Privacy Policy

This document is entitled the external privacy notice for UAE entities (the “Privacy Notice”) and is valid from the date it is published.

Shamal Holding LLC (the “Company”) and/or any of its subsidiaries, hereinafter (“Group”, “we”, “us”, “our”) collects and processes personal data and therefore respects the privacy rights of the online visitors, customers and suppliers (“you”, “your”, “yours”) who interact with the Group and recognises the importance of protecting the personal information which is collected and processed.

We have adopted a group-wide Privacy Notice, that applies to the Group and provides guidance on how the we collect, store, and use the information that you provide when you (i) visit any of the Websites operated by the Group, (ii) download and/or use any of the mobile applications or other digital platforms utilised or offered by the Group (together referred to as the “Website” or “Platform”) and/or (iii) when you interact in any way with any entity of the Group.

This Privacy Notice provides information to enable you to be fully informed of how we collect and processes your personal data.

The Company is the controller of the personal information collected about you by the Group and is responsible for administering this Privacy Notice, including any rights you may exercise and any inquiries you may raise regarding the handling of your personal data by the Group. The Company may also operate as a joint controller alongside the relevant Group entity responsible for the specific entity you interact with.

THIRD PARTIES

The Group’s Websites and Platforms may contain links to and from Websites belonging to other companies or organisations. This Privacy Notice does not apply to Websites or other platforms maintained by those third parties to which any of the Websites or Platforms link, and the Group is not responsible for any personal information you submit to third parties via the Websites and/or Platforms. If you follow any link to another Website, that Website may have its own privacy policy. The Group does not accept any liability or responsibility for the privacy policies of third parties. It is recommended that you read the privacy policies of other companies or organisations before submitting any personal details.

WHAT PERSONAL INFORMATION IS COLLECTED ABOUT YOU?

When you visit any of the Group’s Websites, use or download any of the Platforms, visit any of the stores, or interact with any products or services, some or all of the following information may be collected about you:

Personal Details

• your name, title, residential or office address, date of birth, billing address, email address, phone number, and/or location;
• information resulting from authentication or identity checks, such as your passport number, social security number, or similar information; and/or
• transcripts of any live chat communications if a Website has a live chat option, including functionality that allows you to correspond via WhatsApp.

Family, Lifestyle, and Social Circumstances

• if you choose to interact with an entity of the Group via a social media platform, information provided through that platform;
• information about your preferences, memberships, and loyalty programs;
• information about your family and your next of kin;
• travel details; and/or
• car registration details.

Financial Details

• financial information such as your bank account or credit card details; and/or
• information related to a purchase of or potential purchase of products or services (including invoices and records of purchase).

Other

• geolocation data;
• communication preferences;
• video footage; and/or
• photographs.

Sensitive Personal Data

• medical information, including details about certain medical conditions which may impact your ability to participate in any experiences provided by the Group;
• physical information, such as age, size, weight, and height; and/or
• marital status and next of kin.

In addition, the Group may automatically collect information about you when you visit a Website or Platform. This may include technical information such as the internet protocol (“IP”) address used to connect your computer to the internet, browser type and version, time zone setting, cookies (please refer to the “What About Cookies?” section below), browser plug-in types and versions, and details of the device, operating system, and platform that you use. Additional information may include page response times, download errors, length of visits to certain pages on websites and platforms, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to navigate away from a Website or Platform.

HOW WE MAY COLLECT YOUR PERSONAL DATA

Directly from you when you:

• visit one of the Websites, fill in any forms on a Website, or generally interact with any of the Websites;
• visit, download, or interact with any of the Platforms;
• purchase tickets, make bookings, or sign up for subscriptions or memberships through a Website or Platform;
• purchase goods and services through one an e-commerce Websites/Platforms or in person by visiting the premises;
• correspond by phone or in writing (including by email);
• participate in surveys;
• register for events;
• enter into any competition run by the Group or an entity;
• request information or marketing materials be sent to you or sign up for any newsletters; and
• visit any of the premises and interact with the staff.
• from affiliated entities, social media platforms or third-party business partners to whom you share information and with whom the Group interacts;
• from travel agents and other third parties with whom the Group liaises to provide products and services;
• through any live chat provider available on a Website or Platform (including WhatsApp);
• from your membership or loyalty programs; and
• from cookies on any Website or Platform (please refer to the “What About Cookies?” section below) or similar technologies.

