1. Who is responsible
Hamadryade Lodge, operating under the brand Hamadryade Retreats (“Hamadryade”, “we”), based in Puerto Misahuallí, Napo province, Ecuador, is the data controller for the personal data collected through hamadryade-retreats.com, our forms, our messaging channels and the handling of your booking.
For any privacy matter: retreats@hamadryade-retreats.com. The legal name and tax ID (RUC) appear in your booking confirmation and invoices.
We process your data in accordance with Ecuador’s Organic Law on Personal Data Protection and, where you live in the European Union or European Economic Area, also the General Data Protection Regulation (GDPR).
2. What data we process and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Enquiry form | Name, email, phone, country, retreat and dates of interest, message and how you found us | Reply to your enquiry, send information and schedule a call | Pre-contractual steps at your request; your consent |
| Booking and payment | Contact and billing details, companions, payment data. Payments are processed by WeTravel; we do not store your full card number | Manage your booking, collect payment, invoice and meet tax obligations | Performance of the contract; legal obligation |
| Retreat preparation | Health questionnaire, allergies and diet, emergency contact, arrival details | Organise your safety and appropriate care | Your explicit consent; protection of vital interests in an emergency |
| Messages (email, WhatsApp, Instagram, Facebook) | Content of your messages and contact details | Answer enquiries and follow up, including automated reminders | Pre-contractual steps; legitimate interest in answering people who write to us |
| Newsletter and updates | Email address and preferences | Send you dates, news and offers | Your consent (you can withdraw it at any time) |
| Browsing the website | Online identifiers, IP address, pages viewed, device and browser | Measure site use and ad effectiveness | Your consent, through the cookie banner |
| Website security | Technical server logs | Protect the site and prevent abuse | Legitimate interest |
| Photos and video during the retreat | Image and voice | Document the experience and, only if you agree, publish it | Your separate, express consent |
We only ask for the data needed for each purpose. If you do not provide data marked as necessary, we may be unable to handle your enquiry or manage your booking.
3. Health and dietary data
To keep your stay safe, we may ask about your health, medication, allergies and diet. This is specially protected data: we process it only with your explicit consent, use it solely to prepare and support your retreat, and share it only with team members or professionals who need it to look after you. You can withdraw your consent at any time; in that case we may not be able to offer you certain activities. See also our Health, Safety and Liability Notice.
4. Who we share it with
We do not sell your data. We share it only with providers acting on our behalf and with those essential to delivering the service:
- HighLevel Inc. (GoHighLevel / LeadConnector): CRM, forms, email automation and messaging.
- WeTravel Inc.: booking and payment gateway.
- Google: Google Analytics (if you accept analytics cookies) and Google Translate (only if you choose to translate the page).
- Meta Platforms: Meta Pixel (if you accept marketing cookies), and WhatsApp, Instagram and Facebook when you write to us there.
- Web hosting and email providers that keep the website and our mailboxes running.
- Facilitators, guides and professionals taking part in your retreat, limited to the information they need.
- Authorities (administrative, tax or judicial) where the law requires it.
5. International transfers
Some of these providers are in the United States or other countries, so your data may be processed outside Ecuador and the EEA. Where the provider offers it, we rely on standard contractual clauses or on its certification under the EU-US Data Privacy Framework, and we require appropriate security measures.
6. How long we keep it
- Enquiries that do not lead to a booking: up to 24 months from the last contact.
- Bookings, contracts and invoicing: for as long as applicable tax, accounting and commercial rules require (currently 7 years in Ecuador).
- Health questionnaires and data: as long as needed for your retreat and up to 12 months afterwards, unless a legal obligation or the defence of a claim requires longer. They are then deleted or anonymised.
- Newsletter and marketing communications: until you withdraw consent or unsubscribe.
- Your cookie choice: 6 months, after which we ask you again.
7. Your rights
You may at any time exercise your rights of access, rectification and updating, erasure, objection, portability and suspension or restriction of processing, as well as the right not to be subject to decisions based solely on automated processing. You may also withdraw your consent where processing is based on it, without affecting what has already been done.
Write to retreats@hamadryade-retreats.com with the subject “Personal data” stating which right you wish to exercise. To protect your information we may ask you to verify your identity. We will reply within the legal deadlines.
8. Marketing communications
We will only send you news and offers if you have allowed us to. Every email includes an unsubscribe link, and you can also ask us in writing. Messages tied to your enquiry or booking (confirmations, reminders, practical information) are not marketing communications.
9. Minors
Our retreats are for adults and this website is not directed at people under 18. We do not knowingly collect data from minors; if you believe we have received any, write to us and we will delete it.
10. Security
We apply reasonable technical and organisational measures: encrypted connection (HTTPS) across the site, restricted access to information, providers with recognised security practices and basic team training. No system is infallible; if a breach affecting you occurs, we will tell you and notify the authority where required.
12. Automated decisions
We use automation to send, for example, a welcome email or a reminder after your enquiry. We do not make decisions with legal or similarly significant effects on you based solely on automated processing, nor do we build profiles with such effects.
13. Rights depending on where you live
European Union, EEA and United Kingdom. We apply the principles and rights of the GDPR (and the UK GDPR): you may exercise the rights in section 7 and complain to the supervisory authority in your country (in the UK, the Information Commissioner’s Office).
United States (California and other states with privacy laws). In the last 12 months we may have collected: identifiers and contact details, commercial information (enquiries and bookings), browsing data (only if you accept cookies), health data (only with your express consent) and, if you allow it, image and voice. We do not sell your personal data. If you accept marketing cookies (Meta Pixel), that disclosure may count as “sharing” for behavioural advertising; you can refuse it at any time in Cookie settings and we honour your browser’s Global Privacy Control signal. You may ask us what data we hold about you, access it, correct it, delete it and limit the use of your sensitive data, and we will not treat you differently for exercising these rights. Write to retreats@hamadryade-retreats.com; an authorised agent may act on your behalf if they can show authority.
14. Changes and complaints
We may update this policy; the date of the latest version is shown at the top. If changes are significant, we will make that clear.
If you believe your rights have not been respected, you may complain to Ecuador’s personal data protection authority (Superintendencia de Protección de Datos Personales) or, if you live in the EU, the EEA or the UK, to the supervisory authority in your country.