Privacy Notice

Privacy Notice

Privacy Notice Ordovician Beach Resort — RSH Properties-Panama, S.A. — Last updated: July 26, 2026 1. Introduction and Identity of the Data Controller Ordovician Beach Resort ('we', 'us', 'our') is a boutique luxury resort located on Isla Grande, Colón Province, Republic of Panama, operated by RSH Properties-Panama, S.A. RSH Properties-Panama, S.A. acts as the responsible party (data controller) for the personal data we collect and process, as defined under Panama Law No. 81 of March 26, 2019 on Personal Data Protection ('Law 81') and its implementing regulation, Executive Decree No. 285 of May 28, 2021 ('Decree 285'). The protection of personal data in Panama has constitutional status under Article 42 of the Political Constitution of the Republic of Panama, which recognises every person's right to access their personal information held in databases, and to request its correction and protection. We are fully committed to honouring that right. Data Controller: RSH Properties-Panama, S.A. | Ordovician Beach Resort, Isla Grande, Colón, Republic of Panama Data Protection Contact: [email protected] WhatsApp / Live Chat: via our direct guest communication channels 2. Scope of This Privacy Notice This Notice applies to the collection and use of personal data when you: • Visit or interact with our website or digital channels (Instagram, Facebook, WhatsApp, live chat) • Submit an enquiry or make a reservation through any channel — direct, WhatsApp, live chat, travel advisor, or online travel agency (OTA) • Stay as a guest at Ordovician Beach Resort, including use of accommodation, dining, boat transfer, helipad arrival, and any on-property experience • Receive or interact with email newsletters, WhatsApp broadcasts, or other marketing communications we send • Contact us for any reason including enquiries, complaints, or feedback • Participate in post-stay surveys or guest experience programmes This Notice does not apply to third-party websites, OTAs, or payment providers linked from our channels. Each operates under its own privacy policy, for which we are not responsible. 3. Data Protection Principles Under Law 81 and Decree 285, all personal data we process is governed by the following principles, which we commit to upholding: • Loyalty — data is collected and used in a manner consistent with what guests reasonably expect • Purpose — data is collected for specific, explicit, and legitimate purposes and not further processed in an incompatible manner • Proportionality — only the data necessary for the specified purpose is collected • Truthfulness and accuracy — data is kept accurate and up to date • Data security — appropriate technical and organisational measures are implemented • Transparency — data subjects are clearly informed of how their data is used • Confidentiality — data is not disclosed to unauthorised parties • Legality — all processing has a valid legal basis • Data portability — data subjects may receive their data in a reusable format 4. Personal Data We Collect 4.1 Data You Provide Directly • Identity data: full name, nationality, passport or identity document number and expiry date, date of birth, gender • Contact data: email address, phone number, WhatsApp number, home or billing postal address • Reservation data: arrival and departure dates, room type, number and names of guests, special requests, dietary requirements, accessibility needs, pre-arrival preferences, transfer method (boat from Portobelo or helicopter) • Payment data: billing address and payment method. Full card numbers are handled solely by our payment processor and are not stored by Ordovician Beach Resort • Communications: messages sent to us via WhatsApp (including through WhatsApp-linked advertising such as Meta's "Click to WhatsApp" ads), our website's live chat widget (LiveChat), email, phone, or any other channel • Meta Lead Ads data: contact information submitted through Meta Lead Ads (Instant Forms) on Facebook or Instagram, including your name, email, and phone number, when you request information or express interest in a reservation • Guest experience preferences: stated preferences for food, activities, ambience, and any other personal information you voluntarily provide to personalise your stay 4.2 Sensitive Personal Data Law 81 defines sensitive personal data as information that may create risks or cause harm if processed without appropriate safeguards. This includes health and medical data, dietary restrictions related to religion or health conditions, and accessibility requirements. We only collect sensitive data where strictly necessary to provide the services you have requested, and we treat it with heightened care and security. We do not collect biometric, genetic, political, or criminal record data from guests. 