Privacy policy

Last updated: 3 October 2026

1. Who we are

Coral Triangle Expeditions is the trading brand used on https://coraltriangle.eu, a website operated by OFICINA LTD (ОФИСИНА ЕООД), a company registered in Bulgaria.

Company registration number (EIK): 205866770
Registered office: Kolio Ficheto Street 4, entrance 1, floor 8, apartment 21, 9700 Shumen, Bulgaria
Email: expeditions@coraltriangle.eu
Telephone: +359 98 887 5072

OFICINA LTD is the controller of the personal data we process for the purposes described in this policy. Shopify and other service providers may also process certain information for their own purposes, as explained below.

This policy explains how we collect, use, disclose and retain personal data when you visit our website, submit a travel enquiry or communicate with us.

2. Current scope of our website

Our website currently provides travel information and accepts non-binding enquiries about destinations, accommodation, liveaboards, diving and related travel services.

Submitting an enquiry does not create a confirmed booking or a travel contract. We currently do not accept bookings, deposits or payments through the website.

If we introduce booking or payment services, we will update this policy and provide any additional privacy information before collecting data for those purposes.

Visiting the website or submitting an enquiry does not, by itself, constitute consent to promotional communications or optional tracking technologies.

3. Personal data we collect

Depending on your interaction with us, we may process:

Contact information: your name, email address, telephone number and country or location, where provided.
Travel enquiry information: preferred destinations, travel dates, duration, number of travellers, room or cabin preferences, selected accommodation, diving options, activities and other details you choose to include.
Relevant diving information: experience, certification level or interests, if you provide these when requesting information about diving services.
Correspondence: messages, attachments and records of our communications through website forms, email, telephone or messaging services.
Technical information: IP address, browser and device information, operating system, access times, pages visited and information needed to operate and protect the website.
Cookie and preference information: cookie identifiers, consent choices and information generated by permitted analytics or advertising technologies.
Subscription information: contact details and communication preferences if you subscribe to promotional updates.

Please avoid including passport copies, national identification numbers, payment card details or medical information in an initial enquiry. If additional or sensitive information becomes necessary, we will explain why it is needed, the applicable legal basis and how to provide it appropriately.

4. Where the information comes from

We receive personal data:

Directly from you when you complete a form or contact us.
Automatically through the website, Shopify and permitted cookies or similar technologies.
From a person submitting an enquiry on your behalf.
From service providers supporting our website or communications, where relevant to your interaction with us.

If you provide information about another traveller, share this policy with them and ensure you are authorised to provide their information. Include only what is necessary for the enquiry.

5. Purposes and legal bases

We process personal data for the following purposes:

Responding to specific travel requests: to understand your requirements, check requested options and provide information at your request before a possible contract. Where applicable, the legal basis is Article 6(1)(b) GDPR.
General correspondence and enquiry administration: our legitimate interest in answering questions and managing communications, under Article 6(1)(f) GDPR.
Website operation and security: our legitimate interests in maintaining a functioning website, preventing misuse and investigating technical or security problems, under Article 6(1)(f) GDPR.
Optional analytics, advertising and promotional communications: your consent where required, under Article 6(1)(a) GDPR.
Legal obligations: compliance with applicable legal requirements, under Article 6(1)(c) GDPR.
Complaints and legal claims: our legitimate interest in resolving disputes and establishing, exercising or defending legal claims, under Article 6(1)(f) GDPR.

Where we rely on legitimate interests, we assess the necessity of the processing and its impact on your rights.

Providing enquiry information is voluntary. Without sufficient contact details and information about your request, we may be unable to respond or check suitable options. Optional marketing consent is not required to submit an enquiry.

6. Who may receive your information

We disclose personal data only where necessary for a stated purpose and supported by an appropriate legal basis. Recipients may include:

Shopify and its relevant service providers, for website hosting and platform services.
Providers supporting our email, communications, enquiry forms, IT systems and technical maintenance.
Analytics or advertising providers, where their tools are used and the required consent has been obtained.
Relevant accommodation providers, liveaboard operators, dive centres or other travel suppliers, where necessary to handle a specific enquiry you have asked us to make.
Professional advisers, competent authorities or courts, where necessary for legal obligations, complaints or legal claims.

For initial availability checks, we use non-identifying information where sufficient, such as travel dates, room requirements and group size.

Service providers acting on our behalf process information under appropriate instructions and contractual arrangements. Travel suppliers or communication platforms may act as independent controllers for their own processing.

7. Shopify and Shopify Network Intelligence

Our website is hosted by Shopify. Shopify processes information about website visits and interactions to operate, maintain and protect its services. Information submitted through the website may be processed by Shopify and its service providers in other countries.

If Shopify Network Intelligence or related Enhanced Services are enabled, Shopify may also combine information from interactions with our website, other merchants and Shopify to support features such as personalisation, analytics and advertising.

For processing Shopify undertakes for its own purposes, Shopify is responsible for the applicable privacy information and rights requests. Where consent is required, including for relevant personalised advertising in the EEA, consent must be obtained and can be withdrawn.

