Privacy Policy

Last updated: 25 October 2026

This policy explains how Bambuda (“Bambuda”, “we”, “us”) collects and uses personal data when you visit bambuda.com, book with us, contact us, apply to work with us or stay at one of our properties in Panama.

Who we are

Each Bambuda property is operated by its own Panamanian company. That company decides how and why the personal data of its guests and enquiries is used and is responsible for it:

  • Bambuda Lodge: Ocho Amigos Incorporated (RUC 2578652-1-830611 DV 10), Isla Solarte, Bocas del Toro, Republic of Panama
  • Bambuda Castle: 1812258 Inc. (RUC 155635602-2-2016 DV 47), Alto Lino, El Santuario, Boquete, Chiriquí, Republic of Panama
  • Bambuda Bocas Town: Ojala Bocas S.A. (RUC 155707444-2-2021 DV 83), Avenida H Norte between Calle 5 and Calle 6, Isla Colón, Bocas del Toro, Republic of Panama
  • Bambuda Santa Catalina: Bambuda Santa Catalina S. de R.L. (RUC 155745264-2-2023 DV 52), Calle Via el Estero, Urbanización Santa Catalina, Río Grande, Soná, Veraguas, Republic of Panama

For your use of this website and for enquiries that do not relate to one property, these four companies are responsible together. TASO Hospitality Management S. de R.L. (RUC 155748013-2-2024 DV 83), Avenida H, Urbanización Isla Colón, Bocas del Toro, Republic of Panama, runs the website, central reservations and guest enquiries on their behalf and on their instructions. We have not appointed a data protection officer; our team answers privacy questions at the address below.

Who to contact

For any privacy question or request, write to privacy@taso-group.com.

What we collect

  • Booking details you give us directly or through our booking engine (Mews): name, email, phone, country, travel dates, number of guests, room choice, special requests and payment details. Card details are handled by our payment providers; we do not store full card numbers.
  • Messages you send us by email, WhatsApp, phone, social media or our chat assistant, and anything you choose to tell us in them, such as dietary or accessibility needs. Please share health details only if you are comfortable doing so; we use them only to look after you during your stay.
  • What you enter in our enquiry forms for groups, events and retreats: the organiser’s contact details and the details of the stay or event.
  • If you apply for a job, the details and CV you send us through our Work With Us form.
  • Information needed for your stay, such as passport or ID details that Panamanian law requires us to record, and purchases you make during your stay.
  • Technical data from your browser when you use this site, such as IP address, device, browser and the pages you visit. Analytics and advertising cookies are used as described in Cookies below (in Europe only after you accept; elsewhere until you opt out).
  • If you book through a travel agent or an online travel agency such as Booking.com, Expedia or Hostelworld, the booking details they send us.
  • Images recorded by security cameras in the common areas of our properties.

How we use it

  • To take and manage your reservation, payments and stay. This is necessary to carry out our contract with you.
  • To reply to you and send service messages about your booking and stay, such as confirmations and pre-arrival information, by email, text message or WhatsApp. This is necessary for our contract with you, or in our legitimate interest in answering your enquiries.
  • To plan and quote group stays, events and retreats you ask us about. This is necessary to take the steps you request before a contract.
  • To consider your job application. This is necessary to take the steps you request before an employment contract.
  • To meet legal, tax, accounting and safety obligations. This is required by law.
  • To keep our site, our guests and our properties secure, prevent fraud and spam and improve our services. This is in our legitimate interest, which we weigh against your rights.
  • With your consent, or where the law allows for past guests, to send you marketing emails from Bambuda and TASØ Hospitality Group, and, with your consent, to understand how the site is used and to measure or personalise our advertising.
  • To arrange tours, transfers and activities you ask us to book. This is necessary to provide the service you request.
  • To ask for your feedback after your stay and invite you to leave a review. This is in our legitimate interest in improving our service, and you can opt out at any time.

Marketing emails

We send occasional emails about offers, events and news at Bambuda and our sister properties in TASØ Hospitality Group. We send them to people who agree to receive them, for example by ticking the box when booking (it is never ticked for you) or by signing up, and, where the law allows, to past guests about similar offers at Bambuda. Where the law of your country requires prior consent, we ask for it first. Every email has an unsubscribe link, and we act on unsubscribe requests promptly, within 10 business days at the latest. Our email provider may tell us whether an email was opened or a link clicked, so we can send fewer and more relevant emails. We never sell or rent our mailing list.

Security cameras

Our properties use security cameras (CCTV) in common areas only, to protect guests, staff and property. There are never cameras in guest rooms, dorms or bathrooms. Footage is viewed only when needed, for example to investigate an incident, and may be shared with the police or authorities where the law requires.

Photos and video

We sometimes take photos and video at events and around our properties to use on our website, social media and other marketing. We avoid featuring guests in a recognisable way without their agreement. If you appear in one of our images and would like it removed, contact us and we will remove it.

Booking for others

If you book for, or give us details about, other guests or members of your group, please make sure they know you are sharing their details with us and point them to this policy.