4.3 Guest Photography, Images, and Social Media As part of our commitment to portraying the Ordovician Beach Resort experience, we may wish to photograph or record video footage of the resort and its environment, which may incidentally include guests. We may also wish to feature guest photographs or testimonials in our marketing materials, website, or social media channels. Photography and filming on property. Ordovician Beach Resort staff and authorised photographers may photograph or film public areas of the resort (beaches, dining areas, the dock, and outdoor spaces) for the purposes of marketing and social media content. If you are present in any such area during a photoshoot or filming session, our team will always inform you in advance and give you the opportunity to move to a different area or to be excluded from the frame. We will never photograph or film inside guest accommodation or in any private area of the resort without your explicit prior consent. Use of your image in marketing. If Ordovician Beach Resort wishes to use a photograph or video that identifies you — on our website, Instagram, or in any other marketing material — we will always ask for your explicit written consent before doing so. Consent is entirely voluntary and has no bearing on the quality of service you receive. You may withdraw consent at any time by emailing [email protected], and we will remove the relevant content as soon as reasonably practicable. Photographs you share with us. When you share photographs with Ordovician Beach Resort — for example, by tagging us on Instagram, sending images via WhatsApp, or submitting photos through any other channel — you grant us a non-exclusive licence to use those images on our own social media channels and marketing materials, provided we credit you where you request it. If you wish us not to use an image you have shared, please let us know at any time and we will remove it promptly. Your photographs of the resort. Guests are welcome to photograph and film the resort for personal use. We ask that you respect the privacy of other guests and refrain from photographing or filming other guests without their permission. If you intend to publish photographs or footage of the resort commercially, please discuss this with our management team prior to your stay. 4.4 Data Collected Automatically • Device and browser data: IP address, browser type and version, operating system, screen resolution, language setting • Usage data: pages visited, time spent, links clicked, referring website, search terms used to find us • Cookie data: as described in detail in the Cookie Policy below • Email engagement data: whether you opened an email from us and which links you clicked 4.5 Data Received from Third Parties • Travel advisors and agents making reservations on your behalf • Online travel agencies (OTAs) through which you book • Payment processors confirming transaction details • Meta (Facebook/Instagram) when you interact with our social media pages, advertising, or submit a Meta Lead Ads form, and Google when you interact with our advertising • Analytics providers (Google Analytics) providing aggregated and pseudonymised website usage data 5. Legal Bases for Processing We process your personal data on one or more of the following legal bases under Law 81: Purpose Details Legal Basis Reservation management Processing bookings, confirmations, modifications, cancellations Performance of a contract Guest experience delivery Pre-arrival messages, special requests, boat/helicopter transfers, on-property personalisation Performance of a contract / Legitimate interests Payment processing Transaction authorisation, receipts, refunds Performance of a contract Guest communications WhatsApp, live chat, and email responses to enquiries; pre- and post-arrival messages Performance of a contract / Legitimate interests Marketing communications Newsletters and seasonal updates — only where consent has been given Consent (freely given, specific, informed) Website analytics Understanding site usage and improving digital experience Legitimate interests Legal and tax compliance Panamanian tax law, record-keeping, regulatory obligations Legal obligation Safety and security Protecting the safety of guests and staff at the resort Legitimate interests / Legal obligation Data breach management Notifying ANTAI and affected individuals in the event of a significant breach Legal obligation under Law 81 / Decree 285 We do not use your personal data for automated decision-making that produces legal or similarly significant effects. We do not sell your personal data to any third party. 6. Personalisation and Guest Profiling A central part of the Ordovician Beach Resort experience is personalisation — the ability to anticipate your preferences and tailor every aspect of your stay to you individually. To do this, we maintain a guest preference profile in our property management system which records information you share with us before, during, and after your stay. What we record and why • Room and accommodation preferences: preferred room location, bed configuration, pillow type, temperature, or any specific room requirements noted during previous stays or pre-arrival communications • Dietary and food preferences: food allergies, intolerances, dietary choices (including those with a religious or health basis), and cuisine preferences shared with us prior to or during your stay • Activity and experience preferences: preferred activities, pace of stay, interest in nature, water sports, guided experiences, or quiet retreat — noted from your conversations with