BluDoor Collection Privacy Policy

BluDoor Collection, or BluDoor, is a hospitality brand and service. This policy explains personal-information handling in connection with our website, inquiries, reservations, stays, guest services, and owner relationships. It covers guests, accompanying travelers, visitors, and owners or their representatives.

Our role and your choices

The accommodation supplier or operator, payment recipient, and BluDoor's role are property-specific. Refer to your reservation documents and confirmation, or contact info@bludoorcollection.com for clarification. Privacy responsibilities follow each party's actual role in determining or carrying out information use. Independent booking channels, payment providers, and service suppliers may have their own privacy notices.

This policy is not blanket consent or a waiver of privacy rights. Optional marketing and any required cookie or sensitive-information permissions are separate from accepting a booking. Declining optional marketing does not prevent booking.

Reservation obligations appear in the Guest Booking Policy and Terms & Conditions. The Guest FAQ and Booking Checkout Terms provide summaries.

Information, sources, and purposes

Depending on how you interact with BluDoor, the services you request, and the systems involved, information may include the following. Not every category applies to every guest or interaction.

When information is required for a reservation or legal obligation, we explain the requirement and the consequences of not providing it. Optional information is distinguished from required information. Organizers should share this policy with accompanying guests and provide their information only with appropriate authority.

Any identity-document request must be necessary and proportionate. Please ask for an appropriate protected submission route and whether unnecessary details can be masked. Do not send full card details, card security codes, passwords, or identity-document copies through ordinary email or guest messaging. Payment providers may handle credentials under their own responsibilities.

Legal grounds where applicable

Where law requires a lawful basis, it depends on the particular use: requested pre-contract steps or performance of your contract, a specific legal obligation, a legitimate interest balanced against your rights where available, or valid consent. Reservation administration, required tax records, and proportionate fraud prevention require their own appropriate basis; contract necessity does not authorize every use or cover every accompanying guest.

Optional marketing, monitoring, and sensitive-information handling may require separate permission or additional legal conditions. You may withdraw consent without affecting earlier lawful processing or services unrelated to that consent.

Sensitive requests and children

Accessibility needs, allergies, or health-related preferences may reveal sensitive information. Share only the practical requirement necessary for your requested service, rather than a diagnosis or medical history. Our standard is to limit such information to that necessary purpose and those arranging the service, with separate notice and permission where required. Contact us to discuss an alternative that avoids unnecessary sensitive disclosure.

Booking accounts, where offered, are not intended for people under 18. A parent, guardian, or authorized organizer may provide limited child-guest information needed for occupancy, safety, or a requested service, subject to applicable permissions. Contact us about information supplied without appropriate authority.

Property devices and decision tools

Our portfolio standard prohibits surveillance cameras and audio-recording devices in private interiors or other spaces where guests reasonably expect privacy. Exterior cameras, if present, must have their location, coverage, and operating status disclosed before booking and must not monitor private spaces. Noise monitors may measure sound levels, not record conversations.

If electronic locks or access systems generate logs, you may ask about the information recorded, its purposes and recipients, and retention criteria. Any such use is subject to applicable collection notices and limited to legitimate access, security, and incident needs. Report a device concern through guest-service channels.

If a verification or decision tool is used, applicable notices and protections apply. Where law provides rights concerning profiling or significant automated decisions, you may request information, human review, or an opportunity to contest the result as applicable. Any biometric processing requires its own applicable safeguards and permissions.

Who may receive information

Depending on the reservation or interaction, information may be provided to:

• The property supplier, operator, or authorized staff for the stay, requested services, safety, or lawful administration.
• Booking-system, hosting, communication, support, payment, accounting, or verification providers for their relevant functions.
• A concierge supplier you request, limited to details needed for the service.
• Advisers, insurers, regulators, or authorities where necessary for a legal obligation, claim, or lawful request.

Disclosures must be relevant to the recipient's role and subject to appropriate legal protections. Owner reporting is limited to legitimate property-administration needs, using aggregated or de-identified information where practical. It is not a reason to routinely share payment credentials, identity documents, health details, or complete guest-message histories.

Cookies, analytics, advertising, and communications

The website and booking systems may use cookies or similar technologies for necessary functions such as maintaining a session, remembering booking steps, authentication where offered, and security. Blocking necessary technologies may prevent parts of a booking or portal from working.

Optional analytics or advertising technologies, when used, are subject to the notices, consent, and opt-out choices required by applicable law. These technologies may involve third-party recipients; some arrangements may qualify as sale, sharing, or targeted advertising under local privacy laws. Use privacy choices where provided, or contact info@bludoorcollection.com to ask about applicable opt-out or sensitive-information rights. Requirements concerning browser preference signals depend on the relevant law and processing.

Where promotional email or SMS is offered, the applicable permission is separate from booking. An email subscription does not itself authorize SMS marketing. Use an unsubscribe method in the message, where provided, or contact us to withdraw optional marketing permission. Necessary reservation and safety messages are separate from promotions.

International handling

A reservation involving Mauritius, the United States, or providers in other countries may involve cross-border access or storage. Where a transfer is subject to legal restrictions, the required lawful basis and safeguards apply. Contact info@bludoorcollection.com for information about relevant recipients, locations, and safeguards for your interaction. Booking or accepting this policy does not itself replace required transfer protections or permissions.

