Privacy Policy & Website Security

Our commitment to your privacy

Cozy Central Hoi An Boutique Hotel respects your privacy when you explore our hotel, contact our team or request a stay. This policy explains how we handle information on cozycentralhoian.com and our direct booking website, booking.cozycentralhoian.com.

We use the information you provide to assist with your enquiry and stay, operate our website and protect our guests and services. This policy describes our website practices; booking, payment and cancellation terms are set out separately in our Booking Policies.

Direct bookings & hotel confirmation

Our booking website is managed by Cozy. Moving from cozycentralhoian.com to booking.cozycentralhoian.com takes you to our own direct booking service, rather than a separate online travel agency.

When you send a booking request, we record your details and send an acknowledgement. Acknowledgement does not confirm or hold a room. Our reservations team checks availability and sends a separate confirmation if your reservation is accepted. Your booking reference helps us identify and manage your request.

We do not request card details or collect an online deposit through this booking website. Please do not put payment card numbers, identity documents or other sensitive information in the special requests field.

Information we collect

We collect information you choose to submit and technical information needed to operate the website. Please provide only information relevant to your enquiry or booking.

• Contact details: your name, email address, telephone number and messages you send us.
• Reservation details: room type, arrival and departure dates, number of rooms and guests, bed preference, language, special requests, booking reference and reservation status.
• Stay administration: records of communications, confirmations, changes, cancellations and any payment or refund records entered by authorised hotel staff. The website does not collect payment card details.
• Visit information: a random visit identifier, referral source, marketing channel and campaign parameters. A visit source may be linked to a booking request.
• Operational and security logs: request time, IP address, browser information, requested resources and errors may be recorded by our server or service providers.

How we use your information

We use your information for purposes connected with your request, our services and the operation of the website. Where consent is required, we seek it for the relevant purpose; we also process information where necessary to respond to your request, manage a stay or meet applicable legal requirements.

Reservation emails are service messages about your booking. Submitting a booking request does not enrol you in a promotional mailing list. If we separately invite you to receive marketing, you may decline or withdraw that choice by contacting us.

• Respond to enquiries, check room availability and process reservation requests.
• Send booking acknowledgements, confirmations and updates, and coordinate your arrival and stay.
• Support hotel operations, record payments or changes and respond to complaints.
• Understand website use and booking sources, improve our content and detect misuse.
• Protect our guests and systems and meet applicable record-keeping or disclosure obligations.

Service providers & information sharing

Authorised hotel staff and service providers may handle information needed to perform their work. These include website hosting and maintenance providers, email delivery services (including Google/Gmail), and the hotel systems used to manage a confirmed stay.

We use Google Tag Manager on public pages to manage website tags, and Google Maps to display our location and directions. Depending on the services loaded, browser settings and the tags enabled, Google may receive technical information such as an IP address, page URL or device identifiers. Google services have their own privacy terms.

We use Google reCAPTCHA v3 to help protect booking requests and staff sign-in from spam and automated abuse. It assesses technical and interaction signals, which may include IP address, device or browser information and activity, and returns a risk score. Google processes this information under its Privacy Policy and Terms of Service. We use the result to decide whether to accept a protected request.

We do not sell your booking details. We may disclose relevant information when required by law, to respond to a lawful request, or where reasonably necessary to investigate misuse or protect people, our services and legal rights. Disclosure is limited to the relevant purpose.

Some service providers may process information outside Vietnam. Their locations and handling practices depend on the services used. You may contact us with questions about the providers involved in your booking.

Cookies, browser storage & website statistics

Our website uses browser session storage to recognise a visit and its referral or campaign source. Our first-party statistics feature respects the browser's Do Not Track setting. That setting does not automatically control Google services or other third-party tags.

Secure sign-in cookies support staff administration. Google Maps and services loaded through Google Tag Manager may use cookies or similar technologies according to their configuration and your browser or account settings. Not every tag is active simply because Tag Manager is installed.

You can manage cookies and site storage in your browser, use tracking protection, or adjust your Google privacy and advertising settings. Blocking some services may affect maps or website features. Browser controls do not delete reservation details already submitted; contact us for help with those records.

Website security

Our public website and booking service use HTTPS with TLS certificates to encrypt information in transit between your browser and our server. Check that the address begins with https:// and that your browser does not show a certificate warning before entering personal information.

We restrict booking administration to authenticated hotel users and use measures including protected session cookies, checks on form requests, login rate limits and database backups. Access to personal information is intended for authorised people with a need to handle your request or operate the service.

No website, email system or method of storage can be guaranteed completely secure. HTTPS protects transmission; it is not a promise that every stored record is encrypted or that security incidents can never occur. If you notice suspicious activity or an unexpected request for sensitive information, contact us using the details below.

Keeping your information

We keep reservation records, communications and related operational information for the purposes described in this policy and for applicable accounting, legal or dispute-handling needs. The appropriate period depends on the type of record and the reason it is held.

Retention and deletion requests are reviewed by our team rather than being an automatic deletion service. Some information may need to be retained to meet legal obligations or resolve a dispute. Backup copies may remain until they are replaced or expire under the backup cycle.

Your choices & privacy requests

You may contact us to ask about the information we hold about you, request access or correction, request deletion or restriction, withdraw consent where consent is the basis for processing, or raise a concern. These requests are handled subject to applicable law and any necessary retention obligations.

We may ask for proportionate information to verify your identity and protect your records. Please include your booking reference if relevant, but do not email payment card details or unnecessary identity documents. Withdrawing permission needed to manage a request may limit our ability to provide that service; it does not make prior lawful processing invalid.

Children & family bookings

Our booking service is intended to be used by adults or people authorised to arrange a stay. A parent, guardian or authorised adult should manage a reservation involving children and provide only details necessary for that stay.

We do not ask children to create website accounts or sign up for marketing. If you believe a child has submitted personal information without appropriate authorisation, please contact us so we can review it and take appropriate action, subject to any legal requirements.

External websites & embedded services

Links to Google Maps, social networks and other external websites lead to services operated by other organisations. Embedded services may also connect your browser to those providers while you view our pages.

Their privacy practices and terms may differ from ours. Review the relevant provider's policy before sharing information or using their services. This policy covers Cozy's handling of information and does not replace those external policies.

Your acknowledgement & policy updates

This page is a notice about how our website handles information. Reading or browsing it is not blanket consent to every form of processing and does not waive your privacy rights. When a particular action requires your agreement or permission, that action is handled separately.

We may update this policy as our services, providers or applicable requirements change. The latest revision date is shown on this page. Where a change requires additional notice or renewed consent, we will address that separately.