1. Data controller
This website is a demonstration for the fictional Bongobang Casino Resort concept. The intended data-controller details shown here are placeholders and must not be treated as an operating business identity. Before launch, replace this section with the full legal name, registered address, company or registration number where applicable, and a monitored privacy contact belonging to the actual operator.
2. Information we may process
A production hotel website may process information that visitors choose to provide, such as name, email address, telephone number, reservation details, accessibility requests or messages sent through a contact form. Server systems may also process technical information such as IP address, browser type, device information, timestamps and security logs. Only information necessary for the stated purpose should be collected.
3. Cookies and consent
This demonstration includes a cookie-consent interface and a basic Google Consent Mode v2 default state. Non-essential advertising and analytics consent is denied until the visitor accepts. Essential storage used for security and basic functionality can remain active where legally permitted. A real deployment must connect the consent choices to the actual analytics or advertising tags installed on the site and document every cookie or storage technology used.
Visitors can accept or reject non-essential storage. Their choice is stored in the browser so the banner does not need to reappear on every page view. A production site should also offer a persistent method to reopen privacy settings and withdraw consent as easily as it was given.
4. Purposes and legal bases
Depending on the final website features, personal information may be processed to answer enquiries, manage hotel or restaurant reservations, provide requested services, protect website security, comply with legal obligations and, with appropriate consent, measure website performance or advertising effectiveness. The production privacy notice should identify the specific legal basis relied upon for each processing purpose.
5. Retention, recipients and transfers
Personal data should be kept only as long as necessary for the purpose for which it was collected, subject to legal retention obligations. If the operator uses booking systems, payment processors, email providers, analytics tools, hosting companies or other processors, the privacy notice should identify the relevant categories of recipients and describe any international transfers and safeguards where required.
6. Your rights
Under applicable European data-protection law, individuals may have rights to access, correct, erase or restrict the processing of their personal data, object to certain processing, request data portability and withdraw consent where processing is based on consent. The final policy should explain how a person can exercise these rights and provide the contact details of the relevant supervisory authority.
7. Security and updates
The live site should use HTTPS, access controls, secure hosting practices and appropriate technical and organizational measures. No website can promise absolute security, but the operator should take reasonable steps to reduce risk and respond to suspected breaches in accordance with applicable law. This privacy notice should be updated whenever the site’s data practices materially change.