Moon Gate Hotel and Spa, Antigua

Privacy Policy

Governing Privacy of Guests, Visitors, Employees and Business Partners

Policy Overview Reference

Governing Law: Data Protection Act, 2013, No. 10 of 2013, Electronic Crimes Act No. 14 of 2013 and other applicable laws of Antigua and Barbuda relating to privacy, cybersecurity, electronic communications and information security.

Regulatory Authority: Information Commissioner, Antigua and Barbuda (for matters relating to data protection and privacy)

Applies To: All guests, website visitors, employees, contractors, and business partners.

1. Introduction and Scope

Moon Gate Hotel and Spa (“Moon Gate”, “we”, “us”, or “our”) is a luxury hospitality and wellness establishment located in Antigua and Barbuda. We are deeply committed to safeguarding the personal data of every individual who interacts with us, whether as a guest staying at our property, a visitor to our website or social media platforms, a spa or restaurant patron, a prospective employee, or a business partner.

This Privacy Policy (“Policy”) governs the collection, use, storage, disclosure, and protection of personal data by Moon Gate Hotel and Spa. It has been prepared in full compliance with the Data Protection Act, No. 10 of 2013 of Antigua and Barbuda (“the Data Protection Act”), the Electronic Crimes Act No. 14 of 2013 (“the Electronic Crimes Act”) and the constitutional right to privacy enshrined in Chapter II of the Constitution of Antigua and Barbuda (1981). In addition to governing the lawful processing of personal data, this Policy outlines the measures implemented by Moon Gate to safeguard personal information and electronic systems against unauthorized access, misuse, disclosure, cyber threats and other forms of electronic interference.

Where applicable to processing activities or individuals, Moon Gate will also process personal data in accordance with applicable international data-protection requirements, including the European Union General Data Protection Regulation (“GDPR”).

This Policy applies to guests and prospective guests, website and digital-platform users, spa, wellness, restaurant and event patrons, visitors, business contacts, suppliers and other individuals whose personal data is processed in connection with Moon Gate’s hospitality operations.

By using our services, making a reservation, visiting our website, or otherwise engaging with Moon Gate, you acknowledge that you have been provided with this Privacy Policy and information regarding how we collect, use, disclose, retain and protect personal data. Where consent is required for a particular processing activity, Moon Gate will request that consent separately and in an appropriate manner.2. 

2. Data Controller, Who We Are

For the purposes of the Data Protection Act, No. 10 of 2013, Moon Gate Hotel and Spa acts as the Data User (referred to in international practice as the Data Controller) in respect of personal data processed by or on behalf of the establishment. This means we determine the purposes for which, and the manner in which, personal data is processed.

 

Email: welcome@moongateantigua.com

Registered Address: Half Moon Bay, St. Phillip's, P.O. Box 1275,
St. John's, Antigua & Barbuda

Telephone: (268) 562-2625 

Website: www.moongateantigua.com

Any inquiries, requests, or complaints relating to this Policy or the use of your personal data should be directed to our designated Point of Contact at the details above.

3. Personal Data We Collect

We collect only the personal data that is adequate, relevant, and necessary for the purposes for which it is processed, in accordance with the data minimisation obligations under the Data Protection Act. Individuals are responsible for ensuring that the personal data they provide to Moon Gate is accurate, complete and up to date and should promptly notify us of any changes. The categories of personal data we may collect include:

3.a Guest and Reservation Data

• Full name, date of birth, nationality, and passport or national identification details;
• Contact information including postal address, email address, and telephone number;
• Reservation details such as arrival and departure dates, room or suite preferences, and special requests;
• Payment and transaction information, including billing information, payment method details, transaction records, and limited payment-card information made available to Moon Gate in connection with a reservation or transaction.Loyalty programme membership information and reward point balances;
• Details of accompanying guests, including minors, where applicable.

3b. Payment-Card Information and Security

• Where guests make a reservation, deposit, or other payment online, payment-card information is processed through authorized third-party payment service providers that support Moon Gate Hotel and Spa’s website, booking engine, and payment processing environment.
• Payment-card information is transmitted through secure encrypted connections and is handled in accordance with applicable payment-card security requirements, including the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS establishes requirements for entities that store, process or transmit payment-account data.
• Moon Gate Hotel and Spa does not request that guests send full payment-card details by ordinary email, SMS, WhatsApp, or other unsecured communication channels. Moon Gate does not store full payment-card numbers or card security codes on its public website.
• Moon Gate Hotel and Spa maintains appropriate administrative, technical, and organizational safeguards for the systems and information under its control. We also engage authorized payment service providers that are responsible for maintaining applicable security controls for payment-card data processed, stored, or transmitted through systems under their control. Moon Gate maintains appropriate oversight of its payment service providers and applicable shared security responsibilities.
• Payment-card information may be processed for authorized transaction purposes, including reservation deposits, booking payments, cancellation or no-show charges, pre-authorizations, and other charges permitted under the applicable reservation terms, rate conditions, and Moon Gate policies.

