Privacy Statement

This statement covers the websites and booking services offered under the trade names BookCuraçao.com and Latitude12. Both names belong to one registration with the Chamber of Commerce Curaçao under number 163245.

The legal entity name, registered address and tax registration behind these trade names, and the formal data-controller designation, are being finalised and are deliberately not stated here yet. A public legal contact address will be published in the same update.

• Enquiry data — name, email address, phone number, the message you write, travel dates, party size, the property or journey you were looking at, and the page and referrer you arrived from.
• Quote and booking data — stay dates, number of adults, children and infants, traveller ages where a hotel requires them to price a room, country of residence where required, contact email, currency, price breakdown, special requests and your booking reference.
• Payment data — transaction amount, currency, payment status and the payment identifiers our payment provider returns. Card details are entered on the payment provider’s own hosted payment form and are not stored by us.
• Account data — for Latitude12 accounts: the identifier and email address held by our authentication service, and the role assigned to the account.
• Communication data — transactional emails sent to you, message threads connected to an enquiry or booking, and delivery/suppression records.
• Usage data — on Latitude12 only, and only after you consent: page views and product events, plus the campaign, referrer and landing page of your visit.

To answer enquiries, produce quotes, arrange and confirm accommodation with the property or its distribution partner, take payment, send operational messages about your stay, keep records of transactions, run and secure the service, and — with consent — understand how the Latitude12 site is used.

• Performance of, or steps prior to, a contract — enquiries, quotes, bookings, payment and stay-related messages.
• Legal obligation — transaction and administrative records.
• Legitimate interests — service security, fraud prevention, internal operations and quality control.
• Consent — analytics and any non-essential browser storage; consent can be withdrawn at any time.

These bases are described under the Curaçao Landsverordening bescherming persoonsgegevens (Lbp) and, where the GDPR applies to a given visitor or processing activity, under the GDPR.

Latitude12 has authenticated accounts, used for operator, partner and staff access. They are handled by our hosted authentication and database service, which stores the account identifier, email address and session state. BookCuraçao.com does not require a visitor account to make an enquiry or a booking.

An enquiry is stored as a durable record, together with the page and referrer it came from and any stay or journey context you were viewing. Enquiries may open an internal message thread so the team can follow up. Enquiries made under either trade name are handled through the shared Latitude12 operational and booking systems; the formal allocation of controller and processor roles between the two trade names has not yet been settled and is listed in our open legal items. Guests are not passed to properties to negotiate directly.

Latitude12 is the system of record behind enquiries, quotes and bookings made under either trade name — including bookings started on BookCuraçao.com. A quote stores the travel parameters and the priced result, and expires after a set period. A booking stores guest details, stay details, price composition, payment references and the state of the reservation with the property or its distribution partner.

Payments are processed by Stripe. Stripe receives the transaction amount, currency, description and booking metadata, and collects card and billing details directly through its hosted payment form. We store the resulting payment identifiers and status, not your card number. Refunds, where they apply, are issued through the same payment provider.

Transactional emails (booking confirmations, stay information, replies to enquiries) are sent through our email infrastructure provider, which receives the recipient address, name and the booking or travel details the message contains. We also keep send and suppression logs. Operational records may be synchronised into the internal CRM and mailbox integrations the team uses to handle enquiries and bookings.

Latitude12. Analytics are consent-gated. Nothing is loaded before you choose. With analytics consent, two providers may run: PostHog (product analytics) and Google Analytics 4. Both are refused outright without consent, and both are switched off again when consent is withdrawn. A browser “Do Not Track” signal overrides a stored consent and keeps analytics off for as long as it is enabled. When analytics consent is active and you are signed in to a Latitude12 account, the analytics identity may include your account identifier and email address.

BookCuraçao.com. That site currently loads no analytics or advertising software at all.

Both sites load web fonts from Google’s font service, which means your browser makes a request to Google when a page loads. See the cookies and browser storage notice for details.

Our services are intended for adults making travel arrangements. A hotel may require the exact ages of travelling children in order to price and confirm a room; where that is the case, those ages are collected for that booking purpose only. We do not build profiles of children and we do not use ages for advertising.

• Hosted database, authentication and storage — durable enquiry, quote, booking, account and relationship records.
• Stripe — payment and transaction data; card data collected on Stripe’s hosted form.
• Juniper / Roibos — the guest and travel data a hotel needs to quote and book, which can include traveller ages, country of residence and a contact email.
• Hostaway — guest and reservation data for villa and property-management stays that are mapped to it.
• Email infrastructure provider — recipient address and the booking or travel content of transactional messages.
• CRM and mailbox integrations — contact identity and booking context for internal operational follow-up.
• PostHog and Google Analytics 4 — Latitude12 only, and only with analytics consent.
• Accommodation providers — the details needed to hold and deliver your stay.

This list reflects the integrations actually implemented in our systems. We do not list vendors we do not use.

Our service providers and the properties we work with are located in several countries, including outside Curaçao and outside the European Economic Area.

The complete list of processing countries and the transfer mechanism relied on for each provider is still being compiled and will be published in this statement once confirmed.

Quotes carry an expiry after which they can no longer be used. Beyond that, we are transparent about the current position: a fixed retention and deletion schedule for durable enquiry, booking, communication and relationship records is not yet implemented. Those records are kept while they remain necessary for the booking relationship and for administrative and legal record-keeping.

Defining and implementing a documented retention and deletion schedule is an open item before these documents are finalised.

Access to operational systems is restricted to authenticated accounts with assigned roles, payment credentials are held server-side only, and supplier identifiers and internal records are kept out of public responses. We do not publish specific technical security measures or encryption claims in this document.

Under the Curaçao Lbp, and under the GDPR where it applies, you can ask for access to your personal data, correction of inaccurate data, deletion where the law allows, restriction of or objection to certain processing, and portability where applicable. You can withdraw analytics consent at any time through the “Privacy preferences” link in the footer.

A dedicated contact address for rights requests will be published together with the operator identity details.

Our sites show editorial recommendations and related stays based on destination, area and content relationships. These do not produce legal or similarly significant effects, and we do not carry out automated decision-making of that kind.

You may raise a complaint with us, and with the Curaçao data protection authority (College bescherming persoonsgegevens) or, where the GDPR applies, your local supervisory authority.

Version 2026-09-21-draft. This draft was prepared against the following primary sources:

• Landsverordening overeenkomsten langs elektronische weg (consolidated, P.B. 2024 no. 89), Gobierno di Kòrsou
• Burgerlijk Wetboek Curaçao, Boek 6 (current regulation)
• Consumer Rights Directive 2011/83/EU, Article 16(l) — accommodation on a specific date (where EU law applies)
• College bescherming persoonsgegevens Curaçao (Lbp supervisory authority)