Privacy and Cookie Policy

Last updated: 21 October 2026

1. Who we are

Tropic Tree Maldives ("we", "us", "our") is a 12-room hotel on Gulhi Island, South Malé Atoll, Maldives. The hotel is operated by Tropic X Maldives Pvt Ltd (C-284/2006), Asseyri, Aamagu, Gulhi (08070), South Malé Atoll, Maldives, which is the data controller responsible for your personal data.

If you have any questions about this policy or how we use your data, contact us at tropictree@tropicxmaldives.com or +960 999 6483.

This policy explains how we collect and use personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the laws of the Maldives.

2. What data we collect

Category	Examples	Source
Identity and contact	Name, email address, phone or WhatsApp number, country	You (booking form, email, WhatsApp)
Booking details	Dates, room type, number of guests, children's ages, arrival and transfer times	You, or a travel agent or booking platform
Identity documents	Passport number, nationality, date of birth	You at check-in, as required by Maldivian law
Payment data	Amount paid, payment method, last four card digits	You and our payment provider. We do not store full card numbers.
Stay preferences	Dietary needs, excursions booked, special requests	You
Health information (only if you provide it)	Allergies, mobility or accessibility needs, diving fitness declarations	You, with your explicit consent
Technical data	IP address, browser type, pages visited	Your device, via our website (see section 11)
Communications	Emails, WhatsApp messages, feedback	You

 

We do not knowingly collect personal data from children, except as part of a family booking made by a parent or guardian.

3. How we use your data and our lawful basis

Purpose	Lawful basis
Responding to your booking request and managing your stay, transfers and excursions	Performance of a contract, or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
Registering guests with Maldivian authorities, and keeping tax and accounting records	Legal obligation (Art. 6(1)(c))
Processing payments and preventing fraud	Contract and legitimate interests (Art. 6(1)(b) and (f))
Meeting allergy, medical or accessibility needs	Your explicit consent (Art. 9(2)(a))
Keeping our website secure and understanding how it is used	Legitimate interests (Art. 6(1)(f))
Non-essential cookies and analytics	Consent (Art. 6(1)(a))
Sending offers and newsletters	Consent, or for past guests, offers about similar stays where the law allows. You can unsubscribe at any time.
Asking for feedback or a review after your stay	Legitimate interests (Art. 6(1)(f))
Handling complaints and legal claims	Legitimate interests and legal obligation

 

We do not sell your personal data. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Who we share your data with

• Service providers who act on our instructions, such as our web host, email provider, payment processors, booking software and accountants.
• Partners who deliver your trip, such as speedboat and ferry operators (including Tropic Xpress) and excursion operators (including Tropic Trip Maldives). They receive only the details they need.
• WhatsApp (Meta Platforms) when you choose to contact us through WhatsApp. Meta's own privacy policy also applies.
• Public authorities where Maldivian law requires it, such as immigration, police and tax authorities.
• Travel agents or booking platforms if you booked through them.

5. International transfers

We are based in the Maldives, which does not have an adequacy decision from the European Commission or the UK government. When you send us your data from the EU or UK, it is transferred to the Maldives because this is necessary to perform your booking contract (Art. 49(1)(b) GDPR). Where we use service providers in other countries, such as the USA, we rely on adequacy decisions (for example, the EU-US Data Privacy Framework) or Standard Contractual Clauses. You can ask us for a copy of these safeguards.

6. How long we keep your data

Data	Retention period
Booking requests that do not become a booking	6 months
Booking, payment and invoice records	For the period required by Maldivian tax and accounting law
Passport and guest registration data	For the period required by Maldivian law, then deleted
Health and dietary information	Deleted at the end of your stay
Marketing list	Until you unsubscribe
Email and WhatsApp conversations	2 years after your last stay
Website server logs	Up to 90 days

 

7. Your rights

If you are in the EU, EEA or UK, you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, unless we must keep it by law.
• Restriction of how we use your data.
• Data portability, receiving your data in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time. This does not affect processing carried out before you withdrew it.
• Complain to a data protection supervisory authority.

To exercise any of these rights, email us at reservations@tropictreemaldives.com. We will respond within one month, free of charge. We may ask you to confirm your identity before we act on your request.

8. Complaints

We would like the chance to resolve any concern first, so please contact us. You also have the right to complain to the data protection authority in your EU country of residence (a list is available at edpb.europa.eu) or, in the UK, to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

9. Security

Our website uses HTTPS encryption. Access to guest data is limited to staff who need it to do their jobs. Paper registration records are kept in a locked office. Card payments are handled by PCI-DSS compliant payment providers.

10. Links to other websites

Our website links to Google Reviews, Tripadvisor, Facebook, X, Instagram and WhatsApp. These services have their own privacy policies, and we are not responsible for how they handle your data.

11. Cookies

Cookies are small text files stored on your device when you visit a website. We use only the cookies needed to run our website unless you agree to more. In line with the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations (PECR), non-essential cookies are set only after you click "Accept" in our cookie banner. You can change your choice at any time using the "Cookie settings" link at the bottom of every page.

Category	Purpose	Consent required?
Strictly necessary	Website security, bot protection, form submission and remembering your cookie choice	No
Analytics	Counting visits and understanding which pages are popular	Yes
Marketing	Measuring the effectiveness of our advertising, including on social media	Yes
Embedded content	Displaying maps, videos and social media content from other websites	Yes

 

You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, some parts of the website, such as the booking request form, may not work.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. We will announce significant changes on this page.