Privacy Policy | Frolvina

1. Scope and application

Frolvina publishes hospitality reviews and passes reservation enquiries to properties. Guarding personal data and explaining our handling of it clearly is an obligation we hold across all reader touchpoints.

Below we explain the categories Frolvina gathers, the purposes they serve, the parties they may reach, and the safeguards applied — whether you are reading rankings, creating a profile, or sending a stay enquiry.

2. Information we collect

To return accurate availability, verified assessments, and reliable enquiry confirmations, we handle several categories of record:

Who you are and how to reach you: Name, salutation, chosen language, residential region, the email address you authorise, and telephone contact points given at registration or enquiry.
Reservation preferences: Arrival and departure dates, room and bed configuration, suite category, dietary notes, accessibility requests, and any loyalty membership reference.
Billing and payment confirmation records: Cardholder identity, partial card indicators, billing address, and processor-issued confirmation tokens. At no point is a full card number retained on Frolvina infrastructure.
Technical metadata: Internet protocol address, browser and operating system version, referring URLs, regional time zone, device identifiers, and page interaction times.

3. Lawful bases and purposes

Frolvina processes records only where a recognised legal basis applies: performance of a contract, legitimate business interest, compliance with a statutory duty, or your explicit consent. The operational purposes are:

Handling enquiries: Transmitting itinerary details to the partner resort so a room hold and arrival preparations can be arranged.
Tailoring what you see: Shaping featured rankings and travel guidance around your preferred destinations and resort types.
Protecting the service: Keeping the infrastructure secure, verifying that requests are legitimate, and preventing unauthorised access to reader profiles.
Operational communication: Sending enquiry updates, confirmations, itinerary reminders, and necessary customer service notices.
Regulatory compliance: Fulfilling financial disclosure rules, tax obligations, and other legal mandates that apply to our operations.

4. Who receives your information

Personal identifiers are never sold, rented, or leased to unaffiliated businesses. Data moves only where a contract governs it, and only to these recipients:

Partner properties: Resorts receive the guest name, dates, and accommodation specifics strictly necessary to respond to a request or honour a reservation.
Accredited payment intermediaries: Where payment is involved, encrypted billing details are routed to PCI-DSS validated processing partners.
Technical infrastructure partners: Encrypted database backups sit with tier-1 hosting and content distribution providers to ensure availability.
Courts and regulators: Disclosure may follow a valid legal demand, court order, or regulatory mandate, or be necessary to protect someone's vital interests.

5. Cookies, storage, and analytics

We use cookies and local storage to recognise returning readers, retain display preferences, measure performance, and keep sessions intact. Browser settings give you full control over these, though disabling essential cookies will limit parts of the enquiry process.

6. Safeguards and how long we keep records

Protection is layered across administrative, technical, and physical measures: encrypted transport under TLS 1.3, AES-256 encryption at rest, isolated database clusters, and credentials restricted by role.

Retention lasts no longer than the enquiry, any related correspondence, audit obligations, or a statutory holding period demand. At expiry, records are erased permanently or anonymised irrevocably.

7. Individual rights

Depending on where you live, and after identity verification, you can exercise these rights:

Right of access: Request a transferable copy of your stored records and verify our handling procedures.
Correction: Ask us to fix any record that is inaccurate, incomplete, or no longer current.
Erasure: Have your data removed once processing is no longer required by law or by the purpose it served.
Limiting processing: Pause processing activity while a record's accuracy or our legitimate interest is under review.

Opt-out and your choices

Control over the collection and use of your personal information rests with you. Where local law provides for it, the following choices apply:

Sharing and sale of your data: You may opt out of the sale or sharing of your personal information with third parties where laws such as the CCPA/CPRA in California, or comparable legislation elsewhere, provide for it. While we do not sell personal information in the conventional sense, some data may be shared with trusted partners in order to provide or improve the service.
Cookie controls: Cookies and similar tracking tools can be managed or declined via your browser configuration or the consent controls published on this website.
Marketing communications: Promotional email and newsletters can be discontinued through the unsubscribe link in any message or by contacting us directly.
Consent withdrawal: Where you previously consented to processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, or to make an opt-out request, please contact us at [email protected] or use our contact form.

8. Changes to this notice

Frolvina may revise this notice to reflect regulatory developments or changes to the service. Material amendments appear on this page with a new effective date, and continued use of the site after publication indicates acceptance of the revised terms.