Privacy Policy

Effective: July 2026
Organisation: Graeme Hall Nature Sanctuary (Sanctuary Recreation Ltd.)
Document: GHNS-PRIV-2026

This Privacy Policy explains how Sanctuary Recreation Ltd. collects, uses, stores, and protects personal information in connection with Graeme Hall Nature Sanctuary.

1. Introduction

Sanctuary Recreation Ltd. (operating as Graeme Hall Nature Sanctuary) is committed to protecting the privacy and personal data of every visitor, customer, enquirer, and third party who interacts with our organisation. This Privacy Policy sets out, in plain and legally precise terms, how we collect, use, store, share, and protect personal information in connection with the operation of Graeme Hall Nature Sanctuary located at Graeme Hall, Christ Church, Barbados.

Graeme Hall Nature Sanctuary holds the distinction of being Barbados’ only RAMSAR-listed wetland, designated under the Ramsar Convention on Wetlands of International Importance. As custodians of this irreplaceable natural habitat, we are equally committed to preserving the trust of every individual who chooses to visit, book, or engage with us. We believe that respect for privacy is inseparable from respect for the natural environment we protect.

This Policy applies to all personal data processed by Sanctuary Recreation Ltd. in the course of operating the Sanctuary, including data collected through our website, online booking system, email and telephone communications, and in-person interactions at the attraction. It should be read alongside our Cookie Policy, which provides further detail on our use of cookies and tracking technologies.

By visiting our premises, using our website, or submitting any personal information to us, you acknowledge that you have read and understood this Privacy Policy. Where processing is based on your consent, you further acknowledge that you have provided that consent freely and with full information as described herein.

If you have any questions about this Privacy Policy or how we handle your personal information, please refer to Section 15 (Contact Us) for details of how to reach our team.

2. Data Controller

For the purposes of the Barbados Data Protection Act 2019 (“the Act”) and, where applicable, the European Union General Data Protection Regulation (2016/679) (“GDPR”) and the United Kingdom General Data Protection Regulation (“UK GDPR”), the data controller in respect of all personal data collected and processed in connection with Graeme Hall Nature Sanctuary is:

Sanctuary Recreation Ltd.
Worthing Main Road, Christ Church
Barbados, West Indies
Email: info@graemehall.com
Website: www.graemehall.com

As data controller, Sanctuary Recreation Ltd. determines the purposes for which, and the means by which, personal data is processed. Where we engage third-party processors to handle data on our behalf, we do so pursuant to written data processing agreements that impose obligations consistent with those set out in the Barbados Data Protection Act 2019 and, where relevant, with the GDPR or UK GDPR.

Sanctuary Recreation Ltd. is a company incorporated and operating under the laws of Barbados. All data protection enquiries, subject access requests, and complaints regarding our processing activities should be directed to us using the contact details provided in Section 15 of this Policy.

3. What Personal Data We Collect

We collect and process a range of personal data, depending on the nature of your interaction with Sanctuary Recreation Ltd. and Graeme Hall Nature Sanctuary. The categories of personal data we may collect include the following:

3.1 Identity and Contact Data

Full name (first name and surname) of the lead booker and, where provided, of accompanying guests;
Email address;
Telephone number (mobile and/or landline);
Billing address, including street address, city/parish, country, and postal code;
Any other contact or identity information voluntarily provided in the course of enquiries or communications with us.

3.2 Booking and Transaction Data

Ticket type(s) purchased (e.g. adult admission, child admission, guided tour, event ticket);
Visit date(s) and time slot(s) selected;
Number and composition of the visiting party;
Special requirements or accessibility needs disclosed at the time of booking;
Booking reference and order confirmation numbers;
Transaction amounts and currency;
Refund and amendment history, where applicable.

3.3 Payment Card Data

We accept payment by credit and debit card. Payment card transactions are processed exclusively through our authorised payment processor. In relation to payment card data:

We retain only the last four (4) digits of your payment card number and the card type (e.g. Visa, Mastercard) for the purpose of reconciliation and your own reference;
Full card numbers, card verification values (CVV/CVC), PINs, and other sensitive authentication data are never stored on our systems;
All full card data is captured, transmitted, and stored solely by our authorised payment processor, in accordance with PCI DSS standards. Please see Section 7 for further detail.