our team or post-stay feedback • Communication preferences: preferred language, preferred channel (WhatsApp, live chat, or email), preferred time of day for messages, and opt-in or opt-out status for marketing communications • Arrival and departure patterns: preferred arrival method (boat from Portobelo or helicopter), typical trip duration, and advance booking behaviour This profiling is carried out on the basis of our legitimate interest in providing you with an exceptional and personalised experience, and where the data involved is sensitive (such as dietary information with a health or religious basis), on the basis of your explicit consent provided when you communicate these preferences to us. How long we keep preference data. Guest preference profiles are retained for up to three years from your most recent stay at Ordovician Beach Resort. If you have not visited within that period, your preference profile will be deleted. You may request deletion of your profile at any time by contacting [email protected]. Note: where dietary, health, or accessibility data was collected as part of a reservation record under Section 4.1, it is instead retained under the 5-year reservation retention period described in Section 12, not this 3-year preference-profile period. Your right to object. You have the right to object to the profiling of your personal data at any time. If you exercise this right, we will still be able to provide you with our services, but will not retain or use preference data from previous stays to personalise your experience. To opt out of guest profiling, please email [email protected] or advise any member of our team directly. 7. How We Share Your Personal Data We may share your personal data with the following categories of recipients: • Technology service providers: our property management system, point-of-sale system, accounting system, email platforms, and cloud hosting providers. These parties process data strictly on our instructions under written data processing agreements • Travel advisors and agents: to confirm and coordinate reservations made on your behalf • Payment processors: solely to authorise and complete payment transactions • Transport providers: where we coordinate your boat transfer from Portobelo or helipad arrival logistics on your behalf • Legal and regulatory authorities: ANTAI, tax authorities, courts, and law enforcement where required by Panamanian law or applicable international law • Professional advisers: lawyers, auditors, and insurers, under strict confidentiality obligations We do not share your personal data with third parties for their own independent marketing purposes. 8. Database Registry In compliance with Article 17 of Law 81 and Decree 285, RSH Properties-Panama, S.A. maintains a written registry of all personal data databases it operates. This registry contains information about the categories of data stored, the purposes of processing, the security measures in place, and the protocols for responding to the exercise of data subject rights. This registry is available to ANTAI upon request. 9. International Data Transfers Some of our service providers are located or process data outside Panama, including in the United States and the European Union. In accordance with Article 23 of Law 81, any cross-border transfer of your personal data is only made where we have ensured that the recipient provides a level of protection equivalent to or greater than that required by Panamanian law, or where one of the permitted conditions applies, such as your express consent or the necessity of the transfer for the performance of your reservation contract. For guests who are residents of the European Economic Area or the United Kingdom, we apply the requirements of the GDPR or UK GDPR to those transfers as applicable, including the use of appropriate transfer mechanisms where required. 10. Data Breach Notification In the event of a personal data breach that poses a significant risk to the rights and freedoms of guests, we will notify ANTAI and — where the breach is likely to result in high risk — the affected individuals, in accordance with Law 81 and Decree 285. We maintain an internal data breach response protocol and will act promptly to contain, investigate, and remediate any breach. 11. Security Cameras and CCTV For the safety and security of our guests, staff, and property, Ordovician Beach Resort operates closed-circuit television (CCTV) cameras in common areas of the resort, including the main reception area, boat dock, and external resort perimeter. Cameras are not installed in guest rooms, bathrooms, or any private accommodation areas. CCTV footage is processed on the basis of our legitimate interest in maintaining the safety and security of everyone on the property. Footage is retained for a maximum of 30 days, after which it is automatically overwritten, unless it is required for the investigation of an incident, in which case it may be retained for a longer period or disclosed to law enforcement authorities where required by law. Access to CCTV footage is strictly limited to authorised members of management and, where legally required, to Panamanian law enforcement authorities. Footage is not shared with third parties for any other purpose. If you have questions about CCTV use at the resort, or wish to exercise your ARCOP rights in relation to footage in which you appear, please contact [email protected]. Please note that your right to access footage may be limited where doing so would reveal the personal data of other individuals captured in the same footage. 