Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

Nova Atlantis
Ponta Malongane
1118 / Matutuine
Maputo Province
Mozambique

2. General information on data processing

Protecting your personal data is important to us. We process personal data only where necessary to operate this website, communicate with you, handle enquiries and manage reservations and related services, or where appropriate consent has been given.

Personal data is information through which a natural person can be identified directly or indirectly. This may include, in particular, name, contact details, IP address and information submitted as part of an enquiry or reservation. Where the European Union General Data Protection Regulation (GDPR) applies to the processing concerned, processing is carried out on the basis of the relevant GDPR provisions.

3. Hosting

This website is hosted by IONOS.

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When you access the website, technically necessary information is processed so that the website can be delivered and its security and stability maintained. This may include the website or file accessed, date and time of access, browser type and version, operating system, device type, referrer URL and IP address or information about the origin of access.

Where the GDPR applies, data required for the secure and stable operation of the website is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, reliably and without technical faults. As part of its web-hosting services, IONOS processes data to provide and secure the website. Where IONOS processes personal data on our behalf, this is done under the applicable data-processing agreements.

4. SSL/TLS encryption

This website uses SSL/TLS encryption to protect the transmission of confidential content. An encrypted connection can be recognised, in particular, by the website address beginning with “https://”. Encryption is intended to protect data you transmit to us from unauthorised third-party access during transmission.

5. Contact

If you contact us by email or through the contact form, we process the data you provide in order to handle your enquiry and any necessary further communication. This may include your name, email address, telephone number if provided, the content of your message and other information you submit voluntarily.

Where the GDPR applies, the legal basis depends on the nature of your enquiry. If the contact relates to entering into or performing a contract or reservation, processing is based on Art. 6(1)(b) GDPR. Other enquiries may be processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is the proper handling and response to your enquiry. Data is retained only for as long as necessary to deal with the enquiry and any resulting legal or contractual obligations.

6. Reservations and Vik Booking PRO

We use Vik Booking PRO on this WordPress website to manage room availability, reservation enquiries and bookings.

As part of a reservation, we process the personal data required to handle and complete the booking. Depending on the configuration of the booking form, this may include first and last name, email address, telephone number, address and country of residence, arrival and departure dates, number and composition of travellers, selected accommodation and booking details, special requests or voluntary information, billing details where applicable and other information required for the reservation.

This data is processed to handle your reservation, communicate with you about your stay and perform the accommodation contract. Where the GDPR applies, processing is generally based on Art. 6(1)(b) GDPR where necessary for pre-contractual measures or performance of the accommodation contract. Where data must be retained due to legal obligations, processing within the scope of the GDPR is based on Art. 6(1)(c) GDPR in conjunction with the applicable legal obligation.

7. Cookies and consent management

Technically necessary cookies may be used to operate this website. Other cookies or comparable technologies are used only after the required consent has been given, where legally required. Consent can be managed through the website’s cookie settings and withdrawn for the future. Depending on its configuration, Vik Booking PRO may use technically necessary cookies.

8. Locally hosted fonts

The web fonts used on this website are hosted locally on the website server. No connection to servers of external font providers such as Google Fonts is therefore made to provide these fonts when the website is accessed. Your IP address is not transmitted to Google solely for the purpose of loading the fonts used.

9. Google Maps

Google Maps is intended to be integrated into the website. Google Maps will initially be blocked and loaded only after the user has given consent. The final Privacy Policy and consent configuration must be adapted to the actual technical implementation.

10. Social Media

Instagram and Facebook are currently planned as Nova Atlantis social-media channels; YouTube is not planned. Under the current project setup, social-media profiles are to be accessed only through external links. No social-media feeds, posts or videos are embedded directly in the website. Simply visiting the Nova Atlantis website therefore does not establish a connection to Instagram or Facebook through these links. Only when you actively follow an external link do you leave our website; the respective platform provider is responsible for subsequent data processing.

11. WhatsApp and Other Communication Services

12. Retention period

Personal data is generally retained only for as long as necessary for the relevant processing purpose. Data may be retained for longer where statutory retention periods, tax or commercial obligations, hotel registration requirements or the establishment or defence of legal claims require it. Once the purpose no longer applies and relevant retention periods have expired, the data is deleted or, where necessary, blocked or restricted in its processing.

13. Recipients of personal data

Personal data is generally disclosed only to recipients where necessary to provide the website, handle an enquiry, process a reservation, comply with legal obligations or provide agreed services. These currently include, in particular, hosting and IT service providers. Depending on the final configuration, additional payment, communication or other service providers may be involved.

14. Data processing in Mozambique and third-country transfers

Nova Atlantis is located in Mozambique. Personal data may therefore be processed in Mozambique in connection with enquiries, reservations and communication with guests.

Where personal data is transferred from the European Economic Area to Mozambique and the GDPR applies to the processing concerned, the applicable data-protection requirements are observed. According to EDPB Guidelines 05/2021, the direct entry of personal data by a person in the EU or EEA into a contact or booking form operated by Nova Atlantis in Mozambique does not, solely because Nova Atlantis is established in Mozambique, constitute a third-country transfer within the meaning of Chapter V GDPR. Independently of this, the GDPR may apply to processing by Nova Atlantis under Art. 3(2) GDPR where goods or services are specifically offered to persons in the Union.

If Nova Atlantis subsequently discloses personal data to an independent processor or another recipient in a third country, this may constitute a third-country transfer within the meaning of Chapter V GDPR. In that case, the applicable requirements of Arts. 44 et seq. GDPR must be assessed and appropriate safeguards provided where necessary. According to the European Commission’s current list, Mozambique is not covered by an adequacy decision under Art. 45 GDPR.

15. Rights of data subjects

Where the GDPR applies to the processing of your personal data, you have, subject to the statutory requirements, rights including access, rectification, erasure, restriction of processing, data portability, objection to certain processing and withdrawal of consent with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights: enjoy@nova-atlantis.com

16. Objection to processing based on legitimate interests

Where personal data is processed on the basis of Art. 6(1)(f) GDPR and the GDPR applies, you have the right, subject to the statutory requirements, to object to such processing on grounds relating to your particular situation.

17. Right to lodge a complaint and EU representative

Where the GDPR applies, data subjects have the right, subject to statutory requirements, to lodge a complaint with a competent data-protection supervisory authority regarding the processing of their personal data. Under Art. 77 GDPR, a complaint may in particular be lodged in the EU/EEA Member State of habitual residence, place of work or place of the alleged infringement.

EU representative under Art. 27 GDPR: Under the currently intended business model, Art. 3(2) GDPR is expected to apply to the processing of personal data of guests in the EU where Nova Atlantis specifically offers its accommodation to persons in the EU. If Nova Atlantis has no establishment in the EU, a representative in the Union should therefore be appointed in writing under Art. 27 GDPR before launch. The representative must be established in a Member State where affected persons to whom the services are offered are located; the representative’s name and contact details must then be added to this Privacy Policy.

18. Updates and changes to this Privacy Policy

This Privacy Policy will be updated where changes to the website, the services used or legal requirements make this necessary.

Last updated: September 2026