PRIVACY POLICY

1. About Lulu Tourism:
Lulu Tourism (‘LTC) (as “Data Controller”) an exclusive retreat offering unrivalled leisure experience in a stylish sophisticated setting. Located on the purpose-built Reef Island, our picturesque Clubhouse & Lagoon Beach is perfectly positioned overlooking the panoramic view of Bahrain skyline and within close proximity to city’s business and shopping district of Manama., LTC is processing the required personal data and sensitive personal data of its job candidates, employees, prospects, customers and third parties. The website visitor (“visitor”) (as “Data Subject”) gives explicit consent to LTC to collect, process, and share the personal data to provide the required services, and to carry out any obligations owed to visitors and for other related purposes, including monitoring, and statistical analysis of its business, and legal and regulatory compliance.
2. Origin of Personal Data & Sensitive Personal Data:
LTC collects and processes your personal data to operate its platforms (i.e. website, mobile application, social media accounts) when you visit the website and you:
a. Contact us through using the “Contact Us” webpage or through our social media platform (e.g. Instagram).
b. Use or view our website via your browser’s cookies.

3. Categories of Personal Data:
LTC processes the website visitors following personal data:
a. Identity details such as name, gender, date and place of birth, nationality, ID/ passport details, marital status.
b. Contact details: postal address, email address, phone number
c. Employment Information: employment status, job title, employer details
d. Login information: username
LTC webserver automatically records details about the visit including IP address, the website from which the visitor visited the website, type of browser software used, website pages that the visitor has visited, and date and duration of the website visit.
4. Purposes for Data Collection and Lawful Basis for Processing:
LTC only processes your personal data based on one or more of following lawful basis under Bahrain PDPL:



Purpose	Lawful Basis
For registration process and to respond to online queries.	Legitimate Interest Data Subject Consent
To apply online backups, system support and maintenance activities.	Legal Obligation Legitimate Interest
To provide your information to auditors during and after your contract to verify compliance with Bahrain Laws.	Legal Obligations
To store your contact details electronically in our records.	Legitimate Interests Data Subject Consent
To comply with LTC internal policies and procedures.	Contractual Obligations Legitimate Interests

5. Categories of Recipients of your Data:
LTC may share visitor’s personal data to those who provide services to LTC. LTC may also transfer personal data collected and processed about website visitors with third parties including system support vendors and governmental bodies:
a. To the extent that it is required to do so by any applicable law or regulation; 
b. Where there is a duty to the public to disclose; 
c. Where LTC interests require disclosure to administer the relationship with you or where we have one of the above-mentioned legitimate interests in doing so; or
d. At a visitor's request or with a visitor's consent.

6. Your rights under Bahrain Personal Data Protection Law (PDPL) (Act No. 30 of 2018):
You have the rights to submit your request free of charge to LTC:
a. To be notified about the complete data concerning you and request its rectification.
b. Remove, block, or restrict your personal data.
c. Object if your personal data is being used for direct marketing
d. Object if processing may result in defamation or discrimination causing possible financial or moral damage.
e. Object if your personal data is being used for decisions based on automated data processing and request that the processing be solely automated.
f. Withdraw your consent to the processing of your personal data in cases where you have provided your consent for the processing and, as such, your consent is the lawful basis that LTC is relying on for processing.

• LTC shall process such request free of any charges within a period of 10 working days, otherwise as stipulated by the law.
• A consent once given by the platform visitor can be withdrawn at any time for any future actions.
• You have the right to lodge a complaint to Bahrain Personal Data Protection Authority (Bahrain PDPA) regarding any violation of Bahrain PDPL and its implementing Orders.
7. Decisions based on automated processing:
LTC will not take decisions based on automated processing of your personal data and will you in writing in case this condition is changed.
8. Security of your Personal Data
Platform visitors’ personal data is protected under Bahrain PDPL and LTC ensures implementing selective security measures for protecting your privacy. LTC shall implement technical and organisational security measures to keep your personal data secured and protected including when cross border transfer and storage.
9. Retention Period of your Personal Data
The personal data collected by LTC is retained for as long as necessary to fulfil the purpose for which it was collected, and/or based on the validity of the contract, legal retention period requirements, and historical archiving. We securely destroy and erase or anonymize your personal data to ensure that it cannot be restored after exceeding the retention criteria. Hence, LTC will not be able to support you with any further processing or information request on your personal data.
10. Contact details:
If you have any questions or would like to obtain more details about how we use your personal data, you may contact LTC at DPG@reef-island.com, P.O. Box 31405, Manama, Kingdom of Bahrain
11. Your Role to Keep your Personal Data Accurate
It is essential for LTC to keep your personal data up to date and accurate. Therefore, kindly provide your updated information in case there is any change to your personal data during your business relationship with us.
12. Update on Privacy Policy
LTC has the right to review and update the privacy policy. In case of any changes, we will inform you of any substantial change in how we process your personal data.