Effective Date: April 24, 2026
Last Reviewed: April 24, 2026

1. Introduction

CaymanVacation.com (“we,” “us,” or “our”) has provided vacation rental services in Grand Cayman, Cayman Islands since 1989. We are committed to protecting the privacy and personal data of everyone who interacts with us — including website visitors, email subscribers, vacation rental guests, property owners, vendors, and business partners.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights available to you. It applies to:

• Our website at www.caymanvacation.com and any related subdomains
• Our email marketing and subscription communications
• Booking enquiries and reservation processes
• Guest services and property management activities
• Our relationships with property owners, vendors, and business contacts

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our website and services.

2. Who We Are (Data Controller)

For the purposes of applicable privacy laws — including the EU General Data Protection Regulation (GDPR) and comparable laws — CaymanVacation.com is the data controller responsible for your personal data.

Business name: CaymanVacation.com
Location: Grand Cayman, Cayman Islands
Website: www.caymanvacation.com
Email: reservations@caymanvacation.com

3. Personal Data We Collect

We collect personal data in the following categories, depending on how you interact with us:

3.1  Website Visitors

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, referral URLs, and time spent on pages
• Cookies and similar tracking technologies (see Section 9)

3.2  Booking Enquiries & Guests

• Full name and contact details (email address, phone number, mailing address)
• Travel dates, party size, and property preferences
• Payment information — processed securely through our third-party payment processor; we do not store full card numbers
• Guest review responses submitted post-stay
• Communications and correspondence relating to your stay
• Special requests or accessibility needs you choose to share

3.3  Email Subscribers

• Email address and, where provided, your first name
• Subscription preferences and marketing consent records
• Email engagement data (opens, clicks) collected by our email platform

3.4  Property Owners & Vendors

• Business name and contact information
• Bank account or payment details for remittance
• Property details, contracts, and correspondence
• Tax identification numbers where legally required

3.5  Data We Do Not Collect

We do not intentionally collect sensitive personal data such as racial or ethnic origin, health information, political opinions, religious beliefs, or biometric data. Please do not submit such information through our forms or correspondence unless strictly necessary for the service requested.

4. How We Collect Personal Data

We collect personal data through the following methods:

Directly from you

• Enquiry and contact forms on our website (powered by HubSpot)
• Newsletter and subscription sign-up widgets
• Booking and reservation forms
• Email, phone, or in-person communication
• Guest review and feedback requests submitted post-stay

Automatically when you visit our website

• Website analytics tools that collect usage and traffic data
• Cookies and tracking technologies (see Section 9)
• Server logs

From third-party platforms

• Booking platforms such as Vrbo and Airbnb, when you enquire or book through those channels
• Email marketing platforms (HubSpot, Campaign Monitor) that record subscription and engagement data
• Pricing tools such as Beyond Pricing that provide market and occupancy data

5. Why We Use Your Personal Data (Legal Bases)

We process personal data only where we have a valid legal basis under applicable privacy law. The table below sets out our purposes and the corresponding legal basis:

Where we rely on legitimate interests, we have balanced our interests against your rights and are satisfied that our processing does not override your fundamental privacy rights. You may object to processing based on legitimate interests at any time (see Section 10).

6. How We Share Your Data

We do not sell your personal data. We share it only as described below:

6.1  Service Providers

We engage trusted third-party service providers who process data on our behalf under contractual obligations consistent with this policy:

• HubSpot — CRM, contact management, and website forms
• Campaign Monitor — email marketing delivery and subscriber management
• Beyond Pricing — dynamic pricing and market data analytics
• Vrbo / Airbnb — vacation rental listing and booking platforms
• Payment processors — secure processing of guest payments
• Website hosting and infrastructure providers

6.2  Legal Requirements

We may disclose personal data if required to do so by applicable law, court order, or governmental authority, or to protect the rights, property, or safety of CaymanVacation.com, our guests, property owners, or others.

6.3  Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, personal data held by us may be among the transferred assets. We will notify affected individuals via email or a prominent notice on our website in advance of any such transfer.

