SECTION I: Section for global application

1. Who We Are
1.1 References to “We”, “Us”, or “Our” in this privacy notice, mean the following data controllers, who determine how (and for what purposes) your personal data is used:

1. 1. Royal Caribbean Cruises Ltd., 1050 Caribbean Way, Miami, Florida 33132, USA if:
      1. you use Our websites, mobile application(s), or shipboard kiosks outside of the European Economic Area (EEA) and the United Kingdom (UK);
      2. you call one of Our call centers which is based outside of the EEA and the UK;
      3. your personal data is processed on Our Royal Caribbean International or Azamara Club Cruises vessels; or
      4. you book a cruise through an entity based outside of the EEA and the UK;

1. 1. Celebrity Cruises Inc.,1050 Caribbean Way, Miami, FL 33132, USA if:
      1. you use Our Websites, mobile application(s), or shipboard kiosks outside of the EEA;
      2. you call one of Our call centers which is based outside of the EEA and the UK;
      3. your personal data is processed on Our Celebrity vessels; or
      4. you book a cruise through an entity based outside of the EEA and the UK; or

1. 1. 1. RCL Cruises Ltd., Building 3, The Heights, Brooklands, Weybridge, Surrey KT13 0NY, UK if:
         1. you use Our websites inside the EEA, Australia, and New Zealand or the UK;
         2. you call Our call centers based in the EEA or in the UK; or
         3. you book a cruise through an entity based inside of the EEA or in the UK.

2. Highlights
2.1 Your privacy is very important to Us and We want to be open with you about how We use your personal data – that is the information that identifies you as an individual – to make sure that you have the best possible cruise experience. In this privacy notice We explain:

1. what information We collect about you;
2. what We may do with it; and
3. what your rights are.

2.2 We want you to understand how We use your personal data, how We keep it safe and what your rights are. Summarized below are the main circumstances in which We use Your personal data:

1. 1. 4. We collect your personal data when you use Our websites, mobile application(s), other digital platforms (together, “Digital Platforms”), or call Our call centers. For example, We collect:
         • your contact details and other personal information (which may sometimes include sensitive personal data, such as special needs and dietary requirements);
         • details about your bookings and how you travel with Us;
         • your travel profile and marketing preferences; and
         • information on how you use Our Digital Platforms and interact with Our emails.
      5. We use your personal data to understand what you might be interested in and to make Our emails, texts, social or digital media, and offers relevant to you – We build a profile of your travel patterns and interests to do this.
      6. We need to use your personal data to give you the best possible onboard experience – When you book with Us, We need your personal data to deliver a great cruise vacation. We also process your personal data for customer service purposes and where required by law.
      7. To provide Our services to you, We may need to share your personal data with and receive personal data about you from:
         1. Our global brands (Royal Caribbean International, Celebrity Cruises, and Azamara) and Our affiliates and subsidiaries (hereinafter the “Royal Caribbean Group”); and
         2. Our Suppliers around the world. When We say “Suppliers” in this privacy notice, We mean the parties who provide Us with products and services that enable Us to run Our business. This includes third parties who help Us to deliver your cruise vacation, such as transport and accommodation vendors, media vendors, port agents, and who assist Us to run Our business, such as accountants, consultants, payment providers, auditors, IT service and platform providers, insurance providers, and legal advisers (together, Our “Suppliers”). We choose Our Suppliers carefully and put in place safeguards to help protect your personal data; and
         3. Our Business Partners When We refer to “Business Partners” We mean companies with whom We have partnered to complement the products and services We provide to you, such as tour operators.

3. Contents

• Who’s responsible for your personal data?
• What personal data do we collect or receive?
• How we use your personal data and who we share it with
• Direct marketing
• Profiling and personalised marketing
• Cookies and other tracking technologies
• International transfers of personal data
• Legal basis for our use of your personal and legitimate interests
• Data retention
• Your rights
• Contact us and complaints

4. Who’s responsible for your personal data?
4.1 As a data controller, We are responsible for the personal data you provide to Us and will only share such personal data with the Royal Caribbean Group and Our Suppliers and Business Partners if We have a legitimate reason permitted by law, such as your consent.

5. What personal data do We collect or receive?
5.1 The following are examples of the categories of your personal data that We process alongside information on how and/or when We get that personal data:

6. How We use your personal data and who We share it with
     6.1 This section explains how We use the personal data listed above and who We share it with.

6.2 We use your personal data:

1. 1. To manage your bookings with Us and to provide the services or membership benefits that you request before, during and after your cruise We need to use your personal data to deliver Our services to you when you book a cruise. For example, when you travel with Us We need your personal data to send you a booking confirmation, to manage changes to your booking, to check you in when you board Our ships and to keep track of you onboard, to deliver your benefits for Our loyalty programs, to provide you with further products and services onboard (for example when you book shore excursions, tours or onboard entertainment and when you make purchases in Our shops, restaurants, and casinos).
   2. To help you contact Our customer support services When you get in touch with Our customer support services (whether through the Digital Platforms or otherwise), We will process your personal information so that you receive the best customer service possible.
   3. For your safety Your safety is important to Us, and We use your details to safeguard it. For example, We transfer a record of the personal data you provide during the booking process onto your cruise ship for use if you require medical assistance. Additionally, We check booking details against law enforcement registers and Our internal records for the safety of all customers. With your consent to do so, we compare any photo you provide before your cruise with images taken during embarkation to help identify you and to speed up the boarding process for you. We also use closed-circuit television (“CCTV”) cameras onboard Our ships, and We may match images against the photograph We have of you if We need to identify you. We equip Our security staff with body cameras for your safety. If circumstances allow, We will notify you before We begin recording with a body camera.
   4. To make Our Digital Platforms easy to use and enhance your cruise-planning experience The personal data We collect when you use Our Digital Platforms helps Us to make sure that Our Digital Platforms work well (for example, so that We know it is you when you sign into your account). We’re often improving Our Digital Platforms and content therein to enhance your cruise-planning experience, and data about how you use Our site helps Us to do that. We also use this data to help Us understand interest in the different sections of Our Digital Platforms and the products and services that We sell online. We also use your data to make the cruise booking process more convenient. For example, We can remember what you have searched for so you can pick up where you left off. We also use your information to fix operational problems with the Digital Platforms such as software bugs and to maintain the safety and security of the Digital Platforms.
   5. To manage your relationship with Us as a consumer and to deliver personalized service When you sign up via Our Digital Platforms or make a booking, We create a consumer profile of you in Our systems. This is your digital profile that brings the personal data that We maintain and identifies you across the Royal Caribbean Group. Your consumer profile lets Us deliver a personalized experience when you search for cruises, book and travel with Us or contact Us by phone or email. We also use your consumer profile to personalize the marketing communications that We send you. We also sometimes use your details to ask for feedback on Our services.
   6. To process payments and invoicing When you make a purchase through the Digital Platforms (whether in relation to a cruise or certain products or services such as shore excursions), We will process your payment details to process the transaction.
   7. For marketing and promotional purposes We use your contact details for Our marketing and promotions, including to send you information about the products and services that We and the Royal Caribbean Group offer. We also use your personal data to personalize Our marketing communications to make them more relevant for you and to measure engagement with Our marketing campaigns. See Direct Marketing and Profiling and personalized marketing below for more information, including on how to update your preferences and opt out. We use personal data for additional marketing and promotional activities relating to onboard casinos by tracking guest play to: (i) deliver related loyalty program benefits; (ii) rank players; (iii) send casino-related direct marketing messages; (iv) grant credit to groups playing casinos; and (v) better understand how players use the onboard casinos.
   8. For compliance with Our legal obligations We are sometimes subject to certain legal requirements to collect, retain, and disclose your personal data, for example for customs agencies or port authorities to allow Our ships to dock, or where We need to cooperate with law enforcement agencies, including in relation to criminal investigations. Pursuant to the United States’ Stored Communications Act (the SCA), We may be considered a provider of electronic communication services for certain services We offer through the Digital Platforms (because We provide users of the Digital Platforms the ability to send or receive wire or electronic communications). In such instances, We will not turn over records or other information pertaining to you unless compelled to do so by a Court of competent jurisdiction pursuant to the provisions of the SCA.
   9. For Our business operations We may use your personal data for business management activities, including to assist with incident management and to enable Us to conduct reporting. Reports help Us to monitor Our performance and the performance of Our Suppliers. Additionally, We keep records to assist with any complaints you may have or in the event of a legal claim. We also process your feedback to improve Our products and services.

6.3 We may share your personal data with the following recipients for the purposes listed above:

1. 1. 1. Other members of the Royal Caribbean Group We are a global business and We may need to share your personal data with other members of the Royal Caribbean Group for the purposes above.
      2. Travel partner and Our international partners When you book through a travel partner or one of Our local partners, We may need to send details of your booking to that partner. Travel partners may make decisions themselves about how and why to process your information, or they may or may not process your information on Our behalf. Our privacy notice will not cover the information collected by travel partners and it will not cover how travel partners use that information. We recommend that you check your travel partner’s own privacy policy for details as to how they may process your personal data.
      3. Our Suppliers We use products and services from Our Suppliers in the operation of Our business. For example, We use travel booking systems to provide flight availability and cost details, and to book flights if required by you in connection with your cruise.
      4. Our Business Partners We partner with companies, such as tour operators, to complement the products and services that We provide to you. We only do this in compliance with applicable law.
      5. Ports, customs and other government authorities, law enforcement agencies, courts, and parties to litigation We may need to share your personal data where required under the laws of countries in which We operate. Local ports and customs authorities require passenger details to process Our ships in the ports at which they call. Law enforcement agencies may also require access to personal data, including in connection with criminal investigations, or We may be ordered to disclose personal data by a court or in connection with legal proceedings. We may also share your personal data with other third parties such as trade associations and regulatory bodies, for consumer protection purposes in the event We or our partners cannot fulfill the contracted travel services. In the event We do share such data, the trade association and/or regulatory body may contact you to discuss your options and/or provide support.
      6. Other third parties We may share your personal data with other third parties at your request. Our Digital Platforms may provide links to websites or other digital tools that We believe may be useful to you in addition to advertisements placed by third parties. These may lead you to websites or digital tools operated by third parties operating under their own privacy policies. We encourage you to review those privacy policies, as We have no control over those third parties nor the information you may submit to those third parties.

7. Calling Our call centers
7.1 In certain circumstances, We may re-route calls from Our call centers which are based inside the EEA or in the UK to call centers based outside of the EEA or the UK. In these circumstances, We will let you know at the beginning of your call that your call is being rerouted. See International transfers below for more details about how We safeguard your personal data when We transfer it abroad.

8. Direct marketing
8.1 Marketing communications from Us – We may contact you for marketing purposes, including to tell you more about Our services, share news or tell you about promotions from time to time. You are in control of the emails and texts that you receive, and you can update your preferences or opt out at any time via your Guest Account, following the links in Our emails or by contacting Us using the details provided below. Even if you have opted out of marketing messages, We will still need to contact you in relation to your bookings with Us.

8.2 Marketing communications from other members of the Royal Caribbean Group– Some of the services and activities provided onboard Our ships are managed by other members of the Royal Caribbean Group. These members may contact you about those services and activities – including information and promotions relating to onboard casinos – if you have opted-in to receive marketing communications from the Royal Caribbean Group or where permitted by applicable law. You can opt out at any time using the same options above.

9. Profiling and personalized marketing
9.1 Profiling overview: We think it is important for Us to understand the types of vacations that Our consumers are interested in so that We can make Our marketing relevant and targeted. To do this, We use your personal data to build a profile for you that lets Us work out which of Our marketing segments is the best fit for you.

9.2 The personal data We use: From the personal data that We hold about you, which includes the personal data We receive from Our Suppliers and Our Business Partners, Our model may consider your age, gender, household or travel composition, postcode, how you have interacted with Our websites and marketing emails and your booking history (including your destinations, the ships you have sailed on and your chosen accommodation). We do not always use all of these data categories if We do not have the information about you or it is not relevant for Our marketing activities.

9.3 How We build your profile and what We learn from it:

1. Statistical analysis –We use the data above as inputs for a proprietary statistical model, the output of which can tell Us about your previous or likely future booking behavior, for example:
   1. the value or likely value of the bookings you make with Us;
   2. whether you tend to re-book within 12 months of your last cruise and the destinations that you tend to book; and
   3. the extent to which you engage with Our marketing emails.
2. Marketing segments –We try to match every consumer with one or more pre-defined segments that allow Us to broadly tailor Our marketing messages for the right audience. We define Our segments using anonymized demographic data based on broad characteristics and behaviors such as age, household income, or location. You will share a segment with other consumers, so this process is generally not highly individualized.

9.4 Here’s an example: Let’s say you have just signed up on Our websites (giving Us your contact details) and you have never booked a cruise before. Over the next few days you search for cruises that are generally popular with families (giving Us website interaction data). We might use that data to add you to one of Our family segments so that you get relevant emails from Us.

9.5 What this means for you: Tailoring Our marketing campaigns to your profile or segment means you should receive more relevant communications from Us. That’s good for Us because We think you are more likely to book a vacation that matches your requirements. We hope that’s good for you, too, because it helps you to find the vacations that you are interested in. We might also send you special offers on your birthday.

