1. Who we are
This policy applies to theryokanguide.com and the services made available through it (the Site). The Site is operated by Vent Neuf Ltd, trading as The Ryokan Guide. For applicable data-protection law, the operator is the controller of the personal data described here.
Postal address: 62 Athinas, Athina Court, 1st Floor, Office 103, 8010 Paphos, Cyprus · Registration number: HE 492024
Privacy contact: our contact form
2. Data we handle and why
We collect the minimum data reasonably needed to deliver the Site, send communications you request, understand performance with your consent, protect the service, and meet legal obligations. We do not use special-category or sensitive personal data and ask you not to send it to us.
| Activity | Data | Purpose and legal basis | Recipients |
|---|---|---|---|
| Newsletter signup | Email address, signup source, submission time, and technical anti-spam data | Send the monthly editorial newsletter you requested. Consent; you may withdraw it at any time. | Netlify Forms, its spam-filtering services, and Netlify Forms (collection only; no bulk-email provider is currently active). |
| Book waitlist | Email address, signup source, submission time, and technical anti-spam data | Send book-availability or preorder updates you requested. Consent, separate from newsletter consent. | Netlify Forms, its spam-filtering services, and Netlify Forms (collection only; no bulk-email provider is currently active). |
| Consent-based analytics | Pages and events viewed, approximate location, referrer, device/browser information, cookie identifiers, and booking-link clicks | Measure and improve the Site. Consent. Google Analytics is not loaded until you choose Allow. | Google Analytics. |
| Site delivery and security | IP address, request date/time, requested URL, user agent, and security/error records | Deliver, troubleshoot, and protect the Site. Legitimate interests in operating a reliable and secure publication; legal obligations where applicable. | Netlify and infrastructure or content-hosting providers, including the Directus host where it serves content or assets. |
| Messages and rights requests | Contact details, message contents, evidence you provide, and verification information where reasonably necessary | Respond to you and comply with legal obligations. Legitimate interests, steps at your request, and legal obligations. | Relevant staff, service providers, and professional advisers when necessary. |
| Affiliate referrals, when marked | Destination URL and identifiers embedded in a paid link; a partner may later report conversion, booking value, or commission information | Attribute eligible referrals and operate the reader-supported business. Legitimate interests or consent where applicable tracking law requires it. | The booking service, affiliate network, and their technology providers identified by the destination link. |
We receive information directly from you, automatically from your browser and hosting infrastructure, and—only for marked paid links—from the relevant affiliate or booking service. We do not receive your full payment-card details from an ordinary outbound booking link.
5. Newsletter and book waitlist
Newsletter consent and book-waitlist consent are separate. Joining the waitlist does not subscribe you to the general newsletter. Every marketing email must identify the sender, include the operator's valid postal address, and provide a free way to unsubscribe. We do not rent or sell either list.
You may withdraw consent through the unsubscribe control in an email or by contacting our contact form. We may keep a minimal suppression record so that an address that opted out is not accidentally re-added. If a double-opt-in email is enabled, a signup is not active until its confirmation link is used.
7. International transfers
The Site is available internationally and its providers may process data in countries other than the one where you live. Privacy protections can differ between countries. Where applicable law requires a transfer mechanism, we use contractual or other lawful safeguards offered by the relevant provider and assess supplementary protections where necessary. You may contact us for information about safeguards relevant to your data.
8. How long we keep data
Production retention settings and deletion routines follow these configured periods:
- Newsletter and waitlist contact records: Until consent is withdrawn or 24 months after the last recorded engagement.
- Raw Netlify form submissions: 90 days, then deletion or transfer to the active mailing-list provider.
- Google Analytics user and event data: 14 months.
- Hosting and security logs: Up to 30 days, subject to the hosting provider’s security requirements.
We may retain a limited record longer when reasonably necessary to honour an opt-out, establish or defend legal claims, investigate abuse, or meet a legal obligation. Copies in secured backups age out under their normal rotation and are not restored for ordinary business use after a valid deletion request.
9. Your privacy rights
Depending on where you live and which law applies, you may have rights to ask for access to or a copy of your personal data; correction; deletion; restriction; portability; objection to certain processing; and withdrawal of consent. You may always object to direct marketing. You may also have the right to complain to your local data-protection authority.
Send a request using our contact form and state the right you want to exercise. We may ask for proportionate information to verify identity and prevent unauthorised disclosure. We respond within the period required by applicable law and do not discriminate against anyone for exercising a privacy right.
We do not sell personal information. We do not share personal information for cross-context behavioural advertising as those terms are used in California privacy law. If those practices change, this policy and the Site's controls will be updated before the change takes effect.
10. Children and security
The Site is a general-audience travel publication and is not directed to children under 13. Children under 13 should not submit an email address. If you believe a child has sent us personal data, contact us so we can investigate and delete it where required.
We use proportionate organisational and technical safeguards designed to protect data, including access controls and encrypted transport. No internet service is completely secure. We maintain a response process for suspected incidents and will notify affected people and regulators when applicable law requires it.
11. Changes and contact
We may update this policy when the Site, providers, or applicable requirements change. We will post the revised effective date here and provide a more prominent notice before a material change where appropriate. We will request new consent before using previously collected data for a materially different purpose when the law requires it.
Questions, requests, or complaints may be sent using our contact form or by post to Vent Neuf Ltd, 62 Athinas, Athina Court, 1st Floor, Office 103, 8010 Paphos, Cyprus.