Privacy

HighTunis operates this website from Mahdia, Tunisia, and decides how the information described below is used. In data protection law that makes us the controller.

TODO_LEGAL_NEEDEDRegistered legal entity name, legal form, and company or tax registration number.

TODO_LEGAL_NEEDEDFull registered address in Mahdia.

TODO_LEGAL_NEEDEDThe email address that should receive privacy and data protection requests. The site currently publishes hello@hightunis.com, concierge@hightunis.com, partners@hightunis.com and press@hightunis.com, and none of them is designated for this.

Only what you type into a form, plus one technical detail described below.

The enquiry form on the contact page collects:

• 01Your name.
• 02Your email address.
• 03A subject line.
• 04Your message.

The booking request form on a property page collects:

• 01Your name.
• 02Your email address.
• 03Your phone number.
• 04Which property you are asking about, and your check-in and check-out dates.
• 05An optional message.

Collected automatically:

• 01Your IP address, held in the server's memory for up to ten minutes so that the same address cannot flood the form. It is never written to our database and is discarded when the window passes.
• 02Both forms contain a hidden field that people cannot see and automated spam tools usually fill in. Anything entered there causes the submission to be rejected. Its contents are never stored.

TODO_LEGAL_NEEDEDHow long our hosting provider retains its own request logs, which include IP addresses. This depends on the Vercel plan in use and needs confirming.

This is worth stating plainly, because most privacy policies describe things this site does not do.

• 01No cookies are set when you browse this site. See the cookie policy.
• 02No analytics of any kind. There is no Google Analytics, no tag manager, no visitor counter and no heatmap.
• 03No advertising, no remarketing, no tracking pixels and no social media tracking.
• 04No profiling and no automated decision making.
• 05No visitor accounts, so no passwords and no login history.
• 06No newsletter list. We do not add you to a mailing list.
• 07No third party receives your browser's requests. Images and fonts are served from this domain, so external services are not contacted while you browse.

• 01To answer your enquiry or booking request. Taking steps at your request before entering into a contract, Article 6(1)(b) of the GDPR.
• 02To contact you about it. Your consent, Article 6(1)(a), given by ticking the box on the form. You can withdraw it at any time, which does not affect anything done before you withdrew it.
• 03To stop the forms being abused. Our legitimate interest in keeping the site working, Article 6(1)(f). This is the short-lived IP check described above.

Your enquiry is stored in a Supabase database. It is read through a password-protected administration panel on this site. Enquiries are not forwarded to a mailing service, a CRM, or any other third party.

These are the only processors involved:

• 01Supabase, which hosts the database and the image storage.
• 02Vercel, which hosts and serves the website. The deployment region is US East, so pages are served from the United States.

TODO_LEGAL_NEEDEDThe region your Supabase project is hosted in. Visible in the Supabase dashboard under project settings. It determines which country the enquiries physically sit in.

TODO_LEGAL_NEEDEDWhether data processing agreements are in place with Supabase and Vercel, and which transfer mechanism covers them.

We are based in Tunisia, and the website is served from the United States. If you are in the European Economic Area, that means your information leaves it. Tunisia has not been found by the European Commission to provide an equivalent level of protection, so a safeguard such as standard contractual clauses is required.

TODO_LEGAL_NEEDEDConfirmation from a lawyer of which transfer mechanism applies and what has been signed. This is the single most likely point of GDPR exposure for this site.

TODO_LEGAL_NEEDEDA retention period for enquiries. Nothing currently deletes them, so today they are kept indefinitely, which is not a defensible position. A common approach is to keep booking enquiries for the length of any contractual or tax obligation and delete unsuccessful enquiries after a fixed period such as twelve or twenty-four months.

If the GDPR applies to you, you can ask us to give you a copy of your information, correct it, delete it, restrict what we do with it, or send it to someone else. You can object to us using it, and you can withdraw consent at any time.

You can also complain to a supervisory authority: in the European Economic Area, the one for the country you live in, and in Tunisia, the Instance Nationale de Protection des Données Personnelles.

TODO_LEGAL_NEEDEDThe address to send these requests to, and who is responsible for answering them within the one month the GDPR allows.

These are measures actually in place, not aspirations:

• 01The site is served only over HTTPS, and browsers are instructed to refuse an unencrypted connection.
• 02Your browser never talks to the database. Form submissions go to this site's own server, which writes them.
• 03The database key published in the browser has no permission to read enquiries at all. Enquiries are readable only by the server.
• 04The administration panel is password protected, with a signed session that expires after eight hours.
• 05A content security policy restricts what the pages are allowed to load.

This site is aimed at adults booking travel and is not directed at children. We do not knowingly collect information from anyone under 16.

If this policy changes we will update the date at the top. The current version is dated 20 September 2026.

Questions about anything here can go to our contact page.