PRIVACY POLICY
A. Introduction
Welcome to Huvafen Fushi Maldives! Huvafen Fushi is owned by Nakatchafushi Holdings Private Limited in the Maldives and it is managed by Versa Resorts Management Private Limited in the Maldives. Having served millions of guests, we understand how privacy is important to every individual. We are committed to protecting Personal Data that you share with us by various means for numerous purposes.
This Policy describes how your Personal Data is collected, processed, stored and used in accordance with our data protection standards and in compliance with the Applicable Laws. The continuous use of our Websites will constitute your express acceptance and consent to be bound by this Policy. We request you to properly read and familiarize with the contents of our Privacy Policy before you avail our services.
Our Websites are not intended for children and we do not knowingly collect their information unless that information is provided to us by the parents or guardians. We do not expect any child to forward us his Personal Data without consent of his/her parent or guardian.
B. Definitions
In this Policy, the following terminologies have the meaning ascribed to them below.
“We”, “Company”, “Us” or “us” means Nakatchafushi Holdings Private Limited .
“Policy” means this privacy policy for the website users.
“Guests” means guests who are availing the services at any of the Property.
“Property” means Huvafen Fushi Maldives which is owned by Nakatchafushi Holdings Private Limited and managed by Versa Resorts Management Private Limited.
“Website” means this website.
“Applicable Laws” means laws applicable to us in relation to the processing of Personal
Data in the course of our business.
“Data Subjects” means an identified or identifiable natural person.
“GDPR” means the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“Personal Data” means any information relating to a Data Subject or an identifiable natural person one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing”, “process” or “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Child” means a natural person below the age of sixteen (16).
“Special Categories of Personal Data” means the special categories of data as recognized in Article 9(1) of the GDPR.
C. Data Controller
Nakatchafushi Holdings Private Limited at No. 39, Orchid Magu, Male, Maldives is the Data Controller for the Personal Data that we collect from this Website. As the Data Controller, we will be responsible for collecting, processing and storing your Personal Data.
D. Data Protection Officer
Our Data Protection Officer administers this Policy. If you have any complaints, questions or comments regarding this Policy, the Personal Data we hold on you or you want to exercise any of your rights under the GDPR, please contact the Data Protection Officer. The contact details are as follows;
Name of the Entity: Nakatchafushi Holdings Private Limited
Designation: Data Protection Officer
Email Address: [email protected]
Postal Address: No. 39, Orchid Magu, Male, Maldives
Telephone: +960 664 4222
E. Data Protection Principles
We are committed to processing Personal Data in accordance with this Policy and the Applicable Laws. We adhere to the following Data Protection Principles in processing Personal Data;
- processed fairly and lawfully and in a transparent manner;
- collected for specified, explicit and legitimate purposes;
- adequate, relevant and limited to what is necessary;
- accurate and where necessary kept up to date;
- kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which those Personal Data are processed;
- processed in a manner that ensures appropriate security of the Personal
F. What Personal Data Is Collected by Us?
We may collect different types of Personal Data you provide to us. This may include data relating to the areas like your identity, reservation, contact details, payments, internet access. We have grouped them as follows. However, these groups are not exhaustive and there could be Personal Data that we collect which do not fall into any of the categories mentioned below.
Identity related information including full name, last name, middle name, first name, maiden name, marital status, title, date of birth, gender, nationality, passport number, copy of passport or identification document, visa information, membership number of loyalty programme, user name and password of the loyalty programme, country of residence, wedding anniversary, profession.
- Contact information including email address, telephone number, mobile number, postal address, fax number, residential address.
- Travel information including date of arrival, date of departure, estimated arrival time, estimated departure time, arriving flight, departure flight, boat transfers, sea plane transfers.
