1. Highlights 

1.1. Your privacy matters. We want you to understand how we use the personal data you provide to us.

1.2. We use data about you. As a Supplier to, or Business Partner of, Royal Caribbean (defined below), we process your personal data and produce records based on that personal data.

1.3. We need to use your data. We use your personal data in furtherance of the Supplier/Business Partner relationship and our business operations.

1.4. We need to share your data with the Royal Caribbean Group, other Suppliers, and Business Partners in furtherance of our business operations. As a global business, we share your personal data within the Royal Caribbean Group and with other Suppliers, and Business Partners. We choose our Suppliers and Business Partners carefully and put in place safeguards to ensure that they protect your personal data.

2. Definitions

2.1. Affiliate: Affiliates, with respect to any entity, includes any other entity controlling, controlled by, or under common control with, such entity.

2.2. Associated Party: Associated Party includes those transferees of the benefit(s) and/or burden(s) of our Supplier/Business Partner relationships.

Business Partner: Business Partners include those individuals and entities, their affiliates and associated parties with whom we have partnered to complement the products and/or services we provide (herein referred to as “you” or “your”). This includes, without limitation, travel agents, tour operators, concessionaires, and joint venture partners. Personal data of Business Partners may include personal data of the owners, officers, directors, employees, agents, customers, suppliers and business partners.

2.3. Royal Caribbean: Unless, specifically identified herein, Royal Caribbean includes the Royal Caribbean Group (herein referred to as “we”, “us”, or “our” and their cognate terms).

2.4. Royal Caribbean Group: Royal Caribbean International, Celebrity Cruises, and Our affiliates.

2.6 Supplier: Suppliers include those individuals or entities, their affiliates and associated parties providing us products and/or services in furtherance of our business operations (herein referred to as “you” or “your”). This includes, without limitation, professional advisers (accountants, consultants and independent  contractors, lawyers, etc.). Personal data of Suppliers may include personal data of their owners, officers, directors, employees, agents, customers, suppliers and business partners.

3. Contents

• Who’s responsible for your personal data?
  
  
• What personal data do we collect or receive?
  
  
• How we use your personal data
  
  
• Who we share your data with
  
  
• How we transfer data internationally
• Retention of your personal data
  
  
• Your rights in relation to your personal data
  
  
• Legal grounds for processing
  
  
• Contact us

4. Who’s responsible for your personal data?

4.1. As the data controller, we are responsible for the personal data you provide to us and will determine, either on our own or jointly with you, how that data will be processed. We will only process such data within Royal Caribbean and with other Suppliers and/or Business Partners where we have a legitimate reason(s) to do so.

4.2. Please note the following data controller relationships:

5. What personal data do we collect or receive?

5.1. The following are categories of your personal data that we may process:

6. How we use your personal data

6.1. We process personal data for the purpose of our business relationship with you, the legitimate interests of Royal Caribbean, and to comply with certain legal and regulatory obligations, including:

(a) evaluating prospective business relationships;

(b) establishing the business relationship, including setting up payment and where applicable, access to our sites and/or information technology and communications systems;

(c) managing and assessing the business relationship, including performance, compliance with mutual obligations, etc.;

(d) records and business management, including auditing, compliance, and risk management activities;

(e) complying with:

(i) requests from, and reporting obligations of, governmental, quasi-governmental, and judicial bodies, including port and customs authorities and law enforcement agencies;

(ii) disclosure obligations in the context of litigation or government/regulatory investigations; and

(iii) health and safety obligations, documenting incidents, obtaining medical help, and reporting injuries for claim purposes

(f) protecting the rights and property of Royal Caribbean and any of its staff, customers, and others, ensuring the safety of the aforementioned and conducting related investigations.

7. Who we share your data with (Data sharing)

We may share your personal data with the following recipients for the purposes listed above:

(a) Members of the Royal Caribbean Group
As a global business, we may need to share your personal data with other companies in the Royal Caribbean Group.

(b) Our Suppliers and Business Partners
The integration of your products and/or services into our business operations may require us to share your personal data with other Suppliers and/or Business Partners. For example, we use cloud software providers (a Supplier) to provide booking software for travel agents (a Business Partner).

We choose our Suppliers and Business Partners carefully and put in place safeguards to protect your personal data.

(c) Ports, customs and other government authorities, law enforcement agencies and courts and parties to litigation T
The laws of countries in which we operate may require us to share certain personal information.

For example, ports and customs authorities require vessel manifests prior to permitting entry, law enforcement agencies may require access to personal data, including in connection with criminal investigations, and Royal Caribbean may be ordered to disclose personal data by a court or in connection with legal proceedings.

8. Retention of your personal data

We retain your Personal Data only for as long as necessary: (i) for the purposes set out in this privacy notice; and/or (ii) to comply with our legal obligations and/or internal policies and procedures.

9. Your Rights - Changes to this Privacy Notice

This privacy notice may be updated from time to time in Royal Caribbean’s sole discretion. Updates to this privacy notice are effective on the date published to our websites and/or digital platforms.

10. Contact us

If you require any other information about any part of this notice, you can contact our Data Protection Officer at Royal Caribbean Cruise Ltd. at the mailing addresses above or via email at privacy@rccl.com.

Section II: Heightened European Union requirements/ compliance with the General Data Protection Regulation
1. Application 

This Section supplements the provisions set out in Section I and applies to you if: 

2. Legal grounds for processing

We process your personal data to the extent that one or more of the following legal grounds applies:

(a) where you have given your express consent;

(b) where necessary for the performance of a contract;

(c) where necessary to comply with our legal obligations;

(d) where we need to process your personal data to protect your (or somebody else’s) vital interests, including where you are physically or legally incapable of giving consent, for example in case of a medical emergency;

(e) the establishment, exercise, or defense of legal claims; and/or

(f) where the processing is necessary for our legitimate interests or the legitimate interest of the those whom we transfer your personal data (provided that such legitimate interests are not overridden by your interests or your fundamental rights and freedoms).

3. International data transfers

4. Your rights in relation to your personal data

You certain rights in relation to your personal data we maintain, including the right to:

(a) accurate and complete personal data;

(b) request information about, and access to, your personal data;

(c) object to the processing of your personal data;

(d) request that we restrict the processing of your personal data;

(e) request that we erase your personal data;

(f) request receipt of your personal data and transmission to another controller;

(g) withdraw your consent at any time where the processing of your personal data is based on consent; and

(h) lodge a complaint with a supervisory authority.