PRIVACY POLICY AND INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

Alibey Maldives Pvt. Ltd. Company is committed to providing distinctive resorts and unique experiences for our guests. Consistent with that commitment, we are respectful of the privacy of the personal data that we receive and use in order to provide and offer services. Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements.

This Privacy Policy applies to personal data that (i) you provide to us when you stay with us, make a reservation, submit an enquiry or otherwise interact with us; and (ii) we collect from you when you visit and use www.joali.com (the “Site”).

The following sections explain the types of personal data we collect, how and why we use that information, the circumstances in which we may share it, and the rights and choices available to you in relation to our processing of your personal data. We also describe the measures we take to safeguard personal data and how you can contact us regarding this Privacy Policy, our privacy practices and the exercise of your privacy rights.

As one of our guests and/or a visitor to our Site, we may collect and process your personal data in accordance with this Privacy Policy and applicable laws and regulations. Depending on the circumstances, we may process your personal data on the basis of contract performance, your consent, our legitimate interests, compliance with legal obligations or other lawful grounds recognised under applicable laws.

This Site may contain links to third-party websites that are not operated or controlled by JOALI. We are not responsible for the privacy practices of such websites and encourage you to review their privacy notices before providing any personal data. 

1. Data we collect
2. Use of data
3. Sharing data
4. Transfer of your data to third countries
5. Your rights
6. How we protect your data
7. How long we keep data for
8. Child safety
9. Updates to our Privacy Policy
10. How to contact us

1. Data we collect
Data you provide voluntarily
We will collect, store and process data about you if you voluntarily provide us with such data in connection with the following:

• Filling in a form on any of our websites;
• Filling in a physical registration card;
• Contacting us by telephone or face to face (e.g., in the context of making a reservation);
• Sending us a letter, e-mail or social media message;
• Subscribing to receive a service from us (e.g., a newsletter, blog or by following us on social media);
• Requesting promotional information from us (e.g., information about any of our good or services);
• Participating in a survey, competition or prise draw; or
• Contributing content to us (e.g., for display on a JOALI blog).

The types of data we may obtain include:

• Your name, gender, home and work contact details, business title, e-mail address, telephone number, date and place of birth, nationality;
• Details of food allergies/dietary requirements and special requests made (for example, relating to a disability) you provide to us;
• Passport and visa information, payment information, travel history and details of joint travellers;
• Dates of your stay or travel with us and associated charges;
• Purchase or delivery of products or services;
• Reviews and opinions about our brands, products and services;
• Data we receive about you from third parties through whom you have booked your arrangements

In limited circumstances, we may process special categories of personal data and other sensitive personal data where necessary to provide services requested by you, accommodate accessibility or dietary requirements, protect health and safety, comply with legal obligations, or establish, exercise or defend legal claims.

Such information may include dietary requirements, allergies, accessibility requirements, health-related information voluntarily provided by you, and other sensitive information relevant to your stay or travel arrangements.

Where required by applicable laws, we will obtain your consent or otherwise ensure that an appropriate lawful basis exists before processing such information.

We may use medical or other sensitive data provided by you to better serve and meet your needs (but under no circumstances will we process any sensitive data for marketing and/or profiling purposes).

Such sensitive data is shared only where reasonably necessary with relevant service providers, hospitality technology providers, reservation systems, travel partners, consultants and other authorised service providers for the purpose of providing the services requested by you.

We process such information only where reasonably necessary to provide services requested by you, comply with legal obligations, protect health and safety or otherwise fulfil legitimate operational requirements.

Where required by applicable laws, we will obtain your consent or otherwise ensure that an appropriate lawful basis exists before sharing or processing such information.

