Privacy Policy - Turtle Bay Lodge

This policy explains how Turtle Bay Lodge (operated by Turtle Bay Resort, P.O. Box 325, Luganville, Espiritu Santo, Vanuatu) collects, uses and protects your personal information. It covers our website (www.turtlebaylodge.vu), our Guest Experience App, our online assistant (chatbot) and your stay with us. Questions? Email stay@turtlebaylodge.vu.

1. What we collect

Enquiries: when you use our contact form, we collect your name, email address, travel dates (optional) and your message.
Bookings: when you book, we collect your name, contact details, stay dates, the number of guests, any special requests and payment details. Online bookings are processed through our booking system, Mews, and card payments are handled by the payment provider. We don’t store full card numbers on our website.
During your stay: your room account (meals, drinks, activities), activity and hire bookings, dive certification and medical forms, vehicle rental agreements (including a copy of your driver’s licence), and dietary requirements you tell us about.
Guest Experience App: requests you send through the app (for example dive, tour, hire, table or transfer requests), including the details you enter such as flight information.
Online assistant (chatbot): the questions you type and the answers given, which we keep so we can improve our information. Please don’t enter sensitive personal details in the chat.
Website usage: information collected automatically through cookies and similar technologies (see section 4), such as pages visited, device and browser type, and approximate location.

2. How we use it

To answer your enquiries and manage your booking, stay, payments and requested services.
To keep you and our guests safe (for example dive and vehicle-hire requirements).
To improve our website, app and assistant, and understand which information guests look for.
To measure our advertising and show relevant ads about Turtle Bay Lodge on platforms such as Facebook, Instagram and Google (see section 4).
To send you our email newsletter and offers (using Mailchimp), but only if you have subscribed. Every email has an unsubscribe link.
To meet our legal, tax and accounting obligations.

3. Who we share it with

We don’t sell your personal information. We share it only with service providers who help us run the lodge, and only as needed:

Mews (booking and property management) and our payment and card processors.
SiteGround (website hosting and email), WPForms (contact form), and Google Firebase (Guest Experience App).
Cloudflare and Anthropic, which power our online assistant.
Meta (Facebook/Instagram) and Google, for advertising measurement and analytics.
Mailchimp (email newsletter, for subscribers only).
Xero (accounting) and our professional advisers.
Local tour, dive and transfer operators, when you ask us to book a service with them (for example your name and pickup details).
Government authorities, when the law requires it.

Some of these providers store data outside Vanuatu, including in Australia, the United States and the European Union. We use reputable providers that protect personal information appropriately.

4. Cookies, analytics and advertising

Our website uses cookies and similar technologies:

Essential: needed for the site, language selection and forms to work.
Analytics: Google Analytics helps us understand how visitors use the site.
Advertising: the Meta Pixel and the Google Ads tag measure whether our ads lead to enquiries, and let us show ads to people who have visited our site.
Third-party content: embedded TripAdvisor reviews, Google Maps and Google Fonts may set their own cookies or collect usage data under their own policies.

You can block or delete cookies in your browser settings, and manage ad preferences in your Facebook and Google account settings.

5. How long we keep it

We keep personal information only as long as we need it:

Booking, payment and accounting records (invoices, room accounts, receipts): for 7 years, in line with tax and business record-keeping requirements.
Guest forms such as dive medical forms and vehicle-rental agreements (including licence copies): for 24 months after your stay, or longer if they relate to an incident or claim.
Enquiries, emails and online-assistant conversations: up to 24 months.
Newsletter subscriber details: until you unsubscribe.

After that, we delete or anonymise the information.

6. Your choices and rights

You can ask us to access, correct or delete the personal information we hold about you, or to stop using it for marketing. Email stay@turtlebaylodge.vu and we will respond within 30 days. If you are in the European Union or the United Kingdom, you also have rights under the GDPR: to object, to restrict processing, to data portability, and to complain to your local data-protection authority. Where we rely on your consent (for example for advertising cookies), you can withdraw it at any time.

7. Security

We take reasonable steps to protect your information. These include encrypted (HTTPS) connections, reputable service providers and limiting access to staff who need it. No online service is completely secure, so please contact us straight away if you think your information has been misused.

8. Children

Our website isn’t aimed at children, and we don’t knowingly collect personal information from children online. We only hold details about children in a booking when a parent or guardian gives them to us.

9. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

10. Contact

Turtle Bay Lodge · P.O. Box 325, Luganville, Espiritu Santo, Vanuatu · +678 37988 · stay@turtlebaylodge.vu