Retention and protection

Our retention standard is to keep information only as long as reasonably necessary for its disclosed purpose and applicable obligations. Criteria include completion of the reservation or service, accounting and tax requirements, unresolved complaints or claims, and applicable legal limitation periods. Identity records and device logs warrant particular attention to necessity and sensitivity. A legal hold applies to relevant records, not all information indefinitely. Deletion or de-identification is appropriate when the information is no longer needed, subject to lawful exceptions and backup handling.

We are committed to technical and organizational protection appropriate to the information and risks, including proportionate access, sharing, storage, provider oversight, and incident-handling measures. No system is perfectly secure. This does not reduce applicable security duties or required breach notifications.

Privacy requests and complaints

Contact info@bludoorcollection.com to ask about information use or exercise applicable rights. Depending on your location and legal coverage, rights may include access, correction, deletion, portability, objection or restriction, consent withdrawal, and choices concerning sale, sharing, targeted advertising, sensitive information, or certain automated decisions.

Include enough information to locate your interaction, but do not send a full identity document initially. Where identity verification is necessary, it must be proportionate; additional evidence may be requested with an explanation and appropriate submission route. Authorized agents may act where permitted, subject to authority checks. Responses must also protect other people's information.

We explain any lawful refusal or partial response and applicable review options. You may request internal review at the same email address. Statutory appeals, regulator complaints, and court rights remain available without first contacting us unless law requires otherwise. Lawful exercise of privacy rights must not result in unlawful discrimination.

Regional privacy supplements

These supplements apply only where the relevant law covers the entity, individual, and processing. Coverage can depend on business activities, thresholds, and exemptions, not simply a guest's destination.

Mauritius

Where Mauritius's Data Protection Act 2017 applies, rights include access, correction, applicable erasure or restriction, objection, and protections concerning certain automated decisions; access requests are generally handled free of charge within one month (Data Protection Office overview).

You may raise a complaint with the Data Protection Commissioner through the Data Protection Office’s complaint process, which also explains appeals to the ICT Appeal Tribunal, normally within 21 days of notification of the decision.

Relevant controllers and processors are subject to the Act's applicable registration, representation, and international-transfer requirements (Data Protection Act 2017).

California

Where the CCPA applies to BluDoor and your information, rights include knowing and accessing personal information, deletion, correction, opting out of sale or sharing, limiting certain uses of sensitive personal information, and nondiscrimination for exercising rights (California Attorney General CCPA guidance).

Covered requests to know, delete, or correct generally receive a response within 45 calendar days, with a permitted additional 45 days on notice; sale/sharing opt-outs must be handled as soon as feasible and no later than 15 business days (California Attorney General CCPA guidance).

Covered businesses must honor valid Global Privacy Control opt-out signals; sale/sharing opt-outs are not subject to identity verification in the same way as access requests (California Attorney General CCPA guidance). Contact info@bludoorcollection.com about applicable choices or use them where provided.

Oregon

Where the Oregon Consumer Privacy Act applies, rights include access, correction, deletion, portability, information about specific third-party recipients, and applicable opt-outs for sale, targeted advertising, and certain profiling (Oregon DOJ guidance).

Covered requests receive a response within 45 days, with a permitted 45-day extension on notice, and a denied request may be appealed by emailing info@bludoorcollection.com with “Oregon Privacy Appeal”; an appeal decision is due within 45 days, with an Attorney General complaint route if the appeal is denied (ORS 646A.576).

For covered processing, sensitive data requires consent and universal opt-out mechanisms must be honored; the 2026 rules also restrict under-16 advertising, sale, and profiling and prohibit sale of precise geolocation data (Oregon DOJ guidance).

Washington

Washington's My Health My Data Act may cover health-related requests and inferences, including processing by small businesses; it regulates covered collection, sharing, consent, and deletion (Chapter 19.373 RCW).

Covered rights include confirmation/access, information about recipients, withdrawal of consent, and deletion; requests ordinarily must be fulfilled within 45 days, with one permitted 45-day extension, and an appeal decision is due within 45 days with an Attorney General complaint route if denied (RCW 19.373.040).

Submit a covered request or appeal to info@bludoorcollection.com with “Washington Health Data Request” or “Washington Health Data Appeal.” Additional information about covered health-data processing is provided in a separate consumer-health notice when required.

Utah

Where the Utah Consumer Privacy Act applies, covered consumers may access data, delete data they provided, obtain a portable copy, correct inaccuracies, and opt out of specified processing, including sale or targeted advertising (Utah Code § 13-61-201).

For covered requests, the Act provides a 45-day response period with a permitted additional 45 days on notice, and its sensitive-data standard generally requires clear notice and an opportunity to opt out rather than a universal adult opt-in rule (Utah Consumer Privacy Act, sections 203 and 302). You may also request a voluntary internal review by emailing info@bludoorcollection.com.

EU, UK, and other locations

EU GDPR territorial scope depends on the relevant establishment or processing connection, including offering services to people in the EU or monitoring their behavior there; nationality alone is not the test, and mere website accessibility does not automatically establish targeting (EDPB territorial-scope guidance).

If EU or UK data-protection law applies to an interaction, its relevant rights and protections apply to that processing. Contact info@bludoorcollection.com for information or to exercise applicable rights. These destination supplements do not exhaust every guest's privacy protections.

Updates and contact

Updates carry a revised date. Materially different processing requires additional notice or fresh permission where applicable; posting an update does not retroactively authorize incompatible use.

General and privacy inquiries: info@bludoorcollection.com. Guest-service help: BluDoor Guest Portal, internal messaging, or concierge@bludoorcollection.com. These channels are not emergency-response services; contact local emergency services first, then contact BluDoor when safe. No immediate-response guarantee is made.