Version 2.0 — in force from 1 December 2026 (previous version: 1.0, 17/09/2026)
This policy complies with Law No. 19,628 on the protection of private life, as amended by Law No. 21,719, and with the European Union’s General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), which applies because we offer our services to residents of the European Union.
Kona Koa Eco Lodge — sole trader Jérôme Amigues
Hiku o te ika s/n, 2770000 Hanga Roa, Easter Island — Rapa Nui — Valparaíso Region, Chile
RUT: 14639864-2
Telephone: +56 9 6622 4387
Email: contact@konakoalodge.com
Contact form: konakoalodge.com/contacts/
As this is a sole trader, the data controller is the natural person identified above; there is no legal representative distinct from the data controller. No prevention officer has been appointed within the meaning of article 49 of the law, because no infringement prevention model has been adopted, adoption being voluntary.
The email address and the form indicated above are the means by which data subjects’ requests are notified to us. We keep them current and operational.
Range of people covered by our databases: guests and prospective guests who book or enquire about availability; people who write to us through the contact form; people who subscribe to our communications; visitors to the website.
Categories of data processed:
| Category | Detail |
|---|---|
| Identification | first name, surname |
| Contact | email address, telephone, postal address, country |
| Booking | arrival and departure dates, bungalow or tour chosen, number of people, special requests |
| Billing | amount, currency, payment status, order number |
| Browsing | IP address, browser type, pages viewed, source of the visit |
We do not process sensitive personal data within the meaning of article 2 (g) of the law. We do not deliberately process the data of children or adolescents: bookings are always made by an adult.
Source of the data. All identification, contact, booking and billing data is given to us directly by you through the forms on the site, by email or by telephone. We do not obtain data from publicly accessible sources, nor do we buy it from third parties. Browsing data is generated on your own device when you visit the site.
Bank card data: we do not receive it, we do not see it and we do not store it at any time. Payment takes place in the environment of our provider Getnet / Placetopay, which is the only party that processes that information.
| Purpose | Lawful basis |
|---|---|
| Managing your booking: confirming it, preparing it, welcoming you, invoicing | Art. 13 c) — necessary for the conclusion and performance of the accommodation contract. For availability enquiries: pre-contractual measures taken at your request. |
| Replying to your messages | Art. 13 c) — pre-contractual measures, or art. 12 (consent) where your message does not concern a booking. |
| Complying with Chilean accounting and tax obligations | Art. 13 b) — compliance with a legal obligation. |
| Protecting the site against fraud and automated bookings | Art. 13 d) — legitimate interest. |
| Measuring site audience on an aggregated basis | Art. 12 — your consent, collected through the cookie banner. |
| Sending you our marketing communications | Art. 12 — your free, prior, specific and unambiguous consent. |
| Defending our rights before the courts | Art. 13 e). |
Legitimate interests relied on, individually identified in accordance with article 14 ter (d): (i) the security of the site and of our booking system, against intrusion attempts, bulk sending and bookings generated by bots; (ii) the prevention of payment fraud and of fictitious bookings, which tie up real availability.
You may at any time ask us to inform you of the processing and of the legitimate interest relied on, and object to it in accordance with article 8.
We never make your booking conditional on accepting our marketing communications. The relevant box is separate and is not pre-ticked.
We do not sell or rent your data. We disclose it only to the following recipients, which act as processors within the meaning of article 15 bis, on our behalf and on our instructions, with two exceptions flagged in the table:
| Recipient | What for | Country |
|---|---|---|
| o2switch | hosting of the website, the database and the e-mail service | France |
| Cloudflare | content delivery and bot protection | United States and global network |
| Google Ireland Limited — Google Analytics | audience measurement, subject to consent | Ireland, with transfers to the United States |
| Google Ireland Limited — Google Maps | mapping, subject to consent. Google acts here as an independent controller, not as a processor | Ireland, with transfers to the United States |
| Getnet / Placetopay (Evertec) | card payment processing. They act as independent controllers, not as our processors | Chile and Colombia |
The Google Maps exception. For Google Analytics, Google acts on our behalf as a processor, under its data processing terms. For Google Maps, by contrast, Google processes the data under its own controller-to-controller terms: it is an independent controller, and no processing agreement is possible. That is why Google Maps loads only after you accept it in the cookie banner, and the disclosure rests on your consent (article 12).
Card payment. Payment is processed on the Placetopay platform, operated by Evertec and configured for Getnet Chile. Under the Contrato Getnet, August 2024 version, Getnet is the controller of the data, not our processor. We never receive, see or store any of your card details: that same contract expressly forbids it and imposes the PCI-DSS standard. The disclosure to Getnet and Placetopay is necessary for the performance of your booking (article 13 (c)), and the international transfer it entails rests on article 27, second paragraph, (g).
With each of the processors there is a contract setting out the subject matter, the duration, the purpose of the processing, the type of data, the categories of data subjects and the rights and obligations of the parties, in accordance with article 15 bis. They are prohibited from processing your data for any other purpose and from subcontracting without our written authorisation.
We will also disclose your data to the competent judicial or administrative authority where a law requires us to do so.
Our establishment is in Chile and our providers are abroad: every booking involves international transfers, in both directions. We set them out separately because the applicable regime is not the same.
None of the destination countries has, as at today’s date, a determination of adequate levels of protection issued by the Chilean Personal Data Protection Agency, for the simple reason that the Agency has not yet issued any: there is as yet no list of adequate countries.
Consequently, these transfers are not based on article 27 (a), but on:
We keep those contracts and can demonstrate to the Agency the lawfulness of each transfer, as required by article 28, sixth paragraph.
If you reside in the European Union, your data leaves it when it reaches us. Chile does not have an adequacy decision from the European Commission. This transfer is based on article 49(1)(b) of the GDPR: it is necessary for the performance of the booking contract you enter into with us. Without it we could not prepare for your arrival or welcome you.
Google’s transfers to the United States fall under the EU — US Data Privacy Framework, recognised as adequate by the European Commission on 10 July 2023.
| Data | Retention period |
|---|---|
| Booking made: identification, contact, stay | 3 years from the end of the stay, in order to deal with complaints and subsequent enquiries |
| Accounting and billing documents | 6 years, the period required by Chilean tax legislation |
| Availability enquiries and quotes not taken up | 12 months, after which they are deleted or anonymised, in accordance with article 14 (d) |
| Contact form messages | 12 months from the last reply |
| Subscription to marketing communications | until you withdraw your consent, and 3 years after the last contact |
| Browsing data and audience cookies | 13 months maximum |
| Cookie consent record | 6 months |
Once these periods expire, the data is deleted or irreversibly anonymised.
The law grants you six rights, which are personal, non-transferable and inalienable, and which no act or agreement may limit (article 4):
| Right | Article | What it allows you to do |
|---|---|---|
| Access | 5 | Know whether we process your data, access it and find out its source, the purposes, the recipients, the processing period and the legitimate interests relied on |
| Rectification | 6 | Correct inaccurate, out-of-date or incomplete data |
| Deletion | 7 | Obtain the erasure of your data in the cases provided for by law |
| Objection | 8 | Object to processing based on our legitimate interest, and at any time and without condition to processing for direct marketing purposes |
| Portability | 9 | Receive your data in a structured, commonly used and interoperable electronic format, and request its transmission to another data controller |
| Blocking | 8 ter | Obtain the temporary suspension of processing |
On portability, candidly: article 9 makes it conditional on the processing being automated and based on your consent. Your booking data is processed on the basis of the contract, not of consent: portability does not cover it. It does apply to the data relating to your subscription to our communications.
How to exercise them. Write to us at contact@konakoalodge.com or use the contact form. State your name, an address or email for our reply, and the data or the processing to which your request relates. For access, identifying yourself is enough. We may ask you to prove your identity, solely so as not to hand your data to a third party.
Time limits. We will acknowledge receipt and give our decision within 30 calendar days from the lodging of your request, a period that may be extended once only, by a further 30 calendar days, of which we will inform you. If you request temporary blocking, we will reply within 2 working days and, until we decide, we will not process the data concerned.
No charge. Rectification, deletion and objection are always free of charge. Access is free at least once per quarter. Only if you exercise access or portability more than once in the same quarter may we charge you the direct costs.
If we refuse your request, we will tell you so with reasons, stating the ground and the supporting material, and we will inform you that you have 30 working days to complain to the Chilean Personal Data Protection Agency, in accordance with article 41.
If we refuse your request, answer it incompletely or fail to answer within the time limit, you may complain to the Chilean Personal Data Protection Agency, within 30 working days from our negative reply or from the expiry of the time limit for replying (articles 11 and 41).
If you reside in the European Union, you may also complain to the supervisory authority of your country of residence, under the GDPR.
We do not take automated decisions, nor do we carry out profiling, in respect of anyone. The price of your stay depends solely on the bungalow, the dates and the number of people; it is not calculated on the basis of your behaviour, your history or any individual assessment. No decision affecting you is taken without human involvement.
In accordance with articles 14 quinquies and 14 ter (e), we make public the measures adopted to protect our databases:
In the event of a security breach causing the destruction, leakage, loss or alteration of your data, or unauthorised access to it, and involving a reasonable risk to your rights and freedoms, we will report it to the Agency by the swiftest means possible and without undue delay, and we will keep the record required by article 14 sexies. Where the law requires it, we will also notify you, in clear and plain language.
The site installs the cookies your booking needs — basket, language, currency and payment security — which cannot be disabled because without them booking is impossible. The others await your consent and are not installed before you give it.
| Category | Purpose | Basis |
|---|---|---|
| Necessary | basket, language, currency, bot protection | Art. 13 c) and d) |
| Audience measurement | Google Analytics, on an aggregated basis | Art. 12 — consent |
| Third-party content | Google Maps | Art. 12 — consent |
You may give, change or withdraw your consent at any time from the “Manage my cookies” link in the footer. Withdrawal does not affect the lawfulness of processing carried out before it (article 14 ter (k)).
Where processing is based on your consent — marketing communications, audience measurement, third-party content — you may withdraw it at any time, as easily as you gave it: unsubscribe link at the foot of every email, “Manage my cookies” link in the site footer, or a simple request to contact@konakoalodge.com. Withdrawal does not affect the lawfulness of processing carried out before it.
This policy carries a version number and a date of entry into force, which we update on each change, in accordance with article 14 ter (a). If the change affects your rights or the purposes of the processing, we will inform you by email. The previous version remains available on request.
Kona Koa Eco Lodge — Jérôme Amigues
Hiku o te ika s/n, 2770000 Hanga Roa, Easter Island — Rapa Nui, Chile
contact@konakoalodge.com — +56 9 6622 4387
This site sets the cookies your booking needs: cart, language, currency and payment security. Those cannot be switched off. The rest wait for your consent. Privacy policy
Cart, language, currency, bot protection. Without them, booking is impossible.
Records how you reached the site, so we know what works.
Google maps on the Contacts page. Displaying them sends data to Google.