3.c Health, Dietary, and Wellness Data

When you book spa or wellness services or advise us of dietary requirements, we may collect:

• Health conditions or physical limitations relevant to the safe delivery of treatments or services;
• Dietary requirements, allergies, or intolerances;
• Wellness consultation records and treatment preferences.

This information may constitute sensitive personal data and will be processed only where necessary for the provision of the relevant service and where an appropriate legal basis applies, including explicit consent where required by applicable law.

3.d Website and Digital Interaction Data

• Internet Protocol address and device identifiers;
• Browser type, operating system, and referring URLs;
• Pages visited, time spent on pages, and clickstream data;
• Online booking and enquiry form submissions;
• Cookie and tracking data , see Section 12 below

3.e Employee and Contractor Data

In relation to current, former, and prospective employees and contractors, we collect:

• Name, address, contact details, date of birth, and identification documents;
• Employment history, qualifications, references, and right to work documentation;
• Payroll, banking, and tax information;
• Performance records, training records, and disciplinary information;
• Health and safety records, including any workplace injury or medical reports.

Please note that Moon Gate may monitor the use of company-owned devices, email systems, access control systems and other workplace technologies for legitimate business, operational security and compliance purposes, subject to applicable law.

3.f  CCTV and Security Data

We operate closed-circuit television (CCTV) cameras in public areas of the property for the safety and security of guests, employees, and assets. CCTV footage constitutes personal data and is handled in accordance with Section 9 of this Policy.

3.g  Business Partner and Supplier Data

We collect contact details, business registration information, and contractual data relating to individuals at partner organisations, suppliers, and service providers.

4. How We Collect Personal Data

Moon Gate collects personal data through a variety of means, including:

• Directly from you when you make a reservation, complete a registration form, check in or check out, book a spa or wellness service, submit an online inquiry, or correspond with us;
• Through our website, online booking engine, mobile applications, or third-party booking platforms (for example, online travel agencies);
• From your employer or travel agent when a booking is made on your behalf;
• Through CCTV systems and access control systems on the property;
• Through cookies and similar technologies, when you visit our digital platforms;
• From publicly available sources, such as business directories, social media, or government registers, where relevant;
• During the course of providing services, you voluntarily provide information.

5. Legal Basis for Processing Personal Data

Moon Gate processes personal data only where permitted by applicable law. Depending on the circumstances and the law applicable to the particular processing activity, the basis for processing may include consent, the performance of or steps necessary to enter into a contract, compliance with legal obligations, protection of vital interests, and legitimate business interests where such interests are recognised under applicable law and are not overridden by the rights of the individual.

5.a Consent

Where you have given us your explicit consent to process your personal data for a specific purpose, including the processing of sensitive personal data such as health or dietary information for wellness services. You have the right to withdraw consent at any time without prejudice to the lawfulness of processing that occurred prior to withdrawal.

5.b  Performance of a Contract

Where processing is necessary to fulfil the contract of accommodation, spa, dining, or other services you have engaged us to provide, or to take steps at your request prior to entering into a contract.

5.c Compliance with Legal Obligations

Where processing is necessary to comply with legal obligations to which Moon Gate is subject, including obligations under immigration law, anti-money laundering legislation, tax laws, and employment legislation of Antigua and Barbuda.

5.d  Legitimate Interests

Where processing is necessary for the legitimate interests pursued by Moon Gate, provided such interests are not overridden by your fundamental rights and freedoms. Such interests include the security of persons and property, fraud prevention, and the improvement of our services.

5.e  Vital Interests

In an emergency, where processing is necessary to protect your vital interests or those of another individual, such as in a medical emergency during your stay.

6. Purposes for Which We Use Your Personal Data

Moon Gate processes personal data for the following purposes:

6.a  Delivery of Hospitality Services

• Processing and managing reservations, check-ins, and check-outs;
• Providing accommodation, dining, spa, wellness, and related services;
• Fulfilling special requests, dietary requirements, and accessibility needs;
• Managing payments, invoicing, and refunds.

