Bokkara Member Privacy Notice

This Notice covers prospective, current and former Bokkara members, shared account holders, and people included in a member's booking. References to “you” include a guest whose information is provided by the person arranging the stay. It covers use of our website and account services in connection with membership and accommodation bookings.

Personal information means information that identifies you, relates to you as an identifiable person, or is otherwise protected by applicable privacy law. Your name, membership number, booking details, payment records and online identifiers can all be personal information.

Our Member Terms of Service separately explain membership eligibility, booking conditions, cancellation refunds, ClubNights, ClubCredit and Flight Disruption Assistance. This Notice explains information handling and does not change those commercial terms or remove mandatory privacy rights. Accepting membership terms is not blanket consent to unrelated uses of personal information.

Bokkara Management LLC, a Delaware limited liability company, operates Bokkara and is responsible for the personal information it uses to administer memberships, arrange accommodation, provide rewards and support, and manage the member relationship. Where applicable law uses the term, Bokkara Management LLC is the controller for that processing.

Our privacy contact is legal@bokkara.com. You can use this address for questions, privacy requests and complaints about our handling of your information.

Properties, payment providers and some technology providers may independently determine how they use information for their own services or legal obligations. Their privacy notices apply to that independent processing. Other providers process information for Bokkara on our instructions. We remain responsible for our own processing and disclosures.

Identity and contact information includes your name, email address, telephone number, country of residence, billing or correspondence address, and information needed to identify the correct account or guest. Age, date of birth or identification information may be needed to establish membership eligibility, satisfy a property's requirements, verify identity or address suspected fraud.

Account information includes your account identifier, membership number, membership status, activation and expiry dates, subscription and renewal history, membership guarantee and refund records, shared account relationship and change requests, account preferences, and records of terms or permissions you accept. Authentication services also handle credentials needed to access your account. Do not send your password to our staff.

Booking information includes destinations, travel dates, selected properties, room and rate details, room count, guest numbers and names, relevant age categories, booking member information, contact information, booking references, prices, currency, taxes, fees, confirmations, changes, cancellations and stay completion details. The member making the booking is included in the booking, and their membership account information is used as the main guest check-in information sent to the property.

Transaction information includes billing details, payment and subscription references, amounts, currency, payment status, authorization and capture records, limited payment identifiers or tokens where provided, refunds and payment disputes. Payment providers may collect full payment credentials directly through their own interfaces.

Rewards information includes each member’s ClubNights earned, redeemed, restored or adjusted; qualifying nights personally stayed; qualifying spending of the main account holder; annual reward calculations and renewal eligibility; referral reward records; and ClubCredit Wallet balances, sources and transactions. The main and shared account holders have their own accounts and wallets.

Referral information may include the referring member’s account identifier and referral link or code, the referred person’s identity and account or membership sign-up details, link attribution, the dates of sign-up and the 30-day guarantee period, qualification status, any cancellation or refund relevant to eligibility, and referral ClubCredit issuance or corrections. A referral link may include the referring member’s first name and an account identifier; anyone you share the link with can see information contained in the link.

The systems delivering our website, accounts and checkout may generate technical records such as IP address, approximate location derived from IP address, device and browser type, operating system, language, page requests, timestamps, session identifiers, access logs and error reports. These records support service delivery, account security and troubleshooting.

Technical information can remain personal information even if it does not display your name. For example, a session identifier may link an activity to your signed-in account. We use technical records for the operational purposes described in this Notice rather than advertising tracking.

A destination entered in a search is different from your device's precise location. We do not need precise device location to process a destination you type. Where a feature requests a device permission, the request explains the permission and your available choice.

We may receive information from the main member, a shared account holder or another person authorized to arrange the booking. This can include your name, contact details, occupancy information, membership number if applicable, and requests relevant to the stay. A guest does not need to hold a Bokkara membership to be included on an eligible member’s booking.

Properties may provide reservation acceptance, changes, cancellation status, stay completion, incident details and responses to assistance or refund requests. Payment and subscription providers supply transaction status and information needed to reconcile payments, renewals and disputes. Technology providers can supply operational or security information relevant to delivering the service.

