Legal Notice

We are committed to protecting your personally identifiable information. With this privacy statement, we hope to provide a more detailed explanation of what personally identifiable information we collect and how it is used.

1 – Data controller and contact

The following person is responsible for processing your personal data:

BLEUWORLD – FZCO is a Dubai based company.

Address: Dubai Silicone Oasis Building name: Dubai Digital Park

If you have any questions or ideas about data protection, or if you want to exercise your rights, please contact us using the following link: https://bleudubai.com/contact/

2 – Purpose of data protection

Data subject to data protection is personal data, which is defined as all information relating to a physically identifiable or identified individual. The term “data” is then used to refer to personal data.

3 – Automated data collection

When you visit our website on the Internet, your device automatically sends data to us for technical reasons. The following information is stored separately from any other information you may send us:

• the URL of the web page visited
• network connection latency
• the date
• time

We keep this data for the following reasons

• to balance loads, i.e. to distribute access to our website across multiple devices and to be able to offer you the shortest possible download times;
• to ensure the security of our IT systems, for example to defend against specific cyber-attacks against our systems and to recognize attack patterns;
• to ensure the proper functioning of our IT systems, for example, if we encounter errors that we can only correct by storing the IP address;
• in order to be able to initiate criminal proceedings, face threats or take legal action if there are concrete indications of wrongdoing.

Your IP address is only kept for 30 days.

In this case, the processing is carried out in order to ensure the security of the processing in accordance with Article 32 of the GDPR, as well as on the basis of our legitimate interest in protecting ourselves against misuse of our services (Article 6, paragraph 1 , letter f GDPR).

4 – BleuDubai account

4.1 Registration

You can create a customer account with BleuDubai to manage reservations, save favorites and view past reservations. To do this, you must provide the following mandatory information:

• surname/first name
• email address
• the passwords

Your registration information is required to set up and maintain a user account for you. In this case, you conclude a free user agreement with us, under which we collect this data (Article 6, paragraph 1, letter b GDPR).

You must provide this data in order to perform the contract. However, you are not contractually or legally obliged to complete the transaction and, therefore, to provide the data.

5 – Opinions and evaluations

On our website you can rate and evaluate guided tours, excursions and activities, as well as leave comments. After completing a tour/guided tour/excursion(s) booked through our website, we may ask you for your feedback. Submitting reviews is, of course, completely voluntary. When you submit a review, we collect the information you provide in order to process it in accordance with the function you have selected and publish it on our website. You can request an assessment to be carried out at any time by contacting our customer service.

The processing of your data for these purposes is carried out to protect our legitimate interest in providing as much information as possible to our customers about the tours/guided tours/excursions that we offer. User ratings are also in the interest of all users. The processing is based on Article 6, paragraph 1, letter f of the GDPR in an appropriate manner.

6 – Customer Service 

6.1 Application processing 

If you send us requests by email, telephone, contact form, WhatsApp, social media accounts or any other method, we will process the information you provide as part of this operation in order to respond to your request (Article 6 , paragraph 1, letter b GDPR). The ultimate storage of the data transmitted in response to your request is based on our legitimate interest in correctly carrying out our business operations and safeguarding our legal positions (Article 6, paragraph 1, letter f GDPR) and, if necessary, on the execution of legal obligations (article 6, paragraph 1, letter f GDPR) (article 6, paragraph 1, letter c GDPR).

6.2 Translations

In some cases, we are required to translate requests sent to us into a specific language. This operation may require the processing of personal data, which is necessary to protect our legitimate interest in providing international customer service (Article 6, paragraph 1, letter f GDPR).

7 – Service providers

We use technical service providers for hosting and certain services necessary for the website. Data processing takes place on the servers of these service providers appropriately. These service providers only process data in accordance with our specific instructions and they are required to maintain adequate technical and organizational safeguards to ensure data security. Therefore, our service providers work for us as processors, as defined by Article 28 of the GDPR.

7.1 Hosting of the website 

We use the services of Amazon Web Services EMEA Sarl (“AWS”), a company based in Luxembourg, to host our website. Therefore, whether you interact with our website or provide personally identifiable information, it is stored on AWS servers.  

8 – Reservation of payments 

8.1 Reservation 

When you book a tour/guided tour/excursion, activity or similar service on our website, we collect the information necessary to carry out the tour/guided tour/excursion. In general, this procedure includes the following information: the name and surname of the person, the billing address, the e-mail address, the telephone number, the number of participants, as well as the day and time . Depending on the activity booked, we may also collect other information, such as the flight number or the age of the participants. The processing associated with these operations is based on Article 6, paragraph 1, letter b of the GDPR. If necessary, we will pass on your information to the organization in charge of the circuit/guided tour/excursion/activity. If a transfer to a third country outside the European Economic Area is necessary, the operation is based on Article 49, paragraph 2, letters b, c of the GDPR. If you make reservations through a partner's website, we will receive from the partner the information we need to make the reservation.

8.2 Payments

You have several options for paying for your reservations. Therefore, we will treat the requested data differently in each case, depending on the payment method used. In this case, your personal data will be processed as described below, this processing being based on Article 6, paragraph 1, letter b of the GDPR and being necessary to use the payment method you have selected.

9 – Fraud prevention

To protect ourselves and activity providers against fraudulent bookings, we evaluate the information provided by our customers during the booking process, including the technical data transmitted by their device, to the extent necessary to protect our legitimate interest and that of the activity providers to have legitimate reservations (article 6, paragraph 1, letter f GDPR).

10 – Cookies

We use so-called "cookies" to enable us to offer certain functions on our website and to improve the user experience. The term "cookies" refers to small text files that are stored on your device via your Internet browser.

Unless other cookies are specifically mentioned elsewhere in this privacy statement or in our cookie consent, we use the following cookies:

• session cookies: These cookies are necessary to record certain technical data during your visit to our website, for example, to determine whether you are logged in;
• persistent cookies: these cookies are necessary to save data after a browsing session (if desired).

11 – Google Service

11.1 Google Analytics

If you give us permission, we use Google Analytics 360, a web analytics service. Google Analytics 360 collects anonymous data about your use of our website, including your IP address, and uses cookies. This data is sent to a Google server. Google will use this data to evaluate your internet usage, generate reports on web activity and provide other services related to web activity and usage. Google may communicate this data to third parties in the event of a legal obligation or when these third parties process data on behalf of Google.

Google Analytics stores your information for a period of 14 months. The data is deleted after this period, and only aggregate statistics are kept.

The use of Google Analytics is based on your consent (Art. 6 para. 1 letter a GDPR).

12 – Social Networks

We manage social media accounts and profiles on a variety of platforms. In this context, personal data is processed in the manner described below.

If you interact with us through our social media sites or our posts, we will collect and process the information you provide in connection with these operations, including, where applicable, your username and any photo profile, for example, if you mark a post with a “like”, a “share” or a “retweet”, if you leave a comment or if you make other content available. Data processing in this respect is routinely carried out on the basis of our legitimate interest in providing the corresponding functions on our social media pages (Art. 6 para. 1 lit. f GDPR) and, if necessary, on the basis your consent to the relevant network operator (Article 6(1) letter an GDPR) or your contractual relationship with the operator (Article 6(1) letter b GDPR). Please also keep in mind that these contents are published on our social media related websites, according to your account settings, and can be viewed by anyone in the world.

It is possible that we have to go through a data processing stage in order to accept and respond to requests or messages sent through our social media sites on the Internet (article 6, paragraph 1, letter b GDPR).

Furthermore, when you visit our social media websites and/or interact with them or our posts, the responsible operators collect and process personal data about you under their own data protection responsibility. This is especially true if you are a member of or connected to the relevant network. Even if you are not connected to a network, operators collect certain personal data when you visit a page, such as unique identifiers linked to your Internet browser or your device.

12.1 Facebook

You can find our Facebook page at the following address: https://www.facebook.com/bleudubai/

Facebook is operated by Facebook Ireland Limited (“Facebook”), 4 Grand Canal Square, Dublin 2 (Ireland). If you visit or like our Facebook page while you are logged in as a Facebook user, Facebook will collect your personal data. Even if you are not a member of Facebook and visit our Facebook page, Facebook may collect anonymous usage data about you. Please see Facebook's Data Policy at https://www.facebook.com/about/privacy/ and https://www.facebook.com/legal/terms/information about page insights data for more information. You'll also find information on your Facebook account's adjusting options in the data policy.

12.2 Instagram

Our Instagram page can be found at: https://www.instagram.com/bleu.dubai/

Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2 (Ireland) (“Facebook”) operates Instagram. Instagram's privacy policy can be found at: https://help.instagram.com/519522125107875 . You will also find information about your account setup options here.

Your personally identifiable information may be shared with other Facebook or Instagram companies. This operation may involve the transfer of personal data to the United States and other countries for which the European Commission has not issued an adequacy decision. In this case, Facebook uses the contractual clauses adopted by the European Commission. You can also find more detailed information in Instagram's privacy policies.

12.3 Pinterest

You can find our Pinterest page at the following address: https://www.pinterest.fr/entreprisebleudubai/

Pinterest is operated by Pinterest Europe Ltd (“Pinterest”), Palmerston House, 2nd Floor, Fenian Street, Dublin 2 (Ireland). Pinterest's privacy policy can be viewed on the Internet at the following address: https://policy.pinterest.com/en/privacy-policy.

Remember that Pinterest sends personal data to countries outside the European Economic Area, countries for which the European Commission has not issued an adequacy decision. If necessary, Pinterest will take appropriate data protection measures, such as entering into the sorts of contractual agreements adopted by the European Commission. Please see Pinterest's Privacy and Security Policy for more information.

12.4 WhatsApp

You can also contact us by WhatsApp if you have any requests. Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2 (Ireland) (“Facebook Ireland”) operates WhatsApp. WhatsApp's privacy policy can be found at https://www.whatsapp.com/legal/privacy-policy-eea?lang=en . You will also find information about your account setup options here.

It is conceivable that your personally identifying information may be shared with other Facebook companies. This operation may involve the transfer of personal data to the United States and other countries for which the European Commission has not issued an adequacy decision. In this case, Facebook uses the contractual clauses adopted by the European Commission. You can also find more detailed information in Facebook's data policy.

12.5 Social media management

In order to gauge the success of our social media campaigns, we track the number of times we have been tagged on social media. In this context, we process information about people who come to us for help. The processing that takes place in this context is based on our legitimate interest in optimizing our social media activities (Art. 6 para. 1 letter f GDPR).

13 – Product development and evolution

We also process our customers' data in order to regularly improve our products. Thus, we use anonymous profiles to examine how certain target groups perceive our products and our advertisements. Your information is processed in accordance with our legitimate interest in optimizing our products and measuring the success of our business activities/operations (Article 6, paragraph 1, letter f GDPR).  

If agreed, we will also ask for your consent (Art. 6 para. 1 letter a GDPR). You may withdraw any consent you have given for this purpose at any time, with withdrawal taking effect immediately. For this purpose, you can contact us, for example, using the contact details provided. The processing we have carried out until you withdraw your consent remains unaffected by your withdrawal.

14 – Deletion of your data

We will delete or anonymize your personally identifiable data after it is no longer necessary for the purposes for which it was collected or used, as set out in the preceding paragraphs. We will also retain your data if we are required to do so by law, or if the data is required for a longer period in order to pursue a criminal case, or to protect, enhance or enforce legal rights. When you delete your user account, your profile is permanently deleted.  

We will, however, keep backup copies of your data in case they are necessary for legal reasons, a criminal investigation or to protect, enhance or enforce legal claims.

If certain data must be retained for legal reasons, the processing will be restricted. After that, this data is no longer available for further use.

According to Article 6 (1) letter f GDPR, a storage outside the contractual relationship is based on our pre-existing legitimate interests.

15 – Your rights as a data subject

You have the following rights with regard to the processing of your personal data. You can exercise your rights by submitting a request here, which can be sent by post or by e-mail to the above address.

15.1 Access rights of the data subject

You have the right to request information from us at any time about the personal data which we process and which relates to you, in the manner and according to the criteria set out in Art. 15 GDPR and Art. 34 BDSG [Federal Law]. on data protection].

15.2 Right to rectification of inaccurate data

You have the right to ask us to correct the personal data concerning you as soon as possible if this information is inaccurate.

15.3 Right to erasure 

You have the right to ask us to erase your personal data under the conditions provided for in Article 17 GDPR and Article 35 BDSG [Federal Data Protection Act]. These conditions include a right to erasure if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, as well as a right to erasure in the event of illegitimate or unlawful processing, of dispute, or of the existence of an obligation of erasure imposed by a law of the European Union or of a Member State to which we are subject.

15.4 Right to data portability

In accordance with Article 20 of the GDPR, you have the right to obtain from us the personal data which you have provided to us in a structured, common and machine-readable format.

15.5 Right to Complain

You have the right to contact a supervisory authority of your choice in the event of a complaint.