9.6 Targeted advertising on third party social media platforms and websites: We may share your personal data – including your name, email address, address and date of birth – with third party social media platforms, including Facebook, and websites for the purposes of allowing those platforms to display targeted advertisements to you. You can ask Us not to share your personal data with platforms, but you will need to contact the platform with any requests in relation to how the platform uses your personal data because We do not control that.

9.7 You can opt out: You are in control of your personal data. You can update your marketing preferences or opt out of personalized marketing at any time using your Guest Account or, where you do not have a Guest Account, by either clicking a link in an email marketing communication, replying STOP to an SMS text message or by calling the sender of any marketing communication.

10. Cookies and other tracking technologies
10.1 We use cookie data and other technologies to collect information on Our web pages for a variety of purposes, such as to improve the design and content of Our website and to enable Us to provide a more personalized experience when you browse the Internet. We also use cookies for advertising and targeted tracking purposes, which aims to improve the relevance of the advertisements you see. For example, after you visit Our website you may be shown advertisements relating to Our services and products on third parties’ websites.

10.2 Most web browsers have an option that allows you to turn off all cookies or have your computer inform you each time that a request to place a cookie is being made. You may opt out of the use of certain cookies on Our websites by using the “Do Not Sell My Personal Information” link at the bottom of our website. The link also contains additional information on Our use of cookies.

If you turn cookies off (or refuse to accept a request to place a cookie), you may not have access to some features on Our websites and some of Our services, such as purchasing a cruise or being automatically recognized as a loyalty member. We also might not be able to remember your preferences, including in relation to marketing materials on Our websites, without using cookies.

11. Data retention

11.1 We retain your personal data only for as long as necessary: (i) for the purposes set out in this privacy notice; (ii) to provide Our products and services to you; (iii) to comply with Our legal obligations (e.g., to comply with tax or accounting rules or in connection with legal proceedings); or (iv) to comply with Our usual business data retention policies.

12. Acting on someone else’s behalf

12.1 If you give Us information about another person (or persons), such as another guest, We will understand this to mean that they have appointed and authorized you to act on their behalf. This includes providing consent (to the extent this is required) to:

1. 1. • Us processing their personal data and
      • you receiving any information protection notices on their behalf.
        We may ask you to provide evidence that you have been appointed and authorized to act on behalf of the other person (or persons).
      • 13. Multi-guest reservations and linking reservations
        13.1 If you make a multi-guest reservation, all of the guests who are part of the reservation will be able to access the personal data of the other guests on Our Digital Platforms.13.2 Our Digital Platforms will allow your reservation – as well as your personal data therein – to be associated to another user’s guest account provided you have furnished certain credentials or unique identifiers to them. We call this “linking”. If your reservation is linked by another user of Our Digital Platforms, We will allow the user who has linked your account to (1) complete online check-in for you and others in your reservation, (2) view your boarding pass, and the boarding pass of others in your reservation, (3) pay for an onboard or shore product or activity for you or others in your reservation, using their own onboard expense account or their own payment methods, and (4) view eDocs associated to your reservation. However, they will not be able to modify or cancel your reservation, view your folio or use a digital key to access your stateroom.
   2. Children
      14.1 Our Digital Platforms seek to promote Our cruise vacations for sale to adults. We do not knowingly solicit personal data from children, unless permitted by applicable law. If a parent or guardian becomes aware that his or her child has provided Us with information without their consent, he or she should contact Us using the contact details below. We will delete such information from Our files.
   3. Sale of personal data
      15.1 Certain States within the United States have enacted laws, including the California Consumer Privacy Act, that require Us to disclose to you whether We sell your personal data to certain third parties or otherwise disclose your personal data to third parties for the third party’s commercial use, as this concept is defined in the respective laws.We choose Our Suppliers and Business Partners carefully and put in place safeguards to help protect your personal data, including, but not limited to, written agreements. As such, and as of the date of this privacy notice, We generally do not sell or disclose your personal data in this manner. Notwithstanding, we may share certain information stored or retrieved by cookies or related technologies on Our website and such sharing may be construed as a “sale” under these laws. To opt out of such sharing please use the “Do Not Sell My Personal Information” link at the bottom of Our webpage.Please note, terms in this Privacy Policy that are defined in these laws shall not be construed as having the definitions and legal significance set forth in these laws.

