nanaYour privacy matters.
REPLACE BEFORE LAUNCH: This page is a beta placeholder. It has not been reviewed by a lawyer and is not the final, binding text.
Who is responsible
Nana is responsible for your personal data. Contact: [support email]. [Data protection officer or representative, if required.]
What we collect
The lead guest's name, email and phone number, your stay details, supplier booking references, the status of your payment and booking, and support notes about your booking. We also keep a session cookie and security records such as hashed session and access tokens.
What we do not collect
Card numbers, expiry dates and security codes. These are entered directly into Nuitee's payment form and never reach Nana.
Why we use it
To make and manage your reservation, send your confirmation and secure booking links, handle cancellation requests and support, prevent abuse, and meet legal obligations. [Lawful bases to be confirmed by legal counsel.]
Who receives it
Nuitee (LiteAPI), which passes your booking to the hotel and processes payment with its payment provider. Our email delivery provider, which sends our messages. Our hosting provider, which stores our database. [List processors and countries of transfer.]
Cookies
Nana uses one essential cookie to keep your search and checkout private to your browser, and one for operator sign-in. We do not use advertising cookies. The optional travel assistant is provided by LiteAPI and uses its own browser storage when you open it.
How long we keep it
Searches expire after 30 minutes. Secure booking links expire after 30 minutes and are then deleted. Guest details on checkouts that did not lead to a booking are removed after 30 days. Booking records are kept for [retention period] to meet legal and accounting obligations.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, or object to how it is used. Email [support email]. We reply within [response time]. You can also complain to [supervisory authority].
Security
Payment references and email contents waiting to be sent are encrypted. Booking pages are reachable only through an expiring link sent to the booking's email address.