in your jurisdiction, you may exercise the following:

Access: Request a transferable copy of your stored records and verify our handling procedures.
Correction: Request prompt correction of profile information that is wrong, partial, or out of date.
Right to erasure: Request deletion of your records where we no longer have a legal reason to retain them.
Limiting processing: Limit how we process your data while accuracy or a legitimate interest is being examined.

Opt-out and your choices

Control over the collection and use of your personal information rests with you. Where local law provides for it, the following choices apply:

Sharing and sale of your data: Under the CCPA/CPRA and equivalent statutes elsewhere, you may refuse the sale or sharing of your personal information with third parties. Although we do not sell personal information in the traditional sense, limited data may reach trusted partners so that we can provide or improve our services.
Cookie controls: Cookies and similar tracking tools can be managed or declined via your browser configuration or the consent controls published on this website.
Marketing messages: You can stop receiving promotional email or newsletters at any time by using the unsubscribe link in any message, or by contacting us directly.
Withdrawal of consent: Where you previously consented to processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Write to [email protected], or use the contact form on this site, to exercise any right or lodge an opt-out request.

8. Revisions

We may update this notice as regulations or our systems change. Significant revisions are published here with a fresh effective date; continuing to use the site afterwards signifies acceptance.