Privacy Policy

1. Who We Are (Data Controller)

Dive Dame Pvt Ltd (“we”, “us”, “our”) is the data controller responsible for your personal data collected through the Ataraxis Grand & Spa website and in the operation of our boutique guesthouse, dive, surf, and wellness retreats in Fuvahmulah, Maldives.

Registered Company Name: Dive Dame Pvt Ltd
Trading Name: Ataraxis Grand & Spa
Company Registration Number: C01282020
Registered Address: Kokkiri, Fuvahmulah City, Gnaviyani Atoll, Republic of Maldives
Ministry of Tourism Operating License: 88-QARS/GH/2021/267
Privacy & Data Protection Contact: [email protected]

We comply with applicable Maldivian laws, including the Maldives Tourism Act and data protection principles. Because we welcome guests from the European Union, the United Kingdom, the United States, and across the globe, we have implemented GDPR-aligned privacy protections across all operations to ensure the highest standard of international transparency, fairness, and accountability.

2. What Personal Data We Collect and How

A. Inquiries and Reservation Requests (Website)

When you submit an inquiry or booking request via our website:

Identity & Contact Details: First and last name, email address, telephone/WhatsApp number, country of residence, nationality.
Stay & Activity Details: Travel dates, room preferences, package selections (e.g., Tiger Shark diving, surf camps, wellness packages), number of adults/children, and optional custom requests.
Communication History: Inquiries received through our online forms, Google Workspace email communications, and direct WhatsApp correspondence.

B. Flight Coordination & Maldivian Guest Registration

Following booking confirmation and upon arrival:

Passport & Immigration Information: Full legal name, passport number, date of birth, nationality, expiry date, and passport photo/scan (required for issuing domestic flight tickets between Malé and Fuvahmulah, and for mandatory registration with the Maldives Ministry of Tourism and local council authorities).
Travel Itinerary: International arrival/departure times at Velana International Airport (MLE) and Domestic arrival/departure times from Fuvahmulah Airport.

C. Payments & Financial Records

We do not collect or process credit card numbers directly on our website.

Direct Payment Invoicing: Following direct communication with our reservations team, advance payments are collected via secure links generated through our local banking portal (e.g., Bank of Maldives) or via direct SWIFT international bank transfer.
Data Retained: Transaction dates, reference numbers, proof-of-payment receipts, billing addresses, and bank transfer vouchers. Full credit card data is securely handled by our processing bank and never touches or resides on our servers.

D. Scuba Diving, Surfing & Health Data (Special Category Data)

High-adrenaline marine activities require strict medical and safety assessments:

Medical Screening & Liability Forms: PADI/SSI medical screening questionnaires, doctor clearance letters (where applicable), dive certification level, logged dive count, and signed liability waivers.
Dietary & Wellness Information: Allergies, dietary requirements, or physical mobility considerations you voluntarily disclose to us.
Emergency Contacts: Name, relationship, and contact telephone number of your nominated next-of-kin. (You confirm you have the consent of the nominated individual to provide their details).

E. Media, Photography & Videography

High-resolution underwater and surface photography or drone video captured during organised pelagic shark dives, boat excursions, surf sessions, or public hotel gatherings (see Section 6 for detailed rules on media usage).

F. Technical & Cookie Data

Device & Usage Identifiers: IP address, browser type, geographic location (country/city level), operating system, referral URL, time spent on pages, and navigation patterns.
Tracking Technologies: Cookies, Google Analytics 4 tags, Google Ads conversion tags, and Meta (Facebook) advertising pixels (see Section 4).

3. Purposes and Lawful Bases for Processing

Under international data protection laws (including the GDPR), we must have an identified legal basis for processing your data:

Data Category	Purpose	Lawful Basis (GDPR / Best Practice)
Inquiry & Reservation Details	To respond to inquiries, confirm rates, organise room availability, and manage your reservation.	Performance of a Contract (Art. 6(1)(b))
Passport & Travel Data	To issue mandatory Malé–Fuvahmulah domestic flight tickets and complete tourist guesthouse check-in forms.	Legal Obligation (Art. 6(1)(c) – Maldives Tourism & Immigration Regulations) & Contract
Payment & Billing Records	To issue tax invoices, process deposits, and comply with Maldives Inland Revenue Authority (MIRA) reporting.	Legal Obligation (Art. 6(1)(c)) & Contract (Art. 6(1)(b))
Dive & Surf Medical Data (Health Data)	To verify medical suitability for pelagic diving/surfing and prevent life-threatening medical events underwater.	Explicit Consent (Art. 9(2)(a)) & Vital Interests (Art. 9(2)(c))
Emergency Contact Info	To reach next-of-kin in the event of an accident, illness, or emergency.	Vital Interests (Art. 6(1)(d))
Hospitality Communications	To coordinate airport pick-up, schedule dive briefings, and assist during your stay via WhatsApp/Email.	Performance of a Contract (Art. 6(1)(b))
Marketing Newsletters	To send occasional updates on seasonal dive conditions, shark encounters, or special packages.	Consent (Art. 6(1)(a) – freely given opt-in)
Marketing Photography / Video	To showcase genuine guest experiences, diving, and facilities on our website and social channels.	Consent (Art. 6(1)(a)) or Legitimate Interests (Art. 6(1)(f) – strictly for non-identifiable/crowd shots)
Analytics & Pixels	To evaluate website traffic performance and measure the effectiveness of digital campaigns.	Consent (Art. 6(1)(a) – collected via our cookie banner)

4. Cookies and Web Tracking

Our website uses cookies and similar technologies:

Strictly Necessary Cookies: Essential for page navigation, security, and loading of our web application, including a first-party cookie that remembers which campaign link or referring site brought you to us so we can attribute and respond to your enquiry. These cannot be disabled and do not require consent.
Analytics Cookies (Google Analytics 4): Measures website interactions (e.g., button clicks, page engagement) using anonymized or pseudonymized data.
Advertising Tags (Google Ads and Meta / Facebook Pixel): Measure which advertisements lead to enquiries and help us deliver relevant advertisements on Google, Facebook and Instagram to users who have previously visited our website.