12. Data Retention • Reservation and stay records: minimum 5 years, consistent with Panamanian tax and record-keeping law • Financial transaction records: 5 to 7 years as required by applicable law • Marketing preferences and consent records: until you withdraw consent, at which point your preference not to receive communications will be retained to honour your opt-out • Guest experience preferences (standalone profile data): up to 3 years from your most recent stay, to personalise future visits. Note: where dietary, health, or accessibility data was collected as part of a reservation record (Section 4.1), it is subject to the 5-year reservation retention period, not the 3-year preference profile period. The 3-year cap applies only to preference data held separately in the guest profile and not required for the underlying reservation record. • Database security logs: as required by our security protocols and applicable law When retention periods expire, data is securely deleted or anonymised. 13. Your ARCOP Rights Under Law 81 of Panama, you have the following rights with respect to your personal data — collectively known as ARCOP rights: • Access (A): the right to request, free of charge, a copy of the personal data we hold about you and information about how it is used. We will respond within 10 business days. • Rectification (R): the right to request correction of inaccurate, outdated, or incomplete data. We will respond within 5 business days. • Cancellation (C): the right to request deletion of your personal data, subject to our legal retention obligations. We will respond within 5 business days. • Opposition (O): the right to object to processing based on legitimate interests or for direct marketing purposes. For direct marketing, we will honour your objection immediately. For other opposition requests, we will respond within 5 business days. • Portability (P): the right to receive your personal data in a structured, commonly used, and machine-readable format. We will respond within 10 business days. You also have the right to withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of processing that took place before withdrawal. To exercise any of these rights, please contact [email protected] with your name, the right you wish to exercise, and sufficient information to identify your records. We may ask you to verify your identity before acting on your request. If you are not satisfied with our response, you may lodge a complaint with ANTAI (Autoridad Nacional de Transparencia y Acceso a la Información), Panama's personal data protection supervisory authority, at antai.gob.pa. Guests residing in the EEA or UK may also contact their local data protection authority. 14. California Residents — CCPA Rights If you are a resident of California (USA), additional rights apply to you under the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act (CPRA): • Right to know: you may request details about the categories and specific pieces of personal data we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom it is shared • Right to delete: you may request deletion of your personal data, subject to certain exceptions permitted by California law • Right to correct: you may request that we correct inaccurate personal data • Right to opt out of sale or sharing: Ordovician Beach Resort does not sell personal data and does not share personal data for cross-context behavioural advertising. No opt-out is therefore required, but we will honour any such request • Right to non-discrimination: we will not discriminate against you for exercising any CCPA/CPRA rights To exercise California rights, please contact [email protected]. We will respond within 45 days as required by California law. We will verify your identity before responding. 15. Additional Rights for Residents of US States In addition to the rights available to California residents under the CCPA/CPRA, residents of the following US states have privacy rights under their respective state laws, which we honour to the extent they apply to our processing of your personal data: State / Law Rights Available How to Exercise Virginia — CDPA Access, correction, deletion, portability, opt-out of targeted advertising and profiling Email [email protected] — respond within 45 days Colorado — CPA Access, correction, deletion, portability, opt-out of targeted advertising, profiling, and sale Email [email protected] — respond within 45 days; appeal rights available Connecticut — CTDPA Access, correction, deletion, portability, opt-out of targeted advertising and profiling Email [email protected] — respond within 45 days Texas — TDPSA Access, correction, deletion, portability, opt-out of targeted advertising, profiling, and sale Email [email protected] — respond within 45 days Utah — UCPA Access, deletion, portability, opt-out