Cookie & Data Collection Notice

Cookies are small text files placed on your device when you visit a website. They help the site remember your preferences and understand how you interact with its pages. Lotus Essence uses a consent-first approach: we do not place any optional cookies on your device until you give us clear, informed permission. Essential cookies that are strictly necessary for the website to function may be set without prior consent, as they do not collect personal data for tracking purposes.

We process cookie data under the following legal bases: Essential cookies: Legitimate interest — these are strictly necessary for the website to operate and cannot be disabled without breaking core functionality. Analytics cookies: Consent — placed only after you click "Accept" on the cookie banner. You can withdraw consent at any time. We comply with UAE Federal Decree-Law No. 45/2021 on Personal Data Protection, the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA), and other applicable data protection laws.

These cookies are required for basic site functionality. They do not collect personally identifiable information for marketing or analytics. | Cookie | Purpose | Duration | |--------|---------|----------| | authjs.session-token | Keeps you signed in securely | Session | | __Secure-authjs.session-token | Secure session token (HTTPS) | Session | | cookie_consent | Stores your cookie preference | 1 year | | theme | Remembers your light/dark mode choice | Persistent | These cookies are always active and do not require your consent.

We use Google Analytics 4 (GA4) to understand how visitors navigate our site. These cookies are optional and are only placed after you explicitly accept them via the cookie banner. | Cookie | Purpose | Duration | |--------|---------|----------| | _ga | Distinguishes unique visitors | 2 years | | _ga_[ID] | Maintains session state | 2 years | If you decline analytics cookies, these are never set and no data is sent to Google.

Lotus Essence does not use: • Advertising or retargeting cookies • Social media tracking pixels • Cross-site tracking cookies • Browser fingerprinting techniques • Third-party data brokers or ad networks • Any form of surveillance advertising We do not sell, share, or trade your browsing data with any third party for advertising purposes.

When analytics cookies are enabled, our GA4 configuration includes these privacy protections: • IP anonymization enabled — your full IP address is never stored • Data retention set to 26 months (shortest available option) • Google Signals disabled — no cross-device tracking • Advertising features disabled — no remarketing audiences • Data sharing with Google disabled • Cookie flags set to Secure and SameSite=Lax We use analytics solely to understand which pages are visited and to improve the user experience — not to profile individual visitors.

Beyond cookies, our website may collect data in these ways: Forms: When you submit a contact form, booking request, or questionnaire, we collect the information you provide. This is processed under your consent or to fulfil a contract. Email communications: We may track whether emails are opened and which links are clicked, but only for subscribers who have opted in to marketing communications. Server logs: Our web server automatically records basic request data (IP address, page requested, timestamp, HTTP status code) for security and troubleshooting. These logs are retained for a maximum of 90 days. CDN (Content Delivery Network): We use a CDN to serve static assets quickly. The CDN may set a technical cookie (__cf_bm) for bot protection. This is an essential cookie.

You have several ways to control cookies and data collection: Cookie banner: When you first visit the site, a banner gives you the option to Accept or Decline optional cookies. Both choices are equally easy to make. Change your mind: Clear your browser cookies to reset the banner, or contact us to update your preference. Browser settings: Most browsers let you block or delete cookies. See your browser's help pages for instructions. Google Analytics opt-out: Install the official Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout Global Privacy Control (GPC): If your browser sends a GPC signal (Sec-GPC: 1), we automatically treat this as a request to decline all optional cookies. No banner is shown — your preference is honoured silently. Do Not Track (DNT): If your browser sends a DNT signal (DNT: 1), we respect it in the same way as GPC — all optional cookies are declined automatically.

Regarding cookies and data collection, you have the right to: • Be informed about what cookies we use and why • Give or withhold consent for optional cookies • Withdraw consent at any time without affecting the lawfulness of prior processing • Access the data we have collected through cookies • Request deletion of cookie-related data • Lodge a complaint with a data protection authority if you believe your rights have been violated To exercise any of these rights, contact us at privacy@lotus-official.com.

Our website is not directed at children under 16. We do not knowingly collect cookie data from children. If you believe a child has accessed our site and analytics cookies were set, please contact us and we will delete the relevant data promptly.

We may update this Cookie & Data Collection Notice from time to time. When we make material changes, we will: • Update the "Last Updated" date at the top of this page • Reset the cookie banner so you can make a fresh choice under the new terms • Notify registered users by email if the changes are significant We encourage you to review this notice periodically.