Further information is available in the Shopify Consumer Privacy Policy.

You can exercise applicable rights concerning Shopify’s processing through the Shopify Privacy Portal.

8. Cookies and similar technologies

The website uses cookies and similar technologies to support its operation, security and preferences. Depending on enabled features and your choices, these technologies may also support analytics, personalisation or advertising.

Strictly necessary technologies do not require consent where legally exempt. Other technologies require your prior consent where applicable, including in the EEA and UK.

You can manage your choices through the website’s cookie banner or cookie preferences, where available. You may also control cookies through your browser, although blocking necessary cookies can affect website functionality.

Cookie lifetimes vary by purpose and provider. Information about Shopify cookies is available in the Shopify Cookie Policy. Cookies introduced by other services are subject to those providers’ information and the applicable consent requirements.

9. Promotional communications

If you choose to subscribe to promotional communications, we use your contact details for the communications you have agreed to receive.

You can unsubscribe using the link provided in a promotional email or by contacting expeditions@coraltriangle.eu.

Unsubscribing does not prevent us from answering an enquiry you submit or sending other necessary, non-promotional communications. An enquiry does not automatically subscribe you to marketing.

10. International data transfers

Shopify, communication providers and relevant travel suppliers may process information outside the European Economic Area.

Where we transfer personal data outside the EEA, the transfer must have an appropriate legal basis and satisfy the applicable international transfer requirements. Depending on the recipient and circumstances, these may involve an applicable adequacy decision, standard contractual clauses with necessary additional safeguards, or a specific exception permitted by law.

We do not assume that every overseas travel supplier has the same transfer arrangements as Shopify.

Before disclosing identifiable information to an overseas travel supplier for your request, we will provide information about the relevant recipient, destination country and transfer arrangements where required.

You can contact us for further information about transfers concerning your data and to request information about applicable safeguards.

11. How long we retain information

Retention depends on the purpose and the information involved:

Enquiries and correspondence: while needed to answer your request and complete relevant follow-up. Once this purpose ends, information is deleted or anonymised unless a justified reason requires further retention.
Complaints and legal claims: while necessary to resolve the matter and for applicable legal limitation periods.
Records required by law: for the retention period required by the relevant legislation.
Marketing information: until you unsubscribe or withdraw consent, unless it must be removed earlier. We may keep a limited record of your opt-out to respect your choice.
Technical and cookie information: according to the relevant security purpose, provider settings and cookie lifetime.

We consider the sensitivity of the information, the ongoing need for it and applicable legal requirements. You can ask us about the retention criteria applicable to your information.

12. Security

We use appropriate technical and organisational measures to protect personal data, taking account of the nature of the information and the risks involved.

Access should be limited to people and providers who need the information for their responsibilities. No online system can provide an absolute guarantee of security.

Please contact us if you believe information connected with our website or communications has been exposed or misused.

13. Your rights

Subject to the conditions in applicable data protection law, you may:

Request access to your personal data.
Request correction of inaccurate or incomplete information.
Request erasure or restriction of processing.
Receive qualifying data in a portable format.
Object to processing based on legitimate interests on grounds relating to your situation.
Object to direct marketing at any time.
Withdraw consent without affecting processing lawfully carried out before withdrawal.
Lodge a complaint with a supervisory authority.

Send requests to expeditions@coraltriangle.eu. We may request proportionate information to verify your identity.

Requests are normally handled free of charge and answered within one month. Where a permitted extension is necessary, we will explain this within that initial period.

You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority, including in the EEA country of your habitual residence or workplace. You do not have to contact us first.

14. Automated processing

Website analytics or enabled advertising services may analyse browsing activity to produce statistics or personalise content.

Submitting a travel enquiry does not trigger an automated booking decision. Price calculators provide indicative estimates and do not confirm availability or create a travel contract.

For any applicable processing by Shopify, consult its privacy policy and privacy portal linked above.

15. Children’s information

Enquiries should be submitted by an adult.

If your enquiry involves children, provide only the information needed to assess suitable options, such as their ages where relevant. A parent, guardian or other appropriately authorised adult should provide that information.

Contact us if you believe a child has independently submitted unnecessary personal information so that we can assess and address it.

16. External websites and communication platforms

Our website may link to travel suppliers, social networks or other external services. Those services have their own privacy practices.

If you choose to contact us through a third-party messaging or social platform, that platform also processes information under its own privacy policy. Our handling of information we receive remains subject to this policy.

17. Changes to this policy

We may update this policy when our services, technology, data practices or legal obligations change.

The latest version will be published on this page with an updated date. Where required, we will provide additional notice before a material change takes effect or obtain fresh consent.

18. Contact

For privacy questions or requests concerning your personal data, contact:

OFICINA LTD (ОФИСИНА ЕООД)
Company registration number (EIK): 205866770
Kolio Ficheto Street 4, entrance 1, floor 8, apartment 21, 9700 Shumen, Bulgaria
Email: expeditions@coraltriangle.eu
Telephone: +359 98 887 5072
Website: https://coraltriangle.eu