of targeted advertising and sale Email [email protected] — respond within 45 days Oregon — OCPA Access, correction, deletion, portability, opt-out of targeted advertising and profiling Email [email protected] — respond within 45 days To exercise any of the rights listed above, please email [email protected], clearly stating your state of residence and the right you wish to exercise. We will not discriminate against you for exercising any privacy right. Where a state law permits an appeal of our response to your request, we will include information about the appeals process in our response. Ordovician Beach Resort does not sell personal data as defined under any US state privacy law. Our use of Meta and Google advertising technologies may constitute 'sharing' or 'targeted advertising' under some state definitions. You may opt out of this by disabling Marketing cookies through our cookie consent tool or contacting us directly. 16. Data Security We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include restricted access controls, encrypted data transmission, secure storage protocols, and regular security reviews. Our service providers are contractually required to maintain equivalent security standards. No electronic transmission over the internet is completely secure. While we take the security of your data seriously, we cannot guarantee absolute security and encourage you to take appropriate steps to protect information you send us electronically. 17. Children Ordovician Beach Resort warmly welcomes families with children. We do not knowingly collect personal data directly from children under 13 years of age through our digital channels without verifiable parental consent. Reservation data for family bookings is collected from the adult responsible for the reservation. If you believe we have inadvertently collected data from a child under 13, please contact us immediately at [email protected]. 18. Changes to This Privacy Notice We may update this Notice periodically to reflect changes in our practices, applicable law, or technology. When we make material changes, we will update the 'Last updated' date above. Where required by law, we will notify you of significant changes. We encourage you to review this Notice periodically. 19. Contact RSH Properties-Panama, S.A. — Ordovician Beach Resort Isla Grande, Colón Province, Republic of Panama Email: [email protected] ANTAI — National Authority for Transparency and Access to Information: antai.gob.pa This document reflects the requirements of Panama Law No. 81 of 2019, Executive Decree No. 285 of 2021, Article 42 of the Constitution of the Republic of Panama, and applicable international standards including the GDPR and CCPA/CPRA. Cookie Policy Ordovician Beach Resort — RSH Properties-Panama, S.A. — Last updated: July 26, 2026 1. Cookies and Other Tracking Technologies When you visit the Ordovician Beach Resort website, we and our partners may use a number of technologies to collect information about your device and your behaviour on our site. These technologies include: Cookies. Cookies are small text files placed on your device by a website you visit. They are the most common tracking technology in use. Cookies set directly by Ordovician Beach Resort are called first-party cookies. Cookies set by our advertising, analytics, and social media partners are called third-party cookies. Both types are described in detail in Section 2 of this Cookie Policy. Web beacons and pixel tags. Web beacons (also known as pixel tags or clear GIFs) are tiny invisible images — often a single pixel — embedded in web pages or emails. When your browser or email client loads the page or email, the beacon sends a signal to the server that placed it, confirming that the page or email was loaded, along with your IP address, browser type, and the time of the request. Ordovician Beach Resort uses pixel tags in marketing emails to understand open rates and engagement, as described in Section 4 of this Policy. IP address tracking. Your IP address is a numerical identifier assigned to your device by your internet service provider. When you visit our website, your IP address is automatically transmitted to our web server and to third-party analytics services (such as Google Analytics). IP addresses are used to understand the approximate geographic location of our site visitors (at city level), to diagnose technical issues, and to detect and prevent fraudulent or abusive behaviour. Google Tag Manager. Our website uses Google Tag Manager (GTM), a tag management system that allows us to deploy and manage tracking scripts, pixels, and other third-party technologies on our website without modifying the site's code directly. GTM itself does not collect personal data; however, it controls and fires the tags listed in this Cookie Policy. You can learn more about Google Tag Manager at marketingplatform.google.com. Cross-device tracking. Our third-party advertising partners (principally Meta and Google) may use cookies, device identifiers, and login data to recognise you across multiple devices — for example, if you visit our website on your laptop and later see an Ordovician Beach Resort advertisement on your phone. This cross-device tracking enables our partners to build a more complete picture of your browsing behaviour for advertising purposes. You can opt out of cross-device tracking through our cookie consent tool by disabling Marketing and Targeting cookies. 