Legal Notice
Website Terms of Use:
The information on the Garden Hotel, Jamaica website is provided for general guidance and informational purposes only. We may update, change, or remove content at any time without notice.
While we aim to keep information accurate and current, Garden Hotel, Jamaica does not provide any warranty or guarantee (express or implied) regarding the accuracy, timeliness, performance, completeness, or suitability of the content on this website for any purpose. You acknowledge that the website content may contain inaccuracies or errors, and we exclude liability for any such inaccuracies or errors to the fullest extent permitted by law.
Your use of any information or materials on this website is entirely at your own risk. It is your responsibility to ensure that any products, services, or information available through this website meet your requirements.
Intellectual Property:
Unless otherwise stated, this website and its contents are owned by or licensed to Garden Hotel, Jamaica. This includes (but is not limited to) the design, layout, branding, look and feel, text, images, and graphics.
Reproduction, distribution, or reuse of any website material is prohibited unless permitted under our copyright notice or with our prior written consent.
All trademarks reproduced on this website that are not the property of, or licensed to, Garden Hotel, Jamaica are acknowledged where applicable.
Limitation of Liability:
To the fullest extent permitted by law, Garden Hotel, Jamaica, including its owners, employees, agents, and affiliates, will not be liable for any loss or damage (direct, indirect, incidental, consequential, or otherwise) arising from:
- Use of, or inability to use, this website
Reliance on any information provided on this website
Errors, omissions, interruptions, delays, or viruses
Any third-party links, content, or services referenced on this website
You use this website and any materials or information on it at your own risk, and you remain responsible for ensuring any services or information meet your needs
The Garden Hotel Mandeville Privacy Policy
Effective date: January 1st, 2026 | Last updated: October 19th, 2026
This policy explains how we handle personal information when you visit our website, enquire about our services, make a booking, stay at the Hotel or otherwise interact with us. It also covers additional guests, visitors and emergency contacts whose information we receive. We handle personal information in accordance with Jamaica’s Data Protection Act, 2020 and applicable regulations.
Who is responsible for your information
THE GARDEN HOTEL MANDEVILLE (the Hotel, we, us or our), is the data controller responsible for the processing described in this policy.
Business address: 4 Hotel Street, Mandeville, Jamaica
Website: https://gardenhoteljamaica.com
Privacy contact email: privacy@gardenhoteljamaica.com
Telephone: +1 876-962-9764
Information we collect
The information we collect depends on your interaction with us. It may include:
Identity and contact information: your name, telephone number, email address, mailing address and government-issued identification type and number used at registration. Example: We inspect an original ID at check-in and record its type and number to verify the registered guest and investigate disputed stays. Recording the full number is subject to a documented necessity assessment; otherwise we record only a verification result.
Booking and stay information: arrival and departure dates, room type, rates, additional guests, signatures, service requests and correspondence.
Payment and transaction information: charges, deposits, refunds, incidental expenses and payment references. Example: We receive the cardholder name, card brand, last four digits, payment token and transaction reference. Our payment provider handles the full card number and security code; the Hotel does not store them.
Emergency-contact information: the name and telephone number of the person nominated as your emergency contact.
Other information relevant to your interaction: complaints, incident reports, marketing preferences and privacy requests. Example: CCTV records images in reception, entrances and car parks, without audio. Visitor records contain names and arrival/departure times. Wi-Fi logs contain device identifiers, connection times and assigned IP addresses; we do not record browsing content.
Website information: IP address, browser type, device type, requested pages, access times and error logs; an essential booking-session cookie and an optional first-party analytics cookie.
If you provide health, disability, allergy or other sensitive information to request assistance, we use only what is necessary for that request and apply the additional legal conditions for sensitive personal data. Example: We collect accessibility or allergy details only when you request relevant assistance. We seek your written consent for this sensitive information and use it only to arrange that assistance; you may withdraw consent by contacting the Privacy Officer.
Where information comes from
We receive information directly from you and, where relevant, from the person arranging your stay, travel agents, booking platforms, payment providers or persons reporting an incident. Example: We receive booking names, contact details, stay dates and reservation references from travel agents, online travel platforms and group-booking organisers, and transaction confirmations from our payment provider. When you give us another person’s details, please make this policy available to them. This does not replace our own duty to provide appropriate privacy information.
