PRIVACY NOTICE

Preamble 

This Privacy Notice applies to the users (hereafter referred to as the “Users” or “you”) of the Joy Island mobile application (hereafter referred to as the “Application”) provided by the Joy Resort Pvt Ltd (hereafter referred to as the “Hotel”) as a digital service channel available to everyone which enables you to benefit from the services offered by Hotel. Users mean any person who accesses or browses the Application. The Hotel is the Data Controller responsible for the processing carried out through the Application.

The purpose of this Privacy Notice is to inform you about the categories of personal data that we may collect or hold about you, how we use it, with whom we share it, how we protect it, and the rights you have over your personal data under the General Data Protection Regulation (hereafter referred to as the “GDPR”).

• Identity of the data controller
• Data subject to processing
• Purposes and legal bases of data processing
• Data recipients
• Duration of data retention
• Transfer of data outside the European Union
• Exercise of the rights of the data subject
• Security
• Contacts
  

Article 1. Data subject to processing

By using the Application, you are agreeing to send us data and information, some of which may identify you and therefore constitute personal data. In all cases, you are informed of the purposes for which your personal data is collected by us via the Application. 

When necessary, we undertake, depending on the circumstances, to obtain your consent and / or to allow you to object to the use of your personal data for certain purposes, such as for example, the possibility of sending you commercial marketing or for the purpose of monitoring the usage of our Application and to offer you targeted commercial offers and advertising based on of your areas of interest.

Data subject to processing is as follows:

• Data relating to your identity: title, surname, first name(s), date of birth, address, telephone number, e-mail address, password, passport number,
• Data relating to transaction security: your log-on and connection data,  
• Data relating to your reservation: arrival and departure dates, preferences,
• Data relating to transactions: the number of the transaction, data relating to the means of payment, details of the purchase, goods or service subscribed, data relating to invoice payments such as payment terms, discounts granted, receipts, balances and outstanding amounts,
• Data communicated from you: your suggestions, questions, and requests.

The Hotel ensures that it only collects personal data that is strictly necessary for the purposes for which it is processed.

Article 2. Purposes, legal basis of data processing and how we collect it

Processing carried out by the Hotel based on the execution or performance of a contract, for the compliance with a legal or regulatory requirement, and when the processing of data is necessary for our legitimate interests. If there is no legal basis specified in the GDPR, your explicit consent is asked.

When the legal basis used for the processing operations is based on the pursuit of a legitimate interest, you have the right, on request, to obtain information relating to the balancing of interests.

We collect your personal data by using automated and partially automated methods through our Application, and/or through you voluntarily providing it to us.

Your various data is collected and processed for the following purposes and on the following legal basis:

Creating your user account in the Application

Creating your user account in the Application covers:

• enabling you to log into the Application with your account,
• updating your user information.

The Hotel processes personal data for above purposes based on the execution or performance of a contract.  

The proper functioning and continuous improvement of the Application and its features 

Monitoring the proper functioning and improvement of our Application covers:

• general administration of the Application,
• responses to your requests and questions,
• customer support and assistance,
• collect your evaluations regarding our Application within the scope of improving our Application and ensuring customer satisfaction.

The Hotel has a legitimate interest in assuring you the best experience on our Application and benefit from the services offered by the Hotel.

Customer relations management

Customer relationship management covers:

• contacting you about our services and the operation of our Application (for example, sending you notifications about innovations, and changes in the Application, or about your requests),
• management of opinions on our products, services and content.

The Hotel has a legitimate interest in processing customer Data in order to provide the best possible commercial relationship, and to ensure the best quality of our Services.

Management of reservations and other services provided by the Hotel

Customer relationship management covers:

• management of reservations (to receive and finalize your reservation requests, suggestions, questions, complaints regarding services through the Application).

The Hotel processes personal data for above purposes based on the execution or performance of a contract.  

Carrying out marketing and commercial research operations

The fulfillment of marketing operations covers:

• carrying out market research (email, telephone, mail)
• conducting campaigns, promotions, and events specific to Application users, to inform you within this scope, and to provide you with products, services, and opportunities that we think may be of interest to you (such studies allow us to increase your loyalty and satisfaction with our products/services).

The fulfillment of marketing operations is based on your consent. Your consent will be asked separately (not as a part of this Privacy Notice) and even if you choose to give your consent, you will have the right to withdraw it any time. 

