Home › Privacy & data protection

Privacy & data protection

This is an exhaustive description of what this website does with your data — not a template. The short version: we run no tracking of any kind, we set no cookies, and everything stays in the EU — the only exception being an optional 3D tour that you have to load yourself, described below. The long version is below, written so it stays true under audit.

01 · Who is responsible

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Controller: Aloaha Limited
Address: 45, Triq Gio Felice Inglott, Pembroke PBK1131, Malta
Email: info@aloaha.com
Phone: +49 151 5761 0183
Data-protection contact: info@aloaha.com

Write to info@aloaha.com for anything on this page — a person reads it.

02 · What we do not do

None of the following exist anywhere on this website. Not behind a consent banner, not "only if you opt in", no asterisks. You can verify every line with your browser's developer tools — open the Network and Application tabs and look.

No cookies. This site sets no cookies at all — not first-party, not third-party, not "essential". There is no cookie banner because there is nothing to consent to.
No analytics. No Google Analytics, Matomo, Plausible, Fathom, Mixpanel, Amplitude or Segment. No self-hosted analytics either. We do not count you.
No tag managers. No Google Tag Manager or any other container that could inject third-party code later.
No advertising or retargeting pixels. No Meta/Facebook pixel, no Google Ads tag, no TikTok/LinkedIn/Pinterest pixel, no conversion tracking, no audience lists. We never build a profile of you and never sell or share data with advertisers.
No session recording or heatmaps. No Hotjar, FullStory, LogRocket, Clarity, Mouseflow. Nobody replays your visit.
No fingerprinting. We do not probe your canvas, fonts, audio stack, screen or device to build an identifier.
No third-party error reporting. No Sentry, Bugsnag or Datadog RUM. Script errors stay in your own browser console.
No A/B testing or feature-flag services. Everyone sees the same site.
No external fonts or CDN JavaScript. The page uses your own system fonts. All CSS and JavaScript is inline, served by this server. Nothing is fetched from Google Fonts, jsDelivr, cloudflare or any other CDN — so no third party ever learns your IP address from loading this page.
No social plugins. No Facebook Like button, no embedded X/Instagram/YouTube widgets, no chat pop-ups, no live-chat SDK.
No browser storage. We do not use localStorage or sessionStorage on the public site. Nothing about you is kept on your device between visits.
No AI profiling and no automated decision-making. Your enquiry is read by a person. There is no profiling and no automated decision producing legal effects (Art. 22 GDPR).
No data sale, ever. Your data is not a product. It is never sold, rented, brokered or traded.

Because we set no cookies and run no tracking, there is no consent banner on this site, and none is required (Art. 5(3) ePrivacy Directive only bites when you store or read information on a user's device — we do neither).

03 · What we do do

The web server keeps standard access logs. Like every web server, ours records the request (URL, HTTP status, timestamp, IP address, user agent). We use these only to keep the service running and secure — never to profile visitors. Legal basis: legitimate interest (Art. 6(1)(f)) in operating and securing the site.
We record availability searches to gauge demand. When you check availability or open a property's booking calendar, we log which property and which dates you looked at, together with your IP address and the time. We use this only to understand which properties and dates are in demand. After a limited period your IP address is automatically removed (anonymised); only the anonymous statistics — property, dates and time, with no way to identify you — are kept for long-term trends. Nothing is shared with third parties. Legal basis: legitimate interest (Art. 6(1)(f)) in understanding demand for our properties.
We serve every property photo from our own EU cache. Photos originate from our channel manager and property system, but we download them server-side and store them on this server. Your browser only ever talks to us — see the "where bytes go" table below. This is a deliberate choice: linking photos directly from their origin would have exposed your IP address to a third country.
If you send an enquiry, we keep what you typed. Details in section 03. That is the only place we ask you for personal data — there is no account, no signup, no newsletter.

The enquiry form — the only personal data we ask for

Sending an enquiry is voluntary. If you do, we process:

Data	Why
Name	To address you properly in our reply.
Email address	To reply to you. This is the only mandatory contact field.
Phone number	Optional — only if you would rather we call.
Property, dates, number of guests	To check availability and quote the correct price.
Your message	Whatever you choose to tell us. Please do not include sensitive data (health, religion, political views etc.) — we never need it.
Timestamp and a random reference id	So we can find your enquiry again and answer in order.

Purpose: To answer your enquiry and, if you want to book, to take the steps you asked for before entering into a contract.
Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. Where an enquiry does not lead to a booking, we rely on Art. 6(1)(f) — our legitimate interest in keeping a record of what we were asked and what we answered.
Where it is stored: In a file on this server, located in Malta (EU) and, so we notice it, as an email to our own mailbox. It is not sent to any analytics, CRM or marketing tool, because we do not use any.
How long: Enquiries that do not become bookings are deleted after 30 days. The clock starts at the last thing the enquiry was about, not at the day you sent it — so if you write to us in 2025 about a stay in 2027, the countdown only begins when that stay ends. Enquiries that become bookings are kept for the life of the booking and then for the statutory retention period Maltese tax and commercial law requires (generally 10 years for accounting records) — we cannot delete those earlier, but they are not used for anything else.
Consequence of not providing it: None. You simply cannot use the enquiry form — you can always phone or email us instead.

04 · Where the bytes go

This is the complete list of hosts your browser can contact while using this site.