   4. Your rights
      16.1 Generally. You can use your guest account to update your direct marketing preferences or opt out of profiling and personalized marketing.16.2 California Consumer Privacy Act (“CCPA”). This sub-section applies to you if you are a California consumer, as that term is defined in the CCPA.
      1. 1. 1. General Notices. See Sections 5 and 6, above, regarding the categories of personal data We may collect and the purposes for which We may use that personal data. Certain programs and activities we solicit you to participate in may be construed as offering a financial incentive for sharing your personal data with Us. Your participation is voluntary and is subject to any applicable terms and conditions.
            2. Your Rights. You have the right to ask Us to:
               • provide you access to the personal data we hold about you; and/or
               • erase your personal data.

         We do not discriminate, as that term is defined in the CCPA, against anyone lawfully exercising their rights under the CCPA. Click on the respective link to submit your request:

      Guest Data Subject Request Form

      1. or

      Marketing Subscriber Data Subject Request Form

      .
   5. Changes to this privacy notice
      17.1 This privacy notice may be updated from time to time for any reason. Updates to Our privacy notice will be posted to the Digital Platforms.17.2 In the event We are involved in a merger, acquisition, or sale of all or a portion of Our assets, you will be notified via email and/or in a prominent notice on Our Digital Platforms of any change in ownership or uses of this information, as well as any choices you may have regarding this information.

1. Contact Us and complaints
   18.1 If you require any other information about any part of this notice, you can contact Our Data Protection Officer at RCL Cruises Limited at the mailing addresses above or by submitting a request via the respective links outlined in Section II.3.1 below.

SECTION II: Heightened European Union/UK requirements/ compliance with the General Data Protection Regulation

This section applies to you if:

1. you use Our Digital Platforms while in the EEA or in the UK;
2. your data controller is RCL Cruises Ltd. (to determine your data controller, see section I.1 above);
3. (c) your personal data is processed on one of Our ships.

1. 1. Legal basis for Our use of your personal data and legitimate interests
      1.1 Legal basis – We only process your personal data to the extent that at least one of the following applies:
      1. you have consented to the processing of your personal data for a specific purpose – We process your sensitive personal data and send you electronic direct marketing communications based on your consent for Us to do that;
      2. the processing is necessary for Us to perform Our contract with you (e.g., to provide your cruise) or for use to take steps at your request before We enter into the contract;
      3. where We need to process your personal data to comply with a legal obligation that We are subject to;
      4. where We need to process your personal data to protect your vital interests (or somebody else’s), including where you are physically or legally incapable of giving consent, for example in case of a medical emergency;
      5. the processing is necessary for Us to establish, exercise or defend a legal claim; or
      6. the processing is necessary for the purposes of Our legitimate interests or a third party’s legitimate interests.

      1.2 Legitimate interests – We rely on several legitimate interests for using and sharing your personal data, including:

      1. improving Our products and services;
      2. understanding how customers travel with Us;
      3. marketing and promotional activities;
      4. identifying and pursuing new ways to develop and grow Our business; and
      5. ensuring the security and safety of Our guests and employees.

1. International data transfers
   2.1 We are a global business and as such We may need to share your personal data with other members in the Royal Caribbean Group for the purposes as outlined in this privacy notice. This means that We may transfer your personal data outside of the EEA or in the UK (including to the United States as this is where the servers that We use for Our business and on which your personal data is stored are located). Sometimes transferring your personal data outside the EEA or the UK will be necessary for Us to perform Our contract with you (e.g., to provide your cruise). We use the European Commission’s standard data protection clauses (also known as Model Clauses) to provide safeguards for your personal data that is transferred outside the EEA or the UK so you can rest assured that the Royal Caribbean Group seeks to adhere to the strict European and UK standards of data security and usage.
2. Your rights
   3.1 You have the right to ask Us to:
   1. 1. provide you with access to the personal data that we hold about you;
      2. correct your personal data;
      3. erase your personal data;
      4. restrict our processing of your personal data;
      5. object to our processing of your personal data;
      6. request that we move your personal data to another organization; or
      7. object specifically to us using your personal data for profiling for direct marketing purposes

   Click on the respective link to submit your request: Guest Data Subject Request Form or Marketing Subscriber Data Subject Request Form. Please use the ‘Submit an inquiry’ button in these forms to exercise your rights under 3.1(f) and (g) above. Note, requests are subject to Us verifying your identity.

   3.2 You also have the right to make a complaint about how We process your personal data to your data protection supervisory authority.

   3.3 Where you have specifically consented to Our use of your personal data, you have the right to withdraw that consent at any time. Please contact Us if you want to do this. See Our website for contact details or refer to Section II.3.1 above for how to submit your request.

   Effective Date: July, 1, 2020