Privacy Policy

1. Legal Framework and International Compliance

Puerto Plaza Hotel & Shops processes personal data in strict compliance with the following international and national data protection frameworks:

• Dominican Republic: Organic Law No. 172-13 on the Protection of Personal Data, Article 44 of the Dominican Constitution (Right to Personal Privacy), and Law No. 310-14 on Commercial Communications.
• European Union & UK: Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR / UK GDPR) and the ePrivacy Directive.
• United States: California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA / CPRA, Cal. Civ. Code § 1798.100 et seq.), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and Texas Data Privacy and Security Act (TDPSA).

2. Notice at Collection and Categories of Personal Information

We collect personal data strictly necessary to fulfill our hospitality services and legal obligations:

• Identifiers and Contact Data: Full legal name, passport or government ID number (presented at physical check-in for national hospitality registration), email address, telephone number, and country of residence.
• Reservation and Stay Data: Check-in and check-out dates, selected apartment type, number of guests, vehicle license plate (if parking is requested), and special concierge requests.
• Financial & Payment Transaction Data: Transaction authorization tokens issued by certified banking gateways. We never store complete credit/debit card numbers or CVV codes on our servers.
• Technical & Telemetry Data: IP address, browser type, operating system, and pseudonymous identifiers (such as SHA-256 hashed interaction data) used strictly to safeguard service availability, prevent automated fraud, and analyze aggregated performance metrics.

3. Legal Bases for Data Processing (GDPR Article 6)

We process personal data only when lawful under applicable data protection statutes:

• Performance of a Contract (Art. 6.1.b GDPR): Managing apartment reservations, executing online check-in, providing guest concierge services, and processing billing.
• Compliance with Legal Obligations (Art. 6.1.c GDPR): Mandatory reporting to tourism authorities and compliance with tax laws of the Dominican Republic (DGII).
• Legitimate Interests (Art. 6.1.f GDPR): Safeguarding IT perimeter security, preventing fraudulent transactions, and ensuring optimal hotel operations.
• Consent (Art. 6.1.a GDPR): Anonymous website analytics (Google Analytics 4) and optional digital marketing communications.

4. Cookies, Google Analytics 4, and Meta Conversions API

Our website utilizes technical cookies and telemetry technologies categorized as follows:

• Strictly Necessary: Essential for session routing, direct reservations, and CSRF protection. Always active.
• Performance & Analytics (GA4): Google Analytics 4 (G-40XYEYDSDN) operates with Google Consent Mode v2 and IP anonymization to evaluate aggregate traffic patterns.
• Marketing & Conversions API (CAPI): Server-side Meta Conversions API and Pixel measure campaign efficacy using one-way SHA-256 cryptographic hashing and unique event IDs for deduplication.
• Global Privacy Control (GPC): Our platform automatically recognizes and honors the navigator.globalPrivacyControl browser signal, immediately applying opt-out status for marketing and cross-context advertising.

You may modify or revoke your cookie preferences at any time by clicking the Cookie Settings or Your Privacy Choices (Do Not Sell/Share) links located in our website footer.

5. Financial Security and PCI-DSS Compliance

To guarantee zero exposure to cyber risks:

• Zero Card Storage: Puerto Plaza Hotel & Shops does not store, log, or process unencrypted credit/debit card numbers or CVV codes on its servers.
• Audited Gateways: All payment transactions are handled through certified PCI-DSS Level 1 compliant financial gateways audited under Dominican Republic Central Bank regulations.
• Encrypted Transport: All data transmissions are protected via bank-grade TLS 1.3 protocol with strict HSTS headers.

6. Your Privacy Rights (ARCO, GDPR & CCPA/CPRA)

Depending on your location, you hold comprehensive rights regarding your personal information:

• ARCO Rights (Dominican Republic): Access, Rectification, Cancellation, and Objection pursuant to Law 172-13.
• GDPR Rights (EU/UK): Right to Erasure ("Right to be Forgotten"), Right to Restriction of Processing, Right to Data Portability, and Right to lodge a complaint with an EU Supervisory Authority (DPA).
• CCPA/CPRA Rights (California/USA): Right to Opt-Out of the sale or sharing of personal information for cross-context behavioral advertising, Right to Correct inaccurate data, and Right to Non-Discrimination for exercising statutory privacy rights.

7. Data Retention and International Transfers

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected:

• Accounting & Tax Records: Retained for 10 years in compliance with Dominican Tax Code (DGII) regulations.
• Technical Server Logs: Retained for 90 days for perimeter security and intrusion prevention.
• Consent Choices: Stored for 12 months or until explicitly updated or revoked by the user.
• International Transfers: Where data is processed via global cloud infrastructure, transfers are safeguarded under European Commission approved Standard Contractual Clauses (SCCs).