Privacy Policy

1. Data We Collect

We collect personal data that you provide directly to us, including: your full name, email address, phone number, nationality, and travel dates when you submit a booking enquiry or contact form.

We may also collect technical data automatically when you visit our website, including your IP address, browser type, device information, pages visited, and time spent on the site. This is collected through cookies and similar tracking technologies.

If you communicate with us by email or phone, we may retain records of that correspondence to assist with your reservation and improve our service.

2. How We Use Your Data

We use your personal data to: process and respond to booking enquiries; arrange airport transfers and accommodation; send reservation confirmations and pre-arrival information; and communicate with you about your stay.

With your consent, we may also send you promotional emails about special offers, new packages, and updates from RR Retreats. You may withdraw this consent at any time by contacting us at reservations@rrretreats.com or clicking the unsubscribe link in any marketing email.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

3. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases: (a) Contract — to fulfil a booking or respond to a pre-contractual enquiry; (b) Legitimate Interests — to improve our services, maintain website security, and prevent fraud; (c) Consent — for marketing communications and non-essential cookies.

You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Cookies

Our website uses cookies — small text files stored on your device — to ensure the site functions correctly, remember your preferences, and analyse how visitors use the site.

Essential cookies are required for the website to operate and cannot be disabled. Analytics and marketing cookies are only set with your consent, which you can manage through the cookie banner displayed on your first visit.

You can also control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

5. Booking Information Storage

Booking enquiry data submitted through our website is securely transmitted to our reservations team and stored in our internal booking management system. We retain guest records for up to 7 years to comply with applicable financial and legal obligations.

Payment transactions are not processed directly through this website. All payment arrangements are handled directly with our reservations team via secure channels.

6. Third-Party Services

We use the following third-party services that may process your data on our behalf:

Facebook (Meta Platforms, Inc.) — We maintain a Facebook Business Page and may use Facebook's advertising and analytics tools. If you interact with our Facebook page or ads, Meta's Privacy Policy applies to that data. You can review Meta's policy at facebook.com/privacy/policy.

Google Analytics — We use Google Analytics to understand how visitors use our website. Google may process your IP address and browsing behaviour. You can opt out via Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.

GoDaddy — Our website is hosted on GoDaddy's platform. GoDaddy may process technical data as part of hosting and infrastructure services. Their privacy policy is available at godaddy.com/legal/agreements/privacy-policy.

We do not sell your personal data to third parties. We only share data with service providers who are contractually bound to process it securely and only for the purposes we specify.

7. International Data Transfers

RR Retreats is based in the Republic of Maldives. If you are located in the European Economic Area (EEA) or United Kingdom, your data may be transferred to and processed in countries outside the EEA, including the Maldives.

Where such transfers occur, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission, to protect your data in accordance with GDPR requirements.

8. Your Rights

Under GDPR and applicable data protection law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (the 'right to be forgotten'); object to or restrict our processing of your data; request a portable copy of your data; and withdraw consent at any time.

To exercise any of these rights, please contact us at reservations@rrretreats.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include secure HTTPS transmission, access controls, and regular security reviews.

While we take all reasonable steps to protect your data, no internet transmission is completely secure. We encourage you to contact us directly for sensitive communications.

10. Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at reservations@rrretreats.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

RR Retreats — reservations@rrretreats.com — +960 4000226 — Republic of Maldives