How and why we use information
We use personal information for specified purposes and only where a condition for lawful processing applies. We do not rely on your acceptance of hotel terms or your use of our website as blanket consent.
Purpose | Ground for processing |
|---|---|
Respond to enquiries and arrange bookings requested by you. | Steps at your request before entering a contract, or performance of our contract with you. |
Provide accommodation, manage your stay, verify booking identity, and administer charges, deposits and refunds. | Performance of our contract, to the extent the processing is necessary. Example: We do not claim that a statute requires full ID-number recording. Any recording beyond inspection relies on a documented assessment of necessity and our legitimate interest in identity verification and fraud prevention, balanced against guest rights; unnecessary details are not retained. |
Keep records required by law and respond to lawful requests from competent authorities. | Compliance with an applicable legal obligation. Example: Tax invoicing and accounting records are maintained to meet applicable duties under Jamaica’s General Consumption Tax Act and Income Tax Act, to the extent applicable to the Hotel; an accountant must confirm the specific duties and periods before this example is adopted. |
Contact a nominated person or arrange assistance in an emergency. | Protection of vital interests where the statutory conditions apply; otherwise another applicable lawful ground. Routine collection requires its own confirmed ground. |
Manage complaints, investigate incidents, prevent fraud and protect guests, staff and property. | Contract performance for complaints about your stay; legitimate interests for proportionate fraud prevention, incident investigation, claims handling and public-area CCTV, after assessing necessity and the impact on individuals. Any sensitive information also requires an additional applicable condition. |
Send promotional messages or offers. | Your specific consent, obtained separately from booking or registration. You may withdraw it. |
Operate and secure the website; use optional analytics or advertising technologies. | Legitimate interests for essential security logs and website operation, following a necessity and balancing assessment; consent for optional analytics. Analytics remain disabled until the visitor opts in and can be disabled through Cookie settings. |
Information needed to provide services
We identify information required to process a booking, provide a requested service or meet a legal obligation at the point of collection. If required information is not supplied, we may be unable to complete the booking or provide the relevant service. Optional information and marketing choices do not determine whether you can stay with us. Example: Name, booking dates, room selection and an available contact method are required to arrange a booking; valid ID must be presented at check-in. Optional marketing, emergency-contact and special-request fields may be left blank. Without the required booking information or identity verification, we cannot complete the relevant service.
Marketing choices
Where we undertake direct marketing, we obtain the consent required by law separately. You may stop marketing by using the unsubscribe method in the message or contacting our privacy contact. We may keep a limited record of your opt-out to respect your choice. Necessary booking and service messages are separate from marketing.
Who receives your information
We disclose information only for a lawful purpose and limit it to what is needed. Depending on the service, recipients may include the following confirmed categories:
Our contracted online booking engine, property-management system supplier and the travel agency or online platform through which you booked.
Our contracted card-payment processor, acquiring bank and banks handling refunds or chargebacks.
Our contracted website host, IT support company, cloud backup provider and business-email provider.
Our insurer and external legal adviser where needed to investigate an incident or handle a claim.
Public authorities, courts or emergency services where disclosure is required or otherwise lawfully justified.
We do not disclose guest contact lists to unrelated businesses for their own marketing and do not share guest information with group companies. Any different arrangement must be reflected here.
Where a provider processes information on our behalf, we require appropriate contractual and security arrangements. Some booking platforms, banks and other organisations act as independent data controllers for their own activities; their privacy notices explain those activities.
Information processed outside Jamaica
Our booking and cloud-backup providers store reservation and contact information in the data centers of Amazon Web Services located in the United States of America (USA), and their support teams may access it there. Email records are also processed by Zoho in their data centers in Europe in their primary data center in Amsterdam, Netherlands and their secondary data center in Dublin, Ireland (Secondary). No other overseas locations are used in this illustrative arrangement.
Any overseas transfer must satisfy the requirements of Jamaican law, including adequate protection or an applicable statutory exception.
Cookies and website services
Our website and third party booking engine provider(s), manage customer sessions, shopping cart actions, and site navigation on our public-facing booking website(s).