- Reservation and profiling information including type of room, meal preferences, dietary requirements, food allergies, special meals, special requests, purchases from bar and restaurants, use of spa, preference for smoking, preference for non- smoking room, preferred type of bedding, preferred type of newspapers/magazines, sports, cultural interests, your questions/comments/feedback during or following a stay, website accessed
- Payment related information including credit or debit card information, card number, expiry date, card holder’s name, billing address and other billing information;
- Technical information relating to your access to the Website and internet usage during the stay at Resorts;
- Marketing and communication related information with regard to your preferences to receive marketing communication from us or third parties;
- Career related information such as educational qualifications, professional experience, engagement with professional associations, Information about your contract of employments (or services) including start and end dates of employment, role and location, job responsibilities, working hours, details of promotion, salary (including details of previous remuneration), pension, benefits and holiday entitlement;
We may also collect your Personal Data which might fall into the category of Special Categories of Personal Data. We may hold and use any of these Special Categories of Personal Data in accordance with the Applicable Law. We may have to collect Special Categories of Personal Data relating to you to perform our contractual obligations to you or to comply with Applicable Law.
G. HOW DO WE COLLECT YOUR PERSONAL DATA?
Personal Data may be collected from various means including;
- when you make reservations at Resorts by directly engaging with us through our Website, email, telephone or any other means;
- when you pre-check-in via our Website or check-in to the Property to avail our services;
- when you avail facilities and services offered through our Website, create accounts in our Website, interact with our chat box, programme, subscribe to our newsletters or new offers, participate in competitions, make complaints, provide feedback, participate in surveys;
- when we administer your credit card payments including refunds to your bank account;
- when we deal with your complaints or claims made in relation to the services we provide at the Resorts;
- when you access our Website using your equipment, IP address, browsing action, patterns, your locations;
- when complying with the Applicable Laws;
H. HOW DO WE USE YOUR PERSONAL DATA?
We ensure that we process your Personal Data only on the following grounds.
- Consent – This means Data Subjects have granted express consent to us to process their Personal Data. We ensure that Data Subjects are informed of the purposes of the processing before we obtain the consent and collect Personal Data.
In obtaining the consents of Data Subjects, we ensure that request for consent shall be presented to Data Subjects in an intelligible and easily accessible form, using clear and plain language. We will maintain the records of consents given by Data Subjects to demonstrate the consenting by Data Subjects.
Where the Personal Data relates to a Child, the consent needs to be given by the holder of parental responsibility over the Child. Where we rely on the consent of the Data Subject to process Personal Data, Data Subjects are offered to withdraw the consent.
- Performance of Contract – This means processing Personal Data is necessary to perform a contract we have entered into with the Data Subject or to take steps at the request of Data Subjects before entering into a contract with that Data Subject.
- Complying with Applicable Laws – This means processing Personal Data of Data Subjects is necessary for us to comply with the Applicable Laws.
- Public Interest – This means processing of Personal Data is necessary for the performance of a task carried out in the public interest or in the exercise of any official function assigned to us by the Government of Maldives.
- Vital Interest – This means processing of Personal Data is necessary in order to protect the vital interests of the Data Subject or of another natural person.
- Legitimate Interests – This means legitimate business interest pursued by us or third parties. Serving our guests with the highest standard of service, continuously improving our service standards, dissemination of information regarding our new promotions are part of legitimate business interests. We ensure that we consider any impact on the Data Subjects and his/her rights before we process any Personal Data to achieve any Legitimate Interest of ours. Except in the instances where the Applicable Laws require or the Data Subject has consented to the processing, we will not process Personal Data of Data Subjects to achieve our Legitimate Interests when the impact on that Data Subjects overrides our interests.
We indeed respect the rights of Data Subjects to restrict the processing of his/her Personal Data and to object for the use of his/her Personal Data. We will honour such requirement of Personal Data unless there is a compelling legitimate ground for the processing such Personal Date like exercising our legal rights, defending a legal claims or complying with Applicable Law.