3.4 Technical and Usage Data

Internet Protocol (IP) address from which you access our website;
Browser type and version;
Operating system and device type;
Pages visited on our website, duration of visit, and referring URL;
Date and time of access;
Cookie identifiers and analytics data generated during your use of our website (see Section 8).

3.5 CCTV and Premises Data

3.6 Marketing and Communications Data

3.7 Correspondence Data

We do not knowingly collect any special category data (as defined in the Barbados Data Protection Act 2019 and the GDPR), such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, or biometric data, in the ordinary course of our operations. If you voluntarily disclose such data to us (for example, in relation to an accessibility requirement), we will treat it with particular care and process it only to the extent strictly necessary.

4. How We Collect Your Data

We collect personal data through a variety of channels and means, as follows:

4.1 Website Forms and Online Booking

When you visit our website at www.graemehall.com and complete an online booking, purchase tickets, or submit an enquiry form, we collect the personal data you enter directly into the relevant fields. This includes contact details, booking preferences, and payment information. Our online booking and checkout process uses secure encryption (SSL/TLS) to protect data in transit.

4.2 Email and Telephone Enquiries

When you contact us by email or telephone to make an enquiry, reservation, or complaint, we collect the personal data you choose to share with us in the course of that communication, including your name, contact details, and the content of your correspondence. We retain records of communications in order to respond to your enquiry and to maintain an accurate record of our interactions.

4.3 In-Person at the Sanctuary

When you visit Graeme Hall Nature Sanctuary in person, you may provide personal data at the point of sale (for example, when purchasing admission tickets at the gate), when making enquiries of our staff, or when completing paper forms or signing waivers. Our staff may record relevant details, including your name and the composition of your visiting party, in our booking or visitor management system. We also collect information about your experience in our exit survey. Your information is never shared with a third-party.

4.4 Automated Technologies (Cookies and Analytics)

When you browse our website, we may collect technical and usage data automatically through the use of cookies, web beacons, and similar tracking technologies. This data helps us understand how our website is used and to improve user experience. Please see Section 8 for a full explanation of our use of cookies and your rights in relation to them.

4.5 Third-Party Sources

We may, on occasion, receive personal data about you from third parties, for example, where a booking is made on your behalf by a group organiser or travel agent, or where a third-party ticketing platform processes a booking and passes your details to us for fulfilment purposes. In such cases, we will use the data only for the purposes described in this Policy and will treat it with the same level of care as data we collect directly.

5. Legal Basis for Processing

Sanctuary Recreation Ltd. processes personal data only where it has a lawful basis for doing so. In accordance with the Barbados Data Protection Act 2019 and, where applicable, the GDPR and UK GDPR, our processing activities are grounded in one or more of the following legal bases:

Legal Basis	Description and Applicable Processing Activities
Performance of a Contract	Where processing is necessary to enter into or perform a contract with you, principally, the processing required to accept, confirm, administer, and fulfil your booking for admission or other services at Graeme Hall Nature Sanctuary, and to handle any related payment, refund, or amendment.
Legitimate Interests	Where processing is necessary for the purposes of legitimate interests pursued by Sanctuary Recreation Ltd., provided that those interests are not overridden by your interests or fundamental rights and freedoms. Applicable activities include: operating CCTV for the security of visitors, staff, wildlife, and property; maintaining records of transactions for financial management and dispute resolution; analysing website usage to improve our digital services; and communicating with you in relation to your booking or enquiry.
Compliance with a Legal Obligation	Where processing is required to comply with a legal obligation applicable to Sanctuary Recreation Ltd. under Barbadian law or the law of another applicable jurisdiction for example, retention of financial and accounting records, co-operation with law enforcement authorities, and compliance with tax obligations.
Consent	Where you have freely, specifically, and informedly provided your consent to a particular processing activity. Consent is the legal basis for: the use of non-essential cookies and analytics technologies on our website; and the sending of marketing communications by email. Where we rely on consent, you have the right to withdraw it at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal. See Section 12 for details on how to exercise this right.