You can also manage cookies through your browser; blocking some cookies may affect website functions. A browser setting is not a substitute for any consent we are required to obtain.
Links to third-party websites and services may take you to organisations with their own privacy practices. Read their notices before providing information to them.
Protecting your information
We use appropriate organisational and technical measures to protect personal information against unauthorised use, disclosure, loss or damage. Access is limited to authorised persons who need it for their work, including appropriately controlled service providers. Paper registration sheets are kept in locked cabinets. Digital records use role-based access, staff multi-factor authentication, encrypted transfers, maintained software and restricted backups. Staff receive privacy training and access is removed when no longer needed. No method of storage or transmission is entirely risk-free. If a breach occurs, we assess and make notifications required by law.
Children and automated decisions
When a booking includes a child, we collect only information necessary for the stay and deal with the parent, guardian or authorised adult as appropriate. For children staying with an adult, we collect the child’s name and age band only where needed for room occupancy or services. We do not request a child’s email for marketing. Any consent needed for a child’s sensitive assistance information is obtained through the appropriate parent, guardian or legally authorised representative.
We do not make decisions about you that produce legal or similarly significant effects solely through automated processing. Staff review disputed bookings and proposed refusals of service.
How long we retain information
We retain information only for as long as needed for its stated purpose and applicable legal obligations. Our expected retention periods are set out below. A relevant dispute, investigation or legal hold may require particular records to be retained longer; access remains restricted. Records are then securely disposed of or irreversibly anonymised as appropriate.
Record category | Expected retention period |
|---|---|
Booking, registration and ID records | Two years after checkout or cancellation for booking and registration records; ID numbers deleted after 30 days unless needed for a specific unresolved incident. These are illustrative periods, not verified legal requirements. |
Payment, refund and accounting records | Seven years after the relevant financial year-end as an illustrative accounting period, subject to confirmation against applicable Jamaican tax and accounting duties; this is not a statement of a statutory minimum. |
Emergency contacts and special assistance details | Emergency-contact details deleted within 30 days after checkout; routine special-assistance details deleted within seven days after checkout, unless relevant to an unresolved incident. |
Enquiries, complaints and incident records | Unconverted enquiries: six months after last contact. Routine complaints: two years after closure. Incident or claim files: six years after closure as an illustrative period, subject to legal review and any continuing hold. |
CCTV, visitor and Wi-Fi records, if used | CCTV: 30 days. Visitor register: 90 days. Wi-Fi connection logs: 30 days. Relevant extracts are isolated if required for a specific incident and retained with that incident file. |
Website logs and cookies | Security and web-server logs: 30 days. booking_session: session end. cookie_choice: six months. visit_stats: 30 days. Aggregate, irreversibly anonymised statistics may be retained longer.] |
Marketing consent and opt-out records | Marketing contact and consent records: while subscribed and for two years after withdrawal to document the consent history. A minimal email-only suppression entry remains while that marketing channel operates, reviewed annually, to prevent renewed contact. |
Privacy requests and responses | Three years after completion, to document the request, response and any dispute; unrelated identity-verification copies are deleted within 30 days of completing verification. |
Your rights and how to exercise them
Subject to the Act’s conditions and exceptions, you may request access to your personal information and information about its processing; correction of inaccurate information; and erasure, blocking or restriction where applicable. You may withdraw consent, object to processing in the circumstances provided by law, stop direct marketing, request transmission to another controller where applicable, and exercise rights concerning decisions based solely on automated processing. These rights do not require us to erase information that must lawfully be retained.
Contact the privacy contact listed at the start of this policy, or ask reception for help or a paper copy. Describe your request and the information concerned. We may need proportionate evidence of identity or authority to protect your information. We respond within the applicable statutory period; access requests are generally subject to a 30-day period under the Act. If a lawful exception or permitted fee applies, we will explain it. Complaints may be made without charge.
Complaints
Please contact us if you have a concern about how we handle personal information.
Changes to this policy
We update this policy when our practices or legal requirements change and revise the date at the top. Where required, we give further notice and obtain fresh consent before introducing a new use. Continuing to use the website does not, by itself, provide consent for new processing.