Privacy policy and consent
This policy explains what information City-Sea receives when a client makes an enquiry, why it is needed, who may receive it and how the client can exercise privacy rights.
1. Information processed
- name and contact information, including email address and the chosen communication channel;
- preferred island, travel dates, package, accommodation and trip preferences;
- diving experience, equipment size and other information voluntarily provided to organise the programme;
- technical information needed to operate the website, including interface language and standard server security logs.
City-Sea does not request payment credentials, bank card details or detailed medical information through the ordinary website enquiry form. Such information should not be entered in a free-text message.
2. Purposes and grounds
| Purpose | Information used | Ground |
|---|---|---|
| Reply to an enquiry | Name, contact and trip preferences | Consent and steps requested before a contract |
| Prepare a booking | Dates, package, experience and stay | Client request and performance of agreed terms |
| Work with suppliers | Minimum necessary information | Arranging requested services and separate consent where required |
| Website security | Technical logs | Legitimate interest and information security |
Marketing messages are not sent without separate consent. Refusing marketing does not affect the ability to submit an enquiry or receive a service.
3. Sharing and retention
- Access is limited to people and services that need the information to handle the enquiry and arrange the trip.
- For a booking, the minimum necessary information may be shared with selected dive centres, guest houses and transport providers in the Maldives.
- Where cross-border transfer requirements apply, City-Sea completes the required steps before transfer and obtains separate consent where required.
- Information is kept only as long as needed to answer the enquiry, arrange and perform the booking and comply with mandatory retention duties, then deleted or anonymised.
- City-Sea uses reasonable organisational and technical measures against accidental access, loss, alteration or disclosure.
4. Client rights
- ask whether their information is processed and receive information about that processing;
- request correction of inaccurate or incomplete information;
- withdraw consent and request restriction or deletion where there is no other lawful basis to retain the information;
- object to marketing processing;
- complain to the competent authority or a court if they believe their rights have been infringed.
Privacy requests
A request may be sent through the verified channel previously used to communicate with City-Sea or the contact published on the website. City-Sea may request identity verification to protect the client's information.
5. Enquiry form consent
Consent should be confirmed by a separate affirmative action. A pre-selected checkbox should not be used. Suggested wording next to the submit button:
By selecting ‘Send enquiry’, I confirm that I have read the City-Sea Privacy Policy and consent to the processing of the information I provide for replying to my enquiry and preparing the trip. I understand that the minimum necessary information may be shared with selected service providers in the Maldives for booking purposes. I may withdraw my consent through a verified City-Sea communication channel.
27 May 2025