Where any processing activity described in this Policy relies upon the legitimate interests ground, Sanctuary Recreation Ltd. has considered its interests against the privacy interests and fundamental rights of data subjects and has determined, on a case-by-case basis, that such processing is proportionate and appropriate. Individuals may object to legitimate-interests processing; see Section 12.

All processing carried out by Sanctuary Recreation Ltd. is conducted in accordance with the principles of the Barbados Data Protection Act 2019, including the requirements of lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

6. How We Use Your Personal Data

We use personal data collected about you for the following specific purposes:

6.1 Processing Bookings and Payments

We use your identity and contact data, booking details, and payment information to process your ticket purchase or reservation, collect payment, issue receipts, and manage any amendments, cancellations, or refunds. This processing is necessary for the performance of the contract between you and Sanctuary Recreation Ltd.

6.2 Booking Confirmations and Operational Communications

We use your contact information to send you booking confirmations, entry vouchers, visit reminders, and other communications that are directly necessary to administer your visit. These communications are transactional in nature and do not require your consent, as they are required for the fulfilment of your booking.

6.3 Responding to Enquiries and Complaints

We use the contact and correspondence data you provide to respond to any enquiry, request, or complaint you submit to us, whether by email, telephone, or in person. We retain a record of our correspondence to ensure continuity of service and to maintain accurate records of our interactions.

6.4 Compliance with Legal Obligations

We may be required to process and retain certain personal data in order to comply with our legal obligations under Barbadian law and the laws of other applicable jurisdictions, including obligations relating to taxation, accounting, anti-money laundering, and co-operation with regulatory or law enforcement authorities.

6.5 Website Improvement and Analytics

We use technical and usage data collected through analytics cookies and similar technologies to understand how visitors use our website, to identify areas for improvement, to monitor website performance, and to inform our digital marketing strategy. This processing is based on your consent (where analytics cookies are used) or on our legitimate interests in improving our digital services.

6.6 Marketing Communications

Where you have provided your express consent, we may use your name and email address to send you newsletters, promotional offers, and updates about events and activities at Graeme Hall Nature Sanctuary. We will not send you marketing communications without your prior consent. You may withdraw your consent to receive marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us directly using the details in Section 15.

6.7 Security and Premises Management

We use CCTV footage to monitor and protect the security of our premises, visitors, staff, and wildlife, and to investigate incidents or suspected criminal activity. This processing is based on our legitimate interests in maintaining a safe and secure environment.

6.8 Aggregated and Anonymised Analysis

We may use anonymised and aggregated data (which cannot be used to identify any individual) for internal statistical analysis, reporting, and business planning purposes. Such data is not subject to this Privacy Policy as it does not constitute personal data.

7. Payment Data and PCI DSS Compliance

Sanctuary Recreation Ltd. takes the security of your payment information with the utmost seriousness. The following provisions apply to the processing of payment card data:

7.1 Authorised Payment Processor

All payment card transactions conducted through our online booking platform and, where applicable, at our in-person point of sale are processed by our authorised payment processor and/or through an authorised payment gateway (including, as applicable, RBC Royal Bank and/or other certified payment service providers). These processors operate under separate privacy policies and are independently responsible for their own data protection practices in relation to the full card data they handle.

7.2 Data We Do Not Store

Sanctuary Recreation Ltd. does not store, log, or retain:

Full payment card numbers (Primary Account Numbers / PANs);
Card Verification Values (CVV/CVC2 codes);
Personal Identification Numbers (PINs);
Magnetic stripe data or chip data;
Any other sensitive authentication data.

The only card-related data we retain is the last four (4) digits of your card number (for the purpose of reconciliation and enabling you to identify the card used) and the card scheme/type (e.g. Visa, Mastercard, American Express).