The purposes for which we process Personal Data, include the following. However, the following list is not exhaustive, and we will be able to provide you with additional information you may require in that regard. We have also identified what our Legitimate Business Interests are where appropriate.
| Purpose/Activity | Type of Personal Data | Lawful Basis for Processing |
| Make your reservation | · Identity related information · Contact information · Travel information · Payment related information · Technical information | · Consent · Performance of Contract |
| Pre-arrival Checking-in via Websites | · Identity related information · Reservation and profiling data · Contact information | · Consent · Performance of Contract · Legitimate Business Interest (to ensure |
|
| · Travel information · Technical information · Special Categories of Personal Data | that the Property is ready for the guest by the time the guest arrived at Property and to provide a personalized service to the Property) |
| Guest checking-in at the Resorts | · Identity related information · Contact information · Reservation and profiling data · Travel information · Payment related information · Special Categories of Personal Data | · Consent · Performance of Contract · Comply with Applicable Laws |
| Provide services during your stay including spa treatment, snorkeling activities, diving activities | · Identity related information · Special Categories of Personal Data · Reservation and profiling data | · Consent · Performance of Contract · Legitimate Business Interest (to provide superior service to guests) |
| Provide transportation and guest services | · Identity related information · Travel information | · Consent · Performance of Contract · Legitimate Business Interest (to provide seamless transportation connectivity and convenience to guests) |
| Refunding credit card payments | · Payment related information | · Consent · Performance of Contract |
| Creating a Log-in Account via Websites | · Identity related information · Contact information | · Consent · Performance of Contract · Legitimate Business Interest (to provide a personalized service via web) |
| Subscribing to newsletter and promotional materials | · Identity related information · Contact information | · Consent · Performance of Contract · Legitimate Business Interest ( to promote our new offers and services) |
| Providing medical services | · Special Categories of Personal Data | · Consent · Performance of Contract · Legitimate Business Interest ( to ensure safety and health of our guests) |
| Improving security at Resorts | · Security surveillance related information | · Performance of Contract · Legitimate Business Interest ( to ensure security of guests and resorts) |
| Guests’ repeaters programme | · Identity related information · Reservation and profiling data | · Legitimate Business Interest |
|
| · Contact information | ( to appreciate guests loyal to us) |
| Handling your complaints or claims | · Identity related information · Reservation and profiling data · Contact information · Special Categories of Personal Data | · Consent · Performance of Contract · Legitimate Business Interest (to ensure that lapses in the services are understood, compensated and recurrence is prevented ) |
| Repatriating guest’s body | · Identity related information · Reservation and profiling data · Contact information · Special Categories of Personal Data | · Vital interest · Legitimate Business Interest
(to ensure that guests are respected ) |
| Paying of taxes | · Identity related information · Reservation and profiling data | · Comply with laws |
| Co-operating with criminal investigations | · Identity related information · Reservation and profiling data · Contact information · Special Categories of Personal Data | · Comply with laws |
| Complying with directives from the Ministry of Health | · Identity related information · Reservation and profiling data | · Public Interest · Comply with laws |
|
| · Contact information · Special Categories of Personal Data |
|
| Conducting our marketing activities | · Identity related information · Contact information | · Legitimate Business Interest (to promote our business, offers, new services and new properties with you) |
| Establishing, defending or pursuing legal claims or litigation | · Identity related information · Contact information · Reservation and profiling data · Travel information · Payment related information · Special Categories of Personal Data | · Legitimate Business Interest
(to protect our legal interests) |
I. WITH WHOM WE WILL SHARE YOUR PERSONAL DATA
Your Personal Data will be stored by us. In addition, we share your Personal Data with third parties whose services are required to perform our contract with you, in compliance with Applicable Laws. In addition, we will share your Personal Data with third parties where you have consented to.
The external parties with whom we may share your Personal Data include;
- Service providers, contractors and agents acting as processors who provide services such as transportation, airport pick-ups, diving, snorkeling, spa treatment, insurance, recreational services, contact centers, advertising, marketing etc.;
- Tour operators dealing with us;
- Professional advisors including lawyers, bankers, auditors and insurers providing services to us;
- Internet payment gateway service providers, banks, credit card companies, debit card companies and other financial service providers providing services to us;
- Any law enforcement authority, governmental ministries or governmental institution such as Police, customs, immigration, inland revenue, public health
- Diplomatic missions in the Maldives and any other
In all these instances where we disclose your Personal Data to external parties, where possible, we will strive to maintain that we disclose that Personal Data only to the extent of necessity, those Personal Data are treated in accordance with Applicable Laws and those Personal Data is not used for their own purposes. We will endeavour to ensure that those Personal Data are dealt with only for the specific purpose for which it is disclosed.