Your Choice & Control: Non-essential analytics and advertising cookies are only activated once you click “Accept All” or customize your preferences on our cookie banner. You can withdraw your consent or alter cookie settings at any time using the Cookie Preferences link in our website footer.

5. Who We Share Your Data With

We never sell, rent, or trade your personal data. Data is shared exclusively with selected service providers and operational partners necessary to deliver your stay:

Domestic Airline Operators: Your passport details and travel itinerary are shared with domestic carriers (such as Island Aviation Services / Maldivian) to secure domestic flights between Malé (MLE) and Fuvahmulah (FVM).
Affiliated Dining & Wellness Venues: We share operational guest lists with our sister outlets—The Spot (our ground-floor restaurant) and Thresher Cafe & Bistro—solely to accommodate inclusive meal plans, room charges, and table reservations. They do not use your information for independent marketing without your consent.
Partner Dive Instructors & Boat Crews: Certifications, emergency contact numbers, and relevant safety precautions are provided to authorized dive masters and boat captains delivering water-sports excursions.
IT Infrastructure & Cloud Services:
- Hosting: Next.js deployment infrastructure hosted via DigitalOcean Holdings, Inc. / Vercel / Amazon Web Services.
- Business Productivity: Google Workspace (Google LLC) for secure email, database exports, and reservation spreadsheets.
- Messaging Platforms: WhatsApp Business (Meta Platforms) for direct guest liaison.
Financial Institutions: Bank of Maldives (BML) or authorised card payment processing gateways for settlement verification.
Regulatory Authorities: Maldivian immigration, police, or health agencies where required under Maldivian statutory law.

6. Photography, Video & Social Media Policy

Due to the exceptional nature of diving with tiger sharks and pelagics in Fuvahmulah, our team and guides frequently capture photos and video during excursions.

Identifiable Imagery: We will never use identifiable photos or videos of you in our marketing materials, website, or social media feeds unless you have given explicit consent (either via our physical registration form upon check-in or via signed digital release).
Right to Withdraw / Object: You may withdraw your consent or request the immediate removal of any published photo or video where you are identifiable at any time. Simply message us at [email protected], and we will delete or crop the image from our digital channels promptly and without hassle.
Incidental Background Media: Wide-angle, drone, or landscape imagery capturing public beaches, boats, or general diving scenes where individuals are not identifiable may be utilised under our legitimate business interest in illustrating the destination.

7. International Data Transfers

Dive Dame Pvt Ltd is located in the Republic of Maldives. If you visit our website or make a reservation from the European Union, United Kingdom, or United States:

Your data will be transferred to and stored on servers in the Maldives and international cloud providers (such as Google LLC in the United States and EU data centres).
Because the Maldives has not received an adequacy decision from the European Commission, transfers of personal data necessary to finalise your booking are executed pursuant to Article 49(1)(b) of the GDPR (transfer necessary for the performance of a contract between the traveller and the accommodation provider).
Where we utilise cloud infrastructure providers (like Google Workspace), transfers are governed by standard contractual clauses (SCCs) approved by the European Commission.

8. Data Retention Periods

We keep your data only as long as necessary to fulfil the purposes outlined in this policy or to satisfy statutory obligations:

General Inquiries (No Booking Made): Deleted after 36 months from the last communication.
Guest Folios & Invoices: Retained for 7 years to satisfy the requirements of the Maldives Inland Revenue Authority (MIRA) and general company accounting standards.
Passport Copies & Registration Records: Retained for 7 years following check-out, or as mandated by local immigration and tourism regulations.
Dive Medical Forms & Liability Waivers: Retained for 7 years in accordance with maritime/scuba diving insurance and legal liability limitation periods.
Marketing Subscriptions: Retained until you click “Unsubscribe” or withdraw consent.
Analytics Data: Retained in Google Analytics for 14 months before automated deletion.

9. Data Security Measures

We implement multi-layered physical, technical, and organisational measures to safeguard guest records:

In-Transit Protection: 256-bit SSL/HTTPS encryption across all public website pages and forms.
Restricted File Access: Booking spreadsheets, databases, and guest records stored in Google Workspace are protected by strict access controls and mandatory Two-Factor Authentication (2FA).
No Local Payment Storage: We do not hold, record, or process payment card numbers on our local computers or internal systems.
Confidentiality Agreements: All staff and operational personnel with access to guest personal details are bound by confidentiality protocols.

10. Your Legal Rights

Depending on your country of residence (including the EU, UK, and applicable US states), you have clear rights regarding your personal information:

Right of Access: Request confirmation of whether we hold your personal data and obtain a copy.
Right to Rectification: Request correction of inaccurate or incomplete contact or passport details.
Right to Erasure (“Right to Be Forgotten”): Request deletion of your personal information, provided we are not legally obligated to retain it for tax, accounting, or maritime safety records.
Right to Restrict or Object: Restrict our processing of your data, or object at any time to the use of your data for direct marketing.
Right to Withdraw Consent: Where processing is based on consent (e.g., photo releases, marketing emails, non-essential cookies), withdraw it at any time without negative consequences.
Right to Complain: You have the right to lodge a complaint with your local Data Protection Authority (such as the ICO in the UK, or your national EU Data Protection Authority). We encourage you to contact us first so we can resolve any issues directly.

To exercise any of these rights, contact our Data Privacy Lead at [email protected].