Host	When	What it learns	Avoidable?
This server	Every page, every photo, and the map if you open it.	Your IP and the pages you request (standard access log).	No — it is the website.
OpenStreetMap	Only if you click the "© OpenStreetMap contributors" credit under a map.	That you followed a link to their site. It is a plain link — the map itself does not load anything from them (see below).	Yes — don't click it. The credit is there because their licence requires it.
Matterport (matterport.com, a US company)	Only on properties that offer a 3D tour, and only after you click "Load 3D tour". Nothing loads before that click.	Once you load the tour, your IP address and interaction with the 3D viewer, in the United States. Matterport may set its own cookies at that point.	Yes — simply don't load the tour. Every photo and the floor plan are available without it.

Property photos do not come from a third party. Our channel manager stores photos on Amazon S3 in the United States, and our property system has its own image CDN. Linking to either would have sent your IP address out of the EU on every page view. Instead this server downloads each photo once, server-side, and serves it to you from its own cache. Your browser never contacts Amazon, and never contacts our property system.

The map is ours too. An embedded Google, Mapbox or Leaflet map fetches its map images straight from that company on every view — which would hand them your IP address and undo everything above. So we do the same thing we do with photos: this server fetches each map tile once, stores it, and serves it to you from this domain. Your browser only ever talks to us. The map is also behind a button — until you press "Show map", not a single map image is requested. The map data is © OpenStreetMap contributors; our server (not you) is the one that asks them for it.

The optional 3D tour is the one exception — and only if you ask for it. Some properties offer a Matterport 3D walkthrough. It is not loaded with the page: you see a placeholder with a "Load 3D tour" button, and nothing is fetched from Matterport until you press it. Matterport is a company in the United States, so if you do load the tour, your browser then talks to them directly — they receive your IP address and may set their own cookies, exactly like any embedded video. If you would rather not, simply don't press the button; the photos and floor plan already show the whole property. Loading the tour is your affirmative consent (Art. 6(1)(a) GDPR and Art. 49(1)(a) for the transfer) — nothing happens without that click.

05 · Who runs the servers

We do not keep your data on our own office computers. This website and the booking system behind it run on Aloaha Limited's servers in Malta (EU), and your data is stored there.

Aloaha Limited is our processor in the sense of Art. 28 GDPR. In plain terms that means:

They act only on our instructions. They may not use your data for their own purposes, and there is a written data-processing agreement between us that says so.
We remain responsible to you. Aloaha Limited is the controller — if you want your data corrected or deleted, you ask us (section 08) and we see it through.
It stays put. Their servers are in Malta (EU), so your data does not leave that jurisdiction by being hosted with them.
They are not an advertising company and they do not build profiles. The no-tracking promise in section 02 is a property of this software as they build and run it, not a policy we bolted on.

You do not have to take our word for who they are: their company details and registered address, and how they approach privacy in their own words.

06 · Data residency — the EU, and only the EU

All personal data described here is stored and processed on servers in Malta (EU). There is no transfer of your personal data to a third country under Chapter V GDPR, and no reliance on Standard Contractual Clauses or the EU–US Data Privacy Framework for anything a visitor to this site does.

Two honest clarifications, because a privacy notice is worthless if it hides the awkward parts:

Our own suppliers are a separate question from your visit. We use a channel manager and a property-management system to run the business. Those are our processors and they never see anything about your visit to this website — the connection is server-to-server, from us to them, and only for property and booking data. Browsing this site sends nothing to them.
Booking through an online travel agency is not this website. If you find the same property on a large booking platform and book there, that platform is its own controller with its own rules — none of the above applies to it. Booking direct with us is the version where this page is the whole story.

07 · Who else sees your data

Your enquiry is read by our own staff. Beyond that:

Aloaha Limited — our hosting/IT processor, because the data physically sits on their EU servers (section 05). They act only on our instructions under an Art. 28 agreement and never for their own purposes.
No advertisers, data brokers or analytics companies — we have none.
Our property owners — where an enquiry concerns their property and answering you requires it.
Public authorities — only where the law obliges us (for example lawful requests, or the guest registration duties that apply to accommodation in Malta once you actually stay).

08 · Your rights

Under the GDPR you have the right to:

Access (Art. 15) — ask what we hold about you, and get a copy.
Rectification (Art. 16) — have wrong data corrected.
Erasure (Art. 17) — have data deleted, unless a legal retention duty stops us.
Restriction (Art. 18) — have processing frozen while something is disputed.
Data portability (Art. 20) — get your data in a machine-readable form.
Object (Art. 21) — object to processing based on legitimate interest.
Withdraw consent (Art. 7(3)) — where we ever rely on consent. Today we do not rely on consent for anything on this site.

To exercise any of them, write to info@aloaha.com. We answer within one month (Art. 12(3)). There is no fee, and we will not make you jump through hoops.

Right to complain

You can lodge a complaint with a supervisory authority — for Malta, the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, High Street, Sliema SLM 1549, Malta. You may also complain to the authority where you live or work.

09 · Security

The site is served over HTTPS.
The public site is read-only: it can show properties and take an enquiry. It has no access to booking financials, guest records or payment data — those live behind a separate authenticated system and are never reachable from these pages.
We collect no payment-card data on this website. There is no card form here.
Access to enquiries is limited to authenticated staff.

10 · Children

This site is aimed at adults booking accommodation. We do not knowingly collect data from children. If a child's data reaches us in an enquiry, tell us and we will delete it.

11 · The promise

If anything in section 02 ("what we do not do") ever stops being true, this page changes before that change ships. We will not add trackers quietly, and we will not bury a new pixel three menus deep. If you find something in this site that contradicts this page, please tell us at info@aloaha.com — that is a bug, and we will fix it.