Who we share it with

We share personal data only with companies that help us run Bambuda, and only what they need: Mews (reservations, booking engine and payments) and our payment processors; Webflow (website hosting and our website forms); Vercel (hosting of our site code); Mux (video streaming); Cloudflare (spam protection on our forms); jsDelivr (delivery of the calendar and photo carousel code); Google (Google Workspace email, and Google Maps when you click to open a map); HiJiffy (our chat assistant, loaded only when you open the chat); monday.com (our Retreats enquiry form, loaded when you open it); Zoho (email marketing and customer relationship management); Akia (guest messaging by text message and WhatsApp, and guest relationship management); TASØ Suite, our internal guest relationship and operations platform, run by TASO Hospitality Management; WhatsApp for messages you send us there; and CookieYes, which records your cookie choices. When you ask us to arrange a tour, transfer or activity, we give the provider the details they need, such as your name, phone number and arrival time. We also share data with analytics and advertising partners according to your cookie choices (see Cookies): Google (Analytics and Ads), Microsoft (Clarity), PostHog (site analytics and session recordings, with form fields masked), Meta (Facebook and Instagram) and The Hotels Network (booking personalisation and price comparison). We may also disclose data where the law requires it, or to our professional advisers. If a property or its operation is sold or transferred, personal data may pass to the new operator, who must protect it as this policy describes. We do not sell or rent personal data.

International transfers

Several of these providers store or process data outside Panama, including in the United States and the European Union. As Panama’s Law 81 of 2019 allows, we transfer data abroad when it is needed to provide the services you book, when you have consented, or when the provider gives appropriate safeguards such as contractual clauses. We share only what is needed.

Cookies and similar technologies

Essential storage keeps the site working and remembers your choices, for example your cookie preferences and the dates you picked in the booking bar. You can review or change your cookie choice at any time from the Cookies link at the bottom of every page. Our fonts and images are hosted on our own site, and our videos stream from Mux without cookies. The maps on our location pages come from Google Maps and load only when you click on the map. Our booking engine at app.mews.com is run by Mews and has its own cookie notice.

We use CookieYes to show our cookie notice and record your choice, and what you see depends on where you are. In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you accept them: until then, Google Analytics and Google Ads receive only cookieless signals through Google Consent Mode, and Microsoft Clarity, PostHog, Meta, The Hotels Network and Google’s advertising cookies do not load at all. Everywhere else, including Panama, the United States, Canada and Latin America, these cookies are on when you arrive, and you can turn them off at any time with Reject or the “Do Not Sell or Share My Personal Information” link, which replaces the Cookies link at the bottom of the page there. If you live in California or another US state with a privacy law, you have the right to opt out of the sale or sharing of your personal information for targeted advertising. We do not sell personal information for money, but some advertising cookies can count as “sharing”, so we treat your opt-out, or a Global Privacy Control signal from your browser, as a request to stop them; we will not treat you differently for using this right. Cookies are grouped as Necessary (always on), Functional, Analytics, Performance and Advertisement, and Google and Microsoft tools receive your choice through Google Consent Mode and Microsoft’s consent signals. We keep your choice for up to 12 months, then ask again.

Other websites and social media

Our site links to other websites and services, such as our booking engine at app.mews.com, WhatsApp and our social media pages. Those are run by other companies under their own privacy policies, which we encourage you to read.

How long we keep it

We keep booking, stay, invoice and accounting records for up to seven years, in line with Panama’s commercial and tax laws. We keep messages and enquiries for up to two years after your last contact, job applications for up to 24 months after the role is filled, and security camera footage for up to 30 days unless it is needed to investigate an incident. We keep your email address for marketing until you unsubscribe, or for three years after you last open one of our emails, and your cookie choice for 12 months. After that, we delete or anonymise the data.

Your rights

Under Panama’s Law 81 of 2019 you can ask to access, correct, delete or receive a copy of your personal data, and to object to its use, including at any time to marketing. We answer requests for access, deletion, objection or a copy within 10 business days, and correct inaccurate data within 5 business days. Where the EU or UK General Data Protection Regulation applies, you can also ask us to restrict how we use your data. You can withdraw consent at any time; this does not affect what we did before. We do not make decisions about you based solely on automated processing. To use your rights, email us at the address above; we may ask you to confirm your identity. You may also complain to Panama’s National Authority for Transparency and Access to Information (ANTAI) or to the data protection authority where you live.

Children

Our website is meant for adults. Bookings must be made by a person aged 18 or over. We collect children’s details only as part of a booking made by a parent or guardian, with their authorisation.

Security

We use reasonable technical and organisational measures to protect personal data, and only staff who need it can access it. If a security breach affects your personal data, we will notify the data protection authority and you where the law requires. No method of transmission over the internet is completely secure.

Changes

We may update this policy from time to time. The date at the top shows when it last changed. If we make important changes, we will show a notice on this site. This policy is available in English and Spanish; if the two versions differ, the English version prevails.