Account management and carrying out related operations, including the fight against fraud

Account management and carrying out related operations covers:

• detecting and preventing problems and errors with suspicious/illegal transactions within the scope of access and use of the Application,
• keeping account records and legal supporting documents to protect and exercise our rights and execute legal processes in the event of a potential legal dispute,
• fulfilling our legal obligations when we are requested to do so by authorized institutions or institutions, or when we are required to notify such institutions (e.g., sharing your information when requested by a public institution regarding a suspected illegal transaction).

Account management and the carrying out of associated operations are based on our legal obligations arising from the various regulations of the country. 

Management of requests for rights arising from the GDPR 

This processing covers all the operations necessary to monitor rights requests addressed to the Hotel as the data controller regarding the Application (qualification of the request, investigations, fulfillment of specific technical operations, etc.). This processing is carried out on the basis of a legal obligation arising from the GDPR.

Article 3. Disclosures of your personal data (Data recipients)

Within the limits of their respective powers and for the purposes mentioned in Article 4, the primary people who are likely to have access to your Data are as follows:

• If necessary, competent authorities on request and in particular public bodies, exclusively to meet legal obligations, as well as in the case of identifying those responsible for any offenses committed on the internet,
• The authorised personnel of our suppliers and business partners such as, in particular, cloud hosting and storage providers, payment service providers, IT maintenance providers.

In our relations with our suppliers and business partners, we contractually ensure that they process the data in such a way as to guarantee their integrity, confidentiality and security. 

Article 4. Duration of data retention

We will retain your personal information for no longer than is necessary for the purposes stated in this Privacy Notice, unless otherwise extending the retention period is required or permitted by law. The data storage period may vary with scenario, product, and service. The standards the Hotel uses to determine the retention period are as follows: the time required to retain personal data to fulfill business purposes, maintaining corresponding transaction and business records; controlling and improving the performance and quality of products and services; ensuring the security of systems, products, and services; handling possible user queries or complaints and locating problems; whether the user agrees to a longer retention period; and whether the laws, contracts, and other equivalencies have special requirements for data retention; etc. We will maintain your registration information as long as your account is necessary for service provision. 

Article 5. Transfer of data outside the European Union

Whenever we transfer your personal data out of the EEA, we ensure at least one of the following safeguards is in place:

• We will only transfer your personal data to countries that the European Commission have approved as providing an adequate level of protection for personal data by; or
• Where we use certain service providers, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe; or
• We will only transfer your personal data to companies that comply with the GDPR.

We may request your explicit consent to the specific transfer if none of the above safeguards is available. You will have the right to withdraw this consent at any time. 

You can access all of these documents by contacting our Data Protection Officer at the following email address:it@cocoonmaldives.com or at the postal address: Kasanfaru Lagoon, North, Male 08385, Maldivler

Article 6. Exercise of the rights of the data subject

Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.

• the right to erasure (or "right to be forgotten") of your personal data (article 17 GDPR), when it is inaccurate, incomplete, ambiguous, out of date, or of which the collection, use, communication or conservation is prohibited,
• the right to withdraw your consent at any time (article 7 GDPR),
• the right to limit the processing of your data (article 18 GDPR),
• the right to object to the processing of your data (article 21 GDPR), 
• the right to the portability of the data you have provided to us, when your data is subject to automated processing based on your consent or on a contract (article 20 GDPR),
• the right not to be the subject of a decision based exclusively on automated processing (Article 22 of the GDPR); no such decision-making is currently applied by the Hotel. 

If you wish to exercise any of the rights set out above, please email us at it@cocoonmaldives.com or

by sending a letter to Kasanfaru Lagoon, North, Male 08385, Maldivler . You can also lodge a complaint with the supervisory authorities in particular in the Member State of your habitual residence or place of work.

Article 9. Security

We implement all the technical and organisational measures necessary to ensure the security of our processing of personal data and the confidentiality of the data we collect.

As such, we take all the necessary precautions with regard to the nature of the data and the risks presented by its processing to preserve its security and, in particular, to prevent the data from being distorted, damaged, or accessed by unauthorized third parties. These include physical protection of premises, authentication procedures for persons accessing data with personal and secure access via confidential usernames and passwords, secure https protocol, logging and traceability of connections and encryption of certain data. 

Article 10. Contacts

For any question relating to this Privacy Notice or for any request relating to your personal data, you can contact us by emailing our Data Protection Officer at the following address: it@cocoonmaldives.com or sending a letter to the following address: Kasanfaru Lagoon, North, Male 08385, Maldivler