Who is responsible for your data
The controller of the personal data collected through this website is:
[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Hamata / Marsa Alam, Red Sea Governorate, Egypt
Email: mermaid@mermaidredsea.com
WhatsApp: +20 121 302 7822
We have not appointed a data protection officer, as we are not required to. Write to the address above with any question about your data and a person will answer you.
The short version
We run a yacht, not an advertising business. This website has no analytics, no advertising pixel, no tracking of any kind, and we have never sold or shared a visitor's data with anyone. Our typefaces are served from our own server rather than Google's, so no third party sees you simply for reading this page.
One feature on the homepage — the live weather forecast — is fetched by your browser from another company, so we ask before it loads. That is the entire reason the cookie dialog exists.
What we collect, and why
When you visit. Our hosting provider records standard server logs: your IP address, the page requested, the time, your browser and the page you came from. This is unavoidable in operating any web server and is used to keep the site running and to investigate abuse. Legal basis: our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR). Kept for [RETENTION PERIOD — ask your host, typically 7–30 days], then deleted.
When you subscribe to the newsletter. We store your email address, the language you subscribed in, and the date you confirmed. We use double opt-in: nothing is sent until you click the link in the confirmation email, which also proves the consent was yours. Legal basis: your consent (Art. 6(1)(a) GDPR). Kept until you unsubscribe — every message carries a one-click unsubscribe link.
When you contact us. If you email us or message us on WhatsApp, we keep that correspondence so we can answer you and handle your booking. Legal basis: steps taken at your request before entering a contract, and performance of that contract (Art. 6(1)(b) GDPR). Booking correspondence is kept for as long as required by Egyptian tax and commercial law; general enquiries that lead nowhere are deleted after [RETENTION PERIOD, e.g. 24 months].
When you sail with us. Booking a safari requires passport details, certification level, emergency contact and any medical information relevant to diving safety. This is handled separately from the website and is covered by our booking terms. Medical information is a special category of data under Art. 9 GDPR and is collected only with your explicit consent, used only for your safety in the water, and shared only with the crew who need it.
Who else sees your data
Our hosting provider, [HOSTING PROVIDER NAME], [COUNTRY]. They operate the server this website runs on and therefore process everything that passes through it, under a data processing agreement. [CONFIRM: do you have a signed DPA / Auftragsverarbeitungsvertrag with them? For EU visitors you need one.]
Open-Meteo (Switzerland) receives your IP address if, and only if, you agree to the weather forecast. Switzerland has an EU adequacy decision, so no additional safeguards are required. Open-Meteo state that they set no cookies and do not track visitors.
WhatsApp (Meta Platforms Ireland). Our WhatsApp button is an ordinary link — nothing loads from Meta until you click it. If you do choose to message us there, that conversation is subject to WhatsApp's own privacy policy, not ours, and Meta will process the metadata of your message. If you would rather they did not, email us instead.
Our social profiles. The Facebook, Instagram and YouTube icons in our footer are plain links. No content is embedded from those platforms, so they learn nothing about you unless you click through.
Nobody else. We do not sell, rent or trade personal data, and we share it with no one beyond what is described above, except where the law compels us to.
Data leaving the European Union
We are based in Egypt, which the European Commission has not recognised as providing an adequate level of data protection. If you are in the EU or the UK, contacting us or booking with us necessarily means your data is transferred to Egypt. We rely on Art. 49(1)(b) GDPR — the transfer is necessary to perform the contract you are asking us to enter into — and, where that does not apply, on your explicit consent under Art. 49(1)(a).
Your rights
If you are in the EU or the UK, the GDPR gives you the right to ask us for a copy of the data we hold about you (Art. 15); to have it corrected (Art. 16) or deleted (Art. 17); to restrict how we use it (Art. 18); to receive it in a portable format (Art. 20); and to object to processing based on our legitimate interests (Art. 21). Where we rely on your consent, you may withdraw it at any time without giving a reason, and without affecting anything done before you withdrew it.
Write to mermaid@mermaidredsea.com and we will answer within one month. There is no charge, and you do not need to explain why you are asking.
You also have the right to complain to a data protection authority in the country where you live or work. In Germany that is the authority of your federal state; in France, the CNIL; in Poland, the UODO.
Changes to this policy
If we add a service that collects or transmits anything new, we will update this page and ask for your consent again — your previous answer is not carried over to a question you were never asked.
Change your mind
Withdrawing consent has to be as easy as giving it, so here is the same dialog again. Your choice takes effect immediately — no reload, no waiting until next time.
Last updated: September 2026
