Privacy Policy • Dhombe.com

DHOMBE.COM

How Dhombe.com collects, uses, shares, retains and protects personal data

DRAFT 1.0 - OPERATIONAL AND LEGAL REVIEW REQUIREDDo not publish this document until the separate Implementation Checklist has been completed. A privacy policy must accurately describe the cookies, payment flow, hosting, messaging tools, analytics, advertising technologies, security controls and retention practices actually used by Dhombe.com.

Legal entity: Dhombe Travel Private LimitedCompany registration: C18752026Registered address: iHome, Kasthoori Magu, K. Maafushi, Republic of MaldivesPrivacy contact: support@dhombe.comPhone / WhatsApp: +960 7776331Last updated: 19 July 2026Effective date: When approved and published

Services covered

Hotels & Guesthouses | Activities & Tours | Events | Airport Transfers

This draft is original wording prepared for Dhombe.com. It is not copied from another travel platform. It should be reviewed against Dhombe.com's actual systems, vendor contracts and applicable law before publication.

Important summary

This summary explains the main points. The full Privacy Policy below controls if there is any difference.

Dhombe Travel Private Limited operates Dhombe.com and is responsible for personal data used to run the Platform, administer bookings, facilitate payments and provide customer support.
The hotel, guesthouse, activity operator, tour operator, event provider or transfer operator named in your booking is responsible for delivering the Travel Service. That Service Provider normally handles the booking data it receives under its own privacy responsibilities.
We collect information needed to search, book, pay for and receive Travel Services, together with account, communications, device, cookie, fraud-prevention and support information.
We disclose personal data only where reasonably necessary to provide a booking, operate the Platform, process payment, protect people and systems, comply with law, or for another purpose described in this Policy.
Dhombe.com does not sell personal data for money. If advertising technologies are used in a way that legally counts as a sale or sharing, we will provide the required notice and opt-out controls.
You may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, opt out of marketing, or complain to an authority, depending on the law that applies.
A person making a booking must be at least 18 years old. We may process limited information about children only when an adult provides it for a family booking or Travel Service.

Security reminderDhombe.com will never need your card security code, account password or one-time payment code through an ordinary email, social-media message or unsolicited WhatsApp message. Do not send passport copies or full payment-card details through an insecure channel.

Contents

Scope of this Privacy Policy
Who we are and our privacy role
Key definitions
Personal data we collect
How and why we use personal data
Booking data and Service Providers
Payments, refunds and fraud prevention
Customer support and communications
Reviews, photos and other user content
Cookies, analytics and advertising technologies
Marketing and personalization
Automated tools and artificial intelligence
Who receives personal data
International data transfers
How long we keep personal data
Information security
Children and family bookings
Your privacy rights and choices
How to make a privacy request
Additional regional disclosures
Third-party websites and services
Business transfers and legal disclosures
Changes to this Privacy Policy
Contact and complaints
Scope of this Privacy Policy

This Privacy Policy explains how Dhombe Travel Private Limited ("Dhombe.com", "Dhombe", "we", "us" or "our") collects and otherwise processes personal data when you:

visit, search or interact with Dhombe.com or any related mobile interface;
create or use an Account;
request, make, pay for, manage, change or cancel a Booking;
use customer support by email, telephone, WhatsApp, chat, social media or another supported channel;
communicate with a Service Provider through the Platform;
submit a review, rating, photograph, video, complaint or other content; or
otherwise interact with a link, message, form or service that refers to this Privacy Policy.

This Policy applies to Travellers and Platform users. It does not govern a Service Provider's independent collection or use of personal data outside Dhombe.com, or Dhombe.com's handling of employees, job applicants or Service Provider personnel under a separate notice.

The Booking Conditions and Customer Terms and Conditions explain the contractual relationship for each Travel Service. This Privacy Policy explains how personal data is handled; it does not replace the contract or create a guarantee that a particular Travel Service will be available.

Who we are and our privacy role

Dhombe Travel Private Limited, company registration number C18752026, with registered address at iHome, Kasthoori Magu, K. Maafushi, Republic of Maldives, operates Dhombe.com.

