Privacy Policy

We only collect what we need to serve you well:

• Booking information — name, email, phone number, number of guests, dates and preferences you share at checkout.
• Payment information — processed by our payment partners (Stripe and, when enabled, Paystack). We never store full card numbers on our servers.
• Account and admin data — if you are a Retiro team member, your Google account email and name after you sign in.
• Communications — the content of enquiry-form messages, newsletter sign-ups, WhatsApp concierge chats and 3CX Live Chat conversations.
• Device and usage data — IP address, browser type, pages viewed and basic analytics so we can keep the site reliable and secure.
• Cookies — strictly-necessary cookies for your session, plus cookies set by our chat and payment partners when you interact with them.

• Confirm and manage your bookings, send receipts, reminders and magic-link access to your guest portal.
• Prevent double-bookings, fraudulent transactions and abusive activity.
• Respond to enquiries, chat messages and support requests.
• Send you the newsletter if you have subscribed (you can unsubscribe at any time).
• Improve the resort experience and the website — including analytics on which pages and venues matter most.
• Comply with legal, accounting and tax obligations in Nigeria.

Depending on your country, we rely on one or more of the following lawful bases: performance of a contract (your booking), your consent (newsletter, chat, cookies), our legitimate interests in operating a safe hospitality business, and compliance with applicable law.

We never sell your personal data. We only share it with service providers that help us run the resort:

• Stripe and Paystack — to process card and bank payments.
• Resend — to deliver booking receipts, admin alerts and reminder emails.
• Google — for admin sign-in and for the embedded Maps on our Contact section.
• 3CX — for the Live Chat widget and WhatsApp channel routing to our concierges.
• MongoDB Atlas and our hosting provider — for secure storage and delivery of the website and database.

Each partner handles data only on our instructions and under their own privacy terms. Payment data goes directly to the payment processor over an encrypted channel.

Some of our partners (for example Stripe, Google and Resend) process data outside Nigeria. Where this happens, we rely on the safeguards those providers offer — including Standard Contractual Clauses — to keep your information protected.

• Bookings, receipts and related correspondence: 7 years, in line with Nigerian tax record-keeping rules.
• Guest profile notes and tags: until you ask us to delete them or until the guest record is inactive for 7 years.
• Live-chat transcripts (3CX): 30 days from the end of the conversation.
• Enquiries: 24 months.
• Newsletter subscriptions: until you unsubscribe.
• Audit log of admin activity: 90 days.
• Abandoned bookings that never pay: automatically deleted after 24 hours.

Subject to applicable law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your data where we no longer need it to serve you.
• Object to or restrict certain processing.
• Withdraw consent at any time (for example, by unsubscribing from the newsletter or declining the 3CX GDPR notice).
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.

To exercise any of these rights, email us at aweleosadebe@gmail.com. We will respond within 30 days.

We use a small number of strictly-necessary cookies to keep your session working. Our 3CX Live Chat widget shows a GDPR consent screen before any conversation starts; by clicking “I consent” you agree to the processing of your personal data and the use of cookies for the purpose of chat and support, for a duration of 30 days, as described in that notice.

We protect your information with HTTPS, encrypted database connections, strict role-based access to the admin console, Google OAuth for staff sign-in, and immutable audit logging of every back-office mutation. No system is perfectly secure, so if you ever suspect misuse of your Retiro account, write to us immediately.

Retiro welcomes families, but this website is designed for adults making bookings on behalf of their party. We do not knowingly collect data from children under 13; if you believe we have, please contact us and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top will always reflect the latest version. Material changes will be communicated by email where appropriate.

Questions, requests or complaints about this policy can be sent to:
Retiro Resort Lagos — Optima Leisure
Adekunle Animashaun Drive, Oniru (Okunde Zone), Lagos, Nigeria
aweleosadebe@gmail.com