7.3 PCI DSS Compliance

Our payment processing arrangements are designed to comply with the Payment Card Industry Data Security Standard (PCI DSS). By routing full card data exclusively through our certified payment processor and gateway and by ensuring that such data does not pass through or reside on our own servers, we minimise the scope of our PCI DSS obligations and reduce the risk of card data exposure. We regularly review our payment processing arrangements to ensure ongoing compliance with applicable security standards.

7.4 Disputes and Chargebacks

In the event of a payment dispute, chargeback, or fraud investigation, we may be required to share booking and transaction data (but not full card data, which we do not hold) with our payment processor, the relevant card scheme, or our financial institution, in accordance with our legal and contractual obligations.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience and to help us understand how the site is used. A cookie is a small text file placed on your device when you visit a website. Cookies do not contain executable code and cannot access other data on your device.

8.1 Types of Cookies We Use

Cookie Type	Purpose	Legal Basis
Strictly Necessary Cookies	Essential for the operation of our website and booking system, including session management, maintaining your shopping basket, and enabling secure checkout. These cookies cannot be disabled without impairing the functionality of the site.	Legitimate Interests / Contract Performance (no consent required)
Analytics Cookies	Collect aggregated, anonymised data about how visitors use our website — including pages visited, duration of visit, and navigation paths — to help us improve the site. We use Google Analytics or a comparable analytics platform for this purpose.	Consent
Functional Cookies	Remember your preferences (such as language settings or previously entered information) to provide a more personalised experience on return visits.	Consent
Marketing / Targeting Cookies	Used, where applicable, to deliver relevant advertising and to track the effectiveness of marketing campaigns. We use these cookies only with your consent.	Consent

8.2 Cookie Consent Banner

On your first visit to our website, you will be presented with a cookie consent banner that explains the categories of cookies we use and invites you to accept or decline each category. Strictly necessary cookies are applied automatically. Analytics, functional, and marketing cookies are only placed where you have given your explicit consent via the banner. Your preferences are stored and can be updated at any time by accessing the cookie settings link in the website footer.

8.3 Opting Out of Analytics

If you have consented to analytics cookies, you may withdraw that consent at any time through the cookie settings on our website. Additionally, you may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. Opting out of analytics cookies does not affect your ability to use our website or to make a booking.

8.4 Third-Party Cookies

Some cookies may be placed by third-party services embedded in our website (such as analytics platforms or payment gateways). These third parties have their own privacy and cookie policies, and we encourage you to review those policies as appropriate. We do not control the cookies placed by third parties and are not responsible for the data collected by them.

8.5 Further Information

For full details of the individual cookies used on our website, including their names, duration, and data collected, please refer to our separate Cookie Policy, which is available on our website. You may also obtain general information about cookies from www.allaboutcookies.org.

9. Sharing Your Personal Data

Sanctuary Recreation Ltd. does not sell, rent, or trade your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

9.1 Payment Processor and Banking Partners

We share booking and transaction data (excluding full card data, which we do not hold) with our authorised payment processor and, where applicable, our banking partner (including RBC Royal Bank), for the purpose of processing and settling payments, managing refunds, and investigating payment disputes. Our payment processor operates as a data processor acting on our instructions pursuant to a written data processing agreement.

9.2 Email Service Provider

We use a third-party email service provider to send transactional emails (such as booking confirmations and correspondence) and, where applicable, marketing emails to those who have consented. Your name and email address are shared with this provider solely for the purpose of delivering such communications. Our email service provider is not permitted to use your data for any other purpose.

9.3 Online Booking and Ticketing Platform

Where our ticketing and reservation system is operated by a third-party platform provider, that provider may receive and process personal data as part of the booking fulfilment process. Such providers act as data processors and are bound by appropriate contractual data protection terms.

9.4 Government Authorities, Regulators, and Law Enforcement

We may disclose personal data to government authorities, regulatory bodies, or law enforcement agencies where we are required to do so by applicable law, lawful order, court order, or binding demand from a competent authority. We will, to the extent permitted by law, endeavour to notify you of any such disclosure. We may also share personal data where necessary to protect the legal rights, property, or safety of Sanctuary Recreation Ltd., our employees, our visitors, or others.