For Platform operations, account administration, booking facilitation, payment support, marketing under Dhombe.com's control, fraud prevention and customer support, Dhombe Travel Private Limited normally determines why and how personal data is processed and therefore acts as the data controller or equivalent responsible business under applicable law.

The Service Provider named in a Booking Confirmation independently determines how it delivers the booked hotel, guesthouse, activity, tour, event or airport transfer. It normally acts as a separate controller or equivalent responsible business for personal data it receives to deliver that Travel Service, comply with local law, manage safety, handle check-in or operate its own business.

Payment processors, banks, identity-verification providers, messaging services and other recipients may act as Dhombe.com's processors, independent controllers, or both, depending on the service and applicable law. Their own notices may also apply.

Key definitions

Term | MeaningAccount | A user account created to access Platform functions or manage Bookings.Booking | A request or confirmed reservation for a Travel Service made through the Platform.Personal Data | Information that identifies, relates to, describes or can reasonably be linked with an individual.Platform | Dhombe.com and related websites, mobile interfaces, booking tools, emails, messages and customer-support channels.Sensitive Data | Personal Data requiring additional protection, such as health, disability, precise location, passport or identity information, financial credentials, or information about a child, depending on applicable law.Service Provider | The independent hotel, guesthouse, activity operator, tour operator, event provider, transfer operator or other supplier that provides a Travel Service.Traveller | A person who will use or participate in a Travel Service, whether or not that person made the Booking.Travel Service | A hotel or guesthouse stay, activity, tour, event, airport transfer, or related service offered through the Platform.

Personal data we collect

The exact information depends on the Travel Service, the way you use the Platform, the Service Provider's requirements and applicable law. We may collect the categories below.

4.1 Information you provide

Identity and contact information: name, title, postal address, email address, telephone or WhatsApp number, country of residence, nationality, date of birth or age, language and similar identifiers.
Account information: login credentials, account settings, saved Travellers, saved preferences, booking history and communication choices.
Booking and travel information: destination, selected Service Provider, dates, room or service type, number and names of Travellers, ages of children, itinerary, flight number, arrival or departure time, pickup and drop-off point, luggage details, event details and requested extras.
Payment and transaction information: billing details, currency, amount, payment method, transaction status, payment token or reference, refunds, chargebacks, invoices and limited card details such as card type and last four digits where provided by the payment processor.
Identity and travel documents: passport, national identification, visa, permit, certification or other document information when needed for a Booking, verification, safety requirement, check-in, immigration requirement or legal obligation.
Service preferences and requirements: bedding, meal, dietary, accessibility, mobility, language, swimming ability, weight, equipment size, diving or activity certification, health or safety information, pregnancy or injury information, and other details needed to assess suitability or deliver a requested service.
Communications: the content and metadata of emails, forms, telephone calls, WhatsApp messages, chats, complaints, support requests and messages exchanged with a Service Provider through the Platform.
Reviews and user content: ratings, review text, display name, photos, videos, files, survey responses and other content you choose to submit.
Marketing and preference information: newsletter choices, consent records, survey responses, interests, promotion use and opt-out instructions.
Fraud, safety and dispute information: identity-verification results, suspicious activity indicators, complaints, incident reports, evidence, refund reasons and chargeback information.

4.2 Information about other Travellers

A lead booker may provide Personal Data about other Travellers, including children. The lead booker must be authorised to do so and must tell those people that Dhombe.com and the relevant Service Provider will use their information as described in this Policy. Where consent is legally required, the lead booker must obtain it before providing the information.

4.3 Sensitive Data

Some Travel Services require information that may be sensitive, for example health, disability, dietary, pregnancy, injury, passport, child-safety or precise pickup-location information. Please provide only what is reasonably necessary. We use Sensitive Data only to provide the requested service, protect health or safety, establish or defend legal claims, comply with law, or for another purpose permitted by law. Where required, we will ask for explicit consent.

Minimize sensitive informationDo not include medical details, identity documents or payment credentials in a public review. Use the secure upload or verification method provided for the specific Booking. If no secure method is available, contact support before sending the document.

