Privacy Policy
This policy explains how Palmar Beach Lodge (“Palmar”, “we”, “us”) collects and uses personal data when you visit palmarbeachlodge.com, book with us, contact us or stay with us.
Who we are
Palmar Beach Lodge is operated by Panama Partners International, S.A. (RUC 438372-1-429828 DV 4), Playa Segunda, Isla Bastimentos, Bocas del Toro, Republic of Panama. Panama Partners International, S.A. decides how and why your personal data is used and is responsible for it. We have not appointed a data protection officer; our team answers privacy questions at the address below.
Who to contact
For any privacy question or request, write to privacy@taso-group.com.
What we collect
Booking details you give us directly or through our booking engine (Mews): name, email, phone, country, travel dates, number of guests, room choice, special requests and payment details. Card details are handled by our payment providers; we do not store full card numbers.
Messages you send us by email, WhatsApp, phone or social media, and anything you choose to tell us in them, such as dietary or accessibility needs. Please share health details only if you are comfortable doing so; we use them only to look after you during your stay.
Information needed for your stay, such as passport or ID details that Panamanian law requires us to record, and purchases you make during your stay.
Technical data from your browser when you use this site, such as IP address, device, browser and the pages you visit. Analytics and advertising cookies are used as described in Cookies below (in Europe only after you accept; elsewhere until you opt out).
If you book through a travel agent or an online travel agency such as Booking.com or Expedia, the booking details they send us.
Images recorded by security cameras in common areas of the property.
Health information you give us on wellness or massage intake forms.
If you plan a group stay, retreat or event with us, the organiser’s contact details and the details of the event.
How we use it
To take and manage your reservation, payments and stay. This is necessary to carry out our contract with you.
To reply to you and send service messages about your booking and stay, such as confirmations, pre-arrival information and online check-in, by email, text message or WhatsApp. This is necessary for our contract with you, or in our legitimate interest in answering your enquiries.
To meet legal, tax, accounting and safety obligations. This is required by law.
To keep our site, our guests and our property secure, prevent fraud and improve our services. This is in our legitimate interest, which we weigh against your rights.
With your consent, or where the law allows for past guests, to send you marketing emails from Palmar and TASØ Hospitality Group, and, with your consent, to understand how the site is used and to measure or personalise our advertising.
To arrange tours, transfers and activities you ask us to book. This is necessary to provide the service you request.
To ask for your feedback after your stay and invite you to leave a review. This is in our legitimate interest in improving our service, and you can opt out at any time.
To keep guests, staff and the property safe, including with security cameras in common areas. This is in our legitimate interest in security.
Marketing emails
We send occasional emails about offers, events and news at Palmar and our sister properties in TASØ Hospitality Group. We send them to people who agree to receive them, for example by ticking the box when booking on our website (it is never ticked for you) or by signing up, and, where the law allows, to past guests about similar offers at Palmar. Every email has an unsubscribe link, and we act on unsubscribe requests promptly, within 10 business days at the latest. Our email provider may tell us whether an email was opened or a link clicked, so we can send fewer and more relevant emails. We never sell or rent our mailing list.
Security cameras
We use security cameras (CCTV) in common areas of the property to protect guests, staff and property. There are never cameras in guest rooms or bathrooms. Footage is viewed only when needed, for example to investigate an incident, and may be shared with the police or authorities where the law requires.
Health and wellness information
Health, allergy and accessibility details, including wellness or massage intake forms, are sensitive data. We collect and use them only with your explicit consent and only to provide the service safely and look after you during your stay. Only the staff who need this information can see it.
Photos and video
We sometimes take photos and video at events and around the property to use on our website, social media and other marketing. We avoid featuring guests in a recognisable way without their agreement. If you appear in one of our images and would like it removed, contact us and we will remove it.
Booking for others
If you book for, or give us details about, other guests, please make sure they know you are sharing their details with us and point them to this policy.
