Privacy Notice

Last updated: July 2025

Types of Personal Data We Collect

Methods of Personal Data Collection 

How We Use Personal Data 

Sharing and Disclosure of Personal Data 

Your Options for Managing Our Use and Disclosure of Your Personal Data  

Other Important Information 

Contacting Us 

Additional Privacy Provisions Applicable to Residence of Certain Countries

• Information About Rights in the EU/EEA/UK

• Information Related to Residents of the USA

Positive Ocean Holding, trading as Aman at Sea (hereafter collectively, “Aman at Sea”, “we”, or “us”), values you as our guest and recognizes that privacy is important to you. We want you to be familiar with how we collect, use and disclose your Personal Data. 

This Privacy Notice describes the privacy practices of Aman at Sea for Personal Data that we collect in connection to:

• The websites from which you are accessing this Privacy Notice, including https://www.amanatsea.com and also collection of Personal Data through contact forms;

• Your visit or stay as an Aman at Sea guest and use of our various hospitality services including Aman Spa & Wellness Centres, Restaurants, Boutiques or other offline interactions you have with us;

• Our social media pages through which you are accessing this Privacy Notice (collectively, our “Social Media Pages”);

• The email messages and messages via WhatsApp that we send you that link to this Privacy Notice and through your other online communications with us, including your pre-arrival preferences;

• Your marketing preferences; and

• Your use of software applications (including automated tools and chat functionalities) we provide for use.

This Privacy Notice also informs about the personal data we receive from 3rd parties (e.g. travel agents) and other sources (e.g. public databases). When we request your consent for specific data processing activities, we refer either to this Privacy Notice or to separate notices for these activities, providing tailored information to help you understand how your data is used in different contexts.

Collectively, we refer to the Website, Apps, and our Social Media Pages, as the “Online Services” and, together with offline business interactions, the “Services.”

TYPES OF PERSONAL DATA WE COLLECT

“Personal Data” are data that identify you as an individual or relate to an identifiable individual. We collect the following Personal Data: 

• Your identifying and contact information (e.g., salutation, full name, telephone number, date of birth, email address, postal address, social media account ID, profile photo and other data made publicly available, or data made available by linking your social media or other similar identifiers); 

• Your financial information (e.g., credit and debit card data); 

• Your passport, visa or other official identification; 

• Information related to your travel profile (e.g., arrival and departure time, nationality, accommodation and travel preferences, travel itinerary, tour group, language preference, travel agent/company); 

• Your Aman at Sea stays or interactions (including via chat functionalities), and purchases of goods and services during your Aman at Sea journey, (e.g., restaurant visits, preferred suite types, childcare services, spa services, concierge requests); 

• Your inquiries about Aman at Sea offerings or private travel (Aman private jet and yacht); 

• Your IP address (we may also derive your approximate location from your IP address) and system data when you use our mobile devices to access the Online Services, we collect certain data through your browser or automatically through your device, such as your computer type, screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version; and  

• Your browser or automatically through your device, such as your computer type, screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version. 

We may also collect the following information (either based on our legitimate interests or with your consent to the extent required by applicable law): 

• Personal data about family members and companions (e.g., names and ages of children) to help us make your journey with us as comfortable as possible (e.g., we can proactively plan for additional accommodations such as a crib or extra bed for children accompanying you); 

• Important dates, such as birthdays, anniversaries and special occasions to make the stay with us more enjoyable and allow us to provide you with a birthday or anniversary gift; 

• Guest preferences to make more enjoyable your journey and experiences with us, such as preferences relating to suites and amenities and any likes and dislikes about our services that you may tell us about so that we can improve our services, your interests and passions (e.g. what sports you like to play) and special health accommodations (e.g., dietary and health restrictions, mobility requirements), information related to the provision of childcare services (including e.g. allergies or medical information of children) or information related to your general health and physical characteristics, and your skincare and wellness concerns (e.g., skin type, hair type, skin sensitivity, contraindications, beauty concerns, preference for nourishing or purifying skincare products), and preferences for marketing communications; 

• Your images, video and audio data via security cameras (CCTV) located in public areas of our properties, such as hallways and lobbies; 

• Information collected through guest surveys relating to your satisfaction or guest complaints or emergencies; and 

• Information about visits to our properties by journalists, PR agency staff, consultants and business partners. 

 When you use the Online Services, we also collect data typically collected through websites, such as browser and device information, application usage data, information collected through cookies, pixel tags and other similar technologies, and IP addresses. For more detail please see our Cookie Policy. 

METHODS OF PERSONAL DATA COLLECTION

We and our service providers collect Personal Data in a variety of ways, including:

HOW WE USE PERSONAL DATA

We and our service providers use Personal Data for the following purposes:

SHARING AND DISCLOSURE OF PERSONAL DATA

We disclose Personal Data to:

• Aman Group, which includes Aman Group S.à.r.l. as well as its affiliates/subsidiaries for purposes described in this Privacy Notice, such as service provision, personalization, and communication;

• On-board service providers offering goods, services, and experiences that enhance your stay. For example, sharing your Personal Data with Aman at Sea Partners enables personalized services across our spa & wellness centres, health and fitness facilities, restaurants and bars, concierge and other external providers. It also allows us to offer seamless booking for travel-related services, including tours and vacation packages;

• Digital service providers who support our operation, such as those that support website hosting, website booking facilitation, data quality, data analysis, payment processing, customer service, fraud prevention, information technology and related infrastructure provision, customer service or related benefits (including special promotions), email delivery, auditing, and more; and

• Advertising partners to facilitate marketing communications, promotions, and advertisements in alignment with your preferences.

Other Uses and Disclosures

We may use and disclose your Personal Data when necessary or appropriate, including with your consent or when legally necessary:

• To comply with applicable law and regulations which may include jurisdictions outside your country of residence;

• To cooperate with law enforcement, public and government authorities to fulfil legal or security related requests, including foreign authorities;

• For other legal enforcement reasons, such as protecting our terms and conditions, individual rights, safety, or property, as well as those of affiliates, users, or others; and

• Business transactions, including reorganisations, mergers, sales, joint ventures, assignments, transfers, or other asset-related dispositions (including those linked to bankruptcy proceedings).

Your Personal Data and Social Media

By using the Services, you may disclose Personal Data:

• On social media platforms, chat services, or other interactive channels (including our Social Media Pages). Please note that any information shared on these platforms may become public; and

• Through your social media sharing activity such as linking our Services account to social media profiles. This may allow information sharing with friends, other users, and your social media provider. By engaging in social media sharing, you authorise use to facilitate this process, understanding that the provider’s privacy policy governs data usage.

Important Information

We collect Personal Data to provide the Services to you. If you do not provide the information requested, we may not be able to provide certain Services. If you disclose any Personal Data relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Notice.

This Privacy Notice does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any website or service to which the Services link, or payment providers. The inclusion of a link on the Services does not imply endorsement of the linked site or service by us or by our affiliates.

We use third-party advertising companies (such as Meta, Google, Yahoo, Baidu, RED, Weibo, Line, Tripadvisor, Trivago, Yandex) to display online advertisements regarding goods and services that may be of interest to you when you access and use the Services and other websites or online services. For more information on how these companies serve advertisements please see our Cookie Policy.

In addition, we are not responsible for the information collection, use, disclosure, or security policies or practices of other organisations, such as Meta, Apple, Google, Microsoft, RED, Weibo. Line, Tripadvisor, Trivago, Yandex, or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including with respect to any Personal Data you disclose to other organisations through or in connection with our Social Media Pages.

You may receive advertisements based on information relating to your access to and use of the Services and other websites or online services on any of your devices, as well as on information received from third parties. These companies place or recognise a unique cookie on your browser (including through the use of pixel tags). They also use these technologies, along with information they collect about your online use, to recognise you across the devices you use, such as a mobile phone and a laptop. If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Notice, please visit http://optout.aboutads.info and http://networkadvertising.org/managing/opt_out.asp.

YOUR OPTIONS FOR MANAGING OUR USE AND DISCLOSURE OF YOUR PERSONAL DATA  

You have control over how we use and share your Personal Data for marketing purposes. You may opt out from: 

• Receiving marketing-related emails. To stop receiving these emails, you can either email privacy@amanatsea.com or use the unsubscribe link at the bottom of each marketing email; and 

• Sharing your Personal Data with affiliates for direct marketing. If you prefer that we no longer share your data with our affiliates for marketing purposes, you can opt out by emailing privacy@amanatsea.com or using the unsubscribe link at the bottom of each marketing email. 

We will process your request as soon as reasonably practicable. Please note that opting out of marketing emails will not affect your receipt of important administrative messages, which we may still send. 

OTHER IMPORTANT INFORMATION

Retention

We retain Personal Data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services);

• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and

• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Security

We seek to use reasonable organisational, technical and administrative measures to protect Personal Data within our organisation. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting Us” section, below.

Sensitive Data

We only collect Sensitive Data which may be necessary to perform expected services or as required by law. Unless we request it, we ask that you not send us, and you not disclose, any sensitive Personal Data (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs,

health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Services or otherwise to us.

Use of Services by Minors

The Services are not directed to individuals under the age of eighteen (18), and we do not knowingly collect Personal Data directly from individuals under 18.

International Transfers

Your Personal Data may be stored and processed in any country where we have facilities or in which we engage service providers, and by using the Services you understand that your information will be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country.

Some countries are recognised by the European Commission and UK government, respectively, as providing an adequate level of data protection according to EEA/UK standards. For transfers from the EEA and the UK to countries not considered adequate by the European Commission and the UK government, respectively, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission and UK government to protect your Personal Data. You may obtain a copy of the list of countries with adequate level of protection and the standard contractual clauses by contacting us at privacy@amanatsea.com

CONTACTING US

Aman at Sea is responsible (data controllers) for the Personal Data we hold about you.

Aman at Sea is the controller of marketing database and conducts all marketing activities relating to Aman at Sea.

Aman at Sea’s address is Vault 14, Mezzanine Level, Valletta Waterfront, Floriana FRN 1914, Malta.

You may always contact us at privacy@amanatsea.com with your questions or concerns regarding this Privacy notice or in general about our processing of your Personal Data.

Updates to This Privacy Notice

The "LAST UPDATED" legend at the top of this Privacy Notice indicates when this Privacy Notice was last revised. Any changes will become effective when we post the revised Privacy Notice on our Website.

ADDITIONAL PRIVACY PROVISIONS APPLICABLE TO PROCESSING OF PERSONAL INFORMATION OF RESIDENTS OF CERTAIN COUNTRIES

Information About Your Rights in the EU/EEA/UK

If you would like to request access, correction, update, suppression, restriction, or deletion of your Personal Data, object to its processing, or opt out, you may contact us in accordance with “Contact Us” section above. Additionally, if you wish to receive a copy of your Personal Data for transfer to another company – where permitted by applicable law – you may do so through the same process. We will respond to your request in accordance with applicable law.

When submitting your request, please specify the Personal Data you wish to correct or suppress from our database. For your data protection, we may only implement requests with respect to the Personal Data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will make every effort to comply with your request within 1 month.

Please note that certain data may need to be retained for record keeping purposes or to complete pending transactions.

Where provided by applicable law, you may also lodge a complaint with the UK data protection authority here or with an EU/EEA/Turkey data protection authority for your country or region where you have your habitual residence or place of work or where an alleged infringement of applicable data protection law occurs. A list of the EU/EEA data protection authorities is available here.

Information related to Residents of the USA

This section supplements the other parts of our Privacy Notice and provides information for residents of the United States.

If permitted by applicable law, you can exercise the following individual rights: right to know if we process your personal information, right to request we delete your personal information, right to correct inaccurate information, right to opt out for sales and sharing of personal information and/or targeted advertising, including the “sharing” of your personal data for cross-context behaviour advertising, right to limit use and disclosure of sensitive personal information.

As permitted by applicable law, these rights may allow you to authorise agents to submit a request on your behalf.

As permitted by applicable law, you may submit an appeal regarding our response to a request related to the rights above within a reasonable period of time you have received a refusal by contacting us at privacy@amanatsea.com.

To exercise your rights please contact us in accordance with the “Contacting Us” section above.

You have the right to be free from unlawful discrimination for exercising your rights under applicable law.