4.4 Information collected automatically

When you use the Platform, we and approved technology providers may automatically collect:

internet protocol (IP) address and approximate location derived from it;
device, browser, operating system, language, screen size, app version and device identifiers;
dates and times of access, pages viewed, searches, clicks, referral source and interactions;
cookie, local-storage, session and advertising identifiers, subject to your choices and applicable consent requirements;
performance, diagnostic, error, crash and security logs;
network, login, account and transaction signals used to prevent fraud and secure the Platform; and
precise device location only when the relevant feature requests permission and you enable it.

4.5 Information received from others

We may receive Personal Data from Service Providers, payment processors, banks, fraud-prevention providers, identity-verification services, referral or affiliate partners, communications providers, analytics providers, social platforms when you intentionally connect them, other Travellers, insurers, authorities and publicly available sources where permitted by law. We may combine this information with information already held to administer a Booking, verify a complaint, prevent fraud, improve the Platform or comply with law.

How and why we use personal data

We use Personal Data only for specified purposes and under an available legal ground. The legal grounds below are used where the applicable law recognises them. If a legal ground is not relevant in your jurisdiction, we process the information only as otherwise permitted by applicable law.

Purpose | Typical Personal Data | Legal ground where applicableSearch, create and administer a Booking; issue confirmations and vouchers; manage changes, cancellations, no-shows and refunds. | Identity, contact, Booking, Traveller, preference, transaction and communication data. | Performance of a contract or steps requested before a contract.Create and manage an Account and provide saved preferences or booking history. | Identity, login, contact, settings and Booking history. | Contract; legitimate interests in providing account functions.Send required service messages and provide customer support. | Contact, Booking, account, transaction, complaint and communication data. | Contract; legitimate interests in effective support and dispute handling.Share necessary information with the selected Service Provider and other parties needed to deliver the Travel Service. | Traveller names, contact details, dates, itinerary, special requirements, payment status and service details. | Contract; legal obligation; vital interests in an emergency.Process payments, deposits, refunds, commissions, invoices and accounting. | Billing, transaction, Booking, tax and limited payment data. | Contract; legal obligation; legitimate interests in financial administration.Protect Travellers, Service Providers, staff, payments and systems; prevent fraud and abuse. | Identity, device, IP, Booking, payment, location, communication, complaint and risk data. | Legitimate interests; legal obligation; vital interests.Comply with tax, accounting, tourism, sanctions, law-enforcement, court and regulatory obligations; establish or defend claims. | Identity, Booking, transaction, document, complaint and audit data. | Legal obligation; legitimate interests in legal compliance and claims.Improve the Platform, test features, measure performance and understand use. | Usage, device, search, Booking, survey and de-identified or aggregated data. | Consent where required; otherwise legitimate interests.Provide relevant recommendations, promotions and marketing. | Contact, preferences, searches, Booking history, cookie and interaction data. | Consent where required; otherwise legitimate interests where permitted.Publish and moderate reviews and other user content. | Review, display name, rating, images, Booking verification and moderation data. | Consent; contract; legitimate interests in trustworthy reviews.Respond to accessibility, health or safety requirements. | The minimum Sensitive Data needed for the requested service or emergency. | Explicit consent; contract; vital interests; legal claims; other lawful condition.Manage a sale, merger, financing, reorganisation or other corporate transaction. | Relevant business records and Personal Data, subject to safeguards. | Legitimate interests; legal obligation; consent where required.

When we rely on legitimate interests, we assess the necessity of the processing and balance the business or third-party interest against your rights and reasonable expectations. You may object where applicable. When we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal.

Some information is necessary to enter into or perform a Booking. If you do not provide it, we may be unable to confirm the Booking, process payment, provide support or arrange the Travel Service. Optional information will be identified where reasonably practicable.

Booking data and Service Providers

To complete a Booking, we send the selected Service Provider the information reasonably needed to confirm and deliver the Travel Service. Depending on the Booking, this may include Traveller names, contact details, dates, itinerary, room or service selection, guest count, age information, flight or transfer information, payment status, special requests, accessibility or safety requirements, and messages related to the Booking.

The Service Provider may contact you directly and may request additional information at check-in, before participation or for legal and safety reasons. Its own privacy notice and local legal obligations apply to that independent processing. Dhombe.com does not control every independent action of a Service Provider, but may assist with communications, complaints and rights requests where appropriate.

A single checkout may contain services supplied by different Service Providers. Personal Data is shared only with the providers and support parties relevant to each service, unless additional sharing is required for connected itinerary support, safety, fraud prevention or law.

Payments, refunds and fraud prevention

Payment may be collected by Dhombe.com on behalf of a Service Provider, by an authorised payment processor, or directly by the Service Provider, as shown at checkout.

Card or wallet credentials may be entered into a payment processor's secure environment. Dhombe.com does not retain card security codes after authorisation. Where tokenisation is used, Dhombe.com receives a token or reference, transaction status, card type and last four digits rather than the full card number.
Payment processors, card networks, banks and fraud-prevention providers may process information under their own legal responsibilities and privacy notices.
We use payment, device, IP, Booking, account and behavioural signals to verify transactions, detect stolen credentials, prevent chargeback abuse and protect users and Service Providers.
A transaction or Booking may be delayed, placed on hold or referred for human review if a risk check identifies a material concern. We will not rely solely on an automated decision that has a legal or similarly significant effect where applicable law requires human review or another safeguard.
Approved refunds are normally returned to the original payment method. We retain refund and transaction records as needed for financial reconciliation, tax, fraud prevention and disputes.

Payment wording must be verifiedBefore publication, Dhombe.com must confirm whether any full card number passes through or is stored in a Dhombe-controlled system. If it does, this section must be rewritten and payment-security obligations, including the applicable PCI DSS scope, must be addressed.

Customer support and communications

We may communicate by email, telephone, WhatsApp, SMS, chat, social media, Platform notification or another channel you choose or that is necessary for a Booking. We use these channels to send confirmations, changes, reminders, safety notices, administrative messages, refund updates and support responses.

Communications and related metadata may be stored, reviewed or automatically screened to route support, identify spam or malicious content, protect users, investigate fraud, monitor service quality and resolve complaints. If a telephone call is recorded, we will provide notice at the start where required by law. We do not use ordinary support messages for unrelated marketing unless permitted and subject to your choices.

Third-party communications services, including WhatsApp or email delivery providers, may process message content and metadata under their own terms. Do not use an ordinary message to send full payment-card details, passwords, one-time codes or unnecessary identity documents.

Reviews, photos and other user content

If you submit a review, rating, photo, video or other public content, we may display it with your first name, chosen display name, country, avatar, travel context or other information identified before submission. Public content can be copied or viewed by others, so do not include contact details, identity documents, payment data, health information or information about another person without permission.

We may verify that a review relates to a genuine Booking, moderate content for fraud, abuse, unlawful material, personal data or relevance, and share relevant feedback with the Service Provider. Rejected or removed content may be retained for a limited period to enforce content standards, prevent abuse or handle disputes. Rights in user content are addressed in the Customer Terms and Conditions.

Cookies, analytics and advertising technologies

Dhombe.com and approved providers may use cookies, software development kits, pixels, tags, local storage and similar technologies. A separate Cookie Notice and preference tool should identify the technologies actually deployed, their providers, duration and purposes.

Category | Purpose | ChoiceStrictly necessary | Operate security, login, checkout, load balancing, consent settings and core booking functions. | Required for the requested service and cannot normally be disabled through the Platform.Functional | Remember language, currency, search choices and other optional settings. | Used with consent where required; may be disabled in cookie settings.Analytics and performance | Measure visits, errors, searches, conversion and feature performance, preferably using minimised or pseudonymised data. | Used with consent where required; may be disabled in cookie settings.Advertising and social media | Measure campaigns, limit frequency, create audiences or show relevant advertising on or off the Platform. | Used only where permitted and with consent or opt-out controls required by law.

Browser controls can block or delete cookies, but some Platform functions may not work correctly. Where legally required, non-essential technologies will not be activated before you make a choice. Withdrawal of consent should be as easy as giving it.

Dhombe.com does not sell Personal Data for money. If a technology used for cross-context behavioural advertising is legally treated as a "sale" or "sharing", Dhombe.com will provide a clearly labelled opt-out method and honour legally recognised browser signals, such as Global Privacy Control, where required.