WHAT ABOUT COOKIES?

The Websites and Platforms may use cookies. A cookie is a very small data file that a Website asks your browser to store on your computer or mobile device. A cookie allows a Website or Platform to “remember” your actions or preferences when you visit that Website or Platform in the future. A cookie may transmit information via your browser in order to authenticate or identify either the computer (for example, via the IP address) or the user.

Additionally, cookies may contain other information, such as registration data or user preferences. When our servers receive a request from a computer that stores a cookie from a Website or Platform, the servers can use the information stored in the cookie in combination with the information that the Group stores on its servers.

There are four (4) types of cookies:

1. functional cookies:
   These cookies enable you to browse the Websites and Platforms and use their associated features.
2. analytical cookies:
   These cookies are used to measure and analyse how visitors use the Websites and Platforms. This allows the Group to continuously improve the Websites and Platforms and your experience.
3. preference cookies:
   When browsing, the Websites and Platforms will remember the preferences you make (for example: your username, language or location). This makes your browsing experience simpler, easier and more personal to you.
4. targeted cookies or advertising cookies:
   These cookies are used to deliver advertisements (when used) that are relevant to you. In addition, they limit the number of times you see an advertisement and help us measure the effectiveness of our advertising campaigns.

By using any of the Websites or Platforms, you agree to the placement of these types of cookies on your device and access to them when you visit any of the Websites or Platforms in the future.

HOW DO I DELETE OR REJECT COOKIES?

You can delete cookies at any time. If you want to delete any cookies that are already on your computer, please refer to the help and support area on your internet browser for instructions on how to locate the file or directory that stores cookies.

Information on deleting, rejecting or controlling cookies is available at https://allaboutcookies.org/. Please note that by deleting cookies or disabling or rejecting future cookies, you may not be able to access certain areas or features of the Websites or Platforms, or certain functions may not work correctly.

If you use the Websites or Platforms without deleting or rejecting some or all cookies, you agree that any cookies you have not deleted or rejected may be placed by the Group on your computer or on your device.

You may change your cookie preferences (and withdraw your consent to the Group’s use of non-essential cookies that collect your Personal data) at any time by amending your cookie preferences.

HOW THE GROUP MAY USE YOUR PERSONAL DATA

Necessary Administration

• processing, fulfilling, and delivering orders for products and services;
• processing, fulfilling, and providing e-tickets for experience-based products;
• taking payments for services or products purchased and processing refunds;
• creating and managing customer accounts on the Websites and Platforms;
• receiving and handling customer inquiries, complaints, issues, and requests;
• addressing business client and service provider requests; and
• managing relationships with clients and service providers.

Providing specialist products and services

• providing customers with specialist equipment for experience-based services that require professional equipment;
• providing specialist training in specific sports;
• providing customer experience videos and photographs;
• reviewing and storing medical data for certain challenging sporting activities to ensure customer health and safety;
• documenting and maintaining liability waiver forms to ensure customer health and safety; and
• when the Group is providing berth handling services, managing and facilitating the reservation and allocation of berths or docking spaces, movements of berths, renewals of berths, and providing documents for vessel re-registration.

Marketing

• sending updates, news, and promotional messages (including special offers) related to the entity with which you have interacted; and
• sending targeted advertising relating to the entity with which you have interacted.

Analytics

• analysing Website and Platform data to improve products and services;
• analysing your consumption behaviour for the purposes of providing you with special offers or promotions;
• analysing consumption patterns, response times, and other metrics to improve our products and services; and
• utilising survey feedback to improve products and services.

Legal and Regulatory

• in the case of marine services, providing information to port agents to allow customer access to marine assets (including entry to port);
• responding to requests by government or law enforcement authorities or regulators conducting any investigation;
• cooperating with government, taxation, or law enforcement authorities or regulators on any information request;
• complying with any applicable legislation;
• combating money laundering and fraud; and
• preventing and detecting crime.

SECURITY OF YOUR PERSONAL DATA

The Group takes the security of your personal data seriously. It has internal policies and controls in place and implements technology measures to ensure that your personal data is not lost, accidentally destroyed, misused, disclosed, or subject to unauthorised access.

