Mystic Mountain (the “Company”) values you as our customers and recognizes that privacy is important to you. We want you to be familiar with how we collect, use, and disclose your Personal and Other Data (collectively, “Data”).
DATA COVERED BY THIS PRIVACY STATEMENT
This Privacy Statement describes the privacy practices of the Company for Data that we collect:
- through websites operated by us from which you can access this Privacy Statement, including mysticmountain.com and other websites owned or controlled by Mystic Mountain (collectively, our Websites);
- through the software applications (including automated tools and chat functionalities) for use on or through computers and mobile devices (collectively, our Apps);
- through our social media pages that we control from which you have accessed this Privacy Statement (collectively, our Social Media Pages);
- through email messages that we send you that link to this Privacy Statement and through your communications with us online or in person;
- from third parties such as Authorized Sales Agents, and Affiliates, and Other Sources, such as public databases, marketing partners, and other third parties; and
- when you participate in any of our excursions are services at one of our tour sites or through other offline interactions (collectively, Visits and Offline Interactions).
Collectively, we refer to our Websites, Apps, and Social Media Pages, as the “Online Services” and, together with the Property Visits and Offline Interactions, the “Services”.
THE DATA WE COLLECT
At touchpoints throughout your customer journey, we collect Personal Data in accordance with the law, and to provide you with exemplary services. Personal Data is information that may identify you as an individual or relate to you as an identifiable individual. We collect and process the following types of Personal Data about you:
General Identifying Information
Including full name, postal address, e-mail address, telephone number, social media account ID, and other data made publicly available, or as well as data made available when the Website is accessed through links from your social media accounts, or other similar identifiers.
Demographic Information and Important Dates
Including language preferences, nationality, or special occasions.
Financial Information
Including credit, debit, or other payment data.
Travel Information
Including prior customer stays or interactions (including interactions via our chat functionalities), goods and services purchased, special service and amenity requests, travel itinerary, tour group information, activity data, or employer details (for business-related bookings).
Claims Information
Including insurance information, emergency contacts, complaints, medical information or employment details (for worker’s compensation claims).
In more limited circumstances, we may also collect:
- Data about family members and companions (including names, and ages of children);
- Biometric data (such as signatures identification or verification purposes); and
- Images, videos, and audio data via: (a) recordings of your voice (such as when we record customer service calls for quality assurance); (b) security cameras located in public areas, such as hallways and lobbies, in our properties; and (c) body-worn cameras carried by our loss prevention officers and other security personnel.
We may also collect information about your "Experience Preferences" that we use to make your current and future experiences with us more enjoyable, including information about your interests and other relevant information that we learn about you during your trip. This may also include any likes and dislikes about our services so that we can improve our services, and specific dietary, health restrictions or personal needs to provide for your wellbeing. We may also collect your “Personal Preferences", which may include details of your special anniversaries (such as your birthday or wedding anniversary), what type of activities you prefer to take part in when travelling, your hobbies and your preferences exhibited through your use of Online Services. If you submit any Personal Data about other people to us or our Service Providers (e.g., if you make a reservation for another individual), you represent that you have the authority to do so and you permit us to use the data in accordance with this Privacy Statement.
IP Address: We also collect your IP address, a number that is automatically assigned to the device that you are using by your Internet Service Provider (ISP). An IP address is identified and logged automatically in our server log files when a user accesses the Online Services, along with the time of the visit and the pages that were visited. We use IP addresses to calculate usage levels, diagnose server problems and administer the Online Services. We also may derive your approximate location from your IP address.
Precise Location-Based Services: With your consent, we may collect the precise geolocation of your device by using satellite, cell phone towers, Wi-Fi signals, or other technologies. We will collect this data if you opt-in through programs (either during your initial login or later) to improve special offers and enable location-driven capabilities on your device. If you have opted-in to share your location, the program will continue to collect location data based on how you choose to share the data.
