Privacy policy

The site is operated under the trade names Prima Holiday and P2 Properties, for owners in Mauritius.

Legal name: P 2 Properties. Legal form: LTD. BRN: C23200374. VAT number: VAT 28178652. Registered address: West Beaches 2 Apt 2 La preneuse Black River.

Data protection officer: Paul Marrier d’Unienville. Requests about your personal data go through the contact form or the published phone number, +230 5255 5923.

The site presents short-term rental concierge and property management, and an owner login. It is not a guest booking site. A contact form lets an owner describe a property. A separate login opens the owner space (calendar, bookings, money, invoices) when access has been granted.

When you send the form, the server checks it and records it in Zoho Bigin (a CRM). The site calls the Zoho .com endpoints https://accounts.zoho.com and https://www.zohoapis.com, unless ZOHO_ACCOUNTS_DOMAIN or ZOHO_BIGIN_API_DOMAIN points elsewhere. The person is stored as a Bigin Contact. The request is stored as a Bigin Pipeline, with a description and a note when notes are allowed.

The form can contain: your name; the channel you choose (email, phone, or WhatsApp) and the matching detail; and, if you fill them in, the locality, property type, number of bedrooms, situation, timeline, plan you have in mind, and message. It also sends the page language (French or English) and whether you ticked the optional marketing box. That box is unchecked to start with.

A technical submission id is sent so the same click is not created twice. A hidden field named website is a trap for automated posts: if it is filled in, the request is not stored.

The browser keeps campaign context for the visit in sessionStorage under the key prima_acquisition (source, medium, campaign, content, term, landing path, conversion path, button, referrer host only, and touch times). No name or message is put there. Of that context, the server writes source, medium, campaign and the button into Bigin when they exist. The site does not copy the other attribution fields into a Bigin field.

Your IP address is used only in the memory of the server instance, to slow repeated posts (a short window, a handful of attempts). It is not written into the Bigin record.

If Bigin is not configured, production does not pretend the request was saved. The form then shows an error and the published phone number.

The marketing tick box is separate from the enquiry. Leaving it unticked does not block the request. Ticking it records a yes on the Bigin pipeline. The details are not sold. You can withdraw that agreement through the contact form.

Pages load Vercel Web Analytics, the measurement already installed on this site. The script is requested from this site at /_vercel/insights/script.js, which Vercel serves. The site does not set an analytics cookie, and the interface has no cookie banner.

Events sent by the site (page and service views, clicks on calls to action, phone and WhatsApp, form start and submit attempt, and a lead-created event) do not include your name, email, phone, WhatsApp number or message. The lead-created event can include the Bigin record id and coarse campaign dimensions, and only after the server has really saved the enquiry.

By default those events are sent without asking. If the environment variable NEXT_PUBLIC_ANALYTICS_REQUIRE_CONSENT is set to 1, they are sent only when localStorage contains prima_analytics_consent with the value granted. The interface does not write that value.

NEXT_LOCALE is a cookie used to remember French or English. prima_owner_portal is the owner-session cookie: httpOnly, SameSite=Lax, Secure in production, path /, kept for 7 days, cleared on logout. It is not readable by page scripts. prima_acquisition is sessionStorage, not a cookie. prima_analytics_consent is localStorage, and is read only when the consent flag above is on.

Login sends your email and password to this site, which checks them server-side with the Prima guest application. The password is not stored in Bigin and is not written into the contact form. On success the session cookie above is set. The space then shows the lodgings, calendar, bookings and amounts tied to that access.

Failed attempts are counted in server memory, by email and by IP, so a burst of failures can be paused. Those counters are not a customer file.

When the lodging file includes them, the space shows a link to a Zoho Books invoice and a Zoho WorkDrive folder. A Google Maps link may be shown for the address. No map is embedded in the page. Logout clears the cookie and returns to the login page.

Under the Data Protection Act 2017: to answer an enquiry you chose to send and to take steps before a possible contract; to run the owner space when you have access; with your consent for optional marketing; and on a legitimate interest for limited audience measurement and for slowing abuse of the form and the login.

Where the GDPR applies (for example if you are in the European Economic Area): the enquiry and the owner space correspond to steps toward or under a contract; optional marketing relies on consent; limited measurement and abuse prevention rely on legitimate interest. You can object to measurement or marketing, and you can withdraw marketing consent, without affecting an enquiry already sent.

Recipients are Vercel (hosting and audience measurement), Zoho Bigin (the enquiry), and, for login only, the Prima guest application called by the server. Zoho Books and Zoho WorkDrive are opened only through the links described above. Access to Bigin records is limited to the people and tools Prima authorises to handle the enquiry.

The Zoho .com endpoints used by default are outside Mauritius. Vercel hosting is in East Asia. Safeguards for transfers outside Mauritius are in place.

Enquiries in Zoho Bigin: 1 year.

Owner-account data: 1 year. The session cookie itself lasts 7 days, or until you log out.

Audience measurement: 1 year.

The in-memory limits on the form and the login expire with the server process. They are not a long-term register.

Under the Data Protection Act 2017 you can ask for access, correction, and deletion, and you can object or withdraw marketing consent, within the limits of that Act. Where the GDPR applies, you can also ask for restriction, portability, and objection to legitimate-interest processing.

Use the contact form. We do not publish an email address on this page. You can also call the published phone number. You may lodge a complaint with the Data Protection Office of Mauritius (https://dataprotection.govmu.org). If the GDPR applies, you may also contact the supervisory authority of your country.

The site is served over HTTPS. The owner cookie is httpOnly. The form is checked on the server, rejects oversized posts, and uses the hidden field and the short rate limit described above. None of this is a promise that a risk cannot occur.

The site is written for property owners. It is not directed at children.