Who we share it with
We share personal data only with companies that help us run Palmar, and only what they need: Mews (reservations, booking engine and payments) and our payment processors, Akia (guest messaging by text message and WhatsApp, and online check-in), Supabase (secure hosting for TASØ Suite, our internal guest management system), Webflow (website hosting), Mux (video hosting), our email and email marketing providers, WhatsApp for messages you send us there, and CookieYes, which records your cookie choices. When you ask us to arrange a tour, transfer or activity, we give the provider the details they need, such as your name, phone number and arrival time. We also share data with analytics and advertising partners according to your cookie choices (see Cookies): Google (Analytics and Ads), Microsoft (Clarity and Microsoft Advertising), PostHog (site analytics and session recordings, with form fields masked) and Meta (Facebook and Instagram). We may also disclose data where the law requires it, or to our professional advisers. If the hotel or its operation is sold or transferred, personal data may pass to the new operator, who must protect it as this policy describes. We do not sell or rent personal data.
International transfers
Several of these providers store or process data outside Panama, including in the United States and the European Union. As Panama’s Law 81 of 2019 allows, we transfer data abroad when it is needed to provide the services you book, when you have consented, or when the provider gives appropriate safeguards such as contractual clauses. We share only what is needed.
Cookies and similar technologies
Essential storage keeps the site working and remembers your choices, for example your cookie preferences and whether you closed a promotion. You can review or change your cookie choice at any time from the Cookies link at the bottom of every page. Our fonts are hosted on our own site. The map on our Location page comes from Google Maps and loads only if functional cookies are allowed or you click Show map. Our booking engine at app.mews.com is run by Mews and has its own cookie notice.
We use CookieYes to show our cookie notice and record your choice, and what you see depends on where you are. In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you accept them: until then, Google Analytics and Google Ads receive only cookieless signals through Google Consent Mode, and Microsoft Clarity, PostHog, Meta and Google’s advertising cookies do not load at all. Everywhere else, including Panama, the United States, Canada and Latin America, these cookies are on when you arrive, and you can turn them off at any time with Reject or the “Do Not Sell or Share My Personal Information” link, which replaces the Cookies link at the bottom of the page there. If you live in California or another US state with a privacy law, you have the right to opt out of the sale or sharing of your personal information for targeted advertising. We do not sell personal information for money, but some advertising cookies can count as “sharing”, so we treat your opt-out, or a Global Privacy Control signal from your browser, as a request to stop them; we will not treat you differently for using this right. Cookies are grouped as Necessary (always on), Functional, Analytics, Performance and Advertisement, and Google and Microsoft tools receive your choice through Google Consent Mode and Microsoft’s consent signals. We keep your choice for up to 12 months, then ask again.
Other websites and social media
Our site links to other websites and services, such as our booking engine at app.mews.com, our restaurant menu and our social media pages. Those are run by other companies under their own privacy policies, which we encourage you to read.
How long we keep it
We keep booking, stay, invoice and accounting records for up to seven years, in line with Panama’s commercial and tax laws. We keep messages for up to two years after your last contact, wellness intake forms for up to 12 months, and security camera footage for up to 30 days unless it is needed to investigate an incident. We keep your email address for marketing until you unsubscribe, or for three years after you last open one of our emails, and your cookie choice for 12 months. After that, we delete or anonymise the data.
Your rights
Under Panama’s Law 81 of 2019 you can ask to access, correct, delete or receive a copy of your personal data, and to object to its use, including at any time to marketing. We answer requests for access, deletion, objection or a copy within 10 business days, and correct inaccurate data within 5 business days. Where the EU or UK General Data Protection Regulation applies, you can also ask us to restrict how we use your data. You can withdraw consent at any time; this does not affect what we did before. We do not make decisions about you based solely on automated processing. To use your rights, email us at the address above; we may ask you to confirm your identity. You may also complain to Panama’s National Authority for Transparency and Access to Information (ANTAI) or to the data protection authority where you live.
Children
Our website is meant for adults. Bookings must be made by a person aged 18 or over. We collect children’s details only as part of a booking made by a parent or guardian, with their authorisation.
Security
We use reasonable technical and organisational measures to protect personal data, and only staff who need it can access it. If a security breach affects your personal data, we will notify the data protection authority and you where the law requires. No method of transmission over the internet is completely secure.
Changes
We may update this policy from time to time. The date at the top shows when it last changed. If we make important changes, we will show a notice on this site. This policy is available in English and Spanish; if the two versions differ, the English version prevails.