THE ONLINE AND MOBILE DATA WE COLLECT
We may also collect “Other Data” that does not directly identify you. To the extent Other Data reveals your specific identity or relates to an individual, we will treat Other Data as Personal Data.
Other Data includes:
System Data: When you use both desktop and mobile devices to access the Online Services, we collect certain data through your browser or automatically through your device, such as your computer type, screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version and the name and version of the Online Services you are using.
Cookies and Similar Technologies on our Websites:
When you visit our Websites from either a desktop or mobile device, we may collect and use cookies or other identifiers to serve you with personal advertisements for The Company and third-party products, via email, on our Websites, or on other websites on the Internet; to measure how you interact with our Websites; and to maintain your preferences. We do this primarily through cookies, which are pieces of data stored directly on the computer or mobile device that you are using. We do not currently respond to browser do-not-track signals.
You can learn more about cookies at: www.cookies.com
In general, we use four different types of cookies:
- Strictly Necessary Cookies: These cookies are necessary to enable the basic features of our Websites, such as providing a secure log-in or booking an excursion or experience.
- Functional Cookies: These cookies allow our Websites to remember your site preferences and the choices you make on the site. We also use functional cookies to facilitate navigation, display content more effectively, and/ or personalize your experience.
- Advertising Cookies: Advertising cookies allow us to select which advertisements or offers are most likely to appeal to you. We also use them to track responses to online advertisements and marketing, and we may use them to better understand your interests so we can present you with relevant messages and offers. These cookies may also allow you to share certain pages with social networks.
- Analytics Cookies: Analytics cookies help us improve our Websites by collecting and reporting information on how you use them.
Cookie Choices
The Website provides the option for users to accept or reject cookies, if however, you do not accept any cookies, you may experience some inconvenience in your use of the Online Services. For example, we will not be able to recognize your computer, and you will need to log in every time you visit. You will not receive advertising or other offers from us that are relevant to your interests.
There are several ways to manage cookies:
- You can opt out of cookies on your browser. Every browser is different, please check the instructions provided by your browser.
- Through our “Privacy Policy”.
- Google and Adobe Analytics: We collect data through Google Analytics and Adobe Analytics, which use cookies and technologies to collect and analyze data about use of the Online Services. These services also collect data regarding the use of other websites, apps, and online resources. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/ and opt out by downloading the Google Analytics opt out browser add-on, available at https://tools.google.com/dlpage/gaoptout. You can learn more about Adobe and opt out by visiting http://www.adobe.com/privacy/opt-out.html.
Advertising Choices
We may use third-party advertising companies to serve advertisements on our Websites, Apps, and other websites regarding both the Company and third-party goods and services that may interest you when you access and use the Online Services or other websites or online services. You may receive advertisements based on information relating to your access to and use of the Online Services and other websites or online services on any of your devices, as well as on information received from third parties.
These companies place or recognize a unique cookie on your browser (including through use of pixel tags). They also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop. Please utilise opt-in or opt-out options as necessary.
Apps and Mobile Devices
With your consent if required by the operating system and/or applicable law, we may also collect mobile device advertising identifiers to enhance and personalize your experience and deliver relevant products, content, or ads to show you on our Websites, Apps, or through external advertising.
If you use our automated chat functionalities or AI-powered chat technologies, we collect the Personal Data that you submit to provide, improve, or develop the chat functionality, so we can better respond to your and other customers’ future interactions. If you choose to use our automated chat functionalities, you understand that The Company and our third-party service providers will be using the information in the chat for quality and training purposes.
Aggregated and Segmented Data
We may aggregate the data that we collect. During that process data is anonymised and use for research purposes. This aggregated data will not identify you or any other user. Additionally, we may use both Personal Data and Other Data to segment customers into groups, in order to deliver more relevant advertising, including third-party advertising.
