Privacy Policy

1. Scope & Data Controller

This Privacy Policy describes how Cleo Hospitality Ltd. ("Cleo Hospitality", "we", "us", or "our"), an experiential hospitality company established in Accra, Ghana, collects, uses, protects, and discloses personal information obtained through our website (cleohospitality.com), our VIP Concierge communication channels, and our venue reservation platforms (including ARIA Lounge).

We process personal data in strict adherence with the Ghana Data Protection Act, 2012 (Act 843) and international privacy standards, including the General Data Protection Regulation (GDPR) for our international clientele.

2. Personal Information We Collect

We only collect personal information that you voluntarily provide to us when submitting inquiries, reserving tables, or proposing corporate partnerships:

• Concierge & Experience Inquiries: Full name, email address, direct phone/WhatsApp number, requested experience date/timeline, city/country location, and personal preferences or culinary visions.
• ARIA Lounge Table Reservations: Guest name, contact email, phone/WhatsApp number, desired booking date, party size, and bespoke table/seating requirements.
• Corporate Brand Collaborations: Executive contact name and title, company/brand entity, corporate email address, contact phone/WhatsApp number, partnership category, and project scope.
• Technical & Usage Data: Standard server access telemetry including anonymized IP address, browser type, and operating system collected automatically by our edge hosting network (Cloudflare) to ensure platform security.

3. How We Use Your Information

Cleo Hospitality processes your personal information for the following legitimate purposes:

• Service Fulfillment: Responding to bespoke concierge inquiries, preparing customized culinary/event proposals, and processing table reservations at ARIA Lounge.
• Guest Communication: Sending automated email booking confirmations and facilitating instant, one-touch verification via WhatsApp Concierge.
• Corporate Partnership Curation: Evaluating sponsorship, brand activation, and venue hosting proposals.
• Platform Security & Compliance: Protecting our website against automated spam, denial-of-service attempts, and malicious activity.

4. Legal Basis for Processing

We process your data under the following lawful bases:

• Consent: You provide explicit consent by ticking the privacy agreement box before submitting any form on our website.
• Contractual Necessity: Processing is necessary to take steps at your request prior to entering into a hospitality or event contract (e.g. confirming a table reservation or executing an experiential activation).
• Legitimate Interests: Managing client inquiries, enhancing our luxury hospitality offerings, and securing our digital infrastructure.

5. Data Storage, Security & Processors

Your personal information is never sold, rented, or traded to third parties for commercial advertising. We transmit and store your data using enterprise-grade security protocols:

• Cloudflare Pages & Workers: Our edge network enforces TLS 1.3 encryption in transit, strict Content-Security-Policies, and DDoS mitigation.
• Google Workspace & Apps Script CRM: Inquiries and reservation records are managed within an encrypted, access-restricted Google Sheets CRM accessible solely by authorized Cleo Hospitality management.
• WhatsApp / Meta: When you initiate direct communication with our VIP Concierge via WhatsApp, messages are end-to-end encrypted according to WhatsApp's security standards.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected—specifically to manage ongoing bookings, maintain our relationship with VIP patrons, or comply with Ghanaian legal, tax, and accounting obligations. You may request deletion of your information at any time.

7. Your Rights

Under the Ghana Data Protection Act (Act 843) and international privacy frameworks, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of any inaccurate or incomplete information.
• Erasure: Request the deletion of your personal records from our CRM.
• Withdraw Consent: Revoke your consent for future communications at any time.

To exercise any of these rights, please contact our data governance team at [email protected].

8. Cookies & Analytics

Our website uses strictly essential operational cookies required for page performance, form submission state management, and edge security. We do not use third-party tracking pixels or behavioral advertising cookies.

9. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy, please contact: