privacy policy

privacy policy
heavenly vacations

Updated: July, 2026

This Privacy Policy describes the privacy practices of Hawaii Exclusive Management LLC, doing business as (DBA) Heavenly Vacations, and its related entities (collectively referred to as "Heavenly Vacations," "we," "our," or "us"), and in particular how we collect, use, and disclose certain information.

1. WHAT DOES THIS POLICY COVER?

This Privacy Policy applies to our interactions with our customers and visitors, including but not limited to property rentals, rental management, marketing of rental listings, provision of guest services, your use of Heavenly Vacations websites, including www.heavenlyvacations.com, and your use of applications, social media, and advertisements or communications relating to any services we offer ("Services").

Heavenly Vacations is an independently owned and operated franchisee of the Casago brand. This Privacy Policy applies only to information collected, used, or disclosed by Heavenly Vacations. It does not apply to Casago, its corporate affiliates, or other independently owned and operated Casago franchisees, each of which maintains its own privacy practices and policies. Where we share your personal information with Casago or its affiliates (for example, through shared reservation, technology, or marketing platforms), that sharing is described in Section 4 of this Privacy Policy. We encourage you to review Casago's privacy policy for information about its own practices.

This Privacy Policy also does not apply to any third-party websites that may be accessible through a Heavenly Vacations website, or to third-party websites on which Heavenly Vacations advertises.

2. INFORMATION COLLECTED OR RECEIVED

We collect information you provide to us directly, that we collect automatically, that we receive from third parties, and otherwise with your consent. Certain personal information that we collect is necessary to provide services that you request, to fulfill the terms of a contract between you and us, or to comply with our legal obligations. If you do not wish to provide this type of personal information, we may not be able to provide services to you.

When you reserve, pay for, or stay in a property through Heavenly Vacations.

Contact information. When you reserve or stay in a property through Heavenly Vacations, we may collect information such as your first and last name, contact phone number, email address, and other digital contact information. We may also collect names and contact information that you provide about other renters or guests.

Payment information. When you make a purchase, we collect your payment information, such as information from your credit card, debit card, or check, and your billing address, to allow us to process payments.

Identity information. To prevent fraud, to comply with the requirements of applicable law, or to meet the requirements of a hotel, resort, community association, or property owner, we may collect proof of identity or proof of age, such as a government-issued driver's license, passport, or other identity information in connection with your stay.

Other information. We may collect information about your automobile(s) and license plate number(s) in connection with your stay at a property that requires this information for parking permits or safety and security. We may also collect information about your age and the ages of other guests in connection with your stay at a property that imposes a minimum renter age or requires this information for check-in. We may collect additional personal information in connection with your stay to comply with the requirements of applicable law, or to meet the requirements of a hotel, resort, community association, or property owner.

When we provide rental management or marketing services.

Contact information. When we contract with you to provide rental management or marketing services for your property, we may collect information such as your first and last name; the address of your property; your mailing address, contact phone numbers, email addresses, and other digital contact information; and information concerning any entity you own or manage that is an owner of the property. We may also collect names and contact information of any other owners of the property, owners of an entity that owns the property, or guests or family members who use or stay at the property.

Bank account, tax, and identity information. In order to make payments to you, we collect information such as your bank account information, tax identification number, or other information. We may also collect proof of identity, such as a government-issued ID, passport, or other identity information in order to verify your identity or comply with applicable law. We may also collect other types of information from you as required to collect or remit lodging or sales taxes on your behalf, apply for or renew a government license or permit relating to rental management services provided to you, to perform other services on your behalf, or pay utility or other bills on your behalf.

Other information as required by law. We may collect additional personal information about you as necessary to comply with the requirements of applicable law.

When you choose to provide us with additional information.

Information provided or collected during communications with Heavenly Vacations. When you communicate with Heavenly Vacations in person, or by phone, email, text message, application, or other electronic means of communication, we may collect any information that you choose to provide during the communication, as well as information such as call recordings and transcripts consistent with the requirements of applicable law, and other log information like your phone number, calling-party number, receiving-party number, account name, email address, forwarding numbers, time and date of communications, duration of communication, routing information, and the types and volumes of communications.

Other information you choose to provide. We may collect other information you choose to provide to Heavenly Vacations, for example when you submit a review, comment or request, interact with a Heavenly Vacations social media account, attend a Heavenly Vacations event, refer a potential guest or owner, conduct a search, enter a contest, sweepstakes, or promotion, designate a preferred language or currency, or use other aspects of our Services.

We may collect certain information about you from third parties.

Heavenly Vacations does not control or oversee the manner in which third parties collect, use, or disclose your information. Each third party that collects or processes your information does so subject to its own privacy policies. We encourage you to review the privacy policies of websites that you visit.

Information provided by third parties in connection with a booking or stay. If you use a third party to book a stay in a property for which Heavenly Vacations provides rental management or marketing services, the third party may send us personal information relating to your stay that you provided to the third party, such as your name, contact information, payment method, the names of other renters or guests, reservation dates, and identity information. We also may collect information about you from your friends or family members, for example if a friend or family member includes you as part of their reservation. Third parties who provide services to you in connection with your stay, such as a utility, contractor, service provider, tour operator, concierge, resort or community association, or government official, may send us information about the services you used if permitted or required to do so by applicable law. To the extent allowed by applicable law, we may obtain police or background check information or potential fraud alerts from third-party providers of identity verification, criminal background check, or money laundering prevention services.

Information obtained in connection with rental management services. When we agree to provide rental management or marketing services for you, a third party such as a utility provider, government entity, former or current property manager or resort or community association may provide us information such as your name, contact information, property address, property rental history, utility account numbers and history, sales or lodging tax license number and remittance history, or local rental permit numbers.

Information shared by Casago and its affiliates. Because Heavenly Vacations operates as a Casago franchisee, Casago and its affiliates may share reservation, transaction, and related information with us that you provide when you book a stay through a Casago booking channel or website, or when you inquire about services offered under the Casago brand in Hawaii. Such information may include your name, contact information, property addresses, dates of stays, and the names of guests included in a reservation.

Other information we obtain from third parties. We may obtain information from business partners about your use of the Services or services provided by third parties. Such information may include your travel preferences and history, products or services you like, or reviews you submit. We may obtain your name and mailing address or other contact information from third parties such as government agencies, direct mailing service providers, or vendors who compile information from public records. Other than described in this Privacy Policy, we do not intentionally collect sensitive personal information, such as information about your medical history, political views, union membership, religious or philosophical beliefs, racial or ethnic origin, or genetic data.

We automatically collect certain information about you when you visit a Heavenly Vacations website, use a Heavenly Vacations application, or communicate with Heavenly Vacations.

Information about your site visits. When you visit a Heavenly Vacations website, we collect information about your activity on the site. We may track the date and time you accessed the site, the pages you visit and how long you viewed them, your searches for properties, your booking activity (including started, attempted, and abandoned bookings), whether you have followed links to other websites, and your other interactions with the site. Your internet browser may automatically transmit information to us, such as what website you came from.

Device and browser information. We may automatically collect information about the hardware, operating system, browser, and extensions or add-ons you are using, IP address, proxy server, ISP or mobile carrier, device identifier, and any crash data associated with your visit.

Location information. If you use our mobile websites or applications, we may automatically collect location data obtained from your mobile device's GPS. Most mobile devices allow you to control whether an application can use the device's location services. If you use our websites, we may collect information about your location derived from your IP address.

Cookies, web beacons, and similar technologies. As further described in our Cookie Policy, we may use tracking tools like browser cookies, flash cookies, and web beacons. We may also engage certain business partners to use these tracking tools on Heavenly Vacations websites or to track your online behavior on other sites on our behalf.

Communication. When you communicate with Heavenly Vacations using electronic means, we (including through our service providers) may automatically collect the contents of the communication. In some cases, where permitted by law, we may automatically record phone calls for quality assurance and training purposes and maintain transcripts of communications sessions.

We also may collect other information about you, your device, or your use of the Services in ways that we describe to you at the point of collection or otherwise with your consent. You may choose not to provide us with certain types of information, but doing so may affect your ability to use some of the Services.

3. HOW WE USE YOUR INFORMATION

We use your information:

To provide and manage the Services.

We use information about you to provide Services that you request or to fulfill the terms of a contract between you and us. We use information about you to respond to your inquiries or requests; to communicate with you about reservations and stays; to fulfill contractual or legal requirements relating to your request or the Services you are using (for example, to permit you to stay in a property you have reserved); to provide customer service; to provide rental management or similar services; to detect and prevent fraud or illegal activity; and to make or receive payments to or from you.

To optimize, customize and improve our services and your user experience.

We use information about you and your use of the Services to optimize, customize, and improve our Services, our systems, and your user experience. We may use your information to respond to comments, suggestions, and reviews; to personalize your user experience, including changing displayed properties based on your preferences and search and booking history; and to improve and optimize the performance of our websites or applications. We may use your information to send notifications and offers relating to a stay you have booked. We may use location data to find locations nearest to you and provide driving directions to a property you have booked.

To conduct, measure, and improve our advertising and marketing.

We use information about you to communicate with you about Heavenly Vacations and our Services as permitted by law, including sending advertisements and marketing communications. We may use information about you and your search, browsing, and booking history to send promotional messages and offers that may be of interest to you; to analyze and improve the effectiveness of our advertising and marketing efforts; or to conduct marketing campaigns on third-party websites or social media platforms.

We also use your information to produce aggregated information that does not identify you, such as information about ad impressions served or clicked on.

To comply with our legal and contractual obligations and for security and investigation purposes.

We may use information about you to comply with our legal obligations, such as requirements in some jurisdictions to collect and store certain identity and contact information in connection with a booking or information about your tax identification information in connection with making payments to you. We may also use your personal information to comply with our contractual obligations to you or to certain third parties. We may also use your personal information to enforce the terms of an agreement between us and you or a third party; to enforce the terms of our Terms of Service or other policies; or to resolve disputes with you or another Heavenly Vacations customer. We may use your information to conduct security investigations or to conduct or cooperate with investigations related to potential criminal activity. We may use your information to detect and prevent fraud, security incidents, and criminal or harmful activity.

With consent.

We use your information with your consent or at your direction. For example, when you expressly consent to receive text messages from Heavenly Vacations, we may send recurring service or account-related communications and promotional messages to the mobile number you provide. Message frequency may vary and message and data rates may apply. Your consent is not a condition to purchase or receive any product or service, and you can opt out at any time by replying STOP, and can seek assistance by replying HELP.

4. HOW WE DISCLOSE YOUR INFORMATION

We may disclose your information:

To third parties in order to fulfill our contractual obligations and/or provide Services.

We disclose information about you to third parties to provide Services that you request or to fulfill the terms of a contract between you and us. We need to disclose this information to adequately perform the terms of the contract between us and you.

We may disclose your information to our local service providers, such as maintenance technicians, contractors, and housekeepers, to allow us to provide services you request and that we are contractually obligated to provide. We might also authorize our local service providers to collect information on our behalf. If you are staying in a property reserved through Heavenly Vacations, this information may include your full name, the names of other guests, and your telephone number or email address. If we provide you with rental management services or rental marketing services, this information may include your full name and the names of any other owners or contacts you have designated, your telephone number, your email address, the address of the property we are managing or marketing, and your mailing address.

We might also disclose your contact information to property managers, property owners, and service providers to allow them to respond directly to your reviews and questions. We may disclose your information to third parties who provide services to us in connection with a booking. These third parties may provide services related to payment processing; access to property; fraud prevention, identity verification, and risk assessment; and anti-money laundering compliance. These providers' access to your information is limited to the information they reasonably require to perform specific tasks on our behalf, and they are contractually bound to use it only for purposes for which it is disclosed.

Service providers may be located inside or outside of the United States. In particular, we may use service providers located in various jurisdictions.

Some resorts, community associations, government entities, property owners, or other third parties may require us to provide guest information in connection with a specific reservation for a property under their control or jurisdiction. We disclose information to these third parties to the extent it is legally required or that those parties require us to do so as a condition of the rental. This information may include your full name and age, the names and ages of other guests, your telephone number, your address, your government-issued identification (such as a driver's license or passport number), and vehicle information such as make, model, and license plate number. In some jurisdictions we are required to disclose guests' full names, contact information, and transaction information related to a rental stay to the owner of the property.

We provide your information to third parties at your direction or request. For example, we will provide your information to a third party if you ask us to do so to facilitate the resolution of a dispute.

For clarity, if you authorize us to send you text messages, we will not sell or disclose that consent to third parties so that third parties can send you their own promotional or marketing texts. We otherwise do not sell or disclose your mobile phone number to third parties for their own promotional or marketing purposes except as directed by you.

With Casago, our brand franchisor, and its affiliates.

Heavenly Vacations operates as an independently owned and operated franchisee of the Casago brand. We may disclose information about you to Casago and its affiliates for the purposes described in this Privacy Policy, including to complete and manage booking reservations made through shared reservation or technology platforms, to coordinate guest services, to support brand-level marketing and analytics, and to comply with our obligations under our franchise agreement, including the maintenance of books and records. When Casago or its affiliates use such information for their own purposes, they do so as independent data controllers subject to their own privacy policies.

With third parties in order to offer additional services.

We may disclose information about you to local third-party business partners who may offer additional services in connection with a property you have booked. For example, we may provide your name and email address to a company that offers concierge services for the property you have booked.

With a subsidiary or affiliated company.

As allowed by applicable law, we may disclose your information to a Heavenly Vacations subsidiary or other affiliated company under common ownership or control. Unless the subsidiary or affiliated party adheres to its own privacy policy, the terms of this Privacy Policy will apply to such information sharing.

If you book a stay in a state or country other than your state or country of residence, or if you contract with us for us to provide rental management services in a state or country other than your state or country of residence, your information will be disclosed to the Heavenly Vacations entity that manages the property in that state or country. Regardless of your state or country of residence, your information may be disclosed to affiliates of Heavenly Vacations which provide technical, business, administrative, and customer support services. This data disclosure is necessary to perform the terms of the agreement between us and you and is further based on our legitimate interests in providing Services.

In connection with a sale, merger, or change of control.

We may disclose information in connection with the sale of all or part of our business, a merger, a change of control, or a reorganization, or in contemplation of any of these events (for example, as part of the due diligence process). Any entity that buys us or any part of our business, or any successor entity following a merger, change of control, or reorganization, will have the right to use your personal information, but only as permitted in this Privacy Policy unless you agree otherwise.

To comply with the law, respond to legal requests, resolve disputes, prevent harm to persons or property, and protect our rights.

We may disclose your information, including your personal information, to a court, law enforcement agency, government agency, or other authorized third party in response to a court order, subpoena, warrant, or other legal process or legal requirement, or if we have a good faith belief that disclosure is reasonably necessary to (1) investigate, prevent, or take action regarding alleged, suspected, or known illegal activities or any activity that may expose us, you, or any third party on whose behalf we act to liability; (2) comply with our legal obligations; (3) comply with legal process and to investigate, respond to, or defend ourselves against any claims or allegations asserted against us; (4) comply with or respond to an audit conducted by a government agency; (5) enforce our Terms of Service or the terms of any agreement between us and you; (6) prevent or mitigate harm to persons or property; or (7) exercise or protect our rights, the rights of our employees, the rights of third parties on whose behalf we act (such as the owners of properties we manage or market), or the rights of the public.

We may attempt to notify you about a legal request or demand for your personal data, where we reasonably believe that notification is appropriate, except where (a) disclosure is prohibited by applicable law or by the terms of the legal process or court order we receive, (b) where the request is an emergency, or (c) we believe providing notice would be futile, would create or increase a risk of harm to persons or property, or would create or increase a risk of fraud, or prevent the detection of fraud. We may dispute legal demands in instances where we believe a request is overbroad or lacks proper authority. However, we do not undertake to provide notice of every request or challenge any legal demand.

With vendors that perform services on our behalf.

We may disclose your information to vendors or other service providers that provide us with services or software. For example, we may provide your contact information to operators of communication or marketing platforms so that we may use their platform software to communicate with you. We might disclose information to a business partner who is running a joint promotion with us or who provides a product or service in partnership with us. We may disclose information to our outside auditors in connection with their auditing services.

With advertising partners, social media platforms, and advertising publishers.

Where permitted by applicable law, we may use certain personal information about you, such as your email address, to hash and share it with advertising publishers such as Facebook or Google to generate leads or otherwise promote our Services. We carry out these activities based on our legitimate interest in conducting marketing activities to offer you services that may be of interest to you. You may ask us to cease using your email address for these marketing activities by contacting us at contact@heavenlyvacations.com.

To obtain government permits and to collect and remit taxes.

We may share identifying information regarding your property with a government entity or agency in connection with applying for, obtaining, maintaining, or renewing a required license or permit if required in connection with our provision of rental management services. Such information may include your full name and the full name of all owners, your contact information, the address of the property, your tax identification number, and information relating to rental activity.

In jurisdictions that impose lodging, hotel, occupancy, sales, or other types of taxes on transient or rental occupancy of property, and where an agreement permits us to collect and remit such taxes on behalf of an owner, we may disclose information to government agencies in connection with the collection and remission of taxes. The information we disclose may include your name and contact information, the property address, the dates of stay and transaction amounts, amount of tax collected or due, the permit or license number for the property, and the owner's tax identification number(s).

We may aggregate your information.

We may aggregate data about individuals who use the Services, meaning we combine and anonymize this information. We may share this aggregated information with third parties to help describe our business, analyze our marketing efforts, comply with regulations, obtain insights about our business practices, and refine the services we offer, and for other business purposes. Such aggregate data is not personally identifiable.

5. YOUR RIGHTS AND PREFERENCES

Communications from Heavenly Vacations or Third Parties.

Transaction-related communications from Heavenly Vacations. You may receive business-related communications from Heavenly Vacations relating to a booking you have made or an inquiry about a property. Because these communications are necessary for us to provide you with requested services, you cannot opt out of such communications.

Marketing communications from Heavenly Vacations. You may receive marketing communications from Heavenly Vacations as permitted by law. You can register or change your preferences to receive or not receive marketing communications from us by clicking the "unsubscribe" link in the communication you have received or by contacting us at contact@heavenlyvacations.com. Please allow sufficient time for your preferences to be processed. Even if you opt out of receiving marketing messages, we may still contact you for transactional purposes like confirming or following up on a reservation or home inquiry or asking you to review your stay. If you later opt back into receiving marketing communications from us, we will remove your information from our opt-out databases.

Transaction-related communications from third parties. You may receive business-related communications from a third party, such as a resort, relating to a booking you have made or an inquiry about a property. To the extent these communications are necessary for us to provide you with requested services, you cannot opt out of such communications.

Marketing communications from third parties. You may receive marketing communications from third parties with which Heavenly Vacations has contracted or with which Heavenly Vacations is running a joint promotion. You may opt out of disclosure of your personal information to such third parties by contacting us at contact@heavenlyvacations.com.

Your privacy rights.

In addition to the choices described elsewhere in this policy, you may have additional rights concerning the collection, use, and sharing of your data, depending on where you live. Residents of U.S. states that have enacted comprehensive consumer privacy laws (including, for example, California, Colorado, Connecticut, Texas, Utah, and Virginia, among others), as well as residents of the EEA, UK, or Switzerland, and other locations with applicable data privacy laws, may be able to exercise the rights described in this section by contacting us at contact@heavenlyvacations.com or as described in Section 14.

Update your personal information. You may ask us to correct inaccurate or incomplete personal information about you.

Right to access your personal information. In some jurisdictions, you may have the right to obtain a copy of your personal information in our possession. You may also have the rights to request a copy of personal information that you provided to us in machine-readable form, and to request that we transfer this information to another service provider if technically feasible to do so.