HOW AND WHERE WE COLLECT YOUR DATA
This Privacy Statement describes the privacy practices of the Company for Personal and Other Data that we collect through the following:
- Hotels & Other Accommodations. We collect Personal Data and Other Data from Hotels & Other Accommodations which are independently owned and operated and enter into a licence and/or referral agreement with us.
- Hotels, Homes and Villas Property Management Companies. We collect Personal Data and Other Data from companies and their service providers who manage Hotels, Homes and Villas properties, your booking of Hotels, Homes and Villas, and to provide additional support to you during your stay at Homes and Villas (“Homes and Villas Property Management Companies”). Homes and Villas Property Management Companies are independent from the Company.
- Authorized Sales. We collect Personal Data and Other Data from companies when we enter into a license or similar agreement to sell our goods and services (“ Authorized Sales Agents”). Authorized Sales Agents are independent from the Company.
- Promotional Activity. We collect Personal Data and Other Data from third parties who may provide promotions to you, such as sweepstakes, contests, or other offers.
- Other Sources & Service Providers. We collect Personal Data and Other Data from various third parties, such as public databases, joint marketing partners, financial service providers, online travel agencies and providers.
- Online Services.. We collect Personal or Other Data when you interact with our Online Services, by performing such actions as, but not limited to, browsing, making a reservation, purchasing goods and services from our Websites, communicating with us (including via our automated chat functionalities or AI-powered technologies) or otherwise connecting with us or posting to social media pages, or signing up for a newsletter or participating in a survey, contest, or promotional offer.
- Customer Care Centers. We collect Personal Data when you make a reservation over the phone, communicate with us by email, fax, or via online chat services or contact customer service. These communications may be recorded for purposes of quality assurance and training.
- Internet-Connected Devices. We collect Personal and Other Data from internet-connected devices available in our physical locations. Examples include when you connect a device to the internet.
WHY WE COLLECT YOUR DATA (LEGAL BASES)
Please note that you must agree to the collection of your Personal Data for the Company to provide its Services.
| PURPOSE | DESCRIPTION OF ACTIVITIES ASSOCIATED WITH PURPOSE | LEGAL BASES (WHERE APPLICABLE) |
|---|---|---|
| Booking & Customer Registration | There are a number of activities associated with this purpose, such as: facilitating reservations and bookings of our services and experiences; engaging in prearrival communications (logistics, changes, preferences, etc.); and processing payments and security deposits. | Performance of contract for the individual with the customer booking the service Legitimate interests for the individual booking, for example, honoring his/her preferences, as well as for any individuals accompanying the primary Customer (e.g., spouse, children, friends) Legal obligations relating to financial transactions, such as the obligation to maintain books and records |
| On-Site Reception & Services | There are a number of activities associated with this purpose, such as: facilitating check-in and check-out; processing payments; providing consistent and personalized service and advice about the on-site services (based on past usage or expressed preferences); providing concierge, and personal items storage; making arrangements with third- party providers on behalf of customers; facilitating dining (including taking into account any dietary, health restrictions or other personal needs expressed by the customer); handling customer requests, inquiries and complaints (including providing our automated chat functionalities or AI-powered technologies for customers to make requests or inquiries); and determining eligibility for age restricted goods and services (such as alcohol or adult entertainment). | Performance of contract, such as processing payments Legitimate interests, such as honoring the customer’s preferences Consent, such as collecting information regarding dietary preferences that the customer chooses to provide. Legal obligations, such as collecting national ID numbers where legally required |
| Company Operations & General Business | There are a number of activities associated with this purpose, such as: administering customer-care services to facilitate and address inquiries, comments and complaints about any of our services (such as in person, through phone lines, email, or on social media); handling security and fraud prevention; administering online services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and the hosting of data); monitoring and analyzing usage of services and using data analytics or AI to improve services, marketing, programs, overall customer experience, gathering feedback, carrying out pilot programs for potential new services and both developing new and improving existing services (including by analyzing information you provide via automated chat functionalities or AI-powered technologies); and facilitating mergers, acquisitions and other reorganizations and restructurings of our business (including prospective transactions). | Performance of contract, such as checking that the Online Services are functioning so that individuals can make reservations or manage loyalty accounts Legitimate interests, such as responding to customer complaints and concerns which may include, where applicable law permits, recording customer service calls Consent, such as for marketing programs Legal obligations relating to financial transactions, such as the obligation to maintain books and records |
| Emergency & Incident Response | There are a number of activities associated with this purpose, such as: providing for the security of on-site services; responding to, handling and documenting on-site accidents and medical and other emergencies (including facilitating inhouse doctor services); actively monitoring properties to ensure adequate incident prevention, response and documentation (including CCTV and body-worn cameras); requesting assistance from emergency services; and sending notifications and alerts in the event of incidents or emergencies (such as via SMS, email, call, audio-visual device prompts, etc.). | Performance of contract, such as providing for the safety of Customers and personnel through interactions with on-site security personnel Legitimate interests, such as monitoring properties through CCTV and others cameras to provide for the safety of Customers and personnel Legal obligations, such as documenting onsite accidents Individuals’ vital interests, such as contacting medical or emergency services for an ill Customer |
| Legal & Compliance | There are a number of activities associated with this purpose, such as: complying with applicable laws; complying with legal processes; responding to requests from public and government authorities; meeting national security or law enforcement requirements; enforcing our terms and conditions; protecting our operations; protecting the rights, privacy, safety, or property of the Company, Customers, visitors and other relevant individuals; and allowing us to pursue available legal remedies and limiting the damages that Company may sustain. | Legal obligations, such as complying with legal processes Legitimate interests, such as enforcing terms and conditions to protect trademarks Individuals’ vital interests, such as contacting emergency services in case of disturbances and incidents involving Customers |
| Tours & Excursions | There are a number of activities associated with this purpose, such as: facilitating reservations and bookings; determining eligibility for services; honoring disability or other health-related restrictions and providing appropriate and safe activities, services and treatments; providing consistent and personalized service based on past usage and preferences expressed by the individual; processing payments; arranging requested professionals for specific treatments and services; and handling customer requests, inquiries and complaints. | Performance of contract, such as processing payments Consent, such as collecting information about back problems when providing massage services Legitimate interests, such as providing personalized services (e.g., offering a specific treatment based on past activity) Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals’ vital interests (e.g., when an individual becomes ill while receiving treatment) |
| Food & Beverage Services | There are a number of activities associated with this purpose, such as: facilitating reservations; honoring dietary preferences; providing consistent and personalized service based on past usage and preferences expressed by the individual; processing payments; arranging reservations; and handling customer requests, inquiries, and complaints. | Performance of contract, such as processing payments Consent, such as collecting information about dietary, or other restrictions, or personal needs of a Customer when ordering food Legitimate interests, such as providing personalized services (e.g., offering red wine to a Customer based on previous requests) Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals’ vital interests (e.g., when an individual becomes ill in one of the restaurants) |
| Child-Related Services (for Parents & Legal Guardians) | There are a number of activities associated with this purpose, such as: facilitating babysitting/hotel nanny, kids club and junior golf program services; facilitating reservations and bookings; preparing for and coordinating hotel accommodations and services in accordance with Customer preferences, instructions and expectations; processing payment and billing services; providing child-friendly dining services (for example, special menus for children or special discounts for breakfast for children under a certain age). | Performance of the contract, such as having a child of a certain age participate in an excursion or service with his/her parents, resulting in extra charges or discounts Consent of parent or legal guardian, such as accommodating needs of children according to a parent’s instructions Legitimate interests, such as providing a crib or child-sized bathrobes and other amenities for children Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals’ vital interests, such as when a child becomes ill while participating in a kids’ club |
| Marketing, Promotions, Contests & Third-Party Products | There are a number of activities associated with this purpose, such as: communicating about products and services that may be of interest to customers; providing personalized advertisements for products and services on selected websites; facilitating participation in sweepstakes, contests and other promotions (such as best vacation photo contests on social media); and handling customer requests, inquiries and complaints. | Performance of a contract, such as fulfilling obligations associated with a contest Consent, such as honoring the mode of communication preferences (e.g., email, SMS) Legitimate interests, such as providing advertisements for similar products and services Legal obligations, such as handling information consistent with rules relating to sweepstakes |
| Dietary preferences | When you book with us, we want to ensure that you are safe, that we are looking after your wellbeing, and to provide you with services to enhance your experience. For example, we may make a note of your dining or beverage preferences so that we are prepared if you dine during your excursion. | Legitimate interest, in order to provide you with exceptional service Consent |
HOW AND WHEN WE SHARE YOUR DATA
Our goal is to provide you with the highest level of hospitality and Services, and to do so, we may share Personal Data and Other Data with the following:
- Affiliates & Associated Companies. We disclose Personal Data and Other Data to other companies within our Group for the purposes described in this Privacy Statement, such as providing and personalizing the Services, communicating with you, facilitating the loyalty programs and to accomplish our business purposes. We share your Personal Data and Other Data used for making reservations for the destination to fulfil and complete your reservation.
- Owners. We disclose Personal Data and Other Data to Owners of the Company for the purposes described in this Privacy Statement. Owners have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers for the following processing: Owners may use your Personal Data for complying with their own legal obligations, including maintaining books & records and other compliance obligations.
- Third-Party Tour Operators & Service Providers. We disclose Personal Data and Other Data to Third-Party Tour Operators & Service Providers when you book an excursion or experience with us. These Third-Party Tour Operators & Service Providers have rights to use Personal Data for their own purposes and therefore qualify as independent data controllers for the processing of Personal Data related to a booking of the excursion or experience. If available, please read the Privacy Statement of the hotel to understand the privacy practices of each Third-Party Tour Operators & Service Providers.
Cookies and Other Data For information on your choices related to Cookies and Other Data, please see the Section on Cookies and Similar Technologies on our Websites, above.
Your Privacy Choices & Individual Rights When you visit, or shop with the Company online or use any Company online product, service or mobile application, your personal data is controlled by The Company of 3 Haughton Avenue, Kingston 10, St. Andrew, Jamaica. Your personal data is primarily used to provide you with the services you request. It may also be used to comply with legal obligations we are subject to or to fulfill our legitimate interests, such as to personalize your experience, develop and improve our services or detect illegal activities. With your prior consent, it may also be used to send you offers and promotions. You have a number of rights including the right to request access to, right of rectification, or remove your personal data, restrict processing, right of data portability, to be informed, to withdrawn consent or change your marketing preferences (including withdrawing your consent at any time) – please see our Privacy Policy to learn more about managing your marketing preferences or deleting your account.
If you have any questions about your individual rights or process, please contact us at: Data Controller Northjam Island Tours Limited 3 Haughton Avenue, Kingston 10 St. Andrew, Jamaica Email: dpo@islandroutes.com
Data Protection Officer Symptai Consulting Limited 58 Half Way Tree Road, Kingston, Jamaica Email: dpo@symptai.com
Additional Information For your protection, we only fulfill requests for the Personal Data associated with the email address and/or loyalty account number that you identify in your request, and we may need to verify your identity before fulfilling certain requests. When permitted by law, we may charge an appropriate fee to cover the costs of responding to your request.
We will try to comply with your request as soon as reasonably practicable and consistent with applicable law. Please note that all individual rights may not be available under applicable law to all our Customers or other users of our Services.
OTHER IMPORTANT PROVISIONS
Non-Company Entities This Privacy Statement does not address, and we are not responsible for the privacy, data, or other practices of any entities outside of the Company Group, including any third-party operating any site or service to which the Services link, payment service, loyalty program, or website that is the landing page of the high-speed Internet providers at our properties. The inclusion of a link on the Online Services does not imply endorsement of the linked site or service by us. We generally have no control over, and are not responsible for, any third-party’s collection, use and disclosure of your Personal Data. In addition, we are not responsible for the data collection, use, disclosure, or security policies or practices of other organizations, such as Meta, Apple, Google, Microsoft, or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including with respect to any Personal Data you disclose to other organizations through or the apps or our social media pages.
Security We seek to use reasonable organizational, technical, and administrative measures to protect Personal Data. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us in accordance with the “Contact Us” section, below.
Retention We will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Statement unless a longer retention period is required or permitted by law.
- The length of time we have an ongoing relationship with you and provide the Services to you;
- Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and
- Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation, or regulatory investigations).
Sensitive Data
We only collect Sensitive Personal Data which may be necessary to perform reasonably expected services or as required by law. Unless we explicitly request that you provide Sensitive Personal Data, we ask that you not send and/or disclose to us on or through the Services (or in your emails to us) any Sensitive Personal Data unless specially required (e.g. photo identification number; or information on race, religion, ethnicity, sex life or practices or sexual orientation, medical or health information, genetic or biometric information, biometric templates, political or philosophical beliefs, political party or trade union membership, background check information, judicial data such as criminal records, or information on other judicial or administrative proceedings).
Use of Services by Minors
The Services are not intended for children, and we do not knowingly solicit or collect Personal Data from children under the age of eighteen (18) without parental consent. We request that children not provide Personal Data through the Services.
International Data Transfers
The Company is a global organization and provides a global service and utilises processes who operate and process data in various countries. Transferring data internationally is essential to the Services so that you receive the same high-quality service wherever you are in the world. As a result, we will, subject to applicable law, transfer or make available Personal Data and Other Data collected in connection with the Services, to entities in countries where data protection standards may differ from those in the country where you reside. By using our service, you understand that we may transfer your Personal Data globally. The Company enters into Standard Contractual Clauses or another approved mechanism for cross-border transfer where appropriate. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Data. Some of the countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards.
DATA PRIVACY FRAMEWORK ENDORSEMENT
The Company and certain of its Affiliates adheres to Data Protection Act of Jamaica with regard to the processing of Personal Data processed in Jamaica.
UPDATES TO THIS PRIVACY STATEMENT
The “Last Updated” legend at the top of this page indicates when this Privacy Statement was last revised. Changes will become effective when we post the revised Privacy Statement on the Online Services.
CONTACT US
If you have any questions or would like to submit a complaint regarding the Company’s collection, maintenance, use, deletion, or disclosure of your Personal Data, please contact us at dpo@islandroutes.com.
ADDITIONAL INFORMATION
DATA CONTROLLER
The Company acts as an independent data controller in relation to our Owners and Franchisees, who have a limited right to use the Personal Data and Other Data we collect as described below: Third Party Tour Operators & Services Providers: As the excursion who are have reserved may not be owned by the Company, we disclose Data to Third Party Tour Operators & Services Providers for the purposes described in this Privacy Statement. Third Party Tour Operators & Services Providers have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers in order to comply with their own legal obligations, including maintaining books & records and other compliance obligations. Affiliated & Associated Companies: We disclose Personal Data to Affiliated & Associated Companies for the purposes described in this Privacy Statement. Affiliated & Associated Companies have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers for the purposes of managing and coordinating your excursion and experiences, and for complying with their own legal obligations, including maintaining books & records and other compliance obligations. You can also:
- Contact our data protection officer (“DPO”) responsible for your country or region via dpo@islandroutes.com. In your email header, please indicate the country from which you are contacting us.
- Lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection laws occurs. For Jamaica, the responsible data protection authority is the Office of the Information Commissioner (OIC), more details about which can be found on the OIC website.