Marketing and personalization

We may send offers, destination ideas, surveys, abandoned-booking reminders or other marketing when permitted by law. Marketing may be based on your country, language, searches, saved preferences, prior Bookings and interactions with messages or the Platform. Sensitive Data is not used for personalised advertising.

You can unsubscribe from marketing email using the link in the message and can request that marketing by other channels stop. Opting out of marketing does not stop confirmations, security notices, booking updates, support messages or other non-promotional communications necessary for an Account or Booking.

We do not give your contact information to a Service Provider for its unrelated direct marketing unless you separately agree or the Service Provider has another lawful basis and provides its own notice.

Automated tools and artificial intelligence

Dhombe.com may use automated rules or models to rank search results, detect fraud or abuse, route support requests, translate or summarise communications, and provide recommendations. These tools may use Booking, account, device, usage and communication data relevant to the stated purpose.

We do not make a decision based solely on automated processing that produces legal or similarly significant effects where applicable law requires consent, human review, an explanation, a right to contest or another safeguard. You may request human review where such a right applies.

Dhombe.com does not use customer Sensitive Data or private customer communications to train a public or general-purpose artificial-intelligence model unless we first provide clear notice, implement contractual and technical safeguards, and obtain consent where required. We may use de-identified or aggregated information to improve services where it cannot reasonably identify an individual.

Who receives personal data

We may disclose Personal Data to the following categories of recipients, limited to what is reasonably necessary for the relevant purpose:

Recipient | Why information is disclosedSelected Service Providers | To confirm, deliver, change or cancel the Travel Service; manage check-in, participation, safety, special requests, complaints and refunds.Payment processors, banks and card networks | To authorise payment, hold deposits, issue refunds, prevent fraud, reconcile transactions and comply with financial rules.Hosting, cloud, database, backup and cybersecurity providers | To host, store, protect, monitor and maintain the Platform and data.Customer-support, CRM, email, SMS, telephone and messaging providers | To deliver service communications, operate support and maintain communication records.Analytics, testing, cookie and advertising providers | To measure and improve the Platform or marketing, subject to consent and opt-out requirements.Identity, fraud, safety and verification providers | To verify information, assess transaction risk, investigate misconduct and protect people, payments and systems.Referral, affiliate and distribution partners | To attribute a referral, fulfil a Booking initiated through a partner, calculate commission or provide connected support.Professional advisers, auditors, insurers and claims handlers | To obtain legal, accounting, insurance, security or business advice and manage claims or disputes.Government, regulators, courts and law enforcement | To comply with a valid legal request, protect rights or safety, investigate unlawful conduct or meet regulatory duties.Corporate transaction parties | To evaluate or complete a merger, financing, sale, reorganisation or transfer, subject to confidentiality and legal safeguards.A person you authorise | To share information at your direction, for example with another Traveller, an authorised agent or a person managing your Booking.

Service providers acting on Dhombe.com's instructions are required by contract to protect Personal Data and use it only for authorised services, subject to lawful exceptions. Independent controllers use Personal Data under their own notices and legal duties.

International data transfers

Dhombe.com is based in the Maldives, Travel Services may involve Service Providers in different locations, and technology or payment providers may operate data centres or support teams in other countries. Your Personal Data may therefore be accessed, stored or processed outside your country of residence, including in countries with different privacy laws.

Where transfer restrictions apply, we use an available legal mechanism and proportionate safeguards. These may include an adequacy decision, standard contractual clauses, a recognised data-transfer framework, contractual confidentiality and security obligations, transfer-risk assessment, encryption, access limitation and data minimisation. A transfer may also be necessary to perform your Booking or take steps you request before a contract.

You may contact us for more information about the safeguards relevant to your Personal Data. We may redact confidential or security-sensitive information from copies of contractual safeguards.

How long we keep personal data

We retain Personal Data only for as long as reasonably necessary for the purpose collected, including service delivery, support, safety, accounting, tax, fraud prevention, legal claims and regulatory obligations. The applicable period depends on the type of data and whether a dispute, audit, investigation or legal hold is active.