If you provide another person's information, tell them that you are sharing it with Bokkara, give them access to this Notice and have the appropriate authority or legal basis. One member's acceptance does not automatically supply another person's consent where individual consent is required. We provide indirect-collection information within the period required by applicable law, subject to lawful exceptions.

We use identity, contact and account details to process membership applications, establish and protect accounts, issue membership numbers, check eligibility, administer membership and shared accounts, process subscriptions, communicate about renewals and handle membership cancellation.

We use search, guest and booking details to display accommodation information, prepare requests, arrange stays directly with properties, obtain confirmation, communicate changes, administer cancellations and resolve booking problems. Required booking information enables us to identify the correct guests and reservation; without it, we may be unable to provide the requested service.

We use payment records to initiate checkout, coordinate authorizations and captures, reconcile charges, process refunds, investigate payment failures and respond to disputes. A booking request, payment authorization, captured payment and property confirmation are separate events with separate records.

We use booking and completed-stay records to calculate ClubNights for qualifying nights personally stayed by the main or shared account holder, administer the main account holder’s 2 percent annual reward, maintain ClubCredit Wallets, and investigate errors, reversals or misuse. We use correspondence and property responses to provide 24-hour support, investigate complaints and pursue corrections, refunds or alternative accommodation.

We use referral link and sign-up information to connect a referred sign-up to the referring member, verify program eligibility and completion of the referred member’s 30-day guarantee period, issue the USD $15 referral reward as ClubCredit immediately after a referral qualifies, investigate missing or duplicate rewards, prevent misuse and respond to disputes. We use only the records reasonably needed for these purposes.

We use relevant technical and transaction information to protect accounts, prevent fraud, troubleshoot faults and maintain service reliability. We use necessary records for accounting, legal obligations, lawful authority requests and the establishment or defense of legal claims. Optional promotional communication follows section 15.

Where applicable law requires a legal basis, processing necessary to enter or perform our agreement with you supports membership administration, your requested booking and the benefits included in your plan. A contractual basis applies only to information genuinely needed for that purpose.

Legal obligations support processing required for applicable accounting, tax, regulatory and lawful disclosure duties. Legitimate interests may support proportionate security, fraud prevention, troubleshooting, complaint management and administration of guest information where the guest is not our contracting member. The interests are providing a reliable booking service, protecting members and systems, and resolving transactions fairly. We consider the necessity and effect on individuals and do not rely on this basis where applicable law or overriding rights prevent it.

Consent supports optional activities for which consent is required, including certain marketing or sensitive requests. You may withdraw consent by contacting us or using the relevant control; withdrawal does not invalidate lawful processing before withdrawal. We explain if withdrawal prevents an optional service from being provided.

In a genuine emergency, vital interests may support necessary processing to protect life where the legal conditions are met. Sensitive information requires any additional legal condition applicable to that information. Where a country requires consent or another standard instead of this framework, we follow that requirement for covered processing.

The main applicant and membership payer must be at least 18 years old. A shared account holder may be aged 17 or older and has their own account and membership number under the main membership. We process the relationship between these accounts, shared-account changes, membership-year information and eligibility to administer membership access. Both holders can book accommodation for themselves and other guests and receive applicable membership benefits.

A person arranging a booking may receive the guest names, itinerary, price, confirmation status and changes reasonably needed to manage it. A shared reservation can therefore reveal that people are travelling together. Linked membership alone does not authorize unrestricted access to another holder's private correspondence or personal information.

A booking member may arrange rooms for other people but must be included in the booking. We provide the property with the booking member’s account information as the main guest check-in information and with other guest information necessary to provide the stay. Property occupancy, identification and check-in requirements apply.

We assess requests to change another guest's information or obtain their records against identity, authority and applicable rights. Paying for a stay does not automatically authorize a person to exercise every other guest's privacy rights. Contact legal@bokkara.com if you have a privacy or personal safety concern about account or booking access.

Children aged 16 and under may be included as accompanying guests. We limit their information to what is needed for occupancy, pricing, reservation administration, legal requirements and requested assistance. An age category may be sufficient where a full date of birth is unnecessary. Properties may separately require identity or guardian information under their own obligations.