Personal data we collect automatically
When you visit JOALI website or the mobile application we may also collect certain data through the use of “cookies” and other automated means. Cookies are small pieces of information that are stored by your browser on your computer’s hard drive. Such information may comprise the following information:

• Date and time;
• Actions taken on our websites (such as page views, site navigation patterns or application activity;
• Search terms that visitors use to reach our Websites. 
• Originating IP address;
• Domain name;
• Type of browser and operating system used (if provided by the browser);
• Object requested;
• Completion status of the request;
• Geographic location; or
• Language preferences

We collect this information to improve the operation of the Site and the services we provide.

We use cookies and similar technologies to support the operation, security and functionality of the Site, improve user experience, analyse website usage and support personalisation features where applicable.

Depending on your location and applicable laws, we may obtain consent before deploying certain non-essential cookies and similar technologies.

Additional information regarding our use of cookies and similar technologies is available in the JOALI Cookie Policy.

2. Use of data
Typically, we will use and process your data to:

• Help us create content that is relevant to our visitors;
• Make improvements to our websites and social media pages and ensure that content on these is presented in the most effective manner for you;
• Provide you with information, products or services that you request from us or which we feel may interest you;
• Assess and help us understand general trends and patterns relating to our business;
• Provide for the safety and security of our guests and visitors;
• Manage general record keeping;
• Enable us to compile anonymous, aggregated statistics that allow us to understand how users use our websites and to help us improve the structure of our websites;
• Enable you to make reservations and payments;
• Meet any legal and/or regulatory requirements;
• Provide the products or services you request from us; and
• Improve our products and services and to ensure our products and services are of interest to you;
• Personalise communications, guest experiences, offers and content based on your previous stays, enquiries, preferences and interactions with JOALI;
• Manage guest preferences, customer relationship management activities and customer engagement programmes;
• Manage customer relation services; and
• Manage and perform the contractual processes relating to your stay.

The processing of your personal data for:

• Marketing and profiling purposes is managed solely by JOALI as data controller. Your decision to provide your data for such purposes is optional and will have no consequence on your ability to stay with us or benefit from the requested services;
• All purposes concerning your booking, your stay and to provide you with the services you have requested, is managed by JOALI . Your decision to provide data to us is voluntary however, if you do not provide such data you may no longer be able to benefit from our services.

We may process your personal data by both automated and manual means. We may use your data in other ways for which we provide specific notice at the time of collection.

Depending on the circumstances in which personal data is collected and processed, JOALI may rely on one or more of the following lawful bases:

• Performance of a contract with you or taking steps at your request before entering into a contract;
• Your consent;
• Compliance with legal or regulatory obligations;
• Protection of vital interests; and/or
• JOALI's legitimate business interests, provided such interests do not override your rights and freedoms.

Where we rely on your consent, you may withdraw that consent at any time, subject to applicable legal requirements.

Personalisation and Guest Preferences

We may use information relating to your previous stays, enquiries, preferences, interactions and use of our services to personalise communications, enhance guest experiences, manage customer relationships and provide information, recommendations and offers that may be relevant to you.

Such activities are intended to improve the quality, relevance and effectiveness of the services, communications and experiences we provide to our guests.

Where required by applicable laws, we will obtain your consent before carrying out profiling or personalisation activities for marketing purposes.

3. Sharing data
We do not sell, otherwise disclose, or share data we collect and hold about you, except as described in this Privacy Policy.

We may share your data with service providers who perform functions and services on our behalf. Such third parties will be appointed as data processors and will be provided only with data necessary to perform the services on our behalf but are not authorised to use such data for any other purposes. In this regard, we may share your data with our vendors, consultants, and other third-party service providers.

We may share your data with third-party vendors, service providers, contractors, or agents ('third parties') who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal data and to ensure that they cannot do anything with your personal data unless we have instructed. They will also not share your personal data with third party. These contracts also constitute a commitment by those Third Parties to protect your data and to retain it for the period we instruct.

