1. Who we are: Explora SA
Explora S.A., headquartered in Avenue Eugène-Pittard 16, Geneva, Switzerland, registered for tax purposes under number CHE-315.766.578, acting as data controller, (the “Data Controller”, “we” or “us”), is committed to the fair processing of the users’ personal data (“your data”). In order to provide you with a great journey experience, we collect personal data about you on different occasions, such as when you browse the website www.explorajourneys.com (“Website”) and interact with us, or when you buy one of our product/service.
For all matters relating to the protection of personal data, it is possible to contact us via e-mail at privacy@explorajourneys.com.
Please read carefully this information notice, which is based on Article 13 of the General Data Protection Regulation (Reg. (EU) 2016/679 or simply “GDPR”).
As we are part of the MSC Cruises Group of companies, we appointed a Group Data Protection Officer (“DPO”). The DPO is available for any information regarding the processing of personal data carried out by Explora S.A. via dpo@explorajourneys.com. You can also send requests in writing; in that case, please specify “For the Attention of the Data Protection Officer” on the envelope.
2. Why, when and how we collect data about you
Our main objective is to provide you with a great experience during your journey. Below you will find the main purposes why your data is processed.
a. Providing you with our services
In order to enable you to navigate our website and take advantage of the services provided, we need to process certain data relating to your navigation. In addition, in order to provide you with our services, such as the sending of exclusive news and information about Explora S.A., we need to know your full name, your e-mail address, as well as if you are a Travel Agency, Media or Guest, and any other personal data we may need to fulfil your requests. We will only use this information to fulfil your requests, but without this data, we cannot provide you with the requested information. In particular, using the different forms on the website, you can request to be contacted through different channels (phone, e-mail, SMS, messaging systems, etc.) and we will contact you through the mean you requested or, where indicated, the mean you indicated as preferred. In case you fill out our online request form for telephone contact:
· we will contact you as per your preference on the date and time you have specified in the request form;
· we will contact you on the following days as per the initial time slot indicated by you if the call is not answered or the connection fails.
· we will make a maximum of 3 attempts to contact you by phone if the call is not answered or the connection fails and, if none are successful, we will contact you by e-mail to inform you of our attempts, and invite you to make a new request if you still wish to be recontacted.
During each contact, you may inform us of your wish to discontinue the service or, alternatively, send us an email. This processing is carried out to take steps at the request of the data subject prior to entering into a contract (Article 6.1(b) GDPR). In addition, where required by local regulations, phone calls may be recorded: in this case you will be notified at the beginning of the call and the processing is carried out for compliance with a legal obligation to which the controller is subject (Article 6.1(c) GDPR).
b. Completing and handling the booking of a cruise
To travel on-board our ships, you need to provide your name, contact details, date of birth and nationality at booking stage. We also register some information about your cruise choices, such as cabin type and type of cruise experience. In some cases (e.g., authorities, VIPs, etc.) we may also process some of your data (e.g., first name, last name and image) to ensure you have the best experience on board. We process this data on the basis of our contract with you (Article 6.1(b) GDPR). You also need to provide information about valid travel documents and visas, where applicable. We process this information to comply with regulatory requirements in the ports of call, therefore on the basis of an existing legal obligation (Article 6.1(c) GDPR). During the booking, in some cases, you could communicate data revealing information about your health or even your religious preferences (for example, food preferences that indicate the observance of a specific religion – such as kosher or halal food – or medical conditions requiring special attention on-board – such as disabilities or celiac disease). We collect this data in our Special Needs form and process it only on the basis of your informed and specific consent (Article 9.2(a) GDPR). It is not mandatory to provide this data, but please be informed that if you do not provide it, we are unable to accommodate your needs on-board. When you make a booking with a Travel Agency, that Travel Agency will insert the above data into our booking systems, acting as autonomous data controller; the Travel Agency will be responsible for the processing it carries out on your personal data and for taking the adequate data protection measures. Please contact your local Travel Agency for information about how it processes your personal data.
c. Sending you satisfaction questionnaires about the cruise you took part in
At the end of each cruise you take part in, we will send you an e-mail containing an invitation to complete a satisfaction questionnaire in order to collect your feedback and suggestions for improvement. The completion of the questionnaire is absolutely optional and all answers provided will be collected and processed anonymously without being able to associate the answers to your identity in order to improve our services and our offer to guests. This data processing is carried out on the basis of our legitimate interests in receiving feedback on our services in order to improve them and our offer to guests (Article 6.1(a) GDPR). You can obtain information about the balancing test upon request by using the contact email address provided in section 1 of this notice.
d. Sending you newsletters and communications
When you write us a message using the “Talk to us” page and indicate that you wish to receive information about our products and services, or where in any other case you provide us with your free consent, by clicking the consent box, we will contact you for marketing, promotional and publicity purposes, including to carry out direct marketing, market research and surveys, via e-mail, SMS, ordinary mail, over the phone, through push notifications/pop-up banners, instant messaging, through an operator, through Explora S.A.’s official social media pages, as well as for marketing activities in the broad sense, including prize events, games and competitions, products and/or services related to the company and/or to third-party products and/or services
Please, note that it is not mandatory to provide your consent to receive promotional messages and offers from us, but without it we will not be able to send you our offers.