The Group will update these policies, controls, and measures from time to time as appropriate, including when new technology becomes available.

RETENTION OF YOUR PERSONAL DATA

The Group will only retain your personal data for as long as necessary to fulfil the purposes for which the personal data is collected, including satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, the Group will consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which the personal data is processed, and whether such purposes can be achieved through other means, as well as the applicable legal requirements.

In some circumstances, for example, where the basis for processing your data has changed or ceased to exist, your personal data may be anonymised so that it can no longer be associated with you, in which case the Group may use such information without further notice to you.

If you have elected to receive marketing communications from one of our entities, the Group will retain personal information about your marketing preferences for a reasonable period of time, which will be determined based on the date you last expressed interest in our content, products, or services.

YOUR RIGHTS

The Group aims to keep the personal data that is held about data subjects as accurate as possible. As a data subject, you may have a number of statutory rights available to you. The actual rights available to you will depend on the data protection regime applicable to you and/or your personal data. The rights available to residents of the United Arab Emirates (“UAE”) are set out below.

If you wish to exercise any of your rights, please fill out the Data Subject Request Form, available here: www.shamalholding.com.

If you wish to enquire about your rights or exercise any of your rights, please follow the instructions in the ‘Contact Us’ section on www.shamalholding.com.

Where you make any request to us, the Company reserves the right to request further details from you to evidence your identity before processing your request.

• The Right to Withdraw Consent

Where your consent is relied upon as the lawful ground for processing your personal data, you may withdraw your consent at any time.

Any withdrawal of consent must:

• be in writing (either in hard copy or electronic form);
• notified by one of the methods set out in the section entitled ‘Contact Us’ on www.shamalholding.com.; and
• clearly set out the processing for which consent is withdrawn.

In the event that the applicable legislation or regulations set out any additional requirements to which a withdrawal of consent must adhere, then such additional requirements shall apply in addition to the above requirements.

The withdrawal of consent will not affect the validity of the processing of your personal data that occurred prior to the withdrawal of your consent. Depending on the nature of the processing for which consent is withdrawn, this may affect your ability to receive certain products, services or functionality.

• The Right to Access, Rectification and Erasure

You may request a number of details about how your personal data is being processed, including, but not limited to, the types of personal data that are being processed and whether decisions are made about you using automated processing or profiling.

In some cases, you may also request for your personal data to be corrected or erased.

• The Right to Restriction of Processing

In some circumstances, you may restrict the processing of your personal data. Please get in touch using the details provided in the ‘Contact Us’ section on www.shamalholding.com. to find out more about what restrictions you may request and the circumstances in which the processing of your personal data may continue, irrespective of such a request.

• The Right: Request Transfer of personal data

Where the processing is carried out on the grounds of consent or the performance of a contract and is carried out by automated means, you may have the right to receive such data in a machine-readable format, provided that it is technically feasible to do so, and such disclosure will not infringe the rights of any other natural person.

• The Right to Object to any Decision Based Solely on Automated Processing.

You have the right to object to any decision that is made based solely on automated processing, including profiling, which produces legal consequences upon you or other seriously impactful consequences. You may also require such decisions to be reviewed manually.

• The Right to Lodge a Complaint

You may lodge a complaint with The UAE Data Office or the UAE Ministry of Economy’s Consumer Complaints Department at www.moec.gov.ae/en/complaints-service.

We encourage you to first raise any complaints directly with the Company by utilising the contact methods under the ‘Contact Us’ section on //www.shamalholding.com.

MARKETING OPT-IN AND OUT

When you register on a Website or Platform or use the ‘Contact Us’ option on www.shamalholding.com., you may be given the opportunity to subscribe to a regular update service which may send you alerts for new products, features, enhancements, special offers, upgrade opportunities, contests, events of interest, and one-off marketing promotions (“Alerts”)

Alerts may be sent by email, SMS, WhatsApp, push notification, or other electronic communications means, as well as by postal mail.

Alerts which you subscribe to will only be sent by the Group.

You may unsubscribe from any Alerts at any time. All electronic Alerts will contain an easy automated unsubscribe link so that you can opt out of that particular Alert. To opt out of direct mail Alerts, please contact the Company by email at dataprivacy@shamal.com.

