Legal

Privacy Notice

Version 2.0 · Effective 20 October 2026 · اقرأ النص العربي

Part 1: About this notice

1. Who we are and how to contact us

LuxuryYacht.Tours is a premium yacht charter marketplace and personal concierge at luxuryyacht.tours. It is run by a company in the process of registration (under incorporation) in the Arab Republic of Egypt, in Sharm El Sheikh, South Sinai, represented by its founder Muhammad Abu Dawood (“LuxuryYacht.Tours“, “we“, “us“).

We decide why and how the personal data described in this notice is used. This makes us its controller under Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations and, where they apply, under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

The registered company name and commercial register number will be added to this notice as soon as they are issued. When the company is registered, it takes over every role we describe here and this notice keeps applying. We will show that change on this page.

Contact for privacy. Email hello@luxuryyacht.tours with “Privacy” in the subject, or message us on WhatsApp +20 106 099 0121. A concierge replies within 2 hours, 9:00 to 22:00 Cairo time, every day; privacy requests are then handled as set out in section 24.

Data protection officer, licence and representatives. Egyptian law requires controllers to appoint a data protection officer and to hold the licence or permit that the Personal Data Protection Center issues, including for some transfers abroad and for sensitive data. The GDPR and the UK GDPR may also require us to appoint a representative in the European Union and in the United Kingdom. We are taking the steps these laws require, and we will publish the names and contact details here as soon as they are in place. Until then, please send every privacy request to hello@luxuryyacht.tours.

2. Whom this notice covers

This notice covers personal data we handle through the website luxuryyacht.tours, its private booking pages, the operator portal and partner portal (including the app versions you can add to a phone), our forms, emails, WhatsApp and phone conversations (together, the “Platform“). It applies to:

• Visitors: anyone who browses the site.
• Guests: people who send a request, receive a quote or book a trip, and the people travelling with them.
• Launch list subscribers: people who ask us to email them when yachts go live.
• Operators and their staff: licensed yacht operators who apply to list yachts or work with us, and their owners, managers, captains and crew whose details we receive.
• Partners and their staff: hotels, destination management companies, travel agencies and concierge firms that apply to send guests to us, and the people who work for them.
• Business contacts: people at yacht operators, marinas and other businesses we contact to propose working together.
• People who contact us for any other reason, including questions, complaints, press enquiries and job or collaboration enquiries.

This notice does not cover how operators, partners, payment providers, WhatsApp or other independent businesses use personal data for their own purposes. Their own privacy notices apply to that. Section 3 explains how we require operators and partners to protect guest data.

3. Our role, and the role of operators and partners

We are a booking agent. We do not own or operate yachts. The trip itself is provided by a licensed yacht operator, which is responsible for the trip, the yacht, the crew and safety. The contract for the trip is between you and the operator; our contract with you covers the booking service.

Operators. We share with the operator the guest data it needs to prepare and run your trip. From then on, the operator is an independent controller of the data it holds. Under our Operator Agreement (clause 28), every operator must:

• use guest data only to run the trip and to meet its legal obligations;
• not use guest data for marketing without the guest’s prior consent;
• keep guest data secure and share it only with crew who need it;
• follow Egyptian Personal Data Protection Law No. 151 of 2020 and its rules;
• delete guest data when it no longer needs it for the trip or for the law, and in any case within 12 months after the trip, unless the law requires it to keep the data longer; and
• tell us within 24 hours if guest data it holds is lost, stolen or exposed.

Partners. If a hotel, agency, destination management company or concierge firm referred you or made the request for you, it receives copies of the booking emails we send you and sees your booking in its partner portal (section 17). The partner is an independent controller of what it receives and uses it to look after you as its own guest or client.

Our service providers, such as our web host, email service and security tools, act on our instructions as processors and may use the data only to provide their service to us.

4. Words we use

• Personal data means any information about an identified or identifiable person, such as a name, phone number, booking reference or IP address.
• Processing means anything done with personal data, such as collecting, storing, using, sharing or deleting it.
• Sensitive personal data means the categories the law protects more strictly. Egyptian law includes data about health, genetic and biometric data, financial data, religious, political and security data, criminal records and all data about children. The GDPR uses similar special categories.
• Controller means the person or business that decides why and how personal data is processed; processor means a business that processes it on a controller’s behalf.
• Other capitalised words, such as Operator, Partner, Quote, Deposit and Balance, have the meaning given in our booking terms and our Operator Agreement.

Part 2: The personal data we use

5. Data about guests

We collect only what we need to answer your request, arrange your trip and keep the records the law requires.

If you send a request or make a booking for other people, please give us only the details we need about them, and let them know that you are sharing their details with us and where they can read this notice.

6. Data about website visitors

When you browse the site, our web host and our security tools record technical data such as your IP address, browser, the pages you request and the time, to deliver the pages, keep the site secure and fix errors. We do not use analytics or advertising cookies, similar browser storage or tools, and we do not build profiles of visitors. When you open our request form, the page reads the campaign tags and partner code in its own address (our “Request” links carry them over from the page you landed on) and the external website that referred you, and adds a short “how you found us” line to a hidden field of the form. Nothing is stored on your device for this, and the line reaches us only if you send the request. It is kept with that request or booking and deleted with it.

The site uses a small number of cookies and similar technologies. Most are needed for the site to work. Our Cookie Notice lists each one and explains your choices.

If you join our launch list, we keep your email address and, if you add it, when you are thinking of sailing, so that we can send you one email on the day the first yachts go live.

7. Data about operators and their staff

• Application: company name, contact name, WhatsApp number, email, city, harbour, number of yachts, licence number and your message.
• Documents: boat tourism (navigation) licences, passenger insurance, captain and crew licences where required, commercial register or equivalent registration, tax card, and any renewal of them.
• Yachts and trips: the details, photos and videos you supply, availability, prices, offers, confirmations, cancellations and notes from the video review of each yacht.
• Money: bank or InstaPay details in your business’s name, settlements, statements, invoices, refunds and chargebacks.
• Account and acceptance records: your portal account, sign-in and security data, and for each acceptance of the Operator Agreement: the version, date and time, account, business name, the name, email and WhatsApp number of the person who accepted, IP address, browser, a SHA-256 fingerprint of the accepted text and the page used.
• Performance: your reply times, confirmations, cancellations, complaints, guest reviews and replies, and your quality tier.
• App notifications: if you switch them on, the push subscription for each device (section 17 and our Cookie Notice).

8. Data about partners and their staff

• Application: company, type of business, contact name, role, email, WhatsApp number and expected number of requests.
• Partner account: your partner code, QR card, portal account, sign-in and security data, and app notification settings.
• Bookings with your code: the guest name, trip date, yacht, status, total, partner price and commission, and the booking emails we copy to you.
• Money: commission statements, payment details in your business’s name and payments made, and the statement files you download.

9. Data about business contacts and people who contact us

Business contacts. To find licensed operators and partners, we may contact businesses using contact details they publish for business purposes, such as an email address on their website. We keep the business name, the contact details we used, our messages and any reply. Every message tells you how to say no, and if you do, we stop.

People who contact us. When you write to us, we keep your name, contact details, your message and our reply. If you send a job or collaboration enquiry, we also keep the CV or other documents you choose to send.

10. Where the data comes from

• From you, when you fill in a form, message or call us, accept a Quote, pay, leave a review or use a portal.
• From the person who made the request for you, such as a family member, colleague, partner hotel or agency.
• From the operator, such as confirmation of your trip, the captain’s name and phone, and what happened on the day if there is a complaint.
• From our payment providers, such as confirmation of payment, refunds and chargebacks.
• From authorities, such as a sailing ban, a port authority or coast guard instruction, or a request the law obliges us to answer.
• From public business sources, for business contacts (section 9), and from the issuing authority or insurer when we check an operator’s documents.
• Automatically, from your browser and our systems (sections 5 and 6).

11. Sensitive data and identity details

Health and safety notes. You may tell us about pregnancy, a medical condition, an allergy, a dietary need, reduced mobility, seasickness or swimming ability, so that the operator can keep you safe and comfortable. Please share only what the crew needs. We use it only to arrange your trip and pass it only to the operator of your trip, which shares it only with crew who need it. We rely on your explicit consent, which you give when you send the information to us. You may withdraw it at any time, but the crew may then be unable to adapt the trip. In an emergency we may share health information to protect someone’s life. Please do not send us medical reports.

Details for protected areas and ports. Trips to protected areas such as Ras Mohammed National Park, or the rules of the port, may require a guest list with names, nationality or identity document numbers. We ask only for the details the authority requires, pass them to the operator, which deals with the authority, and do not ask for copies of passports unless the authority requires them.

Financial data. Egyptian law treats financial data as sensitive. Card and wallet details are entered on our payment providers’ secure pages and processed by them. We keep only the payment records described in section 5 and, for operators and partners, the payout details of their business.

Children’s data. See section 12.

We do not ask for data about religion, political opinions, criminal records, genetics or biometrics. Please do not send it to us.

12. Children

Requests and bookings must be made by adults aged 18 or over. The Platform is not meant for children. Children are welcome on board as part of a group booked by a parent, guardian or another adult responsible for them.

For a group with children, we ask only for what the trip needs: the number of children and, where it matters, their ages (for example to bring life jackets in the right sizes, to apply park fees, which are free under 7 years, and to respect the yacht’s licensed capacity). We ask for a child’s name or identity details only when an authority requires them for the trip.

Egyptian law treats all data about children as sensitive and requires the consent of a parent or guardian. When you give us details about a child, you confirm that you are the child’s parent or guardian or have their permission. If we learn that a child has sent us personal data without that consent, we delete it.

Part 3: Why we use personal data

13. Purposes and legal bases

We use personal data only for the purposes below, each with a legal basis. “Contract” means the processing is needed to take steps you ask for before a contract, or to perform a contract with you. “Legal obligation” means a law requires it. “Legitimate interests” means it is needed for our reasonable business interests, and we have checked that they are not outweighed by your rights. “Consent” means you agreed, and you may withdraw your consent at any time without affecting what we did before.

Egyptian law. Law No. 151 of 2020 allows processing with your consent or where it is needed to perform a contract with you or take steps you ask for, to meet a legal obligation or a court or authority order, or to protect your vital interests, among the grounds it lists. Where a purpose above relies on our legitimate interests and Egyptian law requires your consent for it instead, we ask for your consent. You give consent when you tick the box on the request form or accept a Quote after being shown this notice, and you may withdraw it at any time.

If you do not give us the details marked as required on a form, we may not be able to answer your request or arrange your trip. Optional details are always marked as optional.

14. Automated decisions and our yacht matching

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

Yacht matching. When a request arrives, our system builds a shortlist of yachts that fit it. It ranks yachts, not people, using the place, the number of guests against each yacht’s licensed capacity, the trip type and date, the experience and occasion, your budget compared with prices operators gave us, each operator’s reply record and Founding Partner status. A concierge reviews the shortlist, asks the operators, compares their written offers and decides what to quote. You can always ask for another option.

Operators: the ranking can affect how often your yachts are proposed. The criteria are those in our Operator Agreement. You may ask us to explain how a request was matched and to have a person review it.

Automatic security checks. Our firewall may block traffic that looks harmful, the request form accepts up to 5 requests per hour from one connection, and the “find my booking” form limits repeated attempts. If you are blocked by mistake, message us on WhatsApp +20 106 099 0121 or email hello@luxuryyacht.tours and a person will help.

15. Marketing and how to stop it

• We send marketing only if you ask for it. Messages about your request or booking, including the invitation to review your trip, are service messages, not marketing.
• If you join the launch list, we send you one email on the day the first yachts go live, and nothing else.
• If we ever offer other news or offers, we will ask for your consent first, show who is writing, and include an easy way to stop in every message.
• You can stop marketing at any time: use the link in the email, reply “stop”, or tell us on WhatsApp. We act on it within 7 days at the latest.
• We never sell personal data or give it to others for their own marketing. Operators may not use guest data for marketing without the guest’s prior consent.
• Business contacts can reply “no” to any message from us and we will not write again.

16. Emails, WhatsApp and calls

• Email. The site sends emails through our email provider. A log of each email the site sends, with its content, is kept for up to 2 years so that we can confirm what was sent and resend it.
• WhatsApp. WhatsApp is a service of Meta. When you message us on WhatsApp, Meta processes your number and the message data under its own terms and privacy policy. You can always choose email instead. We message you on WhatsApp only if you gave us your number.
• Calls. We do not record phone or video calls. We may write short notes of what was agreed.
• Payment safety. We never ask for card details by email, WhatsApp or phone, and we never ask you to pay into a personal account.
• Private booking pages. Your booking page has a private, hard-to-guess address, is hidden from search engines and is not cached. Anyone who has the link can see the booking, so please keep it to yourself. The “find my booking” form sends the link only to the email address on the booking.
• Calendar. If you use the “Add to calendar” links on your booking page, the trip details go into your own calendar app. If you choose Google Calendar, Google receives them under its own terms.

Part 4: Who receives personal data, and where

17. Who receives your data

We share personal data only when needed for the purposes in section 13, and only what each recipient needs.

We do not sell personal data, we do not share it for advertising, and we do not publish your name or contact details without your consent. Reviews appear only with your first name.

18. International transfers

We are based in Egypt. If you are in the European Union or the United Kingdom, your data is transferred to Egypt when you send us a request. There is no EU or UK adequacy decision for Egypt; this transfer is necessary to answer your request and to perform the booking you ask for.

Some of our providers, such as our web host, Meta, Google, PayPal and Wordfence, may store or process data in other countries, including in the European Union, the United Kingdom and the United States. When data leaves Egypt, the EU or the UK, we rely on the safeguards the law recognises, such as adequacy decisions, the standard contractual clauses approved by the European Commission and the UK addendum or agreement, and the providers’ security commitments, and we send only what is needed.

Egyptian law allows transfers abroad only to countries that offer a level of protection not lower than Egyptian law and with a licence from the Personal Data Protection Center, or in the cases the law allows, such as with your consent or where the transfer is needed to perform a contract with you. We are taking the steps required to obtain that licence. You may ask us for more information about the safeguards for any transfer.

19. How long we keep data

We keep personal data only as long as we need it for the purposes in section 13, then delete it or make it anonymous.

We keep data longer only when the law requires it, or for as long as it is needed to establish, exercise or defend a legal claim, such as an open complaint, chargeback or dispute. Operators keep guest data under their own obligations and, under our agreement, delete it within 12 months after the trip unless the law requires otherwise.

Part 5: Keeping data safe

20. How we protect personal data

• The whole site uses an encrypted connection (HTTPS).
• A web application firewall and security scans protect the site, and software is kept up to date, with security updates for WordPress applied automatically.
• Only people who need data for their work can see it. Operators and partners see only the bookings that concern them.
• Booking pages use private addresses that cannot be guessed or listed, are hidden from search engines, are not cached and do not pass their address to other sites.
• Operator documents are stored in a private folder that the web server refuses to show to anyone outside our team.
• Payments are made on our payment providers’ secure pages. We never store full card numbers.
• Forms limit repeated submissions, and daily backups let us restore data after an incident.
• Everyone who works for us, and every operator and partner, must keep personal data confidential.

No system is completely secure. Please help by keeping your booking link and portal password private, and by telling us at once if you think someone else has access to them.

21. Data breaches

If personal data we are responsible for is lost, stolen, exposed or changed without permission, we act at once to contain it and assess the risk. We notify the Personal Data Protection Center within 72 hours of becoming aware of a breach, and we tell the people affected within the time Egyptian law sets after that notice. For guests in the EU or UK, we notify the competent supervisory authority where the law requires, and we tell you without undue delay if the breach is likely to put your rights at high risk. We keep a record of every breach and what we did. Operators must tell us within 24 hours if guest data they hold is lost, stolen or exposed.

22. Links and other services

The Platform links to other sites and services, such as WhatsApp, payment pages, Google Calendar and the sites of operators and partners. They are run by others under their own privacy notices. We are not responsible for how they use personal data, so please read their notices.

Part 6: Your rights and choices

23. Your rights

Under Egyptian Personal Data Protection Law No. 151 of 2020 and, where they apply to you, the GDPR and the UK GDPR, you have the right to:

• know and access the personal data we hold about you and get a copy of it;
• correct data that is wrong, add to data that is incomplete, and update it;
• delete your data, or have it deleted when it is no longer needed, unless we must keep it by law or for a legal claim;
• restrict how we use your data, for example while we check a complaint about its accuracy;
• object to processing based on our legitimate interests, and at any time to marketing;
• withdraw consent at any time, without affecting what we did before;
• receive data you gave us in a common, machine-readable format, or have it sent to another business, where the law gives this right;
• be told about a breach of your data, as described in section 21;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, and to ask for a person to review any such decision; and
• complain to a supervisory authority (section 25).

24. How to use your rights

• Email hello@luxuryyacht.tours with “Privacy” in the subject, or message us on WhatsApp +20 106 099 0121. Tell us which right you want to use and, if you have one, your booking reference.
• To protect your data, we may ask you to confirm who you are, for example by replying from the email address on your booking. We ask only for what we need to check.
• Someone else, such as a family member or lawyer, may make a request for you if they show us your written permission.
• Using your rights is free. If a request is clearly unfounded or excessive, we may refuse it or charge a reasonable fee where the law allows, and we will explain why.
• We reply within 30 days at the latest, and sooner where the law that applies to your request sets a shorter time. If a request is complex, we tell you within that time why we need longer, as the law allows.
• If we cannot do what you ask, for example because the law requires us to keep booking records, we explain why and what we can do instead.
• If your request concerns data an operator or partner holds as an independent controller, we pass your request to them and tell you how to contact them.

25. Complaints

If you are unhappy with how we use your data, please contact us first so that we can try to put it right. You also have the right to complain to:

• the Personal Data Protection Center in the Arab Republic of Egypt;
• if you live or work in the European Union, the data protection supervisory authority in your country, or where you think the problem happened; or
• if you live in the United Kingdom, the Information Commissioner’s Office (ICO).

You may also go to the competent courts.

26. Changes to this notice

We update this notice when our services, our providers or the law change. The version and effective date at the top show which version applies. Before an important change takes effect, we tell guests with open bookings by email and operators and partners in their portal and by email. Earlier versions are available on request.

27. Language

This notice is made in English and Arabic. Both versions are equally valid. If they differ, the Arabic version prevails. This does not take away any right that the law of your country gives you.

28. Contact

• Email: hello@luxuryyacht.tours (subject “Privacy”)
• WhatsApp and phone: +20 106 099 0121, 9:00 to 22:00 Cairo time, every day
• LuxuryYacht.Tours, a company in the process of registration, Sharm El Sheikh, South Sinai, Arab Republic of Egypt