A shared account holder aged 17 is covered by this Notice, including any additional rights and consent requirements that apply because of their age. Membership eligibility does not itself determine the age at which an individual can consent to every use of personal information in every country.

The person providing a child's information must have appropriate authority and supply any required parent or guardian consent. We do not use accompanying children's booking information for behavioral advertising. If we identify an ineligible account or unnecessary collection of a child's information, we assess the circumstances and take appropriate action, which may include restricting access or deleting unnecessary information.

Parents and guardians may contact us about a child's information. We verify authority and consider the child's own rights before responding. Avoid sending unrelated information about a child in booking notes or attachments.

Accessibility, disability, allergy, medical or dietary requests may reveal health information, religious beliefs or other sensitive information. Share only what is necessary for the assistance you want. Do not send full medical records or identity documents through a general enquiry unless specifically requested through an appropriate channel.

We use relevant sensitive information to address the request and communicate necessary details to the property or other recipient responsible for providing the assistance. Where required, we obtain explicit consent or identify another valid sensitive-information condition. A request does not mean that a property has accepted it or can meet it.

You may withdraw consent where consent is the basis, although this may affect the requested assistance. Limited retention or processing may continue where permitted by another valid basis and any required additional condition. We do not use sensitive requests for unrelated advertising.

Bokkara arranges accommodation directly and manually with properties. Authorized staff communicate the guest and reservation details needed to request, confirm, change or cancel a stay and resolve relevant issues. Manual booking remains subject to the privacy requirements applicable to the information.

External destination search, property information, mapping and hosting services help deliver the search experience. A search can involve destination, dates, occupancy and technical identifiers. We limit information sent for a search to what the function requires; payment or membership details are not needed simply to search a destination.

The property receives the information necessary to provide the stay and may use it under its own privacy notice for check-in, identity requirements, local registration, deposits and incident handling. Its on-site cameras, Wi-Fi and other property services are governed by its own practices. A property's independent role does not remove Bokkara's responsibility for its own disclosures.

The property may process information for its own accommodation conditions, including late arrival, cancellation, incidentals, check-in, deposits and charges incurred during the stay. A property may request a credit card or deposit directly. Charges such as room service or minibar purchases made with the property are handled under the property’s own practices.

We use Shopify for commerce and booking checkout and PayPal for membership subscriptions. These services process information needed to provide checkout, payment and subscription functions. Their privacy information is available at https://www.shopify.com/legal/privacy and https://www.paypal.com/us/legalhub/paypal/privacy-full.

We use information about the single Bokkara membership price, applicable taxes and fees, payment, renewals, and 30-day guarantee requests to administer membership. We process booking refunds in the applicable original payment form—money, ClubCredit or ClubNights—according to the booking terms and retain records necessary for reconciliation and mandatory rights.

Payment providers may collect payment credentials directly and process information for execution, authentication, fraud prevention and legal obligations. We receive the transaction references, statuses and other information needed to administer the service. Our staff do not need your banking password, card security code or one-time payment authentication code.

Where the payment method supports authorization followed by capture, we use payment and booking status records to coordinate property confirmation and the later capture. This Notice does not change the checkout disclosure or payment-provider rules. ClubNights and ClubCredit bookings also create redemption, restoration and wallet transaction records.

A privacy deletion request, account closure, marketing opt-out and subscription cancellation are separate actions. To stop recurring charges, use the subscription controls or contact support with a clear request. We explain the effect on account information and retain records that are still required for lawful purposes.

Properties receive information needed to arrange and service your stay, including the booking member’s main guest check-in details, guest names, dates, occupancy, room selections, reservation references and relevant special requests. Support staff receive information appropriate to their duties, including contacting properties and handling member enquiries.

Service providers may process information for hosting, account services, commerce, payments, subscriptions, communications, storage, technical support and security. Access and disclosure are limited to the relevant service and legal requirements. Some recipients have their own independent legal responsibilities, as explained in this Notice.

Professional advisers or auditors may receive relevant records where needed for advice, accounting, legal claims or a required review, subject to appropriate confidentiality. Courts, regulators, law enforcement or other legally entitled recipients may receive information where disclosure is required or otherwise lawfully justified. We assess the request and limit disclosure as appropriate.