Since the processing of your data for the purposes indicated above is based on your specific consent (Article 6.1(a) GDPR), you can revoke this consent at any time by clicking on the “unsubscribe” link at the bottom of a marketing email received from us, by emailing us at the email address provided for in section 5 of this notice, replying STOP to any marketing SMS received from us, through the private area on the Website. Any consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
e. Personalization
Your personal data collected, for instance, by way of tracking your onboard purchases through the cruise card/bracelet, onboard App, or special programs carried out from time to time, may be used for analysis of your preferences, habits, behaviour and/or interests in order to send you personalized commercial communications and carry out targeted promotional actions.
Since the processing of your data for the purposes indicated above is based on your specific consent (Article 6.1(a) GDPR), you can revoke this consent at any time by emailing us at the email address provided for in section 5 of this notice. Any consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
f. Sending you information about similar products and services to the ones you already booked
When you give us your email address in the context of buying any product or service provided by us, we may use your email address to send you information about products or services that are similar or related to the ones you bought (including all the services and experiences you can buy and enjoy on board our ships during your cruise), unless you exercise your right to opt-out of receiving marketing communications from us at the time of booking, or later via the “unsubscribe” link within the footer of our email.
This data processing is carried out on the basis of our legitimate interest of informing you of similar or related products and services that we offer and that may enhance your cruise experience (Article 6.1(f) GDPR). You can obtain information about the balancing test upon request by using the contact email address provided in section 1 of this notice.
g. Compliance with the applicable laws
We process some of your personal data as it is necessary to comply with our legal obligations, and, therefore, the applicable legal basis is compliance with legal obligations binding the data controller, i.e. us - Art 6.1(c) of the Regulation. When you provide personal data to Explora S.A., we are obliged to process it in accordance with the applicable laws, which may include storing and reporting personal data to official authorities for compliance with tax, customs or other legal obligations. Those activities include, for example:
· the processing of personal data for compliance with tax and fiscal laws:
· the tracking of boarding and disembarking from the ship by our guests carried out through the cruise card/bracelet and possible communication of such information to the authorities;
· the processing of any personal data and/or information we may ask you and/or collect before onboarding or during the cruises in compliance with regulation on prevention of Covid-19 infections.
h. Handling requests, complaints and comments
We keep track of the comments and complaints that you make on board in order to adequately respond to your requests. We process these data in connection with our provision of services to you, therefore on the basis of the booking contract (Article 6.1(b) GDPR). You have the option of making an anonymous complaint or comment, but please be aware that in such case it will be impossible for us to follow up on the complaint or to provide assistance and support. In addition, we can use the content of the request, complaint or comment to improve our services on board. We limit as much as possible the use of data that may identify you personally in this case. This processing is carried out on the basis of our legitimate interests in developing our services in a way that ensures our guests get a pleasant experience on board, in accordance with Article 6.1(f) GDPR. You can obtain information about the balancing test upon request by using the contact email address provided in section 1 of this notice.
i. Ensuring on-board security
We keep track of the people who are on board at all times in order to be able to handle crisis situations and to ensure everybody’s security throughout the cruise. We therefore record your name, cabin number, picture (taken when you come on board), date of birth, people you are travelling with, port of embarkation, port of disembarkation and information about special needs that may require specific assistance in case of emergencies. We process these data on the basis of the need to ensure public security and to manage potential crisis situations (Article 6.1(d) GDPR). For security reasons, we operate CCTV cameras onboard our ships, including all access points and in all public areas. These CCTV cameras are continuously recording 24 hours a day. We may perform screening of your personal data against publicly available databases to ensure security on board of our ships. We process these data on the basis of the need to ensure public security and to manage potential crisis situations (Article 6.1(d) GDPR). For this processing, the data controller is Explora S.A.
