Privacy Policy

Effective Date: August 2026 | Last Updated: August 2026

ACOYA Curaçao Resort, Villas & Spa (“ACOYA,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, store, protect, and disclose personal information when you visit our website, make a reservation, stay at our resort, use our facilities or services, communicate with us, subscribe to marketing communications, or otherwise interact with ACOYA. ACOYA is an independent resort located in Willemstad, Curaçao. This Privacy Policy applies to personal information collected through our website, reservations, guest stays, restaurant and spa bookings, meetings and events, marketing activities, CCTV systems, and other interactions with ACOYA.

Information We Collect

The personal information we collect depends on how you interact with ACOYA and may include contact and identification information such as your name, address and country of residence, telephone number, email address, nationality where required, and identification or travel-document information where required for check-in or by law.

When you make or manage a reservation, we may collect arrival and departure dates, room or accommodation preferences, number of guests, names of accompanying guests where required, reservation history, booking source, special requests, airport transfer requests, and communications relating to your reservation or stay.

When you make a reservation or payment, information may be processed for deposits, accommodation charges, restaurant and spa charges, incidental charges, refunds and cancellations, chargebacks and disputed transactions, fraud prevention, and accounting and financial administration. ACOYA uses authorized banking and payment services, including MCB, for payment processing. Payment-card information may therefore be processed directly by the relevant payment service provider rather than stored by ACOYA.

Restaurant Reservations

Restaurant reservations are accepted by telephone, WhatsApp, email, and, where available, online systems. We may collect your name, contact details, reservation date and time, number of guests, and reasonable requests relating to your reservation. For payment details, please refer to the Payment Security section below.

Spa Appointments

For spa appointments, ACOYA collects the information reasonably necessary to arrange and administer your appointment. ACOYA does not currently maintain medical treatment records or health questionnaires as part of its standard spa booking process.

Meetings, Weddings and Events

When you enquire about a wedding, meeting, conference, banquet, or other event, we may collect information such as your name, company or organization, email address, telephone number, preferred event dates, number of attendees, accommodation requirements, catering requirements, and other information voluntarily provided regarding the proposed event.

These enquiries may be handled by telephone, WhatsApp, or email. ACOYA may also introduce online event enquiry forms in the future, in which case this Privacy Policy will apply to information submitted through those forms.

Information Collected Automatically

When you visit our website, certain technical information may be collected automatically, including IP address, browser type, device type, operating system, pages visited, date and time of access, referring website, approximate geographic location, interaction with website content, advertising and campaign information, and cookie or similar technology identifiers.

We use this information to operate and improve our website, understand visitor behaviour, measure marketing effectiveness, maintain security, and provide more relevant content and advertising.

Cookies and Similar Technologies

ACOYA uses cookies and similar technologies on its website. Cookies are small data files placed on your computer, smartphone, or other device when you visit a website.

We may use strictly necessary cookies for essential website functionality; functional cookies to remember preferences; analytics cookies to understand website usage; and advertising and marketing cookies to measure campaigns and provide more relevant advertising.

Where required, non-essential cookies are activated according to the choices you make through our cookie-consent mechanism. You can also manage cookies through your browser settings. Disabling certain cookies may affect website functionality.

Analytics and Digital Advertising

ACOYA uses digital analytics and advertising technologies to understand website performance and improve our marketing. These currently include Google Analytics 4 (GA4), Google Ads, and Meta Pixel.

These providers may use cookies and similar technologies and may process information such as IP addresses, browser information, device identifiers, and website activity. Where these providers independently determine how information is processed, their respective privacy policies also apply.

ACOYA may introduce, replace, or discontinue analytics and advertising technologies from time to time. Where required by applicable law, relevant technologies will be subject to your cookie-consent choices.

Reservation and Property Management Systems

ACOYA uses specialist hospitality technology to administer reservations and guest stays. Our principal systems currently include SiteMinder, used in connection with online reservations and distribution of accommodation inventory, and Winsar, ACOYA’s Property Management System, used for managing reservations, guest stays, and related hotel operations.

Information provided when making or managing a reservation may therefore be processed through these systems. We require service providers handling personal information on our behalf to maintain appropriate confidentiality, privacy, and security standards and, where required by applicable law or appropriate to the relationship, to enter into suitable data-processing or contractual arrangements.

How We Use Your Personal Information

We may use personal information to receive, confirm, modify, and administer reservations; provide accommodation and resort services; process payments and refunds; facilitate restaurant and spa reservations; administer meetings, weddings, conferences, and events; communicate with you before, during, and after your stay; respond to enquiries and requests; provide guest services; manage room preferences and reasonable special requests; arrange requested transportation or related services; provide customer service; handle complaints and disputes; conduct guest satisfaction surveys; improve our facilities, services, and website; maintain accounting and financial records; prevent fraud; investigate disputed transactions and chargebacks; maintain security; comply with legal and regulatory obligations; establish, exercise, or defend legal claims; conduct permitted marketing; measure advertising performance; and maintain and improve ACOYA’s business operations.