Record type | General retention approachBooking, transaction, invoice, refund and tax records | Kept for at least the period required by applicable Maldivian tax law, generally not less than five years from the end of the relevant tax year or taxable period, and longer only where required for an audit, dispute, legal hold or other obligation.Account and profile | Kept while the Account is active and for a reasonable period after closure to complete requests, prevent fraud and manage claims. Booking and financial records may be retained separately for longer.Customer-support messages and complaints | Kept for a reasonable period after the matter closes, and longer where needed for a Booking, recurring issue, fraud investigation, complaint, chargeback or legal claim.Identity documents and verification material | Kept only for the shortest period necessary for verification, Travel Service delivery, fraud prevention or law, then deleted, redacted or de-identified where feasible.Accessibility, health and other Sensitive Data | Kept only while needed to arrange the requested service, protect safety, respond to an incident or manage a legal claim, then deleted or de-identified where feasible.Fraud, safety and security logs | Kept for a period proportionate to the risk, and longer while an investigation, restriction, chargeback or claim remains active.Marketing choices and suppression records | Marketing data is used until you opt out or the purpose ends. A minimal suppression record may be kept so we can respect an opt-out in the future.Reviews and public content | Kept while published or needed for the review service, moderation, integrity and disputes. A deletion request will be assessed under applicable law and the Customer Terms.Cookie and analytics data | Kept for the duration stated in the Cookie Notice or preference tool and no longer than necessary for the relevant function.Backups | Residual copies may remain in protected backups until overwritten under the backup cycle. They are not restored for ordinary use and are deleted or re-isolated when restoration occurs, where feasible.

When retention is no longer justified, we delete, securely destroy, irreversibly de-identify or aggregate the information. De-identified information may be retained for analytics, security and business planning if it cannot reasonably be used to identify a person.

Information security

We use risk-based technical and organisational measures designed to protect Personal Data against accidental or unlawful loss, alteration, access, disclosure or destruction. Measures should include, as appropriate:

encryption in transit and appropriate protection for stored data;
role-based and least-privilege access controls;
multi-factor authentication for privileged or administrative access;
secure software development, patching, logging, monitoring and vulnerability management;
payment tokenisation or use of regulated payment environments;
backups, recovery controls and audit logs;
staff confidentiality, access approval and privacy/security training;
vendor due diligence and contractual data-protection requirements; and
incident-response and notification procedures.

No internet service or storage system can be guaranteed completely secure. You are responsible for using a strong unique password, protecting one-time codes and devices, and contacting us promptly if you suspect unauthorised access or a fraudulent Booking.

If a Personal Data breach creates a risk requiring notice under applicable law, we will notify affected individuals and the competent authority within the legally required period and provide available information about the incident and protective steps.

Children and family bookings

A person must be at least 18 years old to create an Account or make a Booking. The Platform is not directed to children for independent use or marketing.

An adult may provide limited Personal Data about a child as part of a family Booking, including name, age or date of birth, passport or identification details where legally required, and information needed for occupancy, child pricing, safety, accessibility or the Travel Service. The adult must be authorised to provide that information.

We do not knowingly create behavioural advertising profiles for children or send direct marketing to them. If we learn that a child provided Personal Data directly without required authorisation, we will take reasonable steps to delete it, subject to legal and safety obligations. A parent or guardian may contact us to request access, correction or deletion.

Your privacy rights and choices

Depending on the law that applies, you may have one or more of the following rights:

access Personal Data and receive information about how it is used;
correct inaccurate or incomplete Personal Data;
request deletion of Personal Data;
restrict or object to certain processing, including direct marketing and some legitimate-interest processing;
receive Personal Data in a structured, commonly used and machine-readable format or ask that it be transferred where technically feasible;
withdraw consent at any time;
opt out of sale, sharing or targeted advertising where those concepts apply;
request human review or contest a significant automated decision where applicable;
appeal a refusal to act on a request where applicable;
authorise an agent to make a request where permitted; and
complain to a competent data-protection, consumer or judicial authority.

These rights are not absolute. We may refuse or limit a request where allowed, for example to protect another person, preserve evidence, comply with law, complete a transaction, prevent fraud, exercise freedom of expression, or establish or defend a legal claim. We will explain the reason unless law prevents us from doing so.