1.1 Session Cookies and Persistent Cookies Cookies can be either session cookies or persistent cookies, depending on how long they remain on your device: Session cookies are temporary files that exist only for the duration of your visit to our website. They are automatically deleted when you close your browser. Session cookies are typically used to maintain your browsing session, keep items in a reservation form, and enable security features. Persistent cookies remain on your device after you close your browser, for a defined period of time set by the cookie. They are used to remember your preferences on return visits, to measure how you interact with our site over time, and to serve targeted advertising. The duration of each persistent cookie we use is specified in the cookie tables in Section 2. You can view and delete both types of cookies through your browser settings at any time. Deleting session cookies will not affect the current browsing session but will remove any saved preferences. Deleting persistent cookies will mean we cannot remember your previous choices and you may be asked to set your preferences again on your next visit. In addition to cookies, we may use pixel tags (web beacons), local storage, and device identifiers. This Cookie Policy refers to all such technologies collectively as 'cookies'. The processing of data collected through cookies is governed by Panama Law No. 81 of 2019 and, where applicable, the GDPR. 2. Categories of Cookies We Use 2.1 Strictly Necessary Cookies These cookies are essential for the website to function. They enable core features such as navigation, reservation forms, payment processing, and your consent management preferences. They cannot be disabled through our consent tool. You may block them through your browser settings, but this will significantly impair the website's functionality. Cookie Provider Purpose session_id Ordovician Beach Resort / Cloudbeds Maintains your session during the reservation process csrf_token Ordovician Beach Resort Security token preventing cross-site request forgery attacks cookieyes-consent CookieYes Records your cookie consent preferences and manages them across sessions — valid for 1 year rc::a, rc::b Google reCAPTCHA Distinguishes human users from automated bots; protects our contact and booking forms from spam 2.2 Booking Widget Cookies (Cloudbeds) Our reservation system is powered by Cloudbeds. When you use the booking widget on our website to check availability or make a reservation, Cloudbeds may set its own cookies on your device. These cookies are strictly necessary for the reservation process to function and cannot be disabled without preventing you from completing a booking. Cookie Provider Purpose cb_session, cb_uid, cb_token Cloudbeds (booking widget) Maintain your booking session, authenticate your reservation request, and prevent duplicate submissions — session cookies, deleted when you close the browser cb_property_id Cloudbeds Identifies the specific property (Ordovician Beach Resort) in the Cloudbeds system for your booking session — session cookie For more information about how Cloudbeds handles the data collected through the booking widget, including any cookies they set independently, please refer to the Cloudbeds Privacy Policy at cloudbeds.com/en/privacy-policy. 2.3 Performance and Analytics Cookies These cookies collect anonymised or pseudonymised information about how visitors use our website. They help us understand which pages are most visited, where visitors come from, and how to improve the site. No individual is identified. You can opt out of Google Analytics tracking by installing the browser add-on at tools.google.com/dlpage/gaoptout, or through our cookie consent preferences. Cookie Provider Purpose _ga Google Analytics Distinguishes unique users; stores an anonymised identifier — expires after 2 years _gid Google Analytics Distinguishes users and sessions — expires after 24 hours _gat / _gat_UA-* Google Analytics Throttles the request rate to Google — expires after 1 minute _ga_XXXXXXXXXX Google Analytics (GA4) Persists session state across page requests — expires after 2 years 2.4 Functional Cookies These cookies remember choices you make to provide a better, more personalised experience, and enable the live chat feature on our website. Disabling them may make some website features less convenient. Cookie Provider Purpose lang_pref Ordovician Beach Resort Remembers your preferred language or region — session cookie ui_state Ordovician Beach Resort Stores display preferences set during your session — session cookie __lc_cid LiveChat Identifies you as a visitor so our live chat widget can recognise you across chat sessions — persistent cookie __lc_cst LiveChat Stores an authentication token that keeps your live chat session active and secure — persistent cookie LiveChat may set a small number of additional cookies depending on which optional widget features are enabled (such as file sharing or chat history). For the complete and current list, see LiveChat's own Cookie Policy at livechat.com/legal/cookie-policy/. 