J. DATA TRANSFERS
We host all the Personal Data that we collect in the Maldives and in the cloud environment. In instances where we transfer Personal Data to third parties based outside the European Economic Area for our business purposes or to perform our contract with you, we ensure that protection is available to the Personal Data by ensuring at least any of the following safeguards is implemented.
- The non-EEA countries to which we transfer Personal Data have already been deemed by the European Commission as to providing an adequate level of
- If the third party service providers are based in the U.S, we may transfer data to them if they are part of the EU-US Privacy Shield which requires them to provide similar protection to Personal Data shared between the Europe and the
- Where we use third party service providers which are not based in the European Economic Area or the US, we may use specific contracts which gives Personal Data the same protection in line with the GDPR.
K. MARKETING
We would like to send you information about new offers and services offered by our Property which, as we think you, might be of interest to you. We may use the Personal Data relating your identity, your contact details, your IT infrastructure, your use of our Websites or profiling data to understand what your needs and, what you want and what may be of interest to you.
If you have previously availed our services or if you have requested information us relating to new offers and services, you would continue to receive marketing communication from us.
You have the right at any time to stop us contacting you or sharing new offers and services or giving your Personal Data to other parties in compliance with this Policy. If you no longer wish to be contacted for marketing purposes, you may withdraw your consent to receive our communication at any time either by unsubscribing through the link provided in such an email or by informing the Data Protection Officer.
L. HOW DO WE PROTECT YOUR PERSONAL DATA?
We take appropriate technical and organizational security measures, in accordance with applicable legal provisions, to protect your Personal Data against unlawful, unauthorized or accidental access, use, destruction, alteration, loss or disclosure. We always limit the access to your Personal Data only to those employees, agents, contractors and other third parties who have a need to know them and ensure that they are under a duty of confidentiality when they deal with your Personal Data. They will only process your Personal Data on our instructions. We have also put a procedure in place to deal with any data breach or suspected data breach of Personal Data. We will notify you and any applicable regulator of a breach where we are legally required to do so. We emphasize that it is your responsibility to safeguard any email or password that you have created or used in connection with our Websites or the Property.
M. RETENTION AND STORAGE
Unless otherwise required by the Applicable Law for longer periods, we retain your Personal Data in accordance with our Data Retention Policy.
N. YOUR DUTY TO INFORM US OF CHANGES
It is important that the Personal Data we hold about you is accurate and current. We also understand that you may want to access, change or delete your Personal Data. It is your obligation as well to keep us informed if your Personal Data changes during your relationship with us. Therefore, you may correct, update, amend, or remove your personal data by requesting us to do so. You may contact our Data Protection Officer and request for the modification.
O. WHAT ARE YOUR PERSONAL DATA PROTECTION RIGHTS?
We want to ensure that you are well aware of your data protection rights. We are fully committed to uphold your data protection rights. You are entitled to:
- The right to access: You have the right to request us for copies of all of your Personal Data in our custody. We may charge a nominal fee to provide you with your Personal Data if requested.
- The right to rectification: You have the right to request us to correct any Personal Data that you believe is You also have the right to request us to complete any information that you believe as inaccurate. We may have to verify the accuracy of new Personal Data which you may provide to us.
- The right to erasure: You have the right to ask us to erase your Personal We will comply with such request subject to the Applicable Laws and to any prevailing contractual obligations to you.
- The right to restrict processing: You have the right to request us that we will restrict processing your Personal Data under certain conditions. We may honour such request subject to the Applicable Laws and to any contractual obligations towards you. You may understand that we would require to process your Personal Data in order to perform our contractual obligations towards you.