You can change certain Account, marketing and cookie choices directly through the available settings. Withdrawing consent does not affect processing completed before withdrawal and does not stop processing based on another valid legal ground.

How to make a privacy request

Send a request to support@dhombe.com with the subject line "Privacy Request". Include your full name, contact details, Booking reference if relevant, country of residence, the right you wish to exercise and enough detail for us to locate the information. Do not send a full identity document unless we specifically request it through an appropriate channel.

We may verify your identity and authority using information already associated with the Account or Booking. We will request only what is reasonably necessary. An authorised agent may be required to provide signed authority and the individual may need to verify directly.

We aim to acknowledge a request promptly and respond to a verified request within 30 days where practicable, or within the period required by applicable law. If the request is complex or numerous, we may extend the period where law permits and will explain the extension. We do not charge a fee unless a request is manifestly unfounded, excessive or a fee is otherwise permitted by law.

Additional regional disclosures

20.1 European Economic Area, United Kingdom and Switzerland

Where the privacy laws of the European Economic Area, United Kingdom or Switzerland apply, Dhombe Travel Private Limited is the controller for the Dhombe.com processing described in section 2. The purposes and legal bases are listed in section 5. International transfer safeguards are described in section 14. You may complain to the data-protection authority in the country where you live, work or believe an infringement occurred.

Where Dhombe.com is legally required to appoint a local representative or data-protection officer, the applicable contact details will be published with this Policy. The absence of a listed representative does not restrict your ability to contact Dhombe.com directly at support@dhombe.com.

20.2 United States state privacy laws

Where a United States state privacy law applies to Dhombe.com, the categories of Personal Data collected may include identifiers; customer records; commercial and travel information; payment and transaction information; internet or electronic-network activity; approximate or precise geolocation where enabled; audio, visual and communication content; inferences; and Sensitive Data described in section 4. The sources, business purposes and recipient categories are described in sections 4, 5 and 13.

Dhombe.com does not sell Personal Data for money. If Dhombe.com uses advertising technology that constitutes sale, sharing or targeted advertising under an applicable state law, eligible users may opt out through the privacy or cookie controls and Dhombe.com will honour legally required opt-out preference signals. Dhombe.com will not discriminate against a person for exercising an applicable privacy right.

Third-party websites and services

The Platform may link to maps, social networks, payment pages, Service Provider sites, insurance providers or other third-party services. Their privacy practices are controlled by them, not by this Policy. Review the relevant third-party notice before providing information. A link or integration does not mean Dhombe.com is responsible for the third party's independent processing.

Business transfers and legal disclosures

If Dhombe.com is involved in a merger, acquisition, financing, reorganisation, insolvency, sale of assets or transfer of the Platform, relevant Personal Data may be disclosed under confidentiality and transferred as part of the transaction. The recipient must use Personal Data consistently with this Policy unless it provides a new notice and obtains any required consent.

We may preserve or disclose information where we reasonably believe it is necessary to comply with law or valid legal process, protect the rights or safety of a Traveller, Service Provider, Dhombe.com or another person, prevent fraud or cyber incidents, enforce the Customer Terms, or establish, exercise or defend legal claims. We assess requests and disclose only information reasonably necessary, where permitted.

Changes to this Privacy Policy

We may update this Policy to reflect changes in law, technology, vendors, Travel Services or business practices. The "Last updated" date will be revised. If a change materially affects how existing Personal Data is used, we will provide additional notice through the Platform, an Account message, email or another appropriate method before the change takes effect where required.

We will not use Personal Data for a materially incompatible new purpose without providing the required notice and obtaining consent where applicable. Previous versions may be requested from the contact below.

Contact and complaints

Privacy questions, requests and complaints should be sent to:

Controller: Dhombe Travel Private LimitedCompany registration: C18752026Registered address: iHome, Kasthoori Magu, K. Maafushi, Republic of MaldivesEmail: support@dhombe.com (subject: Privacy Request)Phone / WhatsApp: +960 7776331

Email is the preferred channel for privacy requests because it creates a written record and is safer than sending sensitive information through WhatsApp. We will investigate complaints in good faith. You may also contact a competent data-protection, consumer or judicial authority where applicable.