Moreover, the Carrier and/or the master have the right of refusing the boarding or order the disembarkation of any passenger should they deem it necessary, for the safety, security, of the passenger, of the other passengers or of the ship or should the passenger’s conduct which, in the reasonable opinion of the master, is likely to endanger or impair the comfort and enjoyment of other passengers onboard.
j. Onboard commercial photos
On board our ships, there are a number of kiosks managed by our third party partners where you can view, purchase and print all the photographs and videos that have been taken of you throughout the cruise. In case you would like to view your photos at a later stage, you can purchase and download them online after the cruise using your ID on your cruise card. We process your data in this regard in accordance with Article 6.1(b) of the Regulation. In case of special events or commercial photos to be publicly displayed onboard, we will provide you with a specific form to request your consent (based on Article 6.1(a) of the GDPR).
k. Additional data processing activities on-board
Some additional information about you may be collected during the cruise on paperback forms, in order to enable you to participate in specific activities (for example, the gym or the Spa) or to handle the request of specific packages. The data processed varies depending to the specific activity on board, however, we make sure to only collect the strictly necessary data to achieve the specific purposes. We also process some personal data about you to assign you to a dinner table at one of our main restaurants during the cruise, to make sure that you are able to enjoy your meal without having to look for an adequate table for yourself and the people you are travelling with. To assign the tables, our Maître D’ takes into account elements such as the size of the group you are travelling with, the place where you booked the cruise and your preferred language. You can request a different table at all times by contacting the Maître D’ or the Guest Service on-board. The above processing activities are carried to accommodate the request of the data subject (Article 6.1(b) GDPR).
l. Fraud Prevention/Detection and Security:
We process some of your personal data with regard to fraud prevention/detection and security purposes. In this case, we rely on our legitimate interest in preventing and detecting fraud to our own detriment (Article 6.1(f) GDPR).
3. How long we store the data
In accordance with Article 5.1(e) GDPR, the personal data that we collect is kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which personal data are collected and processed in each specific case, and in any case no longer than as specified by the relevant applicable laws.
Personal data processed for the purposes set out in Section 2(a) will be kept by Explora S.A. for the period deemed strictly necessary to fulfil such purpose – in any case, as this personal data is processed for the provision of the service, we will keep them for as long as the statute of limitations on liability related to the provision of the services (as determined by the applicable law) lasts, so as to protect our interests.
Additionally, personal data processed for the purposes of responding to a specific request received through the different channels will be kept by Explora S.A. for the period deemed strictly necessary to fulfil such requests that we receive by you, and in any case not after you revoke your specific request or ask not to receive further information.
Personal data processed for the purposes set out in Section 2(b) will be retained for as long as indicated by statutory dispositions in order to comply with our legal obligations as per Article 6.1(c) of the Regulation). For data collected based on Article 6.1(b) of the Regulation, we will retain your data for no longer than 10 years.
With regards to Section 2(c), considering that completion of the questionnaire is anonymous, the answers we collect will be retained for as long as necessary to guarantee constant improvement of our business, and in any case, not longer than 7 years.
Personal data processed for the purposes set out in Section 2(d - e), based on your consent, will be retained until you revoke this consent, and in any case, not longer than 7 years from the revocation of this consent.
Personal data processed for the purposes set out in Section 2(f) will be kept by Explora S.A. for the period deemed strictly necessary to fulfil such purposes, and in any case not after you exercise your right of opposition by the unsubscribe link, or specific request.
Personal data processed for the purposes set out in Section 2(g) will be kept by Explora S.A. for the period required by the specific legal obligation.
Personal data processed for the purposes set out in Section 2(h) will be kept by Explora S.A. for the period deemed strictly necessary to fulfil such requests that we receive by you, and in any case, the limited information that we keep shall not be retained any longer than 10 years.
All personal data processed through the CCTV cameras on board as set out in Section 2(i) are retained for a period of 30 days. In the event of an incident onboard that may call for further investigations, the extracted CCTV footage related to such incident may be retained for a period no longer than 5 years.
With reference to Section 2(k) and all other processing activities onboard, we have defined a Corporate Data Retention Policy that specifies the time frame for data processing at the end of which all copies of the personal data are either destroyed or anonymised using adequate techniques that do not permit the re-identification of the data subject.
Personal data processed for the purpose of preventing Abuse/Fraud referred to in Section 2(l) will be retained by Explora S.A. for the time strictly necessary for the aforementioned purpose and therefore for as long as Explora S.A. is required to retain it to protect itself in court and to communicate said data to the competent Authorities.
For more information on Explora S.A.’s personal data retention periods and the criteria adopted in determining these periods, please contact our DPO at the email address set out in Section 1.
4. Categories of data recipients and personal data transfer
Your personal data may be shared with:
We store your personal data on servers located in Frankfurt. We may transfer personal data to MSC Cruises Group’s companies, or other reputable third party organizations situated inside or outside Switzerland. Your personal data may also be shared with recipients who are located outside the European Economic Area. For all these cases, Explora S.A. ensures that your personal data are transferred to these recipients in accordance with the GDPR. Indeed, transfers can be based on an adequacy decision, the Standard Contractual Clauses approved by the European Commission or another legal transfer mechanism. For further information please send a written request to dpo@explorajourneys.com.