9.5 Professional Advisers

We may share limited personal data with our legal advisers, auditors, accountants, and insurers where strictly necessary in connection with the provision of professional services to Sanctuary Recreation Ltd. Such parties are bound by professional duties of confidentiality and, where applicable, by data processing agreements.

9.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a substantial part of the assets of Sanctuary Recreation Ltd., personal data held by us may be transferred to the relevant third party as part of that transaction. In such circumstances, we will endeavour to ensure that the receiving party undertakes to process your data in accordance with standards consistent with this Privacy Policy and with applicable data protection law.

In all cases of third-party sharing, Sanctuary Recreation Ltd. takes reasonable steps to ensure that the recipient provides adequate safeguards for the protection of personal data and that the sharing is proportionate to the purpose for which it is carried out.

10. International Data Transfers

Graeme Hall Nature Sanctuary is a Barbados-based attraction that welcomes visitors from around the world, including from European Union and United Kingdom member states. Accordingly, it is possible that personal data we collect may be stored on or transferred to servers, systems, or service providers located outside of Barbados.

10.1 Data Transferred Outside Barbados

Where we use third-party service providers (such as cloud-based email marketing platforms, analytics providers, or payment processors) that process data outside Barbados, your personal data may be transferred to and processed in countries outside Barbados, including countries in the United States, the European Economic Area, the United Kingdom, or other jurisdictions. Not all of these jurisdictions necessarily provide the same level of data protection as Barbados.

10.2 Safeguards for EU and UK Data Subjects

Where personal data relating to individuals ordinarily resident in the European Union or United Kingdom is transferred to a country that does not benefit from an adequacy decision under the GDPR or UK GDPR, we take steps to ensure that appropriate safeguards are in place, such as:

10.3 Barbados Data Protection Act 2019

The Barbados Data Protection Act 2019 contains provisions governing the cross-border transfer of personal data from Barbados. Sanctuary Recreation Ltd. seeks to ensure that any international transfers of data undertaken in connection with our operations are consistent with the requirements of that Act, including that transfers are made only to countries or organisations providing an adequate level of protection, or that appropriate contractual or other safeguards are in place.

10.4 Further Information

If you would like further information about the international transfer safeguards we have in place, or a copy of any relevant Standard Contractual Clauses, please contact us using the details in Section 15.

11. Data Retention

Sanctuary Recreation Ltd. retains personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with our legal and regulatory obligations. The following retention periods apply:

Category of Data	Retention Period	Rationale
Booking and transaction records(including name, contact details, booking details, and payment reference)	7 years from the date of the transaction	Compliance with Barbadian accounting, tax, and financial record-keeping obligations; defence of legal claims.
Email and correspondence records	3 years from the date of the last correspondence	Legitimate interest in maintaining records of communications to resolve disputes and ensure continuity of service.
Marketing data (email address and consent record)	Until consent is withdrawn, or 3 years from the last interaction, whichever is earlier	Consent-based processing; data must not be retained beyond the period of active consent.
CCTV footage	30 days from the date of recording	Security and incident investigation; footage is overwritten automatically after 30 days unless required to be retained longer in connection with a specific incident or investigation.
Analytics and website usage data	As set by the applicable analytics provider (typically up to 26 months for Google Analytics data)	Legitimate interest in improving website performance; data is aggregated and anonymised where possible.
Cookie consent records	3 years from the date of consent	Evidence of consent for regulatory compliance purposes.

At the end of the applicable retention period, personal data is securely deleted, anonymised, or destroyed in accordance with our data disposal procedures. We review our data holdings periodically to ensure that data no longer required is promptly disposed of.

In some circumstances, data may be retained for a longer period where required by law, court order, or in connection with ongoing legal proceedings or regulatory investigations. Where we retain data beyond the standard retention period for such a reason, we will document that reason and the basis for extended retention.

