Privacy Policy

LuxAtolls ("we", "us", "our") operates luxatolls.com. This policy explains what personal information we collect, the purposes for which we use it, the parties with whom we share it, how long we retain it, and the rights available to you. It applies to your use of our website and to any enquiry or booking you make through us.

We are based in Australia and provide services to travellers internationally.

1. Information We Collect

1.1 Information you provide

Enquiries and quote requests. Your name and email address, and, depending on the form used, your telephone number, intended travel dates, the number of adults and children in your party and the ages of any children, room and meal preferences, indicative budget, the occasion for your travel where you choose to tell us, and the content of any message you write. Group enquiries additionally collect your company name and details of the size and composition of the group.

Confirmed bookings. The full name of each traveller as it appears on their passport, and your international flight numbers. Traveller names are required by resorts and airport transfer operators to issue reservations and transfer manifests; flight details are required so that transfers correspond to your arrival and departure. We do not collect passport numbers, images of passports, or dates of birth.

Payments. Payment details are collected directly by our payment providers. Card numbers and bank account details are not transmitted through, processed by, or stored on our website or systems. We retain only the payment method used and a transaction reference, for the purpose of reconciling payment against your booking.

Email list. Your email address and, where provided, the travel details supplied at the same time (party size, indicative budget, approximate travel period) and the resorts in respect of which you have requested alerts.

Correspondence. The content of emails you send us, together with any files attached to them, retained against the relevant enquiry.

1.2 Information collected automatically

Device and usage information. Your IP address, browser and device type, the pages and resorts you view, the source from which you arrived, and the duration of your visit.

Persistent identification. We assign your browser a randomly generated identifier which is stored on your device and persists between visits. Its purpose is to allow us to recognise a returning browser as the same browser. Section 4 explains how this identifier relates to other information we hold about you.

Session recording. We capture recordings of browsing sessions, comprising the pages viewed, scrolling, and interactions with page elements.

Activity records. We maintain a record on our servers of the resorts viewed by each identified browser, the times of those views, and the source of the visit.

2. Purposes and Legal Bases

We use the information described above to:

• prepare and issue quotes and respond to your enquiries;
• arrange and administer bookings with resorts, transfer operators and other travel suppliers;
• provide pre-departure information relevant to your travel;
• process and reconcile payments;
• maintain our records of the arrangements agreed with you;
• operate, secure, analyse and improve our website and the content we publish;
• measure the effectiveness of our advertising;
• send marketing communications in accordance with section 3; and
• comply with our legal obligations and establish or defend legal claims.

Where the General Data Protection Regulation or its United Kingdom or Swiss equivalents apply to you, we rely on the following legal bases: performance of a contract with you, in respect of processing necessary to prepare and fulfil your booking; your consent, where we have requested it; compliance with a legal obligation, in respect of records we are required to keep; and our legitimate interests in operating, securing, analysing and improving our business, in respect of the remainder, including analytics and advertising measurement. You may object to processing carried out on the basis of legitimate interests, as set out in section 8.

3. Marketing Communications

Where you submit an enquiry, we add your email address to our weekly offers email on the basis of the enquiry you have made regarding Maldives travel. Each such email contains a one-click unsubscribe link, and you may also unsubscribe by contacting us at reservations@luxatolls.com. We record whether these emails are opened in order to measure engagement.

Unsubscribing withdraws you from marketing communications only. It does not affect communications forming part of an active booking, including quotes, confirmations, payment reminders and pre-departure information, and it does not of itself delete the information we hold about you. Deletion may be requested under section 8.

4. Analytics, Session Recording and Advertising Measurement

Session recordings are not anonymous to us. The persistent identifier described in section 1.2 is associated with each recording. Where you subsequently submit an enquiry, your enquiry reference is also associated with it. A recording may therefore be linked to you by name once you have contacted us.

Activity records are associated with your customer record. Where you submit an enquiry, the activity records held against your browser identifier become part of the customer record we maintain for you. Where you have submitted enquiries from more than one device, the activity records for those devices are combined within that record.

Advertising measurement. Where you arrive at our website from one of our advertisements, we record that fact, and where you subsequently submit an enquiry, we report that enquiry to the relevant advertising platform as a conversion. This measurement operates only in respect of visits originating from an advertisement.

Providers. Our analytics, session recording and advertising measurement providers are Google, Microsoft and Ahrefs. Each processes this information on its own infrastructure and under its own privacy terms.

