Privacy Policy

Last updated: 30 September 2026

1. Who we are

Mauritius Rooms operates the La Pointe penthouse at La Pointe Luxury Apartments, Coastal Road, Pointe aux Canonniers, Mauritius, and this website. We are the controller of the personal data described in this policy. You can contact us about your data at bookings@mauritiusrooms.com.

We handle personal data in line with the Mauritius Data Protection Act 2017 and, for guests in the European Union and United Kingdom, the EU and UK General Data Protection Regulation (GDPR).

2. The data we collect

• Booking details: your name, email address, phone number, country, preferred language, number of adults and children, dates, chosen rate and extras, and any notes you add.
• Payment details: card payments are handled by Stripe. We receive confirmation of payment and limited details such as the card type and last four digits, but never your full card number.
• Enquiries: what you send us through the contact form, by email, by phone or by WhatsApp.
• Guest portal: your booking reference and surname when you sign in to Manage My Stay, and any requests you make there.
• Virtual Concierge: the messages you type into the website chat, so that an answer can be generated.
• Technical data: your IP address, browser and device type, and the pages you request, which our hosting and security providers log to keep the website running and secure.
• Bookings from other platforms: if you book through Airbnb, Booking.com or Expedia, we receive the booking details that platform shares with us.

3. How we use your data, and why

• To take and manage your booking, including payment, confirmation, pre-arrival and stay emails, and arranging access to the residence. This is necessary to perform our contract with you.
• To answer your enquiries and concierge requests. This is necessary to take steps at your request before a contract, or is in our legitimate interest in helping you.
• To keep records required by law, such as tax and accounting records, and to meet any legal duty to register guests with the authorities.
• To keep the website and bookings secure and prevent fraud and double bookings. This is in our legitimate interest.

We do not sell your data, we do not use it for advertising, and we do not send marketing emails unless you have asked us to.

4. Who we share it with

We share only what each provider needs to do its job:

• Stripe: card payments and refunds.
• Resend: sending booking and stay emails.
• Anthropic: generating Virtual Concierge answers from the messages you type. Messages are not used to train its models.
• Railway: hosting the website and booking database.
• Cloudflare: protecting and speeding up the website.
• Google Fonts: displaying the website's fonts, which means your browser requests them from Google.
• Residence management and on-site services, such as the syndic, security and restaurant, when needed for your access to the residence or services you request.
• Local operators for excursions and transfers you ask us to arrange.
• Authorities, where the law requires it.

5. International transfers

Some of these providers process data outside Mauritius, including in the United States and the European Union. Where this happens, we rely on appropriate safeguards such as standard contractual clauses.

6. How long we keep it

We keep booking and payment records for as long as tax and accounting law requires, normally up to 7 years after your stay. Enquiries that do not lead to a booking are kept for up to 2 years. Technical logs are kept for a short period by our hosting and security providers.

7. Cookies

We do not use advertising or analytics cookies. Cloudflare may set a strictly necessary security cookie to protect the website from abuse. Because it is essential to the website working securely, it does not require consent.

8. Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email bookings@mauritiusrooms.com. We reply within one month.

You can also complain to the Data Protection Office of Mauritius (dataprotection.govmu.org) or, if you live in the EU or UK, to your local data protection authority.

9. Security

Your data is sent over encrypted connections and stored with providers that apply strong security controls. Access to booking data is restricted to the people who need it to look after your stay.

10. Children

Bookings must be made by an adult. We only hold children's details, such as the number of children in a party, as part of an adult's booking.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.