6.4  With Your Consent

We may share your data for any other purpose with your prior explicit consent.

7. International Data Transfers

CaymanVacation.com is based in Florida, US and operating in the Cayman Islands. Some of our service providers (including HubSpot, Campaign Monitor, and Vrbo) process personal data on servers located in the United States and other countries that may not have privacy laws equivalent to those in the European Union or your home country.

Where we transfer personal data from the European Economic Area (EEA) or the United Kingdom to third countries, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to providers covered by recognised adequacy decisions
• Transfers necessary for the performance of a contract with you (e.g. completing your booking)

You may request further information about the specific safeguards we apply to any particular transfer by contacting us at the details in Section 11.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law:

9. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience and analyse how our site is used. Cookies are small text files placed on your device when you visit a website.

9.1  Types of Cookies We Use

Strictly Necessary Cookies

Required for the website to function. These cannot be disabled. They support form submissions, security, and session management.

Analytics Cookies

Help us understand how visitors interact with our website (pages viewed, time on site, referral sources). We use this data in aggregate to improve our content and user experience. These are only set with your consent where required.

Marketing & Functionality Cookies

May be set by third-party services embedded on our site (such as booking widgets, HubSpot forms, and social media plugins). These cookies may track your activity across websites to deliver relevant advertising and measure campaign performance.

9.2  Managing Cookies

You can control and delete cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. You can also manage preferences through any cookie consent banner displayed on our site.

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

10. Your Privacy Rights

Depending on where you are located, you may have the following rights regarding your personal data. We will respond to valid requests within 30 days (or within the timeframe required by applicable law).

10.1  Rights Under GDPR (EEA & UK Residents)

Right of Access

You may request a copy of the personal data we hold about you, along with information about how we process it.

Right to Rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to Erasure (“Right to be Forgotten”)

You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where we have no other legal basis to retain it. Note that we may be required to retain certain data to comply with legal obligations.

Right to Restrict Processing

You may ask us to limit how we use your data while a dispute about its accuracy or our right to process it is resolved.

Right to Data Portability

Where processing is based on consent or a contract, you may request a copy of your data in a structured, machine-readable format.

Right to Object

You may object to processing based on our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.

Right to Withdraw Consent

Where we rely on consent to process your data, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority. In the EU, you may contact your national Data Protection Authority. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO): www.ico.org.uk.

10.2  Rights for US Residents (California — CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt out of the sale or sharing of your personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights
• Correct inaccurate personal information we hold about you
• Limit the use of sensitive personal information

To exercise any California privacy right, contact us as set out in Section 11.

10.3  How to Exercise Your Rights

To submit a privacy request, contact us at:

Email: reservations@caymanvacation.com
Website: www.caymanvacation.com

We may need to verify your identity before responding to your request. We will not charge a fee for reasonable requests but may charge or refuse excessive or unfounded requests.

11. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

CaymanVacation.com

Grand Cayman, Cayman Islands

Email: reservations@caymanvacation.com
Website: www.caymanvacation.com

We aim to respond to all privacy enquiries within 30 days of receipt.

12. Children’s Privacy

Our website and services are not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data, please contact us immediately and we will take steps to delete such information.

13. Third-Party Links

Our website may contain links to third-party websites including booking platforms, review sites, and social media. This Privacy Policy applies only to CaymanVacation.com. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies before providing personal data.

14. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encrypted data transmission (HTTPS/TLS)
• Access controls limiting who can view personal data
• Use of reputable third-party platforms with their own security certifications
• Regular review of our data handling practices

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by law.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the “Last Reviewed” date at the top of this document
• Post a notice on our website or notify you by email where the change is significant
• In some cases, seek your renewed consent where required by law

We encourage you to review this policy periodically. Your continued use of our website after changes have been posted constitutes acceptance of the updated policy.

16. Governing Law

This Privacy Policy is governed by the laws of the Cayman Islands, including the Data Protection Act (As Revised). Where you are located in a jurisdiction with additional privacy rights (such as the EEA, UK, or California), the applicable provisions of those laws will also apply.