Artificial intelligence. We do not use your personal information to train artificial intelligence models, and the content of your enquiries and correspondence is not transmitted to any artificial intelligence service.

You may restrict much of the processing described in this section through your browser's privacy settings. Certain features of the website may not operate as intended if you do so.

5. Disclosure

We do not sell personal information.

Travel suppliers. We disclose the information necessary to arrange and fulfil your booking to the resorts, transfer operators and other suppliers involved. For a confirmed booking this includes traveller names and flight details.

Service providers. We use service providers which process personal information on our behalf, comprising our website hosting and data storage provider, our email delivery provider, our payment providers, and the analytics and advertising providers identified in section 4. Each is engaged on terms requiring appropriate treatment of that information.

Legal disclosure. We may disclose personal information where required by law, regulation or legal process, or where necessary to establish, exercise or defend legal claims.

6. International Transfers

We are based in Australia. Our hosting, storage, email delivery, analytics and payment providers operate infrastructure in the United States, the European Union and other jurisdictions. Your personal information may accordingly be transferred to and processed in a country other than your own, including countries whose data protection laws differ from those of your jurisdiction. Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on the transfer safeguards maintained by the relevant provider.

7. Retention

We retain enquiry and booking records for the duration of our relationship with you and thereafter for so long as those records remain necessary for our own records, to address subsequent questions concerning travel you have undertaken, or to satisfy legal and taxation obligations. We do not presently delete these records on a fixed schedule. You may request deletion under section 8.

Where you have paid for a booking, we are required to keep a record of that transaction for five years from its completion, whether or not you ask us to delete your information. On such a request we reduce that record to the commercial facts — our booking reference, the resort, the travel dates, the number of travellers and the amounts paid — and delete the personal information attached to it, including your name, contact details, traveller names, correspondence and any files you sent us. What remains identifies no one. It is deleted automatically once the five years have elapsed.

If you ask us to delete your information while a trip is still upcoming or a balance remains outstanding, we erase everything that is not required to deliver that booking, and complete the remainder once you have travelled and the booking is settled. We do this because the resort and transfer operators still need your details in order to provide the holiday you have paid for.

Two further limitations apply to any deletion. First, our systems are backed up nightly and fourteen days of those backups are retained; a copy of deleted information may therefore persist within a backup for up to fourteen days before it is superseded. Backups are not edited in place, as doing so would compromise their integrity. Second, email which has already been delivered to you has left our systems and cannot be recalled.

8. Your Rights

You may request that we:

• correct personal information which is inaccurate;
• delete your personal information. On such a request we remove your enquiries and quotes, your customer record, your booking and traveller details, files you have sent us, your record on our email list, and the activity records held against you — subject, where you have paid for a booking, to the transaction record described in section 7, and to the further limitations set out there;
• cease sending you marketing communications;
• cease or restrict particular processing, including analytics and advertising measurement; or
• cease processing carried out on the basis of our legitimate interests.

Requests should be sent to reservations@luxatolls.com. We will verify your identity before acting on a request, ordinarily by requiring the request to be sent from the email address we hold. We will respond within seven days.

If you consider that we have not handled your personal information appropriately, you may lodge a complaint with the data protection authority in your jurisdiction. In Australia this is the Office of the Australian Information Commissioner.

9. Children

Our services are directed to adults. We collect information concerning children only as part of a family's travel arrangements and only as supplied by the adult making that booking, comprising the number of children travelling, their ages, and, for a confirmed booking, their names as they appear on their passports. We do not knowingly collect personal information directly from children.

10. Security

We protect personal information by means of secure hosting infrastructure, access controls limiting the personnel able to access it, and contractual obligations imposed on our service providers. No method of electronic transmission or storage is entirely secure, and we are unable to guarantee absolute security. Where a data breach occurs which is likely to result in serious harm, we will notify affected individuals and the relevant regulator as required by law.

11. Third-Party Websites

Our website contains links to resort websites, booking platforms and other travel resources. We are not responsible for the privacy practices or content of those websites, and we recommend that you review the privacy policy of any third-party website you visit.

12. Changes to This Policy

We may amend this policy to reflect changes in our practices or in applicable law. Amendments are published on this page with a revised date and take effect upon publication. Where an amendment is material, we will identify it as such.

13. Contact

Enquiries concerning this policy, and requests under section 8, should be addressed to reservations@luxatolls.com.