Privacy policy

This privacy policy explains how STA Club Technologies Limited (“STA Club”, “we”, “us”) collects, uses, and protects your personal data in accordance with the Data Protection Act, 2023 of the Republic of Seychelles.

1. Data controller

STA Club Technologies Limited is the data controller responsible for your personal data. We are registered in the Republic of Seychelles (Company registration number 251965, House of Francis, Room 303, Ile Du Port, Mahe, Seychelles).

2. What data we collect

We collect the following categories of personal data:

• Account data — your name, email address, and password (hashed) when you create an account.
• Saved trips — trips you save to your account, including activity type, destination, and group size preferences.
• Search data — search queries and filters you use on the platform, used to improve results.
• Corporate enquiry data — name, organisation, email, phone number, and group requirements when you submit a corporate enquiry.
• Newsletter data — your email address when you opt in to our newsletter.
• Technical data — IP address, browser type, device type, and pages visited, used for site security and analytics.
• Cookie data — cookies set on your device. See our Cookie policy for details.

3. How we use your data

We process your personal data for the following purposes:

• To provide and operate the STA Club platform, including search, saved trips, and account features.
• To respond to corporate enquiries and bookings enquiries.
• To send you our newsletter, where you have opted in.
• To analyse and improve the platform, including search relevance and content quality.
• To detect, prevent, and respond to fraud, security incidents, and misuse of the platform.
• To comply with our legal obligations under Seychelles law and any other applicable laws.

4. Legal basis for processing

Under the Data Protection Act, 2023, we rely on the following bases for processing your personal data:

• Consent — for newsletter subscriptions and cookie consent, which you may withdraw at any time.
• Contract — for processing necessary to provide your account and saved trips features.
• Legitimate interests — for analytics, security, and platform improvement, where our interests do not override your rights and freedoms.
• Legal obligation — where we are required to retain or disclose data by law.

5. Sensitive personal data

STA Club does not knowingly collect or process sensitive personal data (including health, racial or ethnic origin, religious beliefs, or biometric data). If you include such data in a free-text field (for example, an accessibility requirement in a corporate enquiry), we will process it only to respond to your enquiry and will not retain it longer than necessary.

6. Data sharing

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers — hosting (Vercel), email (Google Workspace), and analytics providers, who act as our processors and are bound by contractual obligations of confidentiality.
• Travel providers — when you follow a link to a provider (e.g. Viator), the provider may set cookies and collect data under their own privacy policy. We are not responsible for the provider's processing.
• Legal authorities — where required by law or in response to a lawful request from a Seychelles authority or other competent authority.

7. Cross-border transfers

Your personal data may be processed outside the Republic of Seychelles, including in the United States (Vercel hosting) and the European Union (Google Workspace). We ensure that such transfers are protected by appropriate safeguards, including standard contractual clauses or comparable protections, in accordance with the Data Protection Act, 2023.

8. Data retention

We retain personal data for no longer than necessary:

• Account data — retained while your account is active and for 12 months after account deletion, then permanently erased.
• Saved trips — retained while your account is active, then deleted with your account.
• Corporate enquiries — retained for 24 months from the date of enquiry, then securely deleted.
• Newsletter data — retained until you unsubscribe, then deleted within 30 days.
• Technical and analytics data — retained for up to 14 months.
• Search data — aggregated and anonymised within 30 days; raw search logs deleted after 6 months.

9. Your rights

Under the Data Protection Act, 2023, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention obligations.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — withdraw consent for processing based on consent (e.g. newsletter) at any time.
• Complain — lodge a complaint with the Information Commission of Seychelles.

To exercise any of these rights, email support@sta.club. We will respond within 30 days.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Data breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commission of Seychelles and, where necessary, affected individuals, without undue delay, in accordance with the Data Protection Act, 2023.

12. Children

STA Club is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact support@sta.club and we will delete it.

13. Changes to this policy

We may update this privacy policy from time to time. The updated version will be posted on this page with a revised date. We encourage you to review this policy periodically.

14. Contact us

For any questions about this privacy policy or your personal data, please contact us:

• Email: support@sta.club
• Company: STA Club Technologies Limited (Company registration number 251965)
• Address: House of Francis, Room 303, Ile Du Port, Mahe, Seychelles
• Information Commission of Seychelles: www.infocom.sc/data-protection