12. Your Rights

Under the Barbados Data Protection Act 2019 and, where applicable, the GDPR and UK GDPR, you have a number of rights in relation to your personal data. These rights are described below. We will respond to any request you make in accordance with these rights promptly and, in any event, within 30 days of receipt (or such longer period as may be permitted by applicable law in cases of complexity or high volume).

12.1 Right of Access

You have the right to request confirmation of whether we process personal data about you, and, if so, to receive a copy of that data along with information about how it is processed. This is commonly known as a “Subject Access Request” (SAR). We will provide this information free of charge in most cases; however, we reserve the right to charge a reasonable fee where requests are manifestly unfounded, excessive, or repetitive.

12.2 Right to Rectification

You have the right to request that we correct any personal data about you that is inaccurate or incomplete. If you believe that any data we hold about you is incorrect, please contact us and we will take reasonable steps to verify and, where appropriate, correct the data without undue delay.

12.3 Right to Erasure ("Right to be Forgotten")

In certain circumstances, you have the right to request the deletion of your personal data. This right applies, for example, where the data is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent and there is no other lawful basis for processing, or where you have successfully objected to processing based on legitimate interests. The right to erasure is not absolute and may be subject to exceptions — for example, where we are required by law to retain the data or where it is necessary for the defence of legal claims.

12.4 Right to Restriction of Processing

In certain circumstances, you have the right to request that we restrict the processing of your personal data — for example, where you contest the accuracy of the data (pending verification), where the processing is unlawful but you oppose erasure, or where we no longer need the data but you require it to be retained for the exercise or defence of legal claims.

12.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and the processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit that data directly to another controller where technically feasible.

12.6 Right to Object

You have the right to object at any time to the processing of your personal data where that processing is based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately. Where you object to processing based on legitimate interests, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

12.7 Right to Withdraw Consent

Where processing is based on your consent (for example, in relation to marketing emails or analytics cookies), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal. To withdraw consent from marketing emails, use the unsubscribe link in any marketing communication or contact us directly. To withdraw consent from cookies, update your preferences via the cookie settings link on our website.

12.8 Right to Complain to a Supervisory Authority

If you believe that we have processed your personal data in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority. For individuals in Barbados, the relevant authority is the Office of the Data Protection Commissioner of Barbados, established under the Barbados Data Protection Act 2019. For individuals ordinarily resident in the European Union, the relevant authority is the data protection authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. For individuals ordinarily resident in the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO). We would, however, appreciate the opportunity to address any concerns you have before you contact the relevant authority, and we encourage you to contact us in the first instance.

12.9 How to Exercise Your Rights

To exercise any of the rights described in this Section, please contact us in writing using the details provided in Section 15. Please include sufficient information to allow us to identify you and to understand the nature of your request. We may be required to verify your identity before processing a rights request.

13. Children's Privacy

Graeme Hall Nature Sanctuary is an attraction that warmly welcomes visitors of all ages, including children. However, our website and online booking services are directed at adults, and we do not knowingly collect or solicit personal data from children under the age of 16 without the prior, verifiable consent of their parent or legal guardian.

Where a booking is made that includes child visitors, we collect information about the number and age range of children attending solely for the purpose of allocating the appropriate ticket type and admission price. This information is provided by the adult lead booker and is not used for any other purpose.

We do not send marketing communications to individuals who we know to be under the age of 16. If you believe that a child under the age of 16 has provided us with personal data without appropriate parental consent, please contact us immediately using the details in Section 15 and we will take prompt steps to delete that data from our records.

14. Security Measures

Sanctuary Recreation Ltd. takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include, but are not limited to, the following:

14.1 Encryption in Transit

All data transmitted between your browser and our website is protected using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption. You can verify that your connection is secure by checking for the padlock symbol in your browser’s address bar and confirming that the website URL begins with “https://”. We do not transmit personal data over unsecured connections.

14.2 Secure Payment Gateway

Payment card data is processed exclusively through our certified, PCI DSS-compliant payment gateway. Full card data is encrypted at the point of entry and transmitted directly to our payment processor’s secure servers. As noted in Section 7, Sanctuary Recreation Ltd. does not store, log, or have access to your full card number at any stage of the transaction.

