Privacy Policy

Overview & scope

This policy explains how Qaydan Oasis ("the hotel," "we," "us" or "our") collects, uses, shares and protects personal information when you visit qaydanoasis.com, register your interest in the opening, call or write to the desk, or later stay, dine or hold an event with us at Marine Drive, Cox's Bazar.

The hotel is in Bangladesh and operates under Bangladeshi law. Because our guests travel from everywhere, this policy is also written to meet the standards of the EU and UK General Data Protection Regulations and the California Consumer Privacy Act as amended by the California Privacy Rights Act, which apply to visitors from those places wherever the hotel itself sits.

We open on 1 January 2028. Until then, most of what is described below — reservations, stays, in-room service — is what will happen once the house opens. What we actually collect today is limited to interest registrations, enquiries and ordinary website analytics.

If you are registering, enquiring or later booking on someone else's behalf — a travel agent, a corporate account, a family member — please pass this policy on to them too, since you are giving us their information along with your own.

Who we are

Qaydan Oasis is a hotel on Marine Drive, Cox's Bazar Sea Beach, and a sister concern of the Qaydan Group. We operate the website at qaydanoasis.com, and we are the data controller for the personal information described in this policy — the organisation that decides why and how it is used.

You can reach our privacy team by post at Qaydan Oasis, Marine Drive, Cox's Bazar Sea Beach, Cox's Bazar, marked for the attention of the Data Protection Team; by phone; or by email — full details are under “Contact us & complaints” at the end of this policy.

Information we collect

Information you give us directly

• Reservation details — arrival and departure dates, room type, rate plan, number of guests, and any special requests noted at booking or check-in.
• Identity and contact details — name, postal and email address, phone number, and, where required by local law or your rate plan, a form of identification at check-in.
• Payment information — your card is captured and processed directly by our payment provider; Qaydan Oasis does not store full card numbers on its own servers.
• Interest and account details — the email address you register with, the rough dates and reason for stay you tell us about, and, once you have an account, your stay history and room preferences.
• Guest preferences — dietary requirements and allergies for the terrace kitchens, accessibility needs, occasion notes such as anniversaries, and details of any dogs travelling with you.
• Correspondence — anything you tell the desk, the reservations team or “Chat with us” by phone, email or in person, including call recordings where we've told you a line is recorded.
• Vehicle and travel details — your car registration and flight number, if you ask the house car to meet you at the airport or use valet parking.

Information collected automatically

• Device and usage data — IP address, browser type, pages visited, referring page, and approximate location derived from IP, collected whenever you visit qaydanoasis.com.
• Cookies and similar technologies — see “Cookies & tracking technologies” below for the categories we use and how you control them.
• CCTV — the car court, lobby, corridors, terrace and other communal areas are covered by CCTV for the safety of guests and staff. We do not record inside guest rooms, spa treatment rooms or washrooms.

Information from other sources

• Travel agents, corporate travel accounts and booking platforms, when a reservation is made on your behalf.
• Our payment processor, who confirms whether a payment succeeded — not the card details themselves.
• Publicly available sources, such as a company website, if you book under a corporate or group rate.

How we use your information & our legal bases

Wherever the UK GDPR, EU GDPR or a similar law applies, we only use your personal information where we have a valid legal basis to do so. The table below sets out our main purposes and the basis we rely on for each.

Where we rely on consent — for marketing, and for non-essential cookies — you can withdraw it at any time, free of charge, without affecting anything that already happened while consent was in place.

Cookies & tracking technologies

When you first visit qaydanoasis.com, a banner asks you to Accept all or Reject non-essential cookies. Your choice is stored in your browser, and — so we can see how often each option is chosen — we log an anonymous record of the decision and the page it was made on, never your name, email or IP address.

Essential cookies — always on

These keep the site working: remembering your cookie choice, keeping you signed in, and carrying your booking search between pages. The site can't function properly without them, so Reject does not disable them.

Analytics and advertising cookies — only after you choose Accept

If you accept, we may load one or more of the following, configured by our marketing team: Google Analytics and Google Tag Manager, the Meta (Facebook) Pixel, LinkedIn Insight Tag, TikTok Pixel, Microsoft Clarity, Hotjar, and Vercel Analytics. These help us understand which pages and offers work and, where used, measure advertising results. None of them load if you choose Reject, and none load on our internal dashboard pages.

You can change your mind at any time by clearing your browser's cookies and site data for qaydanoasis.com and reloading the page — the banner will ask again. Most browsers also let you block cookies globally in their settings, though doing so may stop parts of the booking flow from working.

