Privacy

Maldives Beach Wedding, of Butic Goalhi, Thoddoo 09010, Maldives, is the data controller for everything described on this page. That means we decide what is collected and why, and we are the ones answerable for it.

Most of the couples who write to us live in the United Kingdom or the European Union, so the UK GDPR and the EU GDPR apply to what we do with your information. We have written this page to those standards for everybody, wherever you live, because running two standards would be both harder and worse.

We have not appointed a representative in the EU or the UK. Write to us directly and we will answer, at maldivesbeachwedding@gmail.com.

We are a small operator. We have not appointed a data protection officer, because nothing we do requires one under Article 37. The person who answers your enquiry is also the person who answers a request about your data.

Only what an enquiry and a ceremony actually need.

From the enquiry form

Your name, your email address, the country you are writing from, your phone number if you give one, your message, the date you have in mind, and how many guests you expect.

If you message us

The content of your emails and WhatsApp messages, and the phone number they come from. WhatsApp itself is operated by Meta and its own privacy terms apply to the app on your phone.

If you book

The names to print on the certificate, your travel dates, your arrival details, the names of your guests, and anything you tell us about mobility, medical or dietary needs.

If you pay

A record of the amount, the date and the reference. We never see or store your full card number. Card payment is not live on this site yet, and this page will be updated before it is.

From the website itself

No cookies, no advertising trackers and no third-party analytics. We store one thing in your browser: a marker called mbw:arrived, kept in session storage, which records that you have already seen the opening screen so you are not shown it twice. It holds no identifier, it is not readable by us, and your browser discards it when you close the tab. Our server keeps ordinary access logs, which include IP addresses, for security and for spotting abuse.

Some of what you might tell us — a disability, a medical condition, a dietary requirement that reveals a religion — is special category data under Article 9. You never have to tell us any of it. Where you do, we use it only to make the day work, we rely on your explicit consent, and we delete it once the ceremony has happened.

Under the GDPR every use of your information needs a lawful basis. Here is ours, use by use.

To answer your enquiry and send you a quotation

Taking steps at your request before entering a contract. Article 6(1)(b).

To deliver the ceremony you booked

Performance of our contract with you. Article 6(1)(b).

To book rooms and transfers on your behalf

Performance of our contract with you. Article 6(1)(b).

To keep accounting and tax records

A legal obligation we are subject to. Article 6(1)(c).

To keep the site and the enquiry form free of abuse

Our legitimate interest in not being overwhelmed by spam, balanced against the very limited data involved. Article 6(1)(f).

To show your photographs on this site

Your consent, given separately in writing and withdrawable at any time. Article 6(1)(a).

Special category data you choose to give us

Your explicit consent. Article 9(2)(a).

We do not send marketing emails. There is no newsletter, no drip sequence and no remarketing list. If you enquire and then go quiet, we will follow up twice and then leave you alone.

Only the people who are needed to deliver your ceremony, and only the part each of them needs. We do not sell your information to anyone, ever, for any amount.

• The celebrant who conducts your ceremony: your names and the date.
• The photographer: the date, the time and where to meet you.
• The guest house, if we book your rooms: your names, your dates and your guest count.
• The boat operator, if we book your transfers: your names, your flight details and your dates.
• Our email provider, Google, and our hosting provider, Vercel, who process data on our instructions under a written agreement.
• Our accountant, and the Maldives Inland Revenue Authority, for the records tax law requires.
• A court or a regulator, if we are legally required to hand something over. We would tell you unless we were forbidden from doing so.

Everyone in that list is bound to use your information only for the job in hand. The local suppliers are small businesses on the island, and we brief each of them on what they may and may not do with a couple’s details.

We operate from the Maldives, so your information leaves the United Kingdom and the European Economic Area and is processed here.

The Maldives is not the subject of an adequacy decision by the European Commission or the UK government. We do not pass your enquiry to anyone outside the Maldives, beyond the email and hosting providers named above, so there is no onward transfer to safeguard. If that ever changes we will put the arrangement here before it does.

We say this plainly rather than burying it, because it is a real thing you are agreeing to when you send an enquiry to an island operator rather than to a European travel agent.

An enquiry that does not become a booking

12 months from your last message, then deleted. Weddings are planned four to twelve months ahead, and a conversation that stops in January often restarts in June.

WhatsApp and email threads

12 months after the conversation ends, or 12 months after your ceremony if you booked.

Booking and payment records

5 years from the end of the tax period, because Maldivian tax law requires it. These are kept as accounting records and are not used for anything else.

Special category data

Deleted within 30 days of your ceremony.

Photographs you let us publish

Until you ask us to take them down.

Server access logs

30 days.

When a retention period ends the record is deleted, not archived. If you ask us to delete something sooner, see your rights below.

Your photographs are yours. We will only publish one on this site, or anywhere else, if you have said yes in writing, and that consent is separate from your booking. Your price does not change either way.

You can withdraw that consent at any time by writing to us. We will remove the photograph from the site within seven days and we will not ask you why. What we cannot do is reach into a copy someone else has already downloaded, which is true of every photograph on the internet and is worth knowing before you say yes.

These are yours under the UK and EU GDPR. They are free to use, and using one of them has no effect on your booking.

Access

Ask for a copy of everything we hold about you, and an explanation of what we do with it.

Correction

Have anything wrong put right. Names on certificates are the usual one.

Deletion

Have your information erased, unless we are legally required to keep it. Accounting records are the only real exception.

Portability

Receive what you gave us in a structured, commonly used, machine-readable file, or have us send it to someone else.

Objection

Object to any use we base on legitimate interests. We stop unless we can show a compelling reason not to.

Restriction

Ask us to pause using your information while a dispute about it is sorted out.

Withdrawing consent

Withdraw any consent you gave, at any time, including for photographs.

Complaint

Complain to a data protection regulator. See below.

Nothing we do involves automated decision-making or profiling, so there is nothing for you to object to on that front.

Write to maldivesbeachwedding@gmail.com and say what you want. You do not need to quote an article number, name a right or use any particular wording. “Please delete everything you have about me” is enough.

• We acknowledge within three working days.
• We answer in full within one month, which is the deadline the GDPR sets. If a request is genuinely complicated we may extend by two months, and we will tell you why before the first month is up.
• There is no charge.
• We may ask one question to check you are who you say you are, usually confirming a detail from your booking. We will not demand a passport scan for a deletion request.

Tell us first, if you are willing to. Most problems are a misunderstanding and we would rather fix it than have you go elsewhere frustrated.

You do not have to, and you can complain to a regulator at any time. In the United Kingdom that is the Information Commissioner’s Office. In the European Union it is the supervisory authority of the country you live or work in, or where you think the problem happened. Complaining to them costs nothing and does not require a solicitor.

We update this page when what we do changes. Card payment is the next change coming, and this page will say what the payment provider receives before the first payment is taken.

The date at the top and the bottom always tells you when it last changed. If a change materially affects a booking that is already made, we will email the couple rather than rely on you re-reading the page.

The terms of service cover the rest of the agreement between us.