6.b  Guest Relationship Management

• Communicating with you regarding your stay, including pre-arrival information and post-stay follow-up;
• Administering loyalty programmes and personalising your experience;
• Responding to inquiries, complaints, and feedback;
• Sending you marketing communications where you have consented or where permitted by applicable law.

6.c  Security, Safety, and Fraud Prevention

• Operating CCTV and access control systems to protect guests, employees, and property;
• Preventing, detecting, and investigating fraud, theft, and other unlawful activities;
• Verifying guest and visitor identity where required.

6.d  Legal and Regulatory Compliance

• Complying with obligations under the laws of Antigua and Barbuda, including immigration registration requirements for foreign guests, tax reporting, and employment law;
• Assisting law enforcement or regulatory authorities where lawfully required;
• Maintaining records required for audit and compliance purposes.

6.e  Business Operations and Improvement

• Managing and developing our workforce, including recruitment, training, payroll, and performance management;
• Maintaining supplier and partner relationships;
• Analysing service usage and guest feedback to improve our offerings;
• IT systems management, maintenance, and security.

 

7. Disclosure of Personal Data to Third Parties

Moon Gate does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share personal data in the following circumstances.

7.a  Service Providers and Data Processors

We engage carefully selected third-party service providers who process personal data on our behalf and strictly in accordance with our instructions and applicable law. These include:

• Reservation, property-management, central-reservation and online booking service providers;
• Payment gateways, payment processors, acquiring banks and other payment-service providers;
• Spa, wellness and guest-service technology providers;
• Customer relationship management, guest communications and marketing platforms;
• Website hosting, analytics, advertising and cookie-management providers;
• IT infrastructure, cloud hosting, cybersecurity and technology-support providers;
• Accounting, financial, audit and professional-service providers;
• Transportation, excursion and other guest-service providers where necessary to fulfil a guest request.Where a service provider processes personal data on Moon Gate’s behalf, appropriate contractual and confidentiality obligations are implemented as required by applicable law.
• Certain third parties, including financial institutions, payment providers, travel intermediaries or other service providers, may process personal data as independent controllers in accordance with their own legal obligations and privacy notices.

7.b  Legal and Regulatory Disclosure

• We may disclose personal data to government authorities, law enforcement agencies, immigration authorities, or courts when required to do so by the laws of Antigua and Barbuda or pursuant to a lawful court order. In such cases, we will disclose only the minimum information necessary.
• We may also preserve, retain and disclose relevant electronic records, access logs, CCTV footage and other information where reasonably necessary for the investigation of security incidents, suspected electronic crimes, fraud, legal proceedings, regulatory inquiries or the protection of Moon Gate’s legal rights and interests.

7.c  Business Transfers

In the event of a sale, merger, acquisition, or restructuring of Moon Gate or its parent entity, personal data may be transferred to the relevant parties as part of such a transaction, subject to equivalent protections and, where required, your notification.

7.d Your Consent

Where you have provided express consent for a specific disclosure, for example, authorising us to share information with a travel agent or medical provider.

8. International Transfers of Personal Data

Antigua and Barbuda is a destination that receives guests from around the world, and some of Moon Gate’s authorized service providers may operate or process personal data internationally. As a result, personal data may be transferred to, stored in, or accessed from jurisdictions outside Antigua and Barbuda.

Prior to transferring personal data outside Antigua and Barbuda, Moon Gate will take appropriate steps in accordance with the Data Protection Act, 2013 and other applicable data-protection laws to ensure that the transfer is lawful and that appropriate protections are in place. Depending on the circumstances, these measures may include:

• confirming that the recipient jurisdiction provides an adequate level of protection for personal data;
• implementing appropriate contractual, organizational or other safeguards permitted under the Data Protection Act;
• ensuring that the transfer is necessary for the performance of a contract, the provision of services requested by the individual, or another lawful business purpose; or
• relying on another transfer mechanism permitted by applicable law.

Where the GDPR or another applicable international data-protection regime applies to a particular transfer, Moon Gate will implement any additional safeguards required under that regime.

Sensitive personal data will be transferred internationally only where permitted by applicable law and where appropriate safeguards are in place, including obtaining explicit consent where consent is required.

