Privacy

HighTunis operates this website from Mahdia, Tunisia, and decides how the information described below is used. In data protection law that makes us the controller.

TODO_LEGAL_NEEDEDRegistered legal entity name, legal form, and company or tax registration number.

TODO_LEGAL_NEEDEDFull registered address and postcode in Mahdia.

TODO_LEGAL_NEEDEDThe email address that should receive privacy and data protection requests. The site currently publishes hello@hightunis.com, concierge@hightunis.com, partners@hightunis.com and press@hightunis.com, and none of them is designated for this.

Only what you type into a form, plus one technical detail described below.

The enquiry form on the contact page collects:

• 01Your name.
• 02Your email address.
• 03A subject line.
• 04Your message.

The booking request form on a property page collects:

• 01Your name.
• 02Your email address.
• 03Your phone number.
• 04Which property you are asking about, and your check-in and check-out dates.
• 05An optional message.

Collected automatically:

• 01Your IP address, held in the server's memory for up to ten minutes so that the same address cannot flood the form. It is never written to our database and is discarded when the window passes.
• 02Both forms contain a hidden field that people cannot see and automated spam tools usually fill in. Anything entered there causes the submission to be rejected. Its contents are never stored.

TODO_LEGAL_NEEDEDHow long our hosting provider retains its own request logs, which include IP addresses. This depends on the Vercel plan in use and needs confirming.

This is worth stating plainly, because most privacy policies describe things this site does not do.

• 01No cookies are set when you browse this site. See the cookie policy.
• 02No advertising, no remarketing, no tracking pixels and no social media tracking.
• 03No profiling and no automated decision making.
• 04No visitor accounts, so no passwords and no login history.
• 05No newsletter list. We do not add you to a mailing list.
• 06Your browser contacts no other company's servers. Images and fonts are served from this domain, and the audience measurement described below is collected through this domain too.

We use Vercel Web Analytics, run by Vercel, who also host this site. It counts page views so we can see which pages are read. It does not use cookies, and it stores nothing on your device: no cookie, no local storage, no identifier of any kind.

It does not know who you are. Instead of an identifier that follows you, it derives a value from your request, and that value is discarded after 24 hours. It cannot be used to recognise you tomorrow, and it cannot follow you to any other website.

According to Vercel, each page view records:

• 01The time, the page address, and the page template that address matched.
• 02The address of the page that linked you here, if there was one, and campaign tags in the link.
• 03Your approximate location: country, region and city. Never a street address.
• 04Your device type, operating system and browser, each with a version number.

Your IP address is not stored, and no data point is tied to one. Nothing here identifies you, and none of it is combined with an enquiry you send. The admin area is excluded entirely: the measurement script is never loaded there.

TODO_LEGAL_NEEDEDLegal review of whether this needs consent. Our reading: it stores nothing on your device, which is what the ePrivacy rules on cookies and similar technologies attach to, so a banner should not be required, and Vercel states it is designed for that. This is a defensible reading rather than a settled one: regulators in different countries treat cookieless measurement differently, and a value derived from a request is still personal data under GDPR even when it is short-lived. Confirm before relying on it, and record which lawful basis is claimed for the processing.

Vercel is the processor for this data. See the section on who else can see your information for what that means.

• 01To answer your enquiry or booking request. Taking steps at your request before entering into a contract, Article 6(1)(b) of the GDPR.
• 02To contact you about it. Your consent, Article 6(1)(a), given by ticking the box on the form. You can withdraw it at any time, which does not affect anything done before you withdrew it.
• 03To stop the forms being abused. Our legitimate interest in keeping the site working, Article 6(1)(f). This is the short-lived IP check described above.

Your enquiry is stored in a Supabase database and read through a password-protected administration panel on this site. It is not forwarded to a mailing service, a CRM, an advertiser or a data broker.

It is sent to the property when you book. We arrange stays on your behalf rather than supplying them ourselves, so making a booking means giving the property what it needs to hold the reservation: normally your name, the dates, the number of guests and a contact detail. That happens when a booking is being made, not when you first enquire, and we send what the booking requires rather than your whole enquiry.

The property decides for itself what it then does with those details, which makes it a separate controller rather than someone acting on our instructions. Its own privacy notice governs what it holds. Most of the properties we work with are in Tunisia, so this is also a transfer outside the European Economic Area; see below.

TODO_LEGAL_NEEDEDWhat is actually sent to a property, field by field, and by what route. Also whether any written terms bind properties on what they may do with a guest's details, and whether an EEA guest's data reaching a Tunisian property is covered by standard contractual clauses or relies on the contract-performance derogation in Article 49(1)(b).

These are the processors acting on our instructions:

• 01Supabase, which hosts the database and the image storage.
• 02Vercel, which hosts and serves the website. The deployment region is US East, so pages are served from the United States.

TODO_LEGAL_NEEDEDThe region your Supabase project is hosted in. Visible in the Supabase dashboard under project settings. It determines which country the enquiries physically sit in.

TODO_LEGAL_NEEDEDWhether data processing agreements are in place with Supabase and Vercel, and which transfer mechanism covers them.

We are based in Tunisia, and the website is served from the United States. If you are in the European Economic Area, that means your information leaves it. Tunisia has not been found by the European Commission to provide an equivalent level of protection, so a safeguard such as standard contractual clauses is required.

Booking adds a second route out. When we place a booking for you, the details the property needs go to that property, and the properties are in Tunisia. That is a separate transfer from the hosting described above, to a recipient that decides things for itself rather than acting on our instructions, and it needs its own answer.

TODO_LEGAL_NEEDEDConfirmation from a lawyer of which transfer mechanism applies and what has been signed. This is the single most likely point of GDPR exposure for this site.

TODO_LEGAL_NEEDEDA retention period for enquiries. Nothing currently deletes them, so today they are kept indefinitely, which is not a defensible position. A common approach is to keep booking enquiries for the length of any contractual or tax obligation and delete unsuccessful enquiries after a fixed period such as twelve or twenty-four months.

If the GDPR applies to you, you can ask us to give you a copy of your information, correct it, delete it, restrict what we do with it, or send it to someone else. You can object to us using it, and you can withdraw consent at any time.

You can also complain to a supervisory authority: in the European Economic Area, the one for the country you live in, and in Tunisia, the Instance Nationale de Protection des Données Personnelles.

TODO_LEGAL_NEEDEDThe address to send these requests to, and who is responsible for answering them within the one month the GDPR allows.

These are measures actually in place, not aspirations:

• 01The site is served only over HTTPS, and browsers are instructed to refuse an unencrypted connection.
• 02Your browser never talks to the database. Form submissions go to this site's own server, which writes them.
• 03The database key published in the browser has no permission to read enquiries at all. Enquiries are readable only by the server.
• 04The administration panel is password protected, with a signed session that expires after eight hours.
• 05A content security policy restricts what the pages are allowed to load.

This site is aimed at adults booking travel and is not directed at children. We do not knowingly collect information from anyone under 16.

If this policy changes we will update the date at the top. The current version is dated 20 September 2026.

Questions about anything here can go to our contact page.