How we share your information

We do not sell your personal information. We share it only in the following circumstances:

• Service providers who work on our behalf — our payment processor, hotel and booking-engine software, hosting provider, email and SMS delivery services, and the analytics and advertising providers listed above. They may only use your information to provide the service we've asked for.
• Travel agents and booking platforms, when a reservation was made through them, so they can confirm or manage the booking.
• Professional advisers, such as our accountants, auditors and legal counsel, when needed.
• Authorities and regulators, where we're required to by law, by a court order, or to protect the safety of a guest, a member of staff, or the public.
• A buyer or successor, if the hotel or its parent company is sold, merged or reorganised — your information would move with the business, subject to the same protections.
• Anyone else, only with your consent — for example, if you ask us to share a booking confirmation with a travel companion.

International data transfers

The hotel is in Bangladesh, and several of the service providers listed above are based elsewhere again — including the United States and the European Union. So your information will ordinarily be handled outside the country you contacted us from. Where information reaches us from the UK or the European Economic Area, we put a recognised safeguard in place first — the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Addendum. You can ask us which safeguard covers a particular transfer using the contact details below.

How long we keep your information

We keep personal information only for as long as we need it for the purpose it was collected, then delete or anonymise it. As a guide:

Where we're required to keep information for longer — a dispute, an insurance claim, a legal hold — we retain only what's relevant, for as long as that need lasts.

How we protect your information

We use technical and organisational measures appropriate to the sensitivity of the data involved, including encryption of data in transit, access controls that limit staff access to what their role requires, regular review of our systems and third-party providers, and PCI DSS–compliant handling of payment card data by our payment processor. No system is completely immune to risk; if we become aware of a breach likely to affect you, we'll notify you and the relevant regulator as required by law.

Your privacy rights

If the UK GDPR, EU GDPR or a similar law applies to you, you have the right to:

• Access the personal information we hold about you, and get a copy of it.
• Correct information that's inaccurate or incomplete.
• Erasure of your information, in certain circumstances.
• Restrict or object to certain processing, including direct marketing at any time and processing based on legitimate interests.
• Data portability — receive certain data in a portable format, or ask us to send it to another organisation.
• Withdraw consent at any time, where we rely on it — this won't affect processing that already happened.
• Complain to a supervisory authority, if you are in a country that has one — in the UK, the Information Commissioner's Office (ico.org.uk); elsewhere in the EEA, your local data protection authority.

To exercise any of these rights, contact us using the details under “Contact us & complaints.” We'll normally respond within one month, and we won't charge a fee unless a request is manifestly unfounded or excessive.

California and other regions

California — CCPA / CPRA

If you're a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we've collected, used, disclosed and (where applicable) sold or shared about you in the past 12 months; to request its deletion or correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of these rights.

We do not sell personal information for money. Some of the advertising cookies described above may count as "sharing" under the CPRA's broad definition once you've accepted them. We honour the Global Privacy Control (GPC) browser signal as a valid opt-out request, and choosing Reject in our cookie banner has the same effect. You, or an authorised agent acting on your behalf, can submit a request using the details under “Contact us & complaints.”

Other regions

If you're contacting us from Canada, Australia, Brazil or another country with its own data protection law — such as PIPEDA, the Privacy Act 1988, or the LGPD — we apply the same principles set out in this policy, and handle your request under whichever law gives you the stronger protection.

Children's privacy

Our website and our interest list are intended for adults registering for the opening or making and managing a hotel booking. We don't knowingly collect personal information directly from children. Children may of course stay with us as part of a family booking made by a parent or guardian, whose information we handle as described in this policy. If you believe a child has given us personal information directly, contact us and we'll delete it.

Marketing preferences

If you register your interest, what you have asked for is the opening rates and the chance to book before they are public — so that, and nothing else, is what we send. We will not add you to a general mailing list off the back of it. Any broader marketing, once the house is open, is opt-in separately, and every message carries an unsubscribe link. Service messages tied to a booking you have made — a confirmation, a pre-arrival email, an itinerary change — are sent even if you have opted out of marketing, since those aren't promotional.

Automated decision-making

We don't make any decision that produces a legal or similarly significant effect about you based solely on automated processing, and we don't profile you to decide what you are offered. If that changes when the house opens — a loyalty scheme, for instance, or automated rate decisions — this policy will be updated before it does.

Third-party links

Our website may link to third-party sites — a mapping service, a review platform, a social network. This policy doesn't cover them, and we're not responsible for their content or privacy practices. Please check their own policies before sharing information.

Changes to this policy

We may update this policy from time to time — to reflect a change in the law, in our systems, or in how we run the hotel. It will certainly be updated when the house opens, since much of what is described here starts then. The “Last updated” date at the top shows when it last changed. If a change is material, we'll post a notice on the website and, where we have your email, tell you directly.