If the business is reorganized, transferred or subject to insolvency proceedings, relevant information may be disclosed to advisers or a successor under appropriate confidentiality and legal safeguards. A business transfer does not authorize unrelated use without a valid basis and any required notice.

We may also disclose information at your request or with valid authorization. We do not sell member personal information or disclose it to other businesses for their own marketing. Necessary booking, payment and service disclosures are different from providing information for unrelated promotional use.

Bokkara does not use analytics tracking tools, advertising pixels or advertising cookies to track members, build advertising audiences or follow them across websites. We do not use member information for cross-context behavioral advertising.

Our website, account and checkout functions may use cookies or similar storage needed to maintain a session, support authentication, remember necessary transaction state and protect the service. Operational logs and these functional technologies are distinct from advertising or analytics tracking. External payment and property websites have their own privacy practices when you use their services.

You can manage cookies through your browser. Blocking or deleting necessary cookies may sign you out, remove transaction state or prevent account and checkout functions from working. If our use of optional technologies changes, we provide updated information and obtain any required permission before that processing begins.

We send account, renewal, booking, payment, cancellation, security and support messages needed to administer your membership and requested services. Booking communications include an acknowledgement that we received your request, a booking confirmation after the property accepts it, and a final message providing the property confirmation number. These service communications are separate from optional promotional messages.

Where permitted by law and your choices, we may send Bokkara offers or membership news. You can unsubscribe through a promotional message or email legal@bokkara.com. Withdrawing promotional permission does not prevent necessary service communications. We may keep a limited suppression record to respect an objection and prevent unwanted marketing from restarting.

Where applicable, you may object to direct marketing, including related profiling, without giving a particular reason. We stop the processing covered by that objection. If you contact us through a messaging or social platform, that platform's handling of your communications is also subject to its own privacy practices.

ClubNights administration uses the eligible main or shared account holder’s booking and completed-stay information, qualifying nights personally stayed, earning dates and redemption history. The 2 percent annual reward uses only qualifying main-account spending, the membership year and renewal status. ClubCredit records show balances and the origin and use of annual rewards, referral rewards, cancellation credits, promotional credits and assistance reimbursements.

When you use a personal referral link, Bokkara processes attribution and qualifying sign-up records and adds eligible referral credit to the referring member’s wallet. We may confirm a referral’s status to the referring member without giving them unrestricted access to the referred person’s private account, booking, payment or guarantee-request details. A person may receive your shared referral link through a service you choose, which has its own privacy practices.

For Flight Disruption Assistance, we process the affected member's flight details, delay or cancellation information, notification time, accommodation dates, property responses, missed nights, lost reservation value and investigation outcome. This enables us to contact the property, investigate eligibility and calculate the credit. We may request relevant supporting information when needed, without collecting unrelated travel details.

Reimbursement is recorded in the affected account holder's wallet. A main and shared account relationship does not mean every support detail is disclosed to the other holder. We retain sufficient transaction and investigation records to explain decisions, correct errors, prevent duplicate reimbursements and address a dispute.

If we invite a review or testimonial, we distinguish private feedback from material intended for publication and obtain any required permission before publishing an identifiable statement or image. Do not include private booking or guest details in public comments.

Our staff, service providers and properties operate in different countries. Authorized support staff work from New York and Florida in the United States; Toronto, Canada; Singapore; Panama; Dubai, United Arab Emirates; London, United Kingdom; and Trinidad and Tobago. Staff access information where necessary for their responsibilities. Access from another country can be an international transfer even when a database remains in its original location.

Information may also be processed in countries used by our commerce, payment, hosting and other service providers, and in the destination country of your property. An office location does not itself identify a database location. We can provide information about processing locations relevant to your service on request at legal@bokkara.com.

Where a transfer requires safeguards, we use the lawful transfer arrangements required for that activity. These may involve a recognized adequacy decision, appropriate contractual protections and supplementary measures, or another legally permitted basis. For relevant EEA or UK transfers, available contractual mechanisms include the European Commission's Standard Contractual Clauses and the applicable UK transfer instruments.

