Privacy Policy

This Privacy Policy explains how Costa Viva For Watersports Equipment Rental L.L.C. ("Costa Viva", "we", "us", or "our"), registered and operating on the mainland of Dubai, United Arab Emirates, collects, uses, stores, and protects your personal data when you use our website at costavivawatersports.com ("Website"), book any of our watersports activities through our Platform or through an approved third-party booking platform, or participate in any Service delivered by us or by our Approved Subcontractors (as defined below).

We are committed to protecting your privacy in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and, where applicable, the EU General Data Protection Regulation ("GDPR").

Please read this Policy carefully. By using our Website or making a Booking, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are — The Data Controller

The data controller responsible for your personal data is:

Costa Viva For Watersports Equipment Rental L.L.C.

Dubai Marina Harbour, Dubai, United Arab Emirates

Email: office@costavivawatersports.com

WhatsApp: +971 56 676 7061

Website: costavivawatersports.com

For privacy-related enquiries, please contact us at the email address above with the subject line "Privacy Enquiry".

2. Key Definitions

In this Policy, "Approved Subcontractor" means a third-party operator, vessel owner, or equipment provider vetted, approved in writing, and engaged by Costa Viva to deliver, or assist in delivering, a Service on Costa Viva's behalf, operating exclusively under the Costa Viva brand. Approved Subcontractors process your personal data only on Costa Viva's documented instructions, under a PDPL-compliant data processing agreement, and are never disclosed to you by name.

"Booking" means a confirmed reservation for a Service. "Participant" means any individual who takes part in a Service, whether or not they made the Booking. "Services" means all watersports activities, rentals, charters, lessons, and related services offered by Costa Viva through its Platform or approved third-party channels.

3. Scope of This Policy

This Policy applies to personal data we collect from: visitors to our Website and app; customers who create an account or make a Booking directly with us; customers who book through an approved Third-Party Platform (such as FareHarbor) where that platform shares your data with us; Participants in our Services, including where a Booking is made on their behalf by a parent, guardian, or group organiser; and individuals who interact with us via email, WhatsApp, or social media.

4. Personal Data We Collect

4.1 Data You Provide Directly

• Identity data: full name, date of birth, nationality.
• Contact data: email address, phone number (including WhatsApp).
• Identity document data: passport number, Emirates ID number, or national ID number, collected at check-in for operational and UAE regulatory compliance.
• Booking data: activity selected, date and time, number of Participants, special requirements.
• Payment data: credit/debit card details processed through our payment gateway — we do not store full card numbers or CVV; bank transfer details where applicable.
• Health and swimming-ability data: relevant medical conditions, swimming ability, and fitness information you provide to ensure your safe participation (treated as sensitive data with heightened protection — see clause 7).
• Marketing preferences: your consent to receive promotional communications by email, SMS, or WhatsApp.
• Communications: messages sent to us via email, WhatsApp, or website contact forms.

4.2 Data Collected Automatically

When you visit our Website, we automatically collect:

• Usage data: pages visited, time spent, referral source, search terms.
• Technical data: IP address, browser type and version, operating system, device type.
• Cookie data: see Section 14 (Cookies) for full details.

4.3 Data from Third Parties

We may receive data about you from:

• Booking platforms (such as FareHarbor) if you book through a third-party channel.
• Review platforms (such as Google Reviews) if you leave a public review mentioning us.
• Social media platforms if you interact with our social media accounts.
• Approved Subcontractors, where they report a safety incident or provide operational information in connection with a Service you have taken part in.

5. Why We Collect Your Data and Our Legal Basis

Where we rely on your consent (e.g., marketing communications, optional cookies, or health data collection), you may withdraw that consent at any time by contacting us or using the opt-out mechanism in our communications. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Payment Data

Payments made directly through our Platform are processed by our payment gateway partners (including Visa, Mastercard, and WIO Bank). We do not receive, transmit, or store your full card number, expiry date, or CVV; card data is processed by our payment gateway in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We may retain limited transaction metadata (amount, date, masked card reference) for accounting, reconciliation, and refund purposes.

Where you book through a Third-Party Platform such as FareHarbor, your payment is handled by that platform or its own payment processor in accordance with its own privacy and payment terms.

7. Health and Swimming-Ability Data — Special Handling

Health and swimming-ability information is sensitive personal data. We apply additional safeguards to it:

• It is collected only with your explicit, specific consent at the time of Booking or check-in;
• It is used solely to assess your safe participation in the relevant activity;
• It is shared only with the staff, instructors, crew, or Approved Subcontractor who need it to deliver the Service safely, who are bound by equivalent confidentiality and data protection obligations;
• It is never used for marketing purposes;
• It is retained for no longer than 30 days after your activity, unless a longer period is required for an incident investigation, insurance claim, or legal obligation, after which it is securely deleted.

Where your health data is shared with an Approved Subcontractor, that subcontractor is contractually bound to process it only for the purpose of delivering the Service safely, to implement appropriate security measures, and to delete it in accordance with our retention schedule. You may decline to provide health data, but doing so may mean we are unable to allow you to participate in certain activities.

8. Marketing Communications

We will only send you marketing communications by email, SMS, or WhatsApp where you have given explicit opt-in consent. You can withdraw your consent at any time by: using the unsubscribe link in our emails; replying "STOP" to SMS messages; messaging us on WhatsApp to opt out; contacting us at office@costavivawatersports.com; or updating your preferences in your account settings. Withdrawing marketing consent will not affect Booking confirmations, safety communications, or other transactional messages.

9. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of recipients:

• Payment processors (e.g., Visa, Mastercard, WIO Bank) for processing card payments securely.
• Booking platform providers (e.g., FareHarbor) for reservation management, where you have booked through such a platform.
• Approved Subcontractors (as data processors): where the Service you have booked is delivered in whole or in part by an Approved Subcontractor, we share the personal data necessary for them to deliver that Service safely — which may include your name, contact details, Booking reference, and relevant health and swimming-ability information. Approved Subcontractors receive your data as data processors acting exclusively on Costa Viva's documented instructions, under a binding PDPL-compliant data processing agreement. They may not use your data for their own purposes, share it with third parties, or retain it beyond our specified retention periods. They are never disclosed to you by name; you are contracting with and being served by Costa Viva throughout.
• Cloud hosting and IT service providers who host and maintain our Website and operational systems.
• Email and messaging providers (e.g., WhatsApp Business, Google Workspace) used for customer communications.
• Analytics providers (e.g., Google Analytics) for understanding Website usage — see Section 14.
• UAE regulatory authorities if required by law (e.g., Dubai Maritime Authority, Dubai Police, UAE Data Office).
• Legal and professional advisors (lawyers, accountants) under strict confidentiality obligations.
• Insurers and claims handlers where necessary to handle an incident, personal injury claim, or dispute relating to a Service.

All third-party processors are required to handle your data in accordance with applicable data protection law and our documented instructions.

10. International Data Transfers

Our services are based in the UAE. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, please note that your data may be transferred to and processed in the UAE and in other countries where our service providers (such as Google and Meta) operate.

Where required by applicable law, we ensure appropriate safeguards are in place for such transfers, including the use of standard contractual clauses or equivalent mechanisms approved by the relevant supervisory authority. We do not transfer Customer personal data to Approved Subcontractors outside the UAE unless required by the nature of the specific Service and subject to appropriate contractual safeguards.

11. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purposes described in this Policy, including to comply with our legal, accounting, tax, and insurance obligations:

• Booking and transaction records: 7 years (UAE commercial law requirement).
• Identity document details (passport / Emirates ID): deleted within 30 days of the activity completion.
• Health and swimming-ability declaration data: deleted within 30 days of the activity, unless required longer for an incident, insurance, or legal matter.
• Marketing opt-in lists: until you withdraw consent, or after 2 years of inactivity.
• Communications (email, WhatsApp): 12 months from the date of the last communication.
• Website usage and analytics data: up to 26 months (aggregated and anonymised after 14 months).
• Photos and videos of activities: up to 3 years, or until you request removal.

After the applicable retention period, personal data is securely deleted or anonymised. Approved Subcontractors are contractually required to delete your data in line with these same periods.

12. Your Rights

Depending on your location and applicable law (including the UAE PDPL and, where applicable, the EU GDPR), you may have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data, subject to legal retention obligations.
• Right to restriction: request that we limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format (GDPR).
• Right to object: object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint: with the UAE Data Office (www.dataoffice.gov.ae) or, if you are in the EU, with your national data protection authority.

To exercise any of these rights, please contact us at office@costavivawatersports.com with the subject line "Data Rights Request". We will respond within 30 days. We may need to verify your identity before processing your request. Exercising your rights against Costa Viva covers personal data held by Approved Subcontractors on our behalf, as they act as our data processors.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encrypted data transmission (HTTPS), access controls, and regular security reviews. All Approved Subcontractors are contractually required to implement equivalent measures before receiving any Participant data.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights, we will notify you and the relevant authority in accordance with the PDPL and, where applicable, the GDPR.

14. Cookies and Similar Technologies

What are cookies?

Cookies are small text files placed on your device by a website. They allow the site to remember your actions and preferences over a period of time.

Cookies we use

Strictly necessary cookies cannot be disabled as they are required for the Website to function. All other cookies are placed only with your consent, which you can manage via the cookie consent banner on your first visit.

Managing cookies

You can manage or delete cookies at any time through your browser settings. Disabling certain cookies may affect the functionality of our Website, including the ability to complete a Booking. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

15. Children's Privacy

Our services are available to guests aged 6 and over when accompanied by a responsible adult. We do not knowingly collect personal data directly from children under the age of 18. The adult making the Booking is responsible for providing any data relating to minors in their party and for giving consent on their behalf, including health and swimming-ability declarations.

If you believe we have inadvertently collected personal data from a child without appropriate parental or guardian consent, please contact us at office@costavivawatersports.com and we will delete it promptly.

16. Photography, Video and Promotional Content

Costa Viva, or photographers and videographers engaged by us or by an Approved Subcontractor acting on our behalf, may capture photographs and video footage during activities for safety, quality assurance, and marketing purposes (including use on our website, social media channels, and promotional materials). We rely on our legitimate interest to promote our services as the legal basis for this processing.

You have the right to opt out. If you do not wish to appear in promotional content, please notify our staff in writing before your activity begins. We will take reasonable steps to exclude you from promotional use, though incidental appearance in group or background footage cannot always be entirely avoided. Photos and videos are retained for up to 3 years or until you request removal (see clause 11).

17. Links to Third-Party Sites

Our Website may contain links to third-party websites, including social media platforms, booking tools, and partner sites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, our use of Approved Subcontractors, or applicable law. When we do, we will revise the "Last Updated" date at the top of this page. If changes are significant, we will notify you by email or by a notice on our Website.

Your continued use of our Website or Services after any changes constitutes your acknowledgement of the updated Policy.

19. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

Costa Viva For Watersports Equipment Rental L.L.C.

Dubai Marina Harbour, Dubai, United Arab Emirates

Email: office@costavivawatersports.com (subject line: "Privacy Enquiry" or "Data Rights Request")

WhatsApp: +971 56 676 7061

You also have the right to lodge a complaint with the UAE Data Office (www.dataoffice.gov.ae) or, if you are in the EU, with your local data protection authority.