SHARING YOUR PERSONAL DATA

Your personal data may be shared internally within the Group. Your personal data may also be shared with:

• Third parties that process data for the purposes of providing services to the Group such as website hosting, data storage, software services, email services, marketing, fulfilling customer orders, providing payment-related services including payment aggregation, data analytics, data mining, providing customer services, and conducting surveys, as permitted by applicable law. These companies may be located within or outside the UAE, but in any case, they are obligated to protect your data;
• Regulatory authorities or other government entities to ensure compliance with legal and professional obligations, including in response to a request made by a government authority;
• Law enforcement authorities and courts;
• Financial institutions;
• Professional advisors providing services to the Group such as legal and accounting services;
• If the Group sells or buys any business or assets, in which case, prospective sellers or buyers of such business or assets, however, such information will be anonymised so you will not be identifiable;
• Third-party social media advertising partners or other third-party digital marketing providers should allow advertising to be tailored to you to ensure that you only receive targeted marketing that is relevant to you. Where targeted advertising is undertaken, the social media company and/or digital advertising companies will only be able to see your email address if you already have an account with them and they already have your address themselves;
• If it is necessary to arrange the receipt of a prize you have won after entering into a competition run by the Group and by the third-party with whom we have run the competition in conjunction; and/or
• Third parties to whom we may pass on information about our Platform or Website traffic and other commercial information, but this information will not include any information which can identify you personally.

All unsolicited/public information shall be deemed to be non-confidential, and we shall be free to reproduce, use, disclose, and distribute such unsolicited/public information to others without limitation or attribution.

TRANSFER OF YOUR PERSONAL DATA TO OTHER COUNTRIES OR JURISDICTIONS

The majority of information the Group collects, including your personal data, is stored in the UAE. However, some personal data may be stored and/or transferred, where required. For example, some of the Group’s third-party providers or facilities may be outside the UAE.

In such circumstances, the Company will take such organisational, contractual, and legal measures as required under applicable legislation or regulations to ensure that your personal data is processed only for the purposes mentioned above and that, where required, adequate levels of protection have been implemented in order to safeguard your personal data.

Where your personal data will be transferred to a jurisdiction that does not have an adequate level of protection, the transferring Group entity may be required to enter into a contract with the recipient or ensure other requirements have been met in accordance with applicable legal requirements.

DATA BREACH

In the event that the security of the Websites, Platforms, or services is compromised or your personal data has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, the Group reserves the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, the Group will make reasonable efforts to notify affected individuals if the breach would prejudice the privacy and confidentiality of the user or if notice is otherwise required by law. If, for any reason, you have a reason to believe that your personal data shared is no longer secure, you may contact the Group using one of the methods set out in the ‘Contact Us’ section on www.shamalholding.com.

CHANGES TO OUR PRIVACY NOTICE

If possible, you will be notified of any changes to this Privacy Notice using the contact information you have provided, and you consent to us contacting you for this purpose. This Privacy Notice will be updated on the Websites and Platforms, which you can refer to at any time, and you may be asked to accept the new Privacy Notice when you next visit a Website or Platform.

CONTACT US – TO ASK QUESTIONS OR FILE COMPLAINTS

The Company is responsible for dealing with all queries regarding this Privacy Notice and the processing of the personal data by the Group. The Company is also responsible for administering any rights you may have under any applicable law(s).

Please contact the Company in regard to any concerns in relation to this Privacy Notice or to exercise your rights:

• By submitting a Subject Request Form, which can be found www.shamalholding.com.; or
• By email to dataprivacy@shamal.com with the subject “Data Protection”.

SEVERABILITY

If any term or condition of this Privacy Notice is deemed invalid or unenforceable by a court of law or tribunal with binding authority, then the remaining terms and conditions shall not be affected.

GOVERNING LAW AND DISPUTE RESOLUTION

This Privacy Notice shall be governed by the laws of the UAE as applied in the emirate of Dubai.

In the event of any dispute, the Group will first attempt to resolve the dispute amicably and in good faith. If that is not possible, either you or the Group may refer the dispute to be finally settled exclusively by the Dubai courts.