Right to request deletion of your data. In some jurisdictions, you may have the right to ask us to erase or delete some or all of your personal information.

Right to object to, withdraw consent to, or limit use of your information. In some jurisdictions, you may have the right to ask us to stop using some or all of your personal information for certain purposes if our processing of your information is based on legitimate interests. In such cases, we will no longer use your personal information for such purposes unless: (i) our use is required to establish, exercise, or defend legal claims or (ii) we demonstrate compelling legitimate grounds for our use of the information. If our use of your personal information is based on your consent, you may withdraw your consent at any time by sending a request stating what consent you are withdrawing. Any withdrawal of consent is prospective only (meaning it does not apply to our use of your data before we receive the withdrawal). In some jurisdictions, you may also have the right to limit the ways we use your personal information, especially if the information is inaccurate or our use of the data is unlawful.

Right to limit the use and disclosure of sensitive personal information. In some jurisdictions, you may have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the Services you have requested or as otherwise permitted by applicable law.

Data retention and deletion.

We retain your personal information for the purposes described above, unless a longer retention is required or permitted by law. The length of time we retain your information depends on the type of information we have collected, the purpose for which we have collected it and the laws of the applicable jurisdiction(s) (usually the jurisdiction of your residence, the jurisdiction of the property where you have booked a stay, or that we are managing, or both).

We also retain your personal data as necessary to comply with our legal obligations, such as obligations to retain and report information for tax, auditing, and regulatory compliance purposes. We may also retain some of your personal information as necessary to meet our legitimate business interests, such as to enhance our ability to detect fraud or to assert or defend against an actual or potential legal claim by you or a third party.

If you share information with others in connection with your use of the Services, such as by writing a review or engaging directly with a third party, your information may continue to be visible to the public or to the third party even after we delete it.

Even after we delete your information, portions of your data may remain in aggregated, anonymized, or tokenized form. In addition, because we regularly back up our systems, portions of your personal information may continue to reside in backup copies for a period of time after it is deleted from our main systems. If you use our mobile application and you delete your user account within the application, we will retain certain account-related reservation and transaction information as needed to comply with any applicable legal requirements, or to meet our legitimate business interests (including to assist or defend against an actual or potential legal claim by you or a third party).

Lawful bases to collect, use, and share your personal information.

We will only collect, use, and share your personal information where we have a lawful basis to do so. Lawful bases include (i) contract (if processing is necessary for the performance of a contract with you), (ii) consent (where you have given consent), (iii) legitimate interests or (iv) as otherwise may be allowed by applicable law and consistent with this Privacy Policy.

6. YOUR PRIVACY AND OUR GLOBAL OPERATIONS

Data controller.

The Heavenly Vacations company that is responsible for your information under this Privacy Policy is the "data controller." Hawaii Exclusive Management LLC, doing business as (DBA) Heavenly Vacations, serves as the data controller for your personal information.

Cross-border data transfers.

We process data both inside and outside the United States, and we may share your data among affiliated companies or with service providers based in countries other than your country of residence or the country in which Services are provided to you. Countries in which we process data may have laws that differ from the laws in your country of residence.

When you submit personal data directly to Heavenly Vacations, that data may be transferred to, processed, and stored in the United States. If you are located in Europe, personal data you transmit may be transferred to Heavenly Vacations, subject to applicable rules concerning adequate levels of data protection.

Safeguards in place to ensure an adequate level of data protection.

Information collected within Europe may be transferred, processed, or stored outside Europe as described in this Privacy Policy. If we transfer, process, or store personal information from Europe to or in a country outside Europe, we ensure that safeguards are in place to ensure an adequate level of data protection. These safeguards may be based on a determination by the European Commission or Swiss Federal Data Protection and Information Commissioner that a country outside Europe has an adequate level of data protection, or on the use of model contract clauses approved by European Union or Swiss data protection authorities.

Additional privacy rights.

Depending on the laws of the country or state in which you reside, you may have additional rights concerning our collection, use, and disclosure of your personal information, as further described at the end of this Privacy Policy.

7. HOW WE SECURE YOUR INFORMATION

We use industry-standard technical measures to protect our websites and your information, and we monitor for and attempt to prevent security breaches. We update and control access to our systems to protect your information, but we cannot guarantee that your information may not be accessed, disclosed, altered, lost or destroyed by breach of any of our security measures. In the event of a data breach, we will comply with applicable laws relating to notification.

8. LINKS TO THIRD-PARTY SITES

Our websites may contain links to third-party websites. If you click on one of those links, you will be taken to websites we do not control and for which we are not responsible. This Privacy Policy does not apply to the information practices of those websites. You should read the privacy policies of other websites carefully.

Some portions of the Services implement Google Maps/Earth mapping services, including Google Maps API(s). Your use of Google Maps/Earth is subject to Google's terms of use, which incorporates Google's Privacy Policy.