14.3 Access Controls

Access to systems and databases containing personal data is restricted to those members of our staff and management who have a legitimate business need to access such data in the performance of their duties. Access is controlled through the use of individual login credentials, role-based access permissions, and, where appropriate, multi-factor authentication. Access rights are reviewed periodically and revoked promptly upon the termination of employment or change of role.

14.4 Staff Training and Data Protection Awareness

All staff members who handle personal data receive appropriate training and guidance on data protection obligations, including the requirements of the Barbados Data Protection Act 2019 and this Privacy Policy. We seek to embed a culture of data protection awareness across our organisation and to ensure that privacy considerations are taken into account in all aspects of our operations.

14.5 Incident Response

In the event of a personal data breach, Sanctuary Recreation Ltd. has procedures in place to identify, contain, assess, and where required notify the relevant supervisory authority and affected individuals in accordance with the timescales prescribed by applicable data protection law. Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected individuals without undue delay.

14.6 Limitations of Security

While we take all reasonable precautions to protect your personal data, no transmission over the internet or electronic storage system can be guaranteed to be completely secure. If you have any concerns about the security of the personal data you have provided to us, please contact us using the details in Section 15.

15. Contact Us / Data Protection Enquiries

All data protection enquiries, subject access requests, complaints, and requests to exercise any of the rights described in Section 12 of this Policy should be directed to us using the contact details set out below. Please mark any written correspondence clearly as a “Data Protection Enquiry” or “Subject Access Request” to ensure it is routed to the appropriate member of our team without delay.

Sanctuary Recreation Ltd.
Graeme Hall Nature Sanctuary
Worthing Main Road, Graeme Hall
Christ Church
Barbados, West Indies
Email: info@graemehall.com
Telephone: + 1 246 435 9727
Website: www.graemehall.com

We endeavour to acknowledge all data protection enquiries within 5 working days of receipt and to provide a substantive response within 30 days, unless the complexity of the request necessitates a longer response period, in which case we will notify you of the extended timeframe and the reason for it.

Where we appoint a designated Data Protection Officer (DPO) or data protection contact, we will update this section of the Privacy Policy to reflect the relevant contact details. In the interim, all data protection matters should be addressed to the attention of the Management Team at the address provided above.

If you are not satisfied with our response to any data protection enquiry or complaint, you have the right to escalate the matter to the relevant supervisory authority as described in Section 12.8.

16. Updates to This Policy

Sanctuary Recreation Ltd. reserves the right to update, amend, or replace this Privacy Policy at any time, in order to reflect changes in our data processing practices, changes in applicable law or regulatory guidance, or improvements in our approach to data protection. The date of the most recent revision is always displayed at the top of this document.

The current version of this Privacy Policy is identified by document reference GHNS-PRIV-2026 and is effective from July 2026. It supersedes and replaces all previous versions of the Graeme Hall Nature Sanctuary Privacy Policy.

Where we make material changes to this Privacy Policy, that is, changes that significantly affect the way in which we process your personal data or your rights in relation to it we will, to the extent practicable, notify you by email (where we hold your email address and where the change is of direct relevance to you) and/or by posting a prominent notice on our website. We encourage you, however, to review this Policy periodically to ensure that you remain informed of how we process your data.

Your continued use of our website or services after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated terms. Where changes require your consent (for example, a new category of processing based on consent), we will seek your consent separately before carrying out the new processing activity.

Updated versions of this Privacy Policy will be published on our website at www.graemehall.com and will be available for inspection by any person who wishes to review them. Archived versions of prior policies are retained by Sanctuary Recreation Ltd. for internal record-keeping purposes.

Graeme Hall Nature Sanctuary | Operated by Sanctuary Recreation Ltd. | Graeme Hall, Christ Church, Barbados

GHNS-PRIV-2026 | Effective: July 2026 | Strictly Private and Confidential

Contact Info

Quick Links

Make a Reservation

Ready to plan your visit or special event? Reserve your spot today and let us help you create a memorable experience surrounded by nature’s beauty.

We accept Visa & Mastercard