Privacy laws and government access powers differ between countries. Choosing an overseas property does not waive your statutory privacy rights. You may request information about the safeguards relevant to a transfer and a copy or meaningful summary where available, subject to necessary protection of confidential information, security and other people's rights.

We retain information for the period needed for its stated purpose, applicable legal duties and relevant claims or disputes. The criteria differ by category; one financial record does not justify retaining every unrelated account detail indefinitely.

Account and membership details remain while needed to administer your membership, shared account, renewal, 30-day membership guarantee or closure. After closure, we keep records needed to complete existing bookings, resolve pending requests, administer surviving reward rights and meet applicable obligations; other account information is deleted or anonymized when no longer necessary.

Booking and payment records remain through completion, cancellation and reconciliation, and for applicable accounting, tax, chargeback and legal-claim periods. ClubNights and ClubCredit ledgers remain while balances or relevant redemption rights can be used and for the period needed to explain adjustments, resolve disputes and meet financial record duties.

Referral link attribution, qualifying sign-up, guarantee-period and reward records remain while needed to issue and explain a reward, correct errors, prevent and investigate misuse, resolve disputes and satisfy applicable legal obligations. We then delete or anonymize the information when no longer needed.

Support and Flight Disruption Assistance records remain through resolution and for any relevant complaint, review or claim period. Sensitive requests and identification material are retained only while needed for their specific booking, verification or legal purpose, with access restricted appropriately. Routine technical logs remain for the operational or security need they serve rather than being kept indefinitely for advertising.

Marketing preferences and limited suppression records remain as needed to honor your choices. Privacy request records remain for the purpose of demonstrating and resolving our response. A legal hold or unresolved investigation may extend retention of the particular relevant records.

Protected backups may retain information until the applicable backup cycle expires; it is not used as a source for ordinary marketing or unrelated activity. When information is no longer required, we delete it, securely dispose of it or irreversibly anonymize it. Information that can still be linked back to an individual remains subject to privacy protections. You can ask us about the retention criteria applying to your records.

We take reasonable technical and organizational measures appropriate to the information and risks, including limiting access to people and providers who need it for their responsibilities and protecting member records from unauthorized use or disclosure. We consider security when handling bookings manually as well as through digital systems.

No internet transmission or storage system is completely secure. Use secure account credentials, protect your devices and notify us promptly of suspected unauthorized access. Our staff do not need your password or payment authentication code to resolve a booking enquiry.

If a personal information incident occurs, we assess the affected information, likely consequences, containment needs and notification requirements. We notify affected individuals, regulators and other parties where required by applicable law within the applicable deadlines. Report a suspected privacy incident to legal@bokkara.com.

Our digital systems support account validation, price and reward calculations, result sorting, payment status updates and error detection. These processes use the account, booking, transaction and technical information relevant to their function.

Contact us if an automated error appears to have affected your booking, membership or rewards. Our support team can investigate the underlying records and explain or correct an error. Flight Disruption Assistance is investigated by Bokkara using the relevant flight and property information.

Where applicable law provides rights concerning profiling or solely automated decisions with legal or similarly significant effects, we provide the required information and review rights. We give additional notice and obtain any required permission before introducing materially different processing. This Notice does not give unrestricted permission to use member information for unrelated automated purposes.

Depending on the law applying to your information, you may request confirmation of processing, access, a copy or portable copy, correction, deletion, restriction or an objection to certain uses. You may also have rights relating to sensitive information, targeted advertising, sale or sharing, significant automated decisions and appeals against a refusal. Consent may be withdrawn where it is the processing basis.

Rights have conditions and exceptions. We may need to retain an invoice, protect another guest's information, preserve evidence for a claim or maintain a suppression record. If we refuse or partly fulfill a request, we explain the relevant reason and available review route unless a lawful restriction prevents that explanation.

Send requests to legal@bokkara.com. Include your name, contact email, country or state of residence, the right you wish to exercise and a relevant membership or booking reference if known. Do not send identity documents unless we request proportionate verification through an appropriate channel. You do not need to buy or renew membership to exercise an applicable privacy right.