9. OUR SITES AND CHILDREN

Our websites and mobile applications are not created for or directed to children, and we do not knowingly allow individuals under 18 to make reservations, create accounts, or otherwise provide personal information to us directly. We may receive limited information about minor guests, such as names and ages, from the adult who makes a reservation; we use that information only for check-in, occupancy, safety, and legal compliance purposes. If you are a parent or guardian and believe we have collected personal information directly from your child, please contact us using the information in Section 11 and we will delete it as required by applicable law. To learn more about how to protect your child online, visit the US Federal Trade Commission's materials on protecting children online.

10. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this policy and provide any additional notice required by applicable law.

This Version: Version 1, effective July, 2026. There are no previous versions.

11. CONTACTING US

If you have any questions regarding this Privacy Policy, you may contact us using the information below.

Heavenly Vacations
Attn: Legal Department
2955 Aukele St. STE 204
Lihue, HI 96766
Email: contact@heavenlyvacations.com

12. HAWAII PRIVACY NOTICE

Hawaii has not enacted a comprehensive consumer privacy law. However, as a Hawaii-based company, we are committed to transparency with Hawaii residents, and this section voluntarily provides information regarding the personal information we collect about Hawaii residents and how they can make requests about it.

We collect personal information from residents of Hawaii, such as guests who stay in Heavenly Vacations managed or marketed homes, the owners of such homes, and individuals interested in our property management and real estate services. Over the past 12 months, we collected the categories of personal information that are described in the Information Collected or Received section above, including:

• Payment information
• Identity information
• Contact information
• Bank account and tax information
• Information provided during communications with Heavenly Vacations
• Information provided in connection with a booking or stay
• Information obtained in connection with rental management services
• Information about your site visits
• Device and browser information
• Location information
• Other information as required by applicable law

We collect and use such information for the purposes described in the How We Use Your Information section above, including:

• To fulfill the terms of a contract between you and us
• To respond to your inquiries or requests
• To communicate with you about reservations and stays
• To fulfill contractual or legal requirements relating to your request or the Services you are using
• To provide customer service
• To provide rental management or similar services
• To detect and prevent fraud or illegal activity
• To make or receive payments from you
• To optimize, customize and improve our services and your user experience
• To conduct, measure, and improve our advertising and marketing
• To comply with our legal and contractual obligations and for security and investigation purposes

Exercising Your Privacy Rights

You may submit a privacy request by contacting us at contact@heavenlyvacations.com or as described in Section 14. We will not discriminate against you for exercising any of your privacy rights.

13. PRIVACY NOTICE OF OTHER U.S. STATES

Residents of U.S. states that have enacted comprehensive consumer privacy laws (including, for example, California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia, among others) may have certain rights regarding their personal information or personal data, as defined in these states' laws (collectively as used in this section, "personal information"). The privacy laws of these states are referred to in this section as "State Privacy Laws."

Under the State Privacy Laws, personal information may not include certain types of publicly available information, de-identified or aggregated consumer information, or certain information excluded from the scope of the laws, such as protected health information covered by HIPAA and personal information covered by certain sector-specific privacy laws, including the FCRA and GLBA.

We collect personal information from and about our users, such as guests who stay in Heavenly Vacations homes, the owners of such homes, and individuals interested in our property management and real estate services. Over the past 12 months, we have collected the categories of personal information (including "sensitive" personal information as defined by State Privacy Laws) that are described in the Information Collected or Received section above, including:

• Payment information
• Identity information
• Contact information
• Bank account and tax information
• Information provided during communications with Heavenly Vacations
• Information provided in connection with a booking or stay
• Information obtained in connection with rental management services
• Information about your site visits
• Device and browser information
• Location information
• Other information as required by applicable law

We collect and use such information for the purposes described in the How We Use Your Information section above, including:

• To fulfill the terms of a contract between you and us
• To respond to your inquiries or requests
• To communicate with you about reservations and stays
• To fulfill contractual or legal requirements relating to your request or the Services you are using
• To provide customer service
• To provide rental management or similar services
• To detect and prevent fraud or illegal activity
• To make or receive payments from you
• To optimize, customize and improve our services and your user experience
• To conduct, measure, and improve our advertising and marketing
• To comply with our legal and contractual obligations and for security and investigation purposes

We disclose information to the categories of entities set forth above in How We Disclose Your Information.

For purposes of certain State Privacy Laws, the following activities may constitute a "sale" in some instances, such as disclosing information about you with local third-party business partners who may offer additional services in connection with a property you have booked. We do not otherwise "sell" personal information as that term is defined by State Privacy Laws.

For purposes of the State Privacy Laws, we process personal information in a manner that constitutes "targeted advertising." We may use certain personal information about you, such as your email address, to hash and share it with advertising publishers such as Facebook or Google to generate leads or otherwise promote our Services. We may also capture information about your use of our website and other online Services through cookies and other online technologies for advertising purposes. In connection with such advertising, we may share your personal information with advertising networks and providers, advertisers, and social media networks, which may be considered the processing of personal information for targeted advertising. You can learn more about our use of these technologies by visiting our Cookie Policy.

Exercising Your Privacy Rights Under State Privacy Laws

Depending on your state of residence, you may request to exercise your rights, as applicable, by submitting a verifiable consumer request as described in Section 14.

