Privacy policy.

[COMPANY'S REGISTERED NAME], [REGISTRATION NUMBER], [POSTAL ADDRESS], Mauritius.

Email hello@meridianfairways.com, telephone +41 76 628 88 69.

We are established in Mauritius and are therefore subject to the Data Protection Act 2017, which rests in all essentials on the same principles as the European data protection regulation.

Because we sell trips to you who live in the EU and EEA — this site exists in Swedish, German and French, and prices are shown in euros and kronor — we are also subject to the GDPR, under Article 3(2). Both regimes apply, then, and where they differ we follow whichever gives you the stronger protection.

Your information is processed in Mauritius. Mauritius has no adequacy decision from the European Commission. Your giving the information directly to us is not in itself a third-country transfer within the meaning of the Regulation — we are the recipient and are already bound by the GDPR — but you should know where the information sits, and it sits here.

[TO DECIDE: whether Article 27 requires you to appoint a representative within the EU. The requirement applies to anyone established outside the EU but caught by Article 3(2), except where the processing is occasional and low-risk. You process passport numbers and dates of birth routinely, so the exemption cannot be assumed. If a representative is appointed, the name and address belong here.]

Every page view sends one line to our own server. The line holds the time, which page you read, its language, which domain you came from (the domain only, never the full address), whether the screen is a phone, a tablet or a computer, and your time zone — for example Europe/Stockholm. The time zone is used instead of looking your IP address up in a geography database.

Your IP address is not stored. It is combined with a salt that changes every day and hashed to twelve characters, purely so that two page views can be counted as one visit. The hash cannot be turned back into an IP address, and yesterday’s hashes cannot be matched to today’s.

We use no cookies for this and store nothing in your browser. If you have Do Not Track switched on, nothing at all is sent.

Legal basis: legitimate interest — knowing how many people read the site and which pages work. The data is pseudonymised and cannot be tied to you as a person.

Kept: [SPECIFY — 14 months suggested, one log file per month].

If you agree, we load Google Analytics (measurement ID G-D6ZC4H46W8) and Google Ads. They set cookies in your browser and send information about your visit to Google Ireland Limited, which also processes it in the United States.

Before you agree, everything is off: ad storage, ad user data, ad personalisation and analytics storage are all set to denied. No cookie is set. If you choose No thanks, it stays that way.

If you agree, Google can recognise your browser between visits and, if you are signed in to a Google account, connect the visit to that account. Collection goes to Google’s European servers and IP anonymisation is on.

Legal basis: your consent. You can withdraw it at any time by clearing site data for meridianfairways.com in your browser — the question then comes back.

Kept: according to the property's settings in Google, [SPECIFY — the default is 14 months].

The form sends what you filled in to our own server: name, e-mail address, telephone number if you gave one, which package or which combination of your own you chose, departure and return, number of nights, how many are playing golf and how many are coming along, room type, language, currency and any message.

The enquiry is stored in a file above the web root — unreachable from the web — and collected from there into our booking system, which runs on our own machine and is not reachable from the internet.

You get a confirmation by e-mail. It is sent through our e-mail provider [CONFIRM: Postmark, Postmark Inc., USA], which processes your e-mail address and the content of the message on our behalf.

Legal basis: steps taken at your request before a possible contract.

Kept: [SPECIFY — 24 months from last contact suggested, if no booking comes of it].

To book flights, hotel and tee times we need more about each traveller: title, name exactly as it stands in the passport, passport number and expiry, nationality, date of birth and — for those playing — golf ID and handicap. A frequent flyer number too, if you want it used.

We ask only the people who actually play for a golf ID, and only one person in the party for contact details, because the airline wants one contact per booking.

The information is passed to those who deliver the trip: the airline, the hotel, the golf clubs, the transport company and the excursion operators. Most of them are in Mauritius, as we are; the airline may be anywhere along the way. Without passing it on there is no booking — it is necessary to perform the contract you have entered into with us.

We pass on only what each recipient needs: the golf club gets a name and a golf ID, not your passport number; the airline gets the passport details, not your handicap.

Payment details are handled by the bank. We neither receive nor store card numbers.

Legal basis: performance of a contract. For the accounts: legal obligation.

Kept: travel documents [SPECIFY], records covered by the accounting act seven years.

We set no cookies of our own. Three values are stored locally in your browser and are never sent to us:

mft-lang — which language you chose. mft-cur — which currency prices are shown in. mft-consent — whether you said yes or no to Google Analytics.

If you say yes to Google Analytics, Google sets cookies of its own, among them _ga.

You have the right to know what data we hold about you and to get a copy of it, to have incorrect data corrected, to have data erased once we no longer need it, to object to processing that rests on legitimate interest, to ask for restriction, and to receive the data you gave us in a machine-readable format.

Write to hello@meridianfairways.com. We answer within one month.

If you are not happy with how we handle your data you can complain to the supervisory authority in the country where you live — in Sweden that is Integritetsskyddsmyndigheten (IMY) — or to the Data Protection Commissioner in Mauritius.

If we change anything in this policy we update the date below. Changes that affect what we do with information already collected, we tell you about directly.

Last changed [DATE].