The categories of third parties we may share personal information with are as follows:

• Digital Marketing Service Providers
• Customer Relationship Management Providers
• Advertising and Measurement Partners
• Social Media Platforms
• Affiliate Marketing Programmes
• Cloud Computing Services
• Communication & Collaboration Tools
• Data Analytics Services
  • Payment Processors
  • Performance Monitoring Tools
• Sales & Marketing Tools
• Website Hosting Service Providers

We also may need to share your data in the following situations:

• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• When we use Google Maps Platform APIs: We may share your information with certain Google Maps Platform APIs (e.g. Google Maps API, Places API). We obtain and store on your device ('cache') your location. You may revoke your consent anytime by contacting us at the contact details provided at the end of this document.
• Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.

We disclose personal data to other companies within our corporate structure for the purposes described in this Privacy Statement, such as providing Services and personalising our communication with you.

We may disclose data about you if we are required to do so by law or pursuant to legal process, or in response to a request from law enforcement authorities or other government officials.

4. Transfer of your personal data to a third country
Due to the international nature of JOALI's hospitality operations, personal data may be transferred to and processed by JOALI group companies, reservation technology providers, hospitality management systems, customer relationship management providers, cloud service providers and authorised service providers located in countries outside the jurisdiction in which you are located.

Where personal data is transferred internationally, JOALI will implement appropriate safeguards in accordance with applicable laws and regulations, including contractual safeguards, adequacy mechanisms, data transfer agreements and other recognised transfer mechanisms, where applicable.

5. Your rights 
Subject to applicable laws and regulations, you may have the right to:

• Obtain information regarding our processing of your personal data;
• Access and obtain copies of your personal data;
• Request correction or rectification of inaccurate or incomplete personal data;
• Request the deletion or erasure of your personal data where applicable;
• Request restriction of the processing of your personal data in certain circumstances;
• Object to the processing of your personal data where permitted by applicable law;
• Request the transfer of your personal data to another organisation or directly to you, where technically feasible and legally applicable;
• Withdraw consent where processing is based on consent;
• Request information regarding automated decision-making and profiling activities and, where applicable, object to such processing; and
• Lodge a complaint with a competent supervisory or regulatory authority.

You may also request that we cease sending marketing communications to you at any time by using the unsubscribe link contained in our communications, adjusting your preferences, or contacting us using the contact details provided below.

If you wish to exercise any of your privacy rights, submit a complaint, or have any questions regarding this Privacy Policy or our processing of personal data, please contact us using the contact details set out in Section 10 (How to Contact Us).
To help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the data.

Please note that if you opt out as described above, we may not be able to remove your personal data from the systems of third parties with whom your information has previously been shared in accordance with this Privacy Policy and applicable laws. You may need to contact such third parties directly regarding your request.

6. How we protect your data
We maintain administrative, technical and physical safeguards designed to protect the data you provide against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use. Service providers and contractors who might have access to your data in order to provide services on our behalf will be contractually obliged to keep such data in confidence, provide adequate data security measures, and may not use that data for any other purpose.

For your own protection, we encourage you not to include sensitive personal data, credit card or similar data in any e-mails you send us or our staff.

7. How long we keep data for
JOALI retains personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including:

• Reservation administration;
• Guest relationship management;
• Legal and regulatory compliance;
• Dispute resolution;
• Exercise or defence of legal claims;
• Record-keeping requirements.

Your credit card details are not stored on our servers.

8. Child safety
We are not intended to collect identifiable personal data from individuals under the age of 18 without the consent of their parents. None of the pages on this website has been designed to attract the attention of young people aged 18 years.

9. Updates to our Privacy Policy
This Privacy Policy may be updated periodically and without prior notice to you to reflect changes in our processing of your information and privacy practices. We will post a prominent notice to notify you of any significant changes to our Privacy Policy and indicate at the top of the Privacy Policy when it was most recently updated.

10. Contact us
If you have any questions regarding this Privacy Policy, our privacy practices, or wish to exercise any of your privacy rights, please contact us at:
Marketing Department
Muravandhoo Island, Raa Atoll
Republic of Maldives
Telephone: +960 658-4400
Email: privacy@joali.com