Privacy Policy

Personal data processing statutory notice

Lotus Destinations S.p.A. (hereinafter also “Lotus Destinations”), as data controller, is providing the following information about the processing of the personal data which you, as the data subject, have provided us:

  • for buying a travel package;
  • within the context of cruises (e.g. purchases made);
  • registration on the Lotus Destinations web site and/or app or the filling in of forms on the Costa Cruise India web site.

Purposes and legal basis of processing

In addition, the data which you have provided may also include some personal data defined by the Code and the GDPR as “special category data”. Sensitive/special category data shall be processed according to the purposes shown further on and only with your consent.

  • Purpose regarding contractual performance. Your personal data shall be processed for the purpose of performing obligations arising out of the contract for the purchase of the travel package, for allowing Lotus Destinations to deliver the service in an optimal manner and, specifically, for:


    • the formation, management and performance of contractual relations between you and Lotus Destinations;
    • responding to your requests;
    • notification of information regarding the travel package (e.g. changes to contractual terms and conditions, etc.);
    • the creation of activities which serve to make your cruise enjoyable and pleasant and to guarantee high entertainment standards on board ships (i.e. party events, photo shoots and video recordings, games, etc.). In addition, in relation to the photos taken and videos recorded by photographers and video operators on board our ship, who work with us to make the cruise experience is unforgettable, please note that whenever you do not wish to be part of photos/videos or whenever you do not want your photos to be displayed on the display board at the Photoshop, you may go to the Photoshops which will record your wishes from time to time. The removal of a photo that features you may only be made after you have reported it.

  • Legal, health and safety purposes.Your personal data shall also be processed for the following purposes:
    • legal, regulatory, domestic and that arising out of orders issued by authorities within the scope of their legal authority;
    • establishing, exercising and/or defending a Lotus Destinations legal claim before the courts;
    • guaranteeing the necessary medical assistance during the cruise;

  • Business and statistics-related purposes.Your personal data shall also be processed for purposes relating or relevant to Lotus Destinations business operations and for the processing of statistics in anonymous form and market research.

  • Additional purposes.Furthermore, whenever you expressly give your consent, your personal data shall be processed for the following purposes:
    • (i.) Marketing purposes, including:

      promotional activities of Lotus Destinations, companies in the Carnival Corporation & PLC Group (hereinafter the “Group”), also abroad, and/or commercial partners, implemented using both automated methods (e.g. e-mail, sms, instant messaging apps, etc.) and non-automated methods (e.g. regular mail, telephone with operator, etc). Specifically, Lotus Destinations may use your e-mail address provided at the time you purchased a travel package, for sending you information and promotional notifications linked to services and products similar to those offered by Costa Cruises and the Group and/or commercial partners, also without your consent, provided you have not opposed said use.


      The Carnival Group companies are: Carnival Corporation (CCL), Carnival PLC (P&O, Cunard, Princess Asia), Costa Croceire S.p.A. (AIDA and Costa), Holland America Line N.V., general partner of Cruiseport Curacao C.V. (Holland America Line and Seabourn) Princess Cruise Lines, Ltd (Princess, Alaska, P & O Australia and Cunard), SeaVacations Limited (CCL business in UK). 


      The commercial partners belong to the following product and market categories:

      • tourism-related activities;
      • airlines/transport services;
      • travel agencies;
      • insurance companies.


    •  profiling activities, i.e. analysis of your travel preferences and market research for the purpose of enhancing the offering of services and sales information from Lotus Destinations, matching them more closely to your interests. Said activity may also be implemented by submitting customer satisfaction questionnaires and/or the use of profiling cookies used during browsing Costa web sites.

    • (ii.) Purposes for the provision of accessory services, including:

      registration on sites (e.g. MyCosta) and digital platforms, for allowing you to access and use the services provided on the portal and reserved for registered users and for guaranteeing you a customised vacation (e.g. for the purchase of wellness packages, beverage packages, photos, Costa-branded gifts and party events, etc.).

    Processing for Marketing Purposes (i.e. for both promotional and profiling activities) may be implemented only with your consent.

    Nature of data provision and consequences arising out of any refusal

    The provision of your personal data is optional; however, without the data requested for the purposes shown in a) and b), the service requested or part thereof may not be performed and you may not be able to take advantage of above-mentioned opportunities.

    The provision of optional data shall allow Lotus Destinations to enhance the services offered, for rendering them better tailored to the personal interests of its passengers.

    The provision of sensitive/special category data is optional; however, without said consent, Lotus Destinations may not be able to comply with a number of contractual obligations and guarantee you any necessary medical assistance.

    Personal data recipient categories

    Your data shall not be disseminated. Your data may be disclosed only for the purposes stated above to the following categories of persons and entities:

    • Lotus Destinations in-house staff, appointed as data processing agents and/or data processor;
    • companies belonging to the Lotus Destinations Corporate Group, also located abroad;
    • to the suppliers and/or agents/operators which, on board ships and ashore, provide services required during the cruise (e.g. port agents, entertainment operators, etc.);
    • persons, companies, associations or professional firms providing services or advisory or consulting services to Lotus Destinations for protecting its claims (e.g. chartered accountants, physicians, lawyers, tax consultants, auditors and consultants within auditing or due diligence operations, etc.);
    • persons, companies or agencies that provide marketing services and analysis or consulting activities to Lotus Destinations;
    • persons and entities that are authorised to access your data, both recognised by law and secondary legislation or by orders issued by authorities empowered by law, including port authorities at the place of landing.

Retention of personal data

Personal data shall be retained for a period of time not exceeding that necessary for the purposes for which they were collected and subsequently processed. Personal data shall be retained for the full duration of the contract which you have entered into and for a subsequent period:

  • within the periods established under prevailing legislation;
  • within the periods established under legislation, including secondary legislation, which require data to be kept (for example tax returns);
  • within the period necessary for protecting the rights of the data controller in the event of any disputes arising concerning performance;

The photos/images and audio/video recordings collected during events and happenings on board shall be retained for a period limited to the duration of the cruise and subsequently they shall be deleted.

Personal data collected and processed for profiling shall be retained for a maximum period of ten (10) years, at the end of which they shall be automatically deleted and rendered permanently anonymous.