- The right to object processing: You have the right to object processing your Personal Data under certain We may honour such objection subject to the Applicable Laws and to any contractual obligations towards you.
- The right to data portability: You have the right to request that we transfer your Personal Data in our possession to another organization or directly to you under certain conditions.
- The right to withdraw consent at anytime: You may withdraw your consent at any time where we rely on your consent to process your Personal You may understand that withdrawal of your consent may have an impact on the delivery of our services to you or performance of our contractual obligations towards you.
You could contact the Data Protection Officer using the Data Subject Access Request Form when you want to exercise your rights. Where you make the request by electronic means, and unless otherwise requested by Data Subjects, the information shall be provided in a commonly used electronic form. Our compliance with your requests will always be in accordance with the Applicable Law.
We would need specific information from you to verify your identity and your rights to access your Personal Data when you are exercising your rights relating to the Personal Data. We may also ask additional information in relation to your requests to ensure that we are able to honour your request.
If you make a request to us in exercising any of your Data Protection rights, we will endeavour to respond within one month to your legitimate requests. However, it may occasionally take longer than one month if your request is complex, need collaboration of third parties or you have made repetitive requests. In such instances, we will keep you informed in advance.
For maintaining confidentiality of Personal Data and protecting them, we will need to verify the identity of the requestor in order to respond to any request for modification or deletion of Personal Data. For this purpose, you will be asked to include a copy of your passport, driver license or other identification along with your request.
P. USE OF COOKIES
We advise you that we use cookies in our Website. Cookies are packets of data used by servers to send status information to a user’s browser and (if the user allowed) return status information to the original server through the same browser. For instance, we use cookies to help us remember and process the request as per your preferences. They are also used to help us understand your preferences based on previous or current website activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We also use cookies to understand the behaviour patterns of our customers which we will use to innovate our services and develop new offers, to serve you better.
You can set your browser to block cookies. Keep in mind that if you set your browser to block cookies, some features, pages and spaces on our Website will not be accessible, and we will not be responsible in such instances. Cookies on our Websites may include the following categories:
- Strictly Necessary Cookies: These are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas. These cookies are session cookies which are erased when you close your
- Analytical/Performance Cookies: These allow us to recognize and count the number of users of our Websites and see how such users navigate through our
Websites. This helps to improve how our Websites works, for example, by ensuring that users can find what they are looking for easily. These cookies are session cookies which are erased when you close your browser.
- Functional Cookies: These improve the functional performance of our Websites and make it easier for you to use. For example, cookies are used to remember that you have previously visited our Websites. These cookies are session cookies which are erased when you close your browser.
- Targeting Cookies: These record your visit to our Websites, the pages you have visited and the links you have followed to recognize you as a previous visitor and to track your activity on the Websites and other Websites you These cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our Websites. You can delete these cookies via your browser settings. We will not collect these cookies from individuals without notice.
Q. PRIVACY POLICIES OF OTHER WEBSITES
Our Website may contain links to the websites of third parties. Your access to those websites will be governed by the terms and conditions, privacy policy and cookie policy of those third-party websites. Those third-party websites may collect your Personal Data and share them with third parties. We do not control those third party websites and we are not responsible for the behaviour of those websites. As such, you may check those terms and conditions, privacy policy and cookie policy prior to accessing those third party websites.
R. REVISIONS TO THE POLICY
We may modify this Policy from time to time as we regularly review and update its contents. Our Websites will carry the updated version. Therefore, we recommend that you check the Privacy Policy of our Website regularly, particularly when availing our services via the Website.
S. CONTACT US
If you have any complaints, questions or comments regarding this Policy, the Personal Data we hold on you or you want to exercise any of your rights, please contact us by sending an email to [email protected] or send us a letter to the Data Protection Officer, No. 39, Orchid Magu, Male, Maldives.
ABOUT HUVAFEN
WORKING IN A LAND OF ENCHANTMENT
Our sanctuary of wonder is a respite from the everyday. We do our utmost to ensure each guest’s stay is curated to their every wish and desire. Bliss is yours to awaken, excitement and adventure are yours to live.