5. Your data subject rights
The GDPR provides for enhanced rights and Explora S.A. is committed to giving you the appropriate control of your own personal data.
In particular, you have the following rights in connection to your personal data:
a. The right to access your personal data and obtain specific information about how we process it, in accordance with Article 15 GDPR; please be aware that you can only exercise this right in relation to your own data or to the data of a minor or another vulnerable person, where you have provided such data as a holder of parental authority or legal responsibility. Explora S.A. reserves the right to ask for proof of identity, as well as to refuse to provide the personal data if the identity or relevant connection to the data subject cannot be proven.
b. The right to rectify your personal data, in accordance with Article 16 GDPR, including by means of providing a supplementary statement.
c. The right to obtain the erasure of personal data concerning you, in accordance with Article 17 GDPR, unless the data are necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which Explora S.A. is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9.2 as well as Article 9.3 GDPR; or for the establishment, exercise or defence of legal claims.
d. The right to obtain the restriction of the processing of your personal data. In accordance with Article 18 GDPR, this right may be exercised in the following cases:
· Temporary restriction, where you are contesting the accuracy of the personal data; in this case, we will restrict the processing of your data for a period enabling us to verify the accuracy of your data and we will provide feedback to you as to the lifting of the restriction;
· The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
· Explora S.A. no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
· Where you have objected to processing pursuant to Article 21.1 GDPR, the processing is restricted pending the verification whether our legitimate grounds override your rights as data subject.
e. The right to data portability. In accordance with Article 20 GDPR, you may exercise this right in those cases where the processing is based on your consent or on your contractual relationship with Explora S.A., and the processing is carried out by automated means.
f. The right to object, at any time, to the processing of the personal data concerning you. In accordance with Article 21 GDPR, you may exercise this right where the processing is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in us, or where the processing is based on our legitimate interests.
g. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which similarly significantly affects you. In accordance with Article 22 GDPR, you may exercise this right unless the processing is necessary for entering into, or performance of, a contract between you and Explora S.A. or one of the companies of our group; or is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or if the processing is based on the your explicit consent.
h. The right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to him or her infringes the GDPR, in accordance with Article 77 GDPR.
Please find the list of all European Data Protection Supervisory Authorities at the following link: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
To exercise your data subject rights, you can send your request to the Data Controller at the e-mail address privacy@explorajourneys.com.
Requests may also be sent in writing to Explora S.A., Avenue Eugène-Pittard 16, Geneva, Switzerland; in that case, please specify “For the Attention of the Data Protection Officer” on the envelope.
6. Website Cookies
6.1. Definitions, characteristics and application of the rules
Cookies are small text files that the Websites visited send to you and store on your computer or mobile device, and which will be returned to these same sites on each new visit. Thanks to these cookies, the Website remembers your actions and preferences (for example connection data, preferred language, font dimensions, other display settings, etc.) so that you do not have to need to specify them again when you return to the Website.
Cookies are used for electronic authentication, session tracking and the storage of information on the activities of users visiting the Website. They may also contain a unique identifier allowing a system to monitor your browsing activities on the website, for statistical or advertising purposes. When you visit a website, you may also receive cookies on your computer or mobile device from other websites or servers (third-party cookies). Certain operations may be impossible to perform without the use of cookies, which are sometimes technically necessary for the proper functioning of the Site.
There are different types of cookies depending on their characteristics and functions, the duration of storage on your computer or mobile device varies. Session cookies are automatically deleted when you close your browser, while persistent cookies remain on your device until a pre-programmed expiration date.
According to the applicable law you in the country you are connected from, this may not always require your consent for the use of cookies. For example, such consent may not be required for “technical cookies”. These cookies are used exclusively to transmit messages over an electronic communication network, or to provide a service specifically requested by the user. In other words, these cookies are essential for the operation of the Website or for the performance of the activities that you request.
Technical cookies that do not require your express consent may also include, according to the country you are connected from, for instance:
· “analytical or audience cookies”, when complying with mandatory conditions as detailed into guidelines issued by the competent data protection authority (i.e. the recommendation. issued by the French Authority), including the production of anonymous statistical data in aggregated format, on the number of users and the way in which they visit the website;
· session cookies (for authentication purposes in order to access a service);
· functional cookies, which allow you to visit the Website according to a set of selected criteria (such as language, products selected for purchase) and which are intended to improve the service provided.
On the contrary, “profiling cookies”, which are used to create user profiles as well as to send advertising messages corresponding to the preferences that You have indicated while browsing the network, require Your specific consent.
6.2. Types of cookies used by the Site
The Site uses the following cookies: