Privacy Policy

INTRODUCTION

Welcome to the privacy policy of ROW Management, Ltd., a company registered in The Bahamas having its principal office at 1551 Sawgrass Corporate Parkway, Suite 200, Ft. Lauderdale, Florida (“The World”).

The World respects your privacy and is committed to protecting your Personal Data. This privacy policy will inform you as to how and when we collect, use, disclose, share, manage, and otherwise look after your Personal Data when you visit our websites https://aboardtheworld.com/ and https://myworldnavigator.com (“Websites”), download and use the My Navigator mobile application software (”App”) onto your mobile telephone or handheld device (“Device”), use any of the services accessible through the Websites or App, or otherwise engage our services or provide us with your Personal Data through the Websites, App social media, email exchanges, or other online services on which this Policy is posted (collectively the “Services”). .

This Privacy Policy applies to all visitors and users of our Services. Your use of the Services is conditioned upon your agreement with this Policy. Before using our Services, please read this Policy carefully as it contains important information on who we are and how and why we collect, store, use, and share your Personal Data. This Policy also explains your rights in relation to your Personal Data and how to contact us or supervisory authorities in the event you have a complaint.

This Privacy Policy is written in the English language. We do not guarantee the accuracy of any translated versions of this Policy. To the extent that any translated versions of this Policy conflict with the English language version, the English language version of this Policy shall control.

TABLE OF CONTENTS

  1. Definitions
  2. Important Information and Who We Are
  3. The Data We Collect About You
  4. How Is Your Personal Data Collected?
  5. How We Use Your Personal Data
  6. CCTV
  7. No Automated Processing, Cross-Context Behavioral Advertising, Targeted Advertising, Consumer Profiling, or Automated Decision Making
  8. Marketing Communications
  9. Disclosures of Your Personal Data
  10. Consent to Processing and International Transfers
  11. Data Security
  12. Data Retention
  13. Special Notice for UK and EEA Residents
  14. Special Notice for California Residents
  15. Special Notice for Colorado Residents
  16. Special Notice for Nevada Residents
  17. Special Notice for Virginia Residents
  18. Changes to this Privacy Policy
  19. Contact Us


1. DEFINITIONS

This privacy policy uses a number of definitions which are set out below:

Apartment: shall mean the rooms on board the Ship designated by the Apartment number specified on the Signature Page of a Residence Agreement or an earlier version thereof or on a document assigning the Residency Rights to an Apartment on board the Ship, together with its appurtenances and fixtures and any closets, balconies, or portion thereof, outside of said partitioned rooms, which are allocated exclusively to the occupant(s) of the Apartment.

Guest: a guest visiting the Ship.

Personal Data: any information which identifies an individual or information relating to an individual who can be identified (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data does not include anonymous data or data that has had the identity of an individual permanently removed.

Processing or Process(es): any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organizing, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring to third parties.

Residency Rights: shall mean the contractual rights related to the Apartment sold by the Ship Owner or a predecessor in interest of the Ship Owner, being those rights hereunder, including, inter alia, the Resident’s (i) exclusive use and occupancy of the Apartment; and (ii) non-exclusive use and occupancy of the common areas of the Ship. In certain contexts, “Residency Rights” also means such contractual rights for all Apartments.

Resident: a direct or indirect owner of Residency Rights to an Apartment onboard the Ship.

Ship: m/v The World.

2. IMPORTANT INFORMATION AND WHO WE ARE

Purpose of this privacy policy

This privacy policy aims to give you information on how The World collects and Processes your Personal Data.

This privacy policy does not address how we process your Personal Data when you apply for a job with The World – this is addressed under our Candidate Policy (a copy of which will be made available to you).

Our Services are not intended for or directed to persons under 18 years of age. IF YOU ARE UNDER THE AGE OF 18 YOU ARE NOT AUTHORIZED TO USE THE SERVICES. We do not knowingly collect data from children on our Services. We do not intend to collect personal information as defined by the U.S. Children’s Privacy Protection Act (“COPPA”) (“Children’s Personal Information”) in a manner that is not permitted by COPPA and only collect such information where required in relation to visits to and passage on the Ship. If you are a parent or guardian and believe we have collected personal information on a child in a manner not permitted by COPPA, please contact us at the below e-mail address and we will remove such data to the extent required by COPPA.

It is important that you read this privacy policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your Personal Data. This privacy policy supplements the other notices and is not intended to override them.

We have appointed our General Counsel as our data protection officer (“DPO”). If you have any questions about this privacy policy, please contact the DPO at: legal@aboardtheworld.com .

Data Controller

The World is the Data Controller for purposes of applicable data protection laws and regulations (referred to as “The World “, “we”, “us” or “our” in this privacy policy).

Your duty to inform us of changes

It is important that the Personal Data we hold about you is accurate and current. Please inform us if your Personal Data changes during your relationship with us.

Third-party links

Our Services may include links to third-party websites, plug-ins and applications which are not maintained or controlled by The World. These third-party links are provided only as a convenient method of accessing information. We are not responsible for the content, accuracy, or opinions expressed on any linked materials. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices or security standards. These linked sites have separate privacy and data collection practices, and we have no responsibility or liability relating to them. When you leave our Services, we encourage you to read the privacy notice of every website you visit. You understand and agree that by clicking on a link to a third-party site service, you have left our Websites and this Policy, is no longer in effect.

3. THE DATA WE COLLECT ABOUT YOU

Personal data

We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows:

  • Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, and Apartment number where applicable.
  • Contact Data includes billing address, delivery address, email address, telephone numbers and country of residence.
  • Device Data includes the type of mobile device you use, a unique device identifier (for example, your Device’s IMEI number, the MAC address of the Device’s wireless network interface, or the mobile phone number used by the Device), mobile network information including type, your mobile operating system, version of the App you are using and the time zone setting.
  • Financial Data includes bank account and payment card details.
  • Transaction Data includes details about payments to and from you and details of the products and services you have purchased from us.
  • Residency Data includes your details of your residencies or stays onboard the Ship, including details of your travel itinerary, where you are embarking and disembarking, any onward travel details, details of experiences or excursions booked through us, meal preferences or requirements, details of any special assistance you might need from us and any other information relevant to enable us to provide you with services arranged with us.
  • Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Services.
  • Profile Data includes your username and password.
  • Preference Data includes information about reservations made by you, your interests, preferences and special requirements when onboard the Ship, feedback and survey responses.
  • Usage Data includes information about how you use our Services, products and services.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and third parties and your communication preferences.
  • Special Category Data includes information about:
    • your passport details, including your passport number, as needed or requested by airports, ports, customs, immigration / border control or other government authorities;
    • your health, for example if you ask us to provide you with special assistance during your travel to, from or onboard the Ship, or to determine your fitness to travel onboard the Ship or to participate in an activity, or if you specify a meal preference that indicates a medical condition (such as coeliac disease);
    • information about your preferences that may indicate your religious beliefs (for example if you specify a meal preference that indicates a particular religion such as a kosher or halal meal); and
    • Criminal conviction data, where security checks are undertaken prior to purchasing Residency Rights or visiting the Ship as a Guest.

We only collect Special Category Data when you provide it to us directly or consent to our request for such information from third parties. We seek to limit any Special Category Data that we collect and, unless we have other specific lawful reasons to use this information (such as in an emergency), we will only use it for the purposes stated herein and will ask for your consent to otherwise disclose or process it. We do not collect or process Special Category Data with the purpose of inferring characteristics about you.

The sensitive personal information we collect is limited to your passport details, your religious dietary preferences, your mental or physical health or medical condition or diagnosis, and your criminal background. Beyond this, we do not collect other sensitive personal information such as your social security, driver’s license, or state identification card; your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; your precise geolocation; your racial or ethnic origin, religious or philosophical beliefs or associations, political opinions or membership, or union membership; the contents of your mail, email and text messages, unless we are the intended recipient of the communication; your genetic or biometric data; your sex life or sexual orientation or practices; your citizenship or citizenship status; or any personal information about a known child.

We ask that you not send nor disclose any sensitive personal information to us unless specifically requested by us for one of the reasons stated above.

Aggregated Data

When you visit or use our Services, we may also collect, use, store and share aggregated, statistical or demographic data which is in an anonymized form (“Aggregated Data”). Aggregated Data may be derived from your Personal Data but is not considered Personal Data by law as it cannot directly or indirectly reveal your identity.

Aggregated Data may include the time and length of your visit to our Services, the pages you have visited on our Services, as well as details of the website you visited immediately prior to visiting our Services. We may also record the name of your internet service provider. We use this information only to measure site activity and to develop ideas for improving our services and will do so in accordance with our Cookies Policy.

For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this privacy policy.

If you fail to provide required Personal Data

Where we need to collect Personal Data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.


4. HOW IS YOUR PERSONAL DATA COLLECTED?

We use different methods to collect Personal Data from and about you including through:

  • Direct interactions. You (or an agent acting on your behalf) may give us your Personal Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide when you:
    • create an account on the Websites or App;
    • download or register the App, search for the App, or report a problem with the App;
    • complete any of our online forms;
    • submit a request for information about the Ship including information about ownership opportunities or arranging for a visit to the Ship;
    • apply for approval to purchase the Residency Rights to an Apartment onboard the Ship and to become a Resident;
    • apply to become a Guest onboard the Ship;
    • provide us with Personal Data whilst onboard the Ship;
    • inform us about medical conditions as a Resident and/or Guest accessing the Ship or other accessibility services;
    • subscribe to our service, newsletters or publications;
    • request marketing to be sent to you;
    • enter a promotion or survey;
    • give us feedback;
    • contact our Residential Advisors or other personnel onboard the Ship or employees or representatives of The World;
    • provide us with information about an accident, illness or incident that occurred in connection with the Ship or your status as a Resident or guest; and
    • attend any events we host.
  • CCTV. Where we have CCTV on board the Ship in public areas, we may capture still or video images and Process them for security purposes. For more information, please contact us at privacy@aboardtheworld.com.
  • Automatically from Services. As you interact with our Services, we may automatically collect Usage Data, Device Data and Technical Data about your equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs and other similar technologies. We may also receive Usage Data, Device Data or Technical Data about you if you visit other websites employing our cookies. For further details, please see our Cookie Policy.
  • Third parties or publicly available sources. We may receive Personal Data about you from various third parties as set out below:
        • analytics providers such as Google Analytics globally;
        • search information providers such as Google AdWords globally;
        • advertising networks such as print magazines, email marketing campaigns, online advertising; events and direct mail campaigns that operate globally;
        • third parties who provide vetting, background and credit checking services.
  • Contact, Financial and Transaction Data from providers of technical or payment services;
  • Identity and Contact Data from data brokers or aggregators.

To the extent we combine data from service providers, third-party services, or other third parties with data we have collected directly from you or automatically, we will treat the combined information as our collected data under this Privacy Policy. Beyond this, data obtained by us from a third party, even in association with the Service, is not subject to this Privacy Policy. Instead, the information collected, stored, and shared by third parties remains subject to their privacy policies and practices, including whether they continue to share information with us, the types of information shared, and your choices on what is visible to others on third-party services. To be clear, we are not responsible for and makes no representations regarding the policies or business practices of any third parties and we encourage you to familiarize yourself with and consult their privacy policies and terms of use.


5. HOW WE USE YOUR PERSONAL DATA

Our information Processing activities include conducting our business, customer communications and support, user verification, payment processing, quality management services, service maintenance and improvements, and complying with legal requirements. We conduct such processing operations to perform the contract that you have with us, or to take steps at your request before entering into a contract, and for our legitimate interests or those of a third party. From time to time, we may also ask for your consent to use your information for certain specific reasons. You may withdraw your consent at any time by contacting us using the information provided below. If the Personal Data we collect is required to provide services to you and you do not provide the Personal Data we request, it may delay or prevent us from providing the service to you.

We will only use your Personal Data in the manners permitted by law. Most commonly, we will rely on the following types of lawful bases to process your Personal Data:

  • Legitimate Interests: the legitimate interests of The World. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We endeavor to consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Data for our legitimate interests.

We do not use your Personal Data for activities where we conclude that our interests are overridden by the impact on you (unless we have your express consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

  • Performance of Contract: processing your Personal Data is necessary for the performance of the contract to which you are a party or to take steps at your request before entering into such a contract.
  • Comply with a legal or regulatory obligation: processing your Personal Data may be necessary for compliance with a legal or regulatory obligation to which we are subject.
  • Consent: in certain circumstances, we may ask for your express consent to collect, process or transfer your Personal Data, for example in relation to opting in to our newsletter and other direct marketing. You have the right to withdraw your consent at any time simply by contacting us.

Purposes for which we will use your Personal Data

We have set out below, in a table format, a description of the ways we plan to use your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your Personal Data where more than one ground has been set out in the table below.

Purpose Activity Lawful basis for processing including basis of legitimate interest

To register you as a new user of the App and install the App

  1. Identity
  2. Contact
  3. Device
  4. Profile

Consent

To provide you with services as a result of the information provided through the App.

  1. Identity
  2. Contact

Performance of a contract

To determine your eligibility to become a Resident, guest, or prospect

  1. Identity
  2. Contact

(a) Performance of a contract

(b) Necessary for our legitimate interests (to provide additional information on residency opportunities as applicable)

To register you as a Resident, guest or prospect

  1. Identity
  2. Contact
  3. Residency
  4. Profile

Performance of a contract

To process and deliver your booking including:

  1. Manage payments, fees and charges; and
  2. Collect and recover money owed to us
  1. Identity
  2. Contact
  3. Financial
  4. Transaction
  5. Marketing and Communications
  1. Performance of a contract
  2. Necessary for our legitimate interests (to recover debts due to us)

To provide services and access to third party services onboard the Ship

  1. Identity
  2. Contact
  3. Financial
  4. Transaction
  1. Consent
  2. Necessary for our legitimate interests (to enhance the service we provide to you)

Through processing still or video images captured by CCTV

  1. Identity

Necessary for our legitimate interest (to ensure security onboard our Ship)

To manage our relationship with you which will include:

  1. Notifying you about changes to our terms or privacy policy
  2. Asking you to leave a review or take a survey
  3. personalizing your customer experience
  4. improving our customer service
  1. Identity
  2. Contact
  3. Profile
  4. Marketing and Communications
  5. Preference
  6. Residency
  1. Performance of a contract
  2. Necessary to comply with a legal obligation
  3. Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
  4. Necessary for our legitimate interests to present you with the right kinds of products and services
  5. Necessary for our legitimate interest in improving our customer service

To enable you to partake in a prize draw, competition or complete a survey

  1. Identity
  2. Contact
  3. Profile
  4. Usage
  5. Marketing and Communications
  6. Preference
  7. Residency
  1. Performance of a contract
  2. Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)

To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

  1. Identity
  2. Contact
  3. Technical
  4. Usage
  5. Device
  1. Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganization or group restructuring exercise)
  2. Necessary to comply with a legal obligation

To deliver relevant Website and App content, including service announcements and advertisements to you from the World and measure or understand the effectiveness of the advertising we serve to you related to the goods and services we provide

  1. Identity
  2. Contact
  3. Profile
  4. Usage
  5. Marketing and Communications
  6. Technical
  7. Preference
  8. Residency

Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)

To use data analytics to improve our Websites, App, products/services, marketing, customer relationships and experiences

  1. Technical
  2. Usage
  3. Device

Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)

To make suggestions and recommendations to you about our goods or services or affiliated excursions, tours, and activities that may be of interest to you

  1. Identity
  2. Contact
  3. Technical
  4. Usage
  5. Profile
  6. Preference
  7. Residency

Necessary for our legitimate interests (to develop our products/services and grow our business)

To ensure security and protect our business interests

  1. Identity
  2. Contact
  3. Financial
  4. Transaction
  5. Profile

Necessary for our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so

To process your visits to or travel onboard the Ship

(a) Identity

(b) Contact

(c) Financial

(d)Transaction

(e)Residency

(f)Technical

(g)Profile

(h) Usage

(i)Marketing and Communications

(j)Special Category

  1. Performance of a contract
  2. Necessary for regulatory purposes and performance of a contract
  3. Necessary for our legitimate interest (to ensure safety and security onboard our Ship)

To undertake medical safety checks prior and during your attendance onboard the Ship and treatment as needed

(a) Special Category

(a) Necessary to comply with a legal obligation

(b) Necessary for our legitimate interest (to ensure safety and security onboard our Ship)

To ensure you are provided with any adjustments you require when accessing or otherwise using facilities onboard the Ship, including and special requests or preferences

(a) Special Category

(b) Preference

  1. Performance of a contract
  2. Compliance with a legal obligation
  3. Necessary for our legitimate interest (to provide preferred services to you)

To provide required information to necessary authorities

  1. Identity
  2. Contact
  3. Residency

Compliance with a legal obligation

Cookies

We use cookies and other technologies to collect information on our web pages for a variety of purposes, such as to improve the design and content of our Services and to enable us to provide a more personalized experience when you browse the Internet.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

At this time, we do not respond to browser “do not track” or “DNT” signals.

Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.


6. CCTV

CCTV is used onboard the Ship at various locations for the purpose of ensuring health and safety compliance and the prevention of crime. For more information on how we use CCTV please contact us at privacy@aboardtheworld.com.


7. NO AUTOMATED PROCESSING, CROSS-CONTEXT BEHAVIORAL ADVERTISING, TARGETED ADVERTISING, CONSUMER PROFILING, OR AUTOMATED DECISION MAKING

We do not use your Personal Data to undertake profiling or automated decision making. By using our Services you will not be subject to any decision based solely on automated processing. We do not use or share your personal information with third parties for cross-context behavioral advertising or process it for targeted advertising or consumer profiling.   


8. MARKETING COMMUNICATIONS

We strive to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising.

Promotional offers from us

You will receive marketing communications from us if you have requested to receive marketing information from us, if you purchased Residency Rights to an Apartment on the Ship, or if you provided us with your details when participating in a promotional event and opted in to receive marketing communication and, in each case, you have not opted out of receiving that marketing.

Where you have opted in to receiving marketing communication, we may use your Identity, Contact, Technical, Preferences, Residency, Usage and Profile Data to form a view on which of our goods and services we think you may want or need, or what we offer that may be of interest to you. This is how we decide which of our products, services and offers may be relevant for you (we call this marketing).

Third-party marketing

We will obtain your express opt-in consent before we share your Personal Data with any company outside The World for marketing purposes.

Opting out

You can ask us or our third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us. If you opt out of receiving these marketing messages, you will still receive non-marketing communications in connection with applying for or being a Resident or other product/service experience or other transactions.


9. DISCLOSURE OF YOUR PERSONAL DATA

We do not trade, rent, or sell your Personal Data to any third party and for any purpose whatsoever. We do not use or share your Personal Data with third parties for cross-context behavioral advertising or process it for targeted advertising or consumer profiling.

We may disclose your Personal Data with the parties set out below for the purposes set out in the table in paragraph 5 above.

Internal Third Parties

We do not routinely share your Personal Data with other entities within our group. The only scenarios where we would share your Personal Data with other group entities is where there is (1) an operational need to do so and it was in our legitimate interests to do so, or (2) where you provide your consent.

External Third Parties

Third party

Type of data

Third parties who provide you services in relation to your travel to and from the Ship, including airlines, hotels, airport authorities, insurance companies, car hire companies and ground handling agencies

  1. Identity
  2. Contact
  3. Transaction
  4. Residency

(e) Special Category, namely passport details, accessibility requirements, and religious preferences as applicable

Third parties who provide services to you during your visit onboard the Ship, including tour operators and excursion providers, transport companies, shops and service providers onboard the Ship

  1. Identity
  2. Contact
  3. Profile
  4. Preference
  5. Residency
  6. Special Category, namely accessibility requirements and religious preferences as applicable

Third parties who provide services to us, for example, IT developers, app developers, service providers and hosting providers, network providers, IT support, third party software companies that provide us with applications on a white label basis.

  1. Identity
  2. Contact
  3. Financial
  4. Transaction
  5. Residency
  6. Technical
  7. Profile
  8. Preference
  9. Usage
  10. Device
  11. Marketing and Communications
  12. Special Category for storage and access purposes only

Medical service providers and the onboard doctor

  1. Identity
  2. Special Category, namely dietary restrictions and mental/physical health conditions or diagnosis

Analytics providers such as google analytics

  1. Profile
  2. Technical
  3. Usage

External marketing and advertising companies, who provider marketing services, competitions and campaign management and advertising services

  1. Contact
  2. Identity
  3. Preference
  4. Marketing and Communications

Credit Card screening providers

  1. Identity
  2. Financial

Providers of and vetting, background, credit checking services

  1. Identity
  2. Contact Data
  3. Special Category, namely criminal conviction information

Ground Agents

  1. Residency
  2. Contact
  3. Identity

Airports, ports, customs, immigration / border control and/or other government authorities. Some local ports and customs authorities require “Advance Passenger Information” about you to process the Ship in the ports at which it calls. Advance Passenger Information comprises the basic information contained in your passport that you would be required to present on your arrival. In addition, laws in certain destinations such as the USA and other countries require carriers to provide certain additional advance information about you and your travel arrangements. We will provide this information where we are required to do so.

  1. Contact
  2. Identity
  3. Residency
  4. Special Category, namely passport details and accessibility requirements as needed

Courts, advisors and parties to litigation. We share your Personal Data with other third parties (including legal, accountants or other advisors, regulatory authorities, courts and government agencies) where necessary to enable us to enforce our legal rights, or to protect the rights, property or safety of our employees or where such disclosure may be permitted or required by law. Law enforcement agencies may also require access to Personal Data, including in connection with criminal investigations, or we may be ordered to disclose Personal Data by a court or in connection with legal proceedings.

  1. Contact
  2. Identity
  3. Transaction
  4. Residency
  5. Other categories as required

We endeavor to require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.


10. CONSENT TO PROCESSING AND INTERNATIONAL TRANSFERS

The World is a global business and may process, transfer, and store Personal Data on servers located in a number of countries, including the United States. As a result, your data may be subject to data protection and other laws that may differ from your country of residence. Your data may be disclosed in response to inquiries or requests from government authorities or to respond to judicial process in the countries in which we operate. By using the Services, or by providing us with any Personal Data, you consent to the collection, processing, maintenance, and transfer of such data in and to the United States where the privacy laws may not be as comprehensive as, or equivalent to, those in the country where you reside or are a citizen.

Many of our external third parties are based outside the UK and EEA, so their processing of your Personal Data will involve a transfer of data outside the UK and EEA.

Whenever we transfer your Personal Data out of the UK or EEA, we shall provide a similar degree of protection of your Personal Data by ensuring that at least one of the following safeguards is implemented:

  • to transfer your Personal Data only to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries.
  • we may use specific contracts or contract provisions (for example the standard contractual clauses adopted by the EU Commission) which endeavor to give Personal Data the same protection it has in UK/EEA (as appropriate).

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of the UK and EEA.


11. DATA SECURITY

We have appropriate safeguards and security controls in place to protect your personal information. These include appropriate technical and organizational measures to protect the personal information (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to the data. Please be advised, however, that while we take reasonable security measures to protect your personal information, such measures cannot be guaranteed to be secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your Personal Data.

We limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.

We also have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

The security of your account relies on your protection of your user profile information. You are responsible for maintaining the security of your user profile information, including your password and for all activities that occur under your account. You may not share your password with anyone. We will never ask you to send your password or other sensitive information to us in an email, though we may ask you to enter this type of information on the Services. Any email or other communication purporting to be from one of our Services requesting your password or asking you to provide sensitive account information via email, should be treated as unauthorized and suspicious and should be reported to us immediately. If you believe someone else has obtained access to your password, please change it immediately by logging in to your account and report it immediately by emailing privacy@aboardtheworld.com.


12. DATA RETENTION

How long will you use my Personal Data?

We will only retain your Personal Data for as long as we believe it is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In general, we will store your Personal Data for as long as your account is active or we are providing the services to you and for a period of 3 years following de-activation/deletion of your account or the conclusion of our services to you, unless applicable law requires us to do otherwise. We may retain your personal data for more than 3 years after deletion of your account to comply with our legal obligations or for our legal protection, in which case your Personal Data may be retained for a period equal to the applicable statutes of limitation.

In some circumstances we may anonymize your Personal Data (so that it can no longer be associated with you and you can no longer be identified by it) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Details of retention periods for different aspects of your Personal Data are available in our retention policy which you can request by contacting us.


13. SPECIAL NOTICE FOR UK AND EEA RESIDENTS

If you would like to submit a Data Subject Request, you can contact The World at privacy@aboardtheworld.com. If you choose to submit a Data Subject Request, you must provide us with enough information to identify you and enough specificity on the requested data. We will only use the information we receive to respond to your request. We will not be able to disclose information if it cannot verify that the person making the Data Subject Request is the person about whom we collected information, or someone authorized to act on such person’s behalf. Please specify clearly which information you would like us to provide you with, review, amend, stop processing, or delete.

“Personal data” means any information relating to an identified or identifiable natural person.

  • Request access to your Personal Data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
  • Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. To the extent possible, we will inform anyone who has received your Personal Data of any corrections.
  • Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your Personal Data unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. If the request is founded, we will try to delete your Personal Data promptly, and, to the extent possible, will inform anyone who has received your Personal Data of your request.
  • Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your Personal Data which override your rights and freedoms.
  • Request restriction of processing of your Personal Data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where you believe that our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. If the request is founded, we will try to do so promptly, and, to the extent possible, will inform anyone who has received your personal data of your request.
  • Request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the Personal Data to perform a contract with you.
  • Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
  • Automated Individual Decision Making. We do not currently engage in automated individual decision making. However, in the event we ever do so, we will inform you of such change and you may request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects that concern you or that similarly significantly affect you, except were the automated individual decision making is necessary for entering into, or the performance of, a contract between you and us; is authorized by law; or is based on the your explicit consent.
  • Complaints. You may contact us at any time where you believe that we are in breach of data protection laws or where you wish to make a complaint about our data processing. Furthermore, if you believe that our processing of your personal data is in breach of data protection laws, you have the right to lodge a complaint with the relevant data protection supervisory authority (i.e., in the U.K. or Member State of your habitual residence, place of work or place of the alleged infringement), if you are of the opinion that any of your personal data is processed in a manner constituting an infringement of the U.K. or E.U. GDPR or where you believe that we have not resolved an issue you have raised with us. We would, however, appreciate the chance to address your concerns before you approach the relevant data protection supervisory authority so please contact us at privacy@aboardtheworld.com in the first instance.

14. SPECIAL NOTICE FOR CALIFORNIA RESIDENTS

If you would like to submit a Consumer Request, you can contact us at privacy@aboardtheworld.com. If you choose to submit a Consumer Request, you must provide us with enough information to identify you and enough specificity on the requested data. We will only use the information it receives to respond to your request. We will not be able to disclose information if it cannot verify that the person making the Consumer Request is the person about whom we collected information, or someone authorized to act on such person’s behalf.

“Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. “Personal information” does not include publicly available information.

  • Request to Correct. You may correct or update your personal information at any time by logging into your account or by contacting us.
  • Request to Access. You may submit a Consumer Request to obtain a copy of or access to the personal information that we have collected on you.
  • Request to Know. You may submit a Consumer Request to receive information about our data collection practices.
    • Right to Know what Personal Information is being Collected. You may request information on the categories of personal information we have collected about you; the categories of sources from which the personal information is collected; our business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we have disclosed personal information, if any; and the specific pieces of personal information it has collected about you.
    • Right to Know what Personal Information is Sold or Shared and to Whom. You may also request the categories of personal information that we have collected about you; the categories of personal information that we have sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared, and the categories of personal information that we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Please note that the categories of personal information, sources, and disclosure will not exceed what is contained in this Policy. Additionally, we are not required to retain any information about you if it is only used for a one-time transaction and would not be maintained in the ordinary course of business. We are also not required to reidentify personal information if it is not stored in that manner already, nor is it required to provide the personal information to you more than twice in a twelve-month period.

  • Request to Limit the Use of Your Sensitive Personal Information. Unless we have other specific lawful reasons to use this information (such as in an emergency), we only collect, use, and disclose Special Category Data for the purposes provided in this Policy or with your consent. However, you may request that we limit the use or disclosure of your Special Category Data by contacting us.
  • Request to Delete. You may request that we delete personal information it has collected from you. Subject to certain exceptions set out below we will, on receipt of a verifiable Consumer Request, delete your personal information from our records, direct any service providers to do the same, and notify all third parties to whom we have shared your personal information to delete it unless this proves impossible or involves disproportionate effort.

Please note that we may not delete your personal information if it is necessary to:

    • Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business’ ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.
    • Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
    • Debug to identify and repair errors that impair existing intended functionality.
    • Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
    • Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
    • Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.
    • To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.
    • Comply with a legal obligation.

We may not, and will not, treat you differently because of your Consumer Request activity. As a result of your Consumer Request activity, we may not and will not deny goods or services to you; charge different rates for goods or services; provide a different level quality of goods or services; or suggest any of the preceding will occur. However, we can and may charge you a different rate, or provide a different level of quality, if the difference is reasonably related to the value provided by your personal information.


15. SPECIAL NOTICE FOR COLORADO RESIDENTS

Personal information or “personal data” means “information that is linked or reasonably linkable to an identified or identifiable individual.” “Personal data” does not include de-identified or publicly available information.

  • Request to Access. You may submit a request to confirm or to obtain a copy of or access to the personal data that we have collected on you including what the data is, how it’s been used, and who it’s been disclosed to. Your personal data may no longer be available because it has been destroyed, erased, or made anonymous in accordance with our data retention policies in which case we will provide you with the reasons why the personal data no longer exists where possible.
  • Request to Correct. You may correct or update your personal data at any time by logging into your account or by contacting us.
  • Request to Delete. You may request that we delete the personal data it has collected on you. We will delete your personal data from our records and direct any service providers to do the same unless retention is required by law.
  • Request to Opt-Out. You may submit a request to opt out of the sale of your personal data as well as its processing for targeted advertising or consumer profiling. We do not sell, rent, or lease your personal data to third parties and does not process your personal data for targeted advertising or consumer profiling.
  • Appeal. If we notify you that no action is to be taken in response to your request to access, correct, delete, or opt-out, you may appeal this decision by contacting us within 30 days with the reason why you believe further action should be taken. If you are not satisfied with the result of the appeal, you may contact the Colorado Attorney General.
  • Withdraw Consent for Your Sensitive Personal Information. Unless we have other specific lawful reasons to use this information (such as in an emergency), we only collect, use, and disclose Special Category Data for the purposes provided in this Policy or with your consent. You may withdraw this consent and request that we limit the processing of any Special Category Data we have collected at any time.

If you like to make any of the above requests, you can contact us at privacy@aboardtheworld.com. If you choose to submit a request, you must provide us with enough information to identify you in order to comply with your request. We will only use the information it receives to respond to your request. We will not be able to disclose information or comply with your request if it cannot verify that the person making the request is the person about whom we collected information, or someone authorized to act on such person’s behalf.


16. SPECIAL NOTICE FOR NEVADA RESIDENTS

We do not sell, rent, or lease your personally identifiable information to third parties. However, if you are a resident of Nevada and would like to submit a request not to sell your personally identifiable information, you may do so by emailing us at privacy@aboardtheworld.com.


17. SPECIAL NOTICE FOR VIRGINIA RESIDENTS

Personal information or “personal data” means “any information that is linked or reasonably linkable to an identified or identifiable natural person.” “Personal data” does not include de-identified data or publicly available information.

  • Request to Access. You may submit a request to confirm or to obtain a copy of or access to the personal data that we have collected on you including what the data is, how it’s been used, and who it’s been disclosed to. Your personal data may no longer be available because it has been destroyed, erased, or made anonymous in accordance with our data retention policies in which case we will provide you with the reasons why the personal data no longer exists where possible.
  • Request to Correct. You may correct or update your personal data at any time by logging into your account or by contacting us.
  • Request to Delete. You may request that we delete the personal data provided by or obtained about you. We will delete your personal data from our records and direct any service providers to do the same unless retention is required by law.
  • Request to Opt-Out. You may submit a request to opt out of the sale of your personal data as well as its processing for targeted advertising or consumer profiling. We do not sell, rent, or lease your personal data to third parties and does not process your personal data for targeted advertising or consumer profiling.
  • Appeal. If we notify you that no action is to be taken in response to your request to access, correct, delete, or opt-out, you may appeal this decision by contacting us within 30 days with the reason why you believe further action should be taken. If you are not satisfied with the result of the appeal, you may contact the Virginia Attorney General or submit a complaint online at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
  • Withdraw Consent for Your Sensitive Personal Information. Unless we have other specific lawful reasons to use this information (such as in an emergency), we only collect, use, and disclose Special Category Data for the purposes provided in this Policy or with your consent. You may withdraw this consent and request that we limit the processing of any Special Category Data we have collected at any time.

If you like to make any of the above requests, you can contact us at privacy@aboardtheworld.com. If you choose to submit a request, you must provide us with enough information to identify you in order to comply with your request. We will only use the information it receives to respond to your request. We will not be able to disclose information or comply with your request if it cannot verify that the person making the request is the person about whom we collected information, or if such person is a known child, that child’s parent or legal guardian.


18. CHANGES TO THIS PRIVACY POLICY

The World may amend this privacy policy from time to time in accordance with applicable laws and regulations, and the updated version will be posted on this website. We request that you revisit this website from time to time for updates on the privacy policy.

You are bound by any changes to our Policy if you continue to use the Services after being notified of such changes. Your continued use of the Website indicates your consent to the Privacy Policy then posted for that visit. Use of information we collect now is subject to the Policy in effect at the time such information is used. If you do not agree, discontinue use of the Services and uninstall all downloads and applications.


19. CONTACT US

If you have any comments, questions or concerns about the contents of this privacy policy or the way in which we use your Personal Data, we encourage you to contact us at privacy@aboardtheworld.com to see if we can help resolve the issue in the first instance.

We have appointed our General Counsel as our data protection officer (“DPO”). If you have any questions about this privacy policy, please contact the DPO at: legal@aboardtheworld.com .

You may also contact our U.K. and E.U. representatives at: privacy@aboardtheworld.com.