9. Data Security

Moon Gate maintains reasonable and appropriate technical, physical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction. The safeguards used may include, where appropriate to the relevant system and processing activity:

9.a Technical Measures

• Encryption of sensitive data in transit and at rest using industry-standard protocols;
• Firewalls, intrusion detection systems, and regular penetration testing;
• Secure access controls, multi-factor authentication, and role-based access permissions;
• Regular security patches, software updates, and vulnerability assessments;
• Secure backups and disaster recovery procedures.

9.b Physical Measures

• Restricted access to areas where personal data is stored or processed;
• CCTV surveillance of public key areas of the property;
• Secure disposal of physical documents containing personal data through cross-cut shredding or incineration.

9.c Organisational Measures

• Regular staff training and awareness relating to privacy, information security and appropriate handling of personal data;
• Confidentiality obligations for all employees and contractors;
• A designated Privacy Point of Contact responsible for policy compliance and incident response;
• Documented procedures for responding to data subject requests and data breaches.

9.d  Data Breach Response

In the event of an actual or suspected personal data breach, Moon Gate will promptly investigate the incident, take reasonable steps to contain and mitigate the breach. Where required under applicable law and regulatory guidance,, Moon Gate will notify affected individuals and the regulatory authority without undue delay. Moon Gate maintains a data breach register and conduct post-incident reviews to  reduce the risk of recurrence.

9.e  Cybersecurity and Protection against Electronic Crime

Moon Gate maintains reasonable technical and organizational safeguards to protect its systems and personal data against unauthorized access, cyberattacks, malware, phishing, data corruption and other electronic threats. Any unauthorized access to, interference with, misuse of, or attempted compromise of Moon Gate’s systems may constitute an offence under the Electronic Crimes Act, 2013, Laws of Antigua and Barbuda and may be reported to the appropriate law enforcement authorities.

10. Closed-Circuit Television (CCTV)

Moon Gate operates CCTV surveillance systems in public and common areas of the property, including entrances, lobbies, car parks, and pool areas. CCTV is not operated in private areas such as guest rooms, bathrooms, or changing facilities.

CCTV footage is used exclusively for the purposes of:

• The safety and security of guests,  employees and visitors.
• Prevention and detection of crime and unauthorised access;
• Investigation of incidents and complaints.

CCTV footage is retained for a period of ninety (90) days, after which it is automatically overwritten unless required as evidence in connection with an ongoing investigation or legal proceeding. Access to footage is restricted to authorised personnel and, where lawfully requested, to law enforcement or regulatory authorities. Visible signage is displayed throughout the property to inform individuals that CCTV is in operation.

11. Data Retention

Moon Gate retains personal data for no longer than reasonably necessary for the purposes for which it was collected and processed, taking into account the nature of the information, applicable legal, accounting and regulatory requirements, operational requirements, applicable limitation periods, dispute-resolution needs and the establishment, exercise or defence of legal claims.

Different categories of information are therefore subject to different retention periods under Moon Gate’s internal records-retention schedule. Where information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable procedures.

Employee Records	7 years from the date of termination of employment
CCTV Footage	90 days, unless retained for investigation
Marketing Consent Records	Until consent is withdrawn, plus 2 years

 

Notwithstanding the retention periods set out above, Moon Gate may retain personal data for longer periods where reasonably necessary for the establishment, exercise or defence of legal claims, regulatory investigations, audits, insurance matters or dispute resolution proceedings, in each case as permitted by applicable law.

12. Cookies and Online Tracking

Moon Gate website and online booking platforms use cookies and similar tracking technologies to enhance your browsing experience and to collect analytics data. Cookies are small data files placed on your device when you visit our website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the website and booking functionality to operate securely and correctly. These cookies cannot generally be disabled through our cookie-management tool.
• Analytics and Performance Cookies: Help us understand how visitors interact with the website and improve performance and content. Where required by applicable law, these cookies are used only after consent.
• Functionality Cookies: Enable enhanced functionality and allow the website to remember certain preferences.
• Marketing and Targeting Cookies: Used to measure campaigns and, where applicable, deliver or personalise advertising. Where required by applicable law, these cookies are used only after consent.

You may review or change your cookie preferences at any time through the Cookie Settings link or consent-management tool available on our website. You may also manage certain cookies through your browser settings. Disabling some cookies may affect website or booking functionality.

13. Your Rights as a Data Subject

Under the Data Protection Act, No. 10 of 2013 of Antigua and Barbuda, you may have rights concerning how Moon Gate collects and uses your information. Under the laws of Antigua and Barbuda and, where applicable, other data-protection regimes such as the GDPR, these rights may include the following:

13. a   Right of Access

You have the right to request access to the personal data we hold about you, together with information about how it is being processed. Such requests will be responded to within a reasonable period not exceeding thirty (30) days.

13.b   Right to Rectification

You have the right to request that inaccurate or incomplete personal data be corrected or updated. We will take reasonable steps to verify and correct such data promptly.

13.c   Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where it has been unlawfully processed. We may retain data where required by law or for legitimate purposes.

13.d  Right to Be Informed

You have the right to be informed about the purposes for which your personal data is collected and processed. This Policy serves as our primary transparency mechanism. We will notify you of any material changes to our data processing activities.

13.e  Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you believe that your fundamental rights and freedoms override those interests.

13.f  Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To exercise any of the above rights, please contact our point of contact via email at welcome@moongateantigua.com or by post by registered address. We may request sufficient information and documentation to verify your  identity before processing any request relating to your personal data. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee.

Moon Gate may be required or permitted to retain certain information notwithstanding a request for deletion, including information necessary to satisfy legal, tax, accounting, fraud-prevention, security, contractual, dispute-resolution or regulatory obligations.

13.g Right to Restriction of Processing

Where provided by applicable law, you may request that Moon Gate restrict the processing of your personal data in certain circumstances.

13.h Right to Data Portability

Where provided by applicable law, you may request to receive certain personal data you have provided to Moon Gate in a structured, commonly used and machine-readable format, or request that it be transmitted to another organisation where technically feasible.

13.i Automated Decision-Making

Where applicable law provides such a right, you may request information regarding, or object to, certain decisions based solely on automated processing that produce legal or similarly significant effects.

14. Direct Marketing and Communications

With your consent, Moon Gate may contact you with information about our services, special offers, seasonal promotions, and exclusive member benefits. We may communicate with you by email, post, SMS, or telephone.

You may opt out of receiving marketing communications at any time by:

• Clicking the “Unsubscribe” link in any marketing email;
• Contacting us at welcome@moongateantigua.com
• Calling our reservations team at Tel: +1 (268) 562-2625 

We will action marketing opt-out requests as promptly as reasonably practicable and in accordance with applicable law. Because preferences may need to be synchronised across multiple systems, you may receive communications that were already in process at the time your request was received.

15. Third-Party Websites and Platforms

Certain services accessible through or in connection with the Moon Gate website, including reservation, payment or other guest-service functionality, may be provided through technology operated by third-party service providers. Where a third party processes personal data under its own authority, its privacy notice may also apply. We encourage you to review the privacy information presented when interacting with those services.

16. Changes to This Privacy Policy

Moon Gate reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our operations, data processing practices, or applicable laws. Any material changes will be communicated to you by email (where we hold your contact details) and by posting a prominent notice on our website.

The “Last Reviewed” date displayed on this Policy identifies when it was most recently updated. We encourage you to review this Policy periodically. Where a material change requires additional notice or consent under applicable law, Moon Gate will take the appropriate steps before the relevant processing occurs.

17. Complaints and Regulatory Authority

If you have a concern or complaint about how Moon Gate has handled your personal data, we encourage you to contact us in the first instance so that we may address the matter directly:

 

Email: welcome@moongateantigua.com

Registered Address: Half Moon Bay, St. Phillip's, P.O. Box 1275,
St. John's, Antigua & Barbuda

Telephone: (268) 562-2625 

Website: www.moongateantigua.com

We will acknowledge your complaint within five (5) business days and endeavour to provide a substantive response within thirty (30) days. If you remain dissatisfied with our response, you have the right to escalate your complaint to the Information Commissioner of Antigua and Barbuda, which is the independent regulatory authority responsible for enforcing data protection legislation in Antigua and Barbuda.

18. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of Antigua and Barbuda, including the Data Protection Act,2013. No. 10 of 2013, the Electronic Crimes Act, 2013, and all other applicable legislation. Any disputes arising in connection with this Policy or the processing of personal data by Moon Gate shall be subject to the exclusive jurisdiction of the courts of Antigua and Barbuda.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which we process your personal data, please do not hesitate to contact us:

 

Email: welcome@moongateantigua.com

Registered Address: Half Moon Bay, St. Phillip's, P.O. Box 1275,
St. John's, Antigua & Barbuda

Telephone: (268) 562-2625 

Website: www.moongateantigua.com