ACOYA does not sell personal information as a commercial product.

Legal Basis for Processing

ACOYA processes personal information where there is an appropriate legal basis for doing so. Depending on the circumstances, processing may be necessary to perform a contract, comply with legal obligations, pursue legitimate business interests, or may be based on your consent.

Legitimate interests may include improving our services, protecting the resort and its property, maintaining security, preventing fraud, administering our business, handling complaints, protecting legal rights, and understanding business performance. We consider the privacy interests and rights of individuals when relying on legitimate interests.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing lawfully undertaken before consent was withdrawn.

Marketing Communications

ACOYA may send you information about offers, packages, events, promotions, and resort news where you have requested such communications or where otherwise permitted by applicable law.

We currently use Mailchimp for email marketing and newsletter distribution. Information such as your name, email address, and interaction with marketing communications may therefore be processed through Mailchimp in accordance with the applicable service and data-protection arrangements.

Marketing emails will provide an appropriate method for unsubscribing. You may also request removal from our marketing list by contacting reservations@acoyacuracao.com. Unsubscribing from marketing communications will not prevent us from sending communications necessary to administer an existing reservation, transaction, or service request.

Sharing Personal Information

ACOYA does not sell guest personal information.

We may share personal information where reasonably necessary with trusted third parties that provide services to ACOYA, including booking and reservation technology providers, property-management system providers, banks and payment processors, website hosting and technical providers, IT and cybersecurity providers, email and marketing platforms, analytics and advertising providers, professional advisers, auditors, accountants, insurers, transportation or other guest-service providers requested by you, tour operators and travel partners relevant to your reservation, and governmental, regulatory, judicial, or law-enforcement authorities where required or permitted by law.

Third-party service providers acting on ACOYA’s behalf are expected to process personal information only as necessary to provide their services and to maintain appropriate technical, organizational, confidentiality, and security measures. Where required by applicable law or appropriate to the relationship, ACOYA uses suitable contractual or data-processing arrangements.

Third-Party Booking Channels

You may reserve ACOYA accommodation through travel agents, online travel agencies, tour operators, and other distribution partners. When you make a reservation through a third party, that party may collect your personal information and subsequently provide relevant reservation information to ACOYA.

ACOYA does not control the independent privacy practices of third-party booking providers. We encourage you to review the privacy policy of the company through which you make your reservation.

Payment Security & Direct Communication Protocol

ACOYA takes reasonable precautions to protect financial and payment information. Payment-card processing is handled through MCB and/or other authorized financial-service providers. ACOYA seeks to use payment arrangements and providers that apply applicable payment-card security requirements, including PCI DSS where relevant.

Unsecured Communication Channels

You should not send full credit-card numbers, card verification values (CVVs), or other sensitive payment credentials through WhatsApp, unencrypted email, or standard instant messaging. Where appropriate, you will be directed to an authorized payment method, secure payment channel, or official banking instructions.

ACOYA does not retain full payment-card information beyond what is reasonably necessary and legally permitted for legitimate payment and reservation purposes. ACOYA maintains administrative, organizational, and technical safeguards appropriate to the information being processed.

CCTV and Resort Security

ACOYA operates CCTV surveillance in public areas of the resort for legitimate safety, security, and operational purposes. CCTV may cover entrances and exits, reception and other public areas, parking areas, and appropriate common areas.

CCTV may be used to protect guests, visitors, employees, and resort property; prevent and investigate theft, fraud, or other incidents; maintain safety and security; and assist competent authorities where legally appropriate.

CCTV is not intended for areas where you would reasonably expect a high degree of personal privacy. Recordings are accessible only to appropriately authorized persons and retained only for the period reasonably necessary for security purposes, unless required for an investigation, legal proceeding, or other legitimate purpose.

Guest Wi-Fi

ACOYA provides complimentary guest Wi-Fi. You are not currently required to provide an email address or room number to obtain standard Wi-Fi access.

Technical information necessary to provide and secure network access may nevertheless be processed automatically by the network infrastructure, including device identifiers, IP addresses, and connection information. ACOYA may use reasonable network-security measures to protect its systems, guests, and users against unauthorized activity or misuse.

International Data Transfers

ACOYA is located in Curaçao, while some technology and service providers used by ACOYA may process or store information in other countries. Reservation technology, analytics, advertising, payment, and email-marketing services may use international technology infrastructure.

Your personal information may therefore be processed outside Curaçao. Where required by applicable law, ACOYA will take reasonable steps to ensure that appropriate safeguards apply to international transfers of personal information. Depending on the circumstances, such safeguards may include contractual protections or other legally recognized transfer mechanisms.