Right to Access: To know whether or not we are processing your personal information and to access (obtain a copy of) such personal information that you previously provided to us.

Right to Correct: To correct inaccuracies in your personal information, as applicable, taking into account the nature of the personal information and the purposes of the processing.

Right to Delete: To request that we delete certain personal information about you. Where an exception applies, we may not fulfill your request for deletion.

Right to Opt Out: To opt out of targeted advertising or the "sale" of personal information about you. You may do so by managing your choices in the cookie preference center available by clicking the "Your Privacy Choices" link in the footer of the website or by submitting a request as described in Section 14.

Right to a List of Third Parties: To obtain a list of the specific "third parties" (as that term is defined under applicable State Privacy Laws extending this right), other than natural persons, to which we have disclosed any personal information.

We do not process personal information for the purpose of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, as defined by State Privacy Laws.

Only you or an authorized agent as authorized by State Privacy Laws may make a verifiable consumer request related to your personal information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are (a) the person about whom we collected personal information or (b) an authorized representative of such person, and must describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Upon receiving your request, we will respond promptly. To the extent that we successfully verify your identity and determine that we will fulfill part or all of your request, we will complete the request within the timeframe required under applicable State Privacy Law, unless we require an extension, in which case we will inform you of the extension.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision.

We will not discriminate against you for requesting to exercise your State Privacy Law rights. In the event that we deny your verifiable consumer request, you may appeal the decision by contacting contact@heavenlyvacations.com with the subject line "State Privacy Rights Appeal." Your appeal must describe in detail why you believe the denial was in error. Your description must include your full name and the email address you used in connection with our Services, along with a copy of the denial notice you received from us.

14. HEAVENLY VACATIONS DATA REQUEST FORM

To submit a data or privacy request, please contact us at:

Email: contact@heavenlyvacations.com
Mailing Address: Heavenly Vacations, Attn: Legal Department, 2955 Aukele St. STE 204, Lihue, HI 96766

Please include your full name, the email address you used in connection with our Services, your state or country of residence, and a description of your request.

HEAVENLY VACATIONS COOKIE POLICY

Like almost all commercial websites, Heavenly Vacations's websites use cookies to improve the functionality of our websites and streamline your user experience. You may delete and block all cookies from the sites, but parts of the sites may not work correctly (or at all). Even if you are only browsing the sites, certain information about your visit may be automatically collected. This information includes information about the platform and operating system you are using, your browser type and version, computer and connection information, and what time you accessed the sites. Unless you opt out, this information may be collected every time you access Heavenly Vacations's websites.

What are cookies?

A cookie is a small text file that is placed in your browser to allow a website to recognize your browser or device. Cookies are used for many purposes, such as enabling certain site functionality, storing user preferences, permitting analytics, and enabling ad delivery. Cookies can help us understand how visitors use our site, help you navigate between pages efficiently, help remember your preferences for later visits, and generally improve your browsing experience. Cookies can also help ensure that marketing you see online is relevant to you and your interests.

The length of time a cookie will stay on your computer or mobile device depends on whether it is a "session" or "persistent" cookie. A session cookie will only remain on your device until you close your browser. A persistent cookie will remain until it expires or is deleted. Each persistent cookie has an expiration date; some cookies may expire after a few minutes while others may not expire for several years.

What types of cookies does Heavenly Vacations use?

When you visit and use a Heavenly Vacations website, Heavenly Vacations or a third party may place a number of cookies in your browser. Some cookies will only be used if you use certain features or select certain preferences, and some cookies will always be used. Cookies placed by the website you're visiting (in this case, a Heavenly Vacations site) are sometimes called "first-party cookies," while cookies placed by other companies are sometimes called "third-party cookies."

In general, there are four different types of cookies, which are explained below. Heavenly Vacations routinely uses all four types of cookies.

Strictly Necessary Cookies. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

Functional Cookies. These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

Targeting Cookies. These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

How can you manage and delete cookies?

Most browsers accept cookies automatically. However, you can change the settings in your browser to delete cookies that have already been set and to not accept new cookies. Instructions for managing cookie settings are available in the help documentation of all major browsers, including Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, and Opera. Browsers on mobile devices may have different ways to manage cookie settings. Note that if you set your browser to disable cookies, you may not be able to access certain parts of the Heavenly Vacations sites and some services we offer may not work properly or at all.

Depending on your location, you may have the legal right to opt out of the sharing or sale of personal information on Heavenly Vacations's websites. Please see "Your Privacy Choices" at the bottom of this page, or submit a request as described in Section 14 of our Privacy Policy.

Do you use any other user tracking technologies?

Heavenly Vacations may use other technology that is standard to the Internet, such as pixel tags, web beacons, and other similar technologies, to track visitors to our sites.

Global Privacy Control ("GPC") and Do Not Track.

You may choose to use a tool to communicate your choices through an opt-out preference signal, such as the Global Privacy Control ("GPC") on your browser or device, if available. Heavenly Vacations honors GPC signals as a request to opt out of the sharing or sale of personal information for purposes of targeted advertising on our website. Heavenly Vacations does not respond to legacy browser settings or signals such as "Do Not Track."

