Privacy Policy

Last updated: 4 August 2026

This Privacy Policy explains how Oficina LTD, trading through the Coral Triangle Expeditions brand, collects and uses personal data when you visit coraltriangle.eu, use its trip-planning tools, submit an enquiry or subscribe to updates.

1. Data controller

• Controller: Oficina LTD
• Bulgarian Unified Identification Code (UIC): 205866770
• Registered address: 4 Kolio Ficheto Street, Shumen, Bulgaria
• Privacy contact: expeditions@coraltriangle.eu

2. Current service status

3. Personal data we may collect

Depending on how you use the website, we may collect:

• name, email address, telephone or WhatsApp number and country of residence;
• preferred dates, destinations, trip duration, accommodation interests and approximate budget;
• number of travellers and whether travellers are divers or non-divers;
• diving certification, approximate number of logged dives, recent experience, comfort in currents and equipment interests;
• destinations, resorts, rooms, cabins or routes selected in Trip Finder, Trip Builder or Save & Compare;
• messages, questions and correspondence;
• newsletter preferences and consent records;
• technical information such as IP address, device and browser data, security logs, cookie choices and website interactions where permitted.

Please do not send medical records or detailed health information through a general enquiry form. If health information becomes necessary at a later stage, the responsible operator should provide an appropriate secure process and privacy notice.

4. How we collect data

We collect data directly from you when you complete a website form, contact us by email or messaging service, subscribe to updates or communicate through social media. Technical data may be collected by Shopify and enabled website tools in accordance with your cookie choices.

Some trip selections may be stored only in your browser or device and may not identify you until you submit them with an enquiry.

5. Purposes and legal bases

Submitting a trip enquiry does not automatically subscribe you to general marketing. Marketing consent is requested separately where applicable.

6. Recipients and service providers

We may use trusted providers to operate the website and communications, including Shopify, email and hosting providers, form tools, analytics providers enabled with consent, professional advisers and IT/security providers.

If you ask us to investigate a specific resort, liveaboard or local service, relevant enquiry details may be shared with that independent operator only where necessary and appropriate for your request. We will not sell personal data.

7. International data transfers

Some technology providers or destination operators may be located outside the European Economic Area. Where personal data is transferred internationally, we rely on an applicable lawful transfer mechanism, such as an adequacy decision, approved contractual safeguards, or another mechanism permitted by data protection law.

Because Coral Triangle destinations are primarily outside the EEA, information necessary for a supplier-specific request may need to be sent to the country concerned. We limit the information shared to what is necessary for the request.

8. Data retention

General enquiry and correspondence data is normally retained for up to 24 months after the last meaningful contact, unless you ask for earlier deletion or a longer period is necessary to establish, exercise or defend legal claims.

Newsletter data is retained until you unsubscribe or consent is otherwise withdrawn. Technical and security records are retained according to the reasonable schedules of the relevant platform. Records required by law are kept for the applicable statutory period.

9. Your rights

Subject to the conditions in applicable law, you may have the right to:

• request access to your personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or direct marketing;
• receive data in a portable format where applicable;
• withdraw consent at any time without affecting earlier lawful processing;
• lodge a complaint with a supervisory authority.

To exercise a right, email expeditions@coraltriangle.eu. We may need to verify your identity before acting on a request.

10. Supervisory authority

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection:

• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Email: kzld@cpdp.bg
• Website: cpdp.bg

11. Security

We use reasonable technical and organisational measures appropriate to the type of data processed. No online system can be guaranteed completely secure, so please avoid sending unnecessary sensitive information through ordinary email or public messaging services.

12. Automated decisions

Trip Finder may calculate or display matches based on selected preferences, but it does not make a legally significant automated decision. Recommendations and enquiries are reviewed by a person.

13. Providing data

Fields marked as required are necessary to respond to the relevant request. You are not legally required to provide general enquiry information, but we may be unable to respond meaningfully without it.

14. Children

The website is not intended for children to submit enquiries independently. A parent or legal guardian should communicate on behalf of a minor traveller.

15. Changes to this policy

We may update this policy when website functions, providers or our legal status change. The current version and update date will be published on this page.

16. Contact

For privacy questions, contact expeditions@coraltriangle.eu.