Data Retention

ACOYA retains personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, accounting, tax, operational, and reporting requirements.

As a general policy, guest reservation records are retained for approximately five (5) years, unless applicable law requires a longer period, a shorter period is appropriate, information is required for an ongoing dispute, investigation, or legal proceeding, or another legitimate reason requires continued retention.

Other information, including marketing information and CCTV recordings, may be subject to different retention periods appropriate to its purpose. Sensitive guest preferences and special-request information are handled in accordance with the principles described below. When information is no longer reasonably required, ACOYA will take appropriate steps to delete, anonymize, or securely dispose of it.

Special Requests & Sensitive Personal Data

You may voluntarily provide information concerning dietary requirements, medical accessibility needs, or specific personal circumstances to facilitate tailored services during your stay.

ACOYA processes such information only to the extent reasonably necessary to fulfill the requested accommodation or service or as otherwise permitted by applicable law. Sensitive personal information should not be retained longer than necessary for the purpose for which it was provided and may be deleted, anonymized, or otherwise securely disposed of when no longer required, subject to applicable legal or operational requirements.

Your Privacy Rights

Depending on the law applicable to your circumstances, you may have rights concerning your personal information. These may include the right to request information about personal data we process concerning you; obtain access; request correction of inaccurate or incomplete information; request deletion where legally applicable; object to or request restriction of certain processing; withdraw consent where processing is based on consent; and request information concerning parties to whom your information has been disclosed, where applicable.

To exercise a privacy right, please contact reservations@acoyacuracao.com and state “Privacy / Personal Data Request” in the subject line. We may request reasonable information to verify your identity before responding.

European Visitors and GDPR

ACOYA welcomes guests from around the world, including residents of the European Economic Area (“EEA”).

Where the European Union General Data Protection Regulation (“GDPR”) applies to particular processing activities, ACOYA will process relevant personal data in accordance with applicable GDPR requirements.

Depending on the circumstances, EEA individuals may have rights including access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent.

EEA residents may direct privacy enquiries or requests to reservations@acoyacuracao.com with “GDPR / EU Personal Data Request” in the subject line. If ACOYA is required under Article 27 of the GDPR to appoint a representative in the European Union, the representative’s contact details will be published in this Privacy Policy.

Children’s Privacy

ACOYA is a family-friendly resort, and children may stay at the property with parents or guardians.

Information relating to children may be included in reservations where reasonably necessary, for example, a child’s name, age, or date of birth where required to determine occupancy, rates, accommodation arrangements, or other requested services.

ACOYA does not knowingly use children’s personal information for independent direct marketing. Where appropriate, information concerning minors should be provided by or with the authorization of a parent or legal guardian.

Security of Personal Information

ACOYA maintains reasonable administrative, organizational, and technical measures designed to protect personal information against unauthorized access, accidental loss, unauthorized alteration, inappropriate disclosure, and unlawful use.

Measures may include access controls, secure systems, password protection, encryption where appropriate, restricted access, staff procedures, and the use of reputable technology and payment providers.

Legal and Security Disclosures

ACOYA may disclose personal information where reasonably necessary to comply with applicable law; respond to a lawful request from a court, regulator, police authority, or other competent authority; investigate suspected fraud or criminal activity; protect the safety of guests, employees, or other persons; protect ACOYA’s property and legal rights; investigate accidents or security incidents; or establish, exercise, or defend legal claims.

Guest Feedback and Surveys

ACOYA may contact you following your stay to request feedback about your experience. Your responses may be used to improve our services, facilities, and guest experience.

Links to Other Websites

The ACOYA website may contain links to third-party websites. ACOYA is not responsible for their privacy practices, security, or content.

Business Transfers

If ACOYA or substantially all of its relevant resort business is reorganized, sold, merged, financed, or transferred, personal information may form part of the transferred business records under appropriate confidentiality requirements.

Applicable Law

ACOYA is established and operates in Curaçao. This Privacy Policy and ACOYA’s processing of personal information are principally subject to applicable Curaçao law, including the Landsverordening bescherming persoonsgegevens (Personal Data Protection Ordinance). Where mandatory international regulations, such as the GDPR, apply, ACOYA respects those applicable requirements.

Changes to This Privacy Policy

ACOYA may update this Privacy Policy periodically. The latest version will be published on our website with the date of the most recent update.

Contact Us

If you have questions concerning this Privacy Policy or ACOYA’s handling of personal information, please contact:

ACOYA Curaçao Resort, Villas & Spa
Kaya Leydi #35, Dr. Hugenholtzweg
Willemstad, Curaçao
Email: reservations@acoyacuracao.com
Telephone: (+5999) 562 1824
Website: www.acoyacuracao.com

© 2026 ACOYA Curaçao Resort, Villas & Spa. All rights reserved.