Privacy

When you create an account: your name, your email address and a password, which is stored only as a one-way hash and cannot be read back by us or by anyone else. If you sign in with Google instead, we receive your name, email address and profile picture from Google, and there is no password at all.

When you book: your dates, the layout, the number of guests, the name and email on the booking, your phone number if you give one, and any special requests you write. Special requests are free text that staff read, so please do not put anything in that box you would not want read.

When you pay: a payment reference, a transaction identifier, the amount, the currency, the method used and the time it succeeded. We never receive your card number, your PIN or your mobile money credentials — payment happens on Paystack’s own pages, not ours.

We use it to hold your dates, take payment, confirm your booking, have your apartment ready, and answer you when you write. That is the whole list.

We send you email about your own bookings and your own account — a confirmation, a verification link, a password reset. We do not send marketing email, and we do not sell, rent or share your details with anyone for their own purposes.

A few companies process data on our behalf so that the site can work. Each sees only what its job requires.

Paystack takes payments and holds the payment instrument details we never see. Resend sends our email, so it handles your address and the message. MongoDB Atlas stores the database and Vercel runs the site itself. Google is involved only if you choose to sign in with a Google account.

Some of these operate outside Ghana, which means your data may be processed abroad. We would also disclose information where the law genuinely requires it, and we would tell you unless we were forbidden from doing so.

One cookie, and only once you sign in: a session cookie that keeps you signed in for up to seven days. Sign out and it goes.

There is nothing else. No analytics cookie, no advertising cookie, no tracking pixel, no tag manager, no session recorder, no third-party script of any kind. That is why this site has no cookie banner asking for your consent — there is nothing to consent to.

Your account stays until you ask us to delete it. Your bookings stay for as long as we need them as a record of a transaction, which is longer than the stay itself — payment records have to be kept for accounting and tax purposes even after an account is closed.

Where we keep a booking after deleting an account, we keep the transaction rather than the person: what is retained is the record of money received, not a profile of you.

Under Ghana’s Data Protection Act, 2012 you can ask us for a copy of what we hold about you, ask us to correct it if it is wrong, and ask us to delete it. You can also object to what we are doing with it.

You do not need a form or a legal reason. Email bookings@tesagardens.com from the address on your account and we will act on it — corrections immediately, deletions as soon as we have checked there is no open booking or unresolved payment attached.

There is no self-service way to edit your details on the site yet, so a correction is a message to us rather than a form — we will make it and confirm when it is done.

The site is served entirely over an encrypted connection, passwords are stored as one-way hashes, and access to the booking administration is restricted to staff accounts that are checked against the database on every request rather than trusted from a token.

No system is perfect. If we ever discovered a breach affecting your data, we would tell you and the regulator rather than hope you did not notice.

Accounts are for adults. Children are of course welcome to stay — the booking simply has to be made by an adult, and we do not knowingly collect information directly from children.

If we change this notice, the date at the top changes with it. A change that materially affects what we do with data already collected would be told to you by email, not slipped in quietly.

If you are unhappy with how we have handled your information, write to bookings@tesagardens.com first. If we cannot put it right, you are entitled to complain to the Data Protection Commission of Ghana. Tesa Gardens is the data controller for the information described here.