2.5 Marketing and Targeting Cookies These cookies are set by our advertising partners — principally Meta (Facebook and Instagram) and Google — and track your browsing activity to deliver advertisements that are relevant to your interests, and to measure the effectiveness of our advertising campaigns. They are set only with your consent. Cookie Provider Purpose _fbp Meta (Facebook/Instagram) Identifies browsers for ad delivery on Meta platforms; tracks conversions from Ordovician Beach Resort ads — expires after 90 days _fbc Meta Stores click attribution from Facebook ads — expires after 90 days IDE Google / DoubleClick Used across Google Display Network for targeted ads and campaign measurement — expires after 1 year NID Google Stores preferences for Google-served ads, including personalised content — expires after 6 months DSID Google Identifies logged-in Google users for cross-device ad delivery 2.6 Social Media Cookies Our website includes links to and content from Instagram, Facebook, and WhatsApp. These platforms may set their own cookies when you interact with our embedded content, follow links to our social profiles, or use social share buttons. We do not control these cookies. Please review the respective platform's privacy and cookie policy: • Meta (Facebook and Instagram): facebook.com/privacy/policy • WhatsApp: whatsapp.com/legal/privacy-policy 3. Cookie Consent Management — Scope and Annual Renewal The Ordovician Beach Resort Cookie Consent tool (provided by CookieYes) allows you to customise your cookie preferences when you first visit our website. The tool records your consent choice and stores it in a cookie on your device. It will ask you to confirm your preferences again once a year to ensure you remain informed of any changes to our Cookie Policy or the cookies we use. The consent tool controls the Performance and Analytics, Functional, and Marketing and Targeting cookies set when you use ordovicianbeachresort.com. You can enable or disable each category independently. Your choice applies to our website only. What the consent tool does not control • Strictly Necessary cookies cannot be disabled through the consent tool, as they are required for the website to function. • Cookies set by third-party websites you visit after leaving our site — for example, if you click a link to Booking.com, Cloudbeds, or a social media platform — are not covered by our consent tool. Those websites set their own cookies under their own policies. • Cookies set by your email client when you open a message from Ordovician Beach Resort — including any pixel tags used for email engagement tracking — are controlled by your email application settings, not by this consent tool. Withdrawing or changing your consent. You may update your cookie preferences at any time by clicking the 'Cookie Settings' link in the footer of our website. Withdrawing consent for a cookie category will not affect the lawfulness of any processing that took place while your consent was active. Some features of our website may not function as intended if certain cookie categories are disabled. Managing cookies through your browser. You can also control cookies directly through your browser settings. Instructions for common browsers: • Google Chrome: Settings > Privacy and security > Cookies and other site data • Safari (macOS): Preferences > Privacy > Manage Website Data • Safari (iOS): Settings > Safari > Privacy & Security • Firefox: Options > Privacy & Security > Cookies and Site Data • Microsoft Edge: Settings > Cookies and site permissions Blocking or deleting all cookies will affect the website's functionality, including the reservation process. Opting out of interest-based advertising • Your Online Choices (Europe): youronlinechoices.eu • Network Advertising Initiative (USA): optout.networkadvertising.org • Digital Advertising Alliance (USA): optout.aboutads.info Our website does not currently respond to browser-level Do Not Track (DNT) signals. We do, however, recognise and honour Global Privacy Control (GPC) signals. The CPRA treats a GPC signal as a valid opt-out of the sale or sharing of personal data. Because our use of Meta and Google advertising technologies may constitute 'sharing' under California law, we treat a GPC signal from your browser as a request to disable Marketing and Targeting cookies for your session, regardless of any prior consent preference stored on your device. If your browser transmits a GPC signal, we will not activate Marketing and Targeting cookies during that visit. 4. Email, Live Chat, and WhatsApp Tracking Emails we send may contain pixel tags (invisible image files) that tell us whether the email was opened, which links were clicked, the time and date of opening, the device type used, and the approximate location of opening (city level). This helps us understand which content is relevant to our guests and improve future communications. Live chat. The live chat feature on our website is provided by LiveChat, a third-party customer service platform. When you start a conversation through this widget, LiveChat may collect your name, email address, and phone number if you provide them, along with the content of your messages and technical information about your device and browser. This information is used to respond to your enquiry and is accessible to our reservations team. For more information on how LiveChat processes this data, see LiveChat's Privacy Policy at livechat.com/legal/privacy-policy/. WhatsApp. We use WhatsApp Business to communicate directly with guests staying at the resort (in-house guest service), and as the landing destination for certain advertising campaigns — for example, Meta "Click to WhatsApp" ads that let you start a conversation with us directly from an ad. Where you contact us through a personal WhatsApp account in a standard consumer conversation, those messages benefit from WhatsApp's end-to-end encryption between devices. However, because we operate these communications through the WhatsApp Business Platform or Cloud API, messages are decrypted at the API boundary and processed through our business systems and service providers. In that context, standard encryption at rest and in transit applies, but the end-to-end guarantee of consumer WhatsApp does not extend to the business-side handling of your message. We do not use the content of WhatsApp or live chat messages for any purpose other than responding to your enquiry or managing your reservation. You can disable email tracking by setting your email client to block external images, or by unsubscribing from Ordovician Beach Resort marketing emails at any time. 5. Cookies Set by Third-Party Embedded Content Our website may embed or link to content from third-party services including Google Maps (for the resort location), YouTube (for resort video content), and booking widgets. These services may set their own cookies when you interact with their content. We do not control third-party cookies. Relevant third-party privacy policies: • Google: policies.google.com/privacy • Meta: facebook.com/privacy/policy • Cloudbeds (booking widget): cloudbeds.com/en/privacy-policy • LiveChat: livechat.com/legal/privacy-policy/ 6. Retention of Cookie Data • Session cookies: deleted automatically when you close your browser • Persistent cookies: retained for the period stated in each cookie's description, typically between 24 hours and 2 years • Analytics data: aggregated data retained in Google Analytics for up to 26 months (GA4 default) • Consent records: retained for 12 months from the date of consent, after which we will ask for your preferences again You can delete cookies stored on your device at any time through your browser settings. 7. California Residents — Cookie Rights Under the CCPA/CPRA, California residents have the right to opt out of the 'sale' or 'sharing' of personal data. We do not sell personal data. Our use of Meta and Google cookies for advertising purposes may constitute 'sharing' under California law. You may opt out by: • Using our cookie consent tool to disable Marketing and Targeting cookies • Visiting optout.aboutads.info or optout.networkadvertising.org • Contacting us at [email protected] with 'California Cookie Opt-Out' in the subject line • Enabling Global Privacy Control (GPC) in your browser, which we will honour automatically as a valid opt-out signal (see Section 3) 8. EU and UK Visitors If you are visiting our website from the European Union or the United Kingdom, additional rules apply to our use of cookies under the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations (PECR). Consent requirement. Under EU and UK law, we require your prior, informed, and freely given consent before placing any non-essential cookies on your device. Strictly Necessary cookies may be placed without consent, as they are essential for the website to function. All other categories — Performance, Functional, and Marketing — require your affirmative consent before we activate them. This is managed through our CookieYes consent banner. Right to withdraw. You may withdraw your consent for non-essential cookies at any time through the 'Cookie Settings' link in our website footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where you withdraw consent, we will stop setting the relevant cookies as soon as technically feasible on your next page load. Legitimate interest for analytics. Some analytics tools may be deployed on the basis of legitimate interest rather than consent where the data collected is genuinely aggregated and anonymised and does not identify individual users. Where we rely on legitimate interest for any cookie processing, this is noted in the cookie tables in Section 2. You retain the right to object to processing on the basis of legitimate interest at any time by contacting [email protected]. 9. Changes to This Cookie Policy We may update this Cookie Policy as our website, the cookies we use, or applicable law changes. When we do, we will update the 'Last updated' date above and, where significant changes have been made, display a new consent banner so you can review and update your preferences. 10. Contact RSH Properties-Panama, S.A. — Ordovician Beach Resort Isla Grande, Colón Province, Republic of Panama Email: [email protected]