We check identity and authority as needed for the type and risk of request, using information already available where suitable. An authorized agent may act where permitted with appropriate evidence of authority. We do not impose identity checks on opt-outs where law prohibits them.

We respond within the applicable legal deadline and explain any permitted extension. Requests are generally free; any exceptional fee or refusal follows the applicable law. We do not unlawfully discriminate or retaliate for exercising rights. Where deletion or restriction prevents a requested service from continuing, we explain the effect rather than treating the request as a penalty.

Where applicable European privacy law governs our processing, the legal grounds, transfer information and rights in this Notice apply with the protections required by that law. You may object to legitimate-interest processing on grounds relating to your situation; we then stop unless the applicable legal test permits continuation. Direct marketing objections do not require that balancing exercise.

GDPR and UK GDPR rights requests are generally answered within one month, with a permitted extension where the legal conditions are met and notice is given. Swiss procedures follow applicable Swiss law.

You may complain to a competent EEA supervisory authority, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner where applicable. EEA authority details are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. UK complaint information is available at https://ico.org.uk/make-a-complaint/. Swiss information is available at https://www.edoeb.admin.ch/.

You can contact legal@bokkara.com about a concern first, but doing so is not a condition of approaching an authority where direct complaints are permitted.

Where US state privacy laws apply, available rights may include access, correction, deletion, portability, and opt-outs relating to sale, targeted advertising or specified profiling. Eligibility, exemptions and appeal procedures depend on the applicable law. Send a request or an appeal with the subject “Privacy Request Appeal” to legal@bokkara.com, and we will explain the applicable review and complaint route.

The member information described in this Notice includes identifiers and contact details; customer and account records; commercial, booking and payment records; internet and technical activity; approximate location derived from IP address; and sensitive information where supplied for eligibility, security or special requests. Sources appear in sections 3 to 5, purposes in sections 6 to 12 and 16, recipients in section 13, and retention criteria in section 18. Each category is collected only as relevant to the member or service.

Bokkara does not sell member personal information, share it for cross-context behavioral advertising, or give it to other businesses for their own marketing. We do not use advertising or analytics trackers. Necessary property and service-provider disclosures remain as described in section 13. We honor recognized opt-out preference signals where required for processing to which they apply.

Where the California Consumer Privacy Act applies, you may exercise its applicable access, correction, deletion and other rights through legal@bokkara.com. Certain requests ordinarily have a 45-day response period, subject to lawful extension; opt-out and sensitive-information requests have their own requirements. Authorized agents may act subject to the applicable authority and verification rules. You may exercise rights without unlawful discrimination.

ClubNights and ClubCredit are administered under the membership terms. They do not authorize unrelated uses of personal information. Where a program requires a separate financial-incentive notice or choice under applicable law, those requirements apply. California consumer information is available at https://oag.ca.gov/privacy/ccpa.

Where Canadian privacy law applies, we give meaningful information about collection, use, disclosure and choices and obtain the consent or other authority required for the activity. You may request access or correction and challenge our information handling subject to applicable law. International service providers may be subject to foreign laws and lawful government access. Federal complaint information is available at https://www.priv.gc.ca/.

Members in Trinidad and Tobago, Singapore, Panama, the United Arab Emirates and other locations retain the privacy rights and protections applicable to their information. A staff location does not by itself determine which legal regime applies to every member. Any mandatory local rights take priority over inconsistent wording in this Notice.

Contact legal@bokkara.com to request information about your rights, raise a concern or obtain information about the competent authority for your location. This Notice does not make local rights conditional on accepting a foreign forum or waiving protections in your home jurisdiction.

We may update this Notice as our services, processing or legal requirements change. The last updated date identifies the version. Where a material change requires direct notice, prominent notification or renewed consent, we provide it as required before the relevant processing begins.

A change to website wording alone does not authorize a new consent-dependent use of previously collected information. You may contact us about the version relevant to your membership or booking.

For privacy questions, access or deletion requests, correction requests, consent withdrawal, objections or complaints, contact Bokkara Management LLC at legal@bokkara.com.

Include your name, the nature of your request and a membership or booking reference if available. We may request further information where necessary to locate records or verify authority. Do not send passwords, card security codes or payment authentication codes.