HEAVENLY VACATIONS CONSUMER HEALTH DATA PRIVACY POLICY

This Consumer Health Data Privacy Policy supplements the Heavenly Vacations Privacy Policy (the "Privacy Policy") and applies to personal data defined as "consumer health data" ("CHD") by the Washington state My Health My Data Act ("MHMDA") and Nevada's Consumer Health Data Privacy Law ("Nevada CHD Law"). Undefined capitalized terms shall have the meaning in the Privacy Policy.

Categories of CHD Collected

As described further in our Privacy Policy, and depending on how you interact with Heavenly Vacations and applicable law, we may collect certain information that may qualify as CHD. For example, you may provide us with accommodation preferences and requests, such as a request for Heavenly Vacations properties with wheelchair access. We might also collect information related to trust and safety issues, such as information collected about injuries at a Heavenly Vacations property, which might include medical records you provide to us or we are authorized to collect. The precise categories of CHD depend in part on what you disclose to us, but they may without limitation include the following categories:

• Individual health conditions, treatment, diseases, or diagnoses
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Bodily functions, vital signs, symptoms, or measurements of health information
• Diagnoses or diagnostic testing, treatment, or medication
• Data that identifies a consumer seeking health care services
• Other information that may be used to infer, derive, or extrapolate data related to the above or other health information

Sources of CHD

Our Privacy Policy describes the sources of information we collect about you. CHD may be collected from the following sources: (1) directly from you; and (2) third-party sources (such as if you authorize us to receive such information from healthcare providers).

Purposes for Collection of CHD

We describe the purposes for collection and use of information about you, including CHD, in the "How We Use Your Information" section of our Privacy Policy. As further described there and subject to applicable law, we may collect and use CHD as directed by you or with your consent, or (1) to provide and manage the Services; (2) to optimize, customize, and improve the Services; and (3) for security and legal purposes, such as to comply with laws or to establish, exercise, or defend our legal rights.

How and Why We Share CHD

We may share each of the categories of CHD described above for business purposes to the categories of entities described in the "How We Disclose Your Information" section of our Privacy Policy. As further described in our Privacy Policy and subject to applicable law, we may share the categories of CHD:

• to deliver products and services to you, including to find properties with accommodation features that you request;
• to enhance our products, services, and your customer experience;
• to protect Heavenly Vacations and others, including to enforce our Terms of Service, Privacy Policy, or other contracts with you, and for fraud prevention;
• to comply with our legal obligations; and
• in connection with any negotiation or completed acquisition, merger, or purchase involving our business assets.

As described in our Privacy Policy, we reserve the right to create aggregated data from the information we collect through the Services and our disclosure of such aggregated data is in our discretion.

As further described in our Privacy Policy, and subject to applicable law, we may share CHD with the following categories of third parties and affiliates:

• Vendors that provide services to us;
• For the protection of Heavenly Vacations and others;
• For legal purposes (e.g. to governmental entities in response to legal process);
• As necessary for business transfers;
• At your direction or with your consent (such as sharing with other users/public if you post in comments or reviews about Heavenly Vacations properties); and
• With affiliates and subsidiaries of Heavenly Vacations.

How To Exercise your MHMDA or Nevada CHD Law Rights

Subject to exceptions, the MHMDA and Nevada CHD Law extend certain rights to CHD. Depending on your jurisdiction, this may include requests (1) to confirm whether Heavenly Vacations is collecting, sharing or selling your CHD; (2) to access your CHD; (3) to delete your CHD and (4) to withdraw your consent to the collection or sharing of your CHD. You can seek to exercise these rights by contacting contact@heavenlyvacations.com with the subject line "Consumer Health Data Privacy Rights." Depending on the nature of your request, we may contact you for further information if appropriate to authenticate your identity. Note, however, that Heavenly Vacations will never ask you for sensitive personal or financial information when authenticating your identity, and no Heavenly Vacations employee will ask you to tell them your password.

If we deny your request in whole or in part, you may appeal that decision by contacting contact@heavenlyvacations.com with the subject line "Health Data Privacy Rights Appeal." If you are a resident of Washington and your appeal is denied, you can contact the Washington State Attorney General at www.atg.wa.gov/file-complaint. If you are a resident of Nevada and your appeal is denied, you can contact the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/.

Updates to this CHD Policy

We reserve the right to change this CHD Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. We will make the revised CHD Policy accessible through the Services, so you should review it periodically. The date this CHD Policy was last revised is identified at the top of the document. You are responsible for periodically monitoring and reviewing any updates to the CHD Policy. If we make a material change to the CHD Policy, we will provide you with appropriate notice in accordance with legal requirements. Your continued use of our Services after such amendments (and notice, where applicable) will be deemed your acknowledgment of these changes to this CHD Policy.

Contact Us

If you have any questions about this CHD Policy or Heavenly Vacations's privacy practices, please contact us at:

Heavenly Vacations
2955 Aukele St. STE 204
Lihue, HI 96766
Email: contact@heavenlyvacations.com