Privacy Policy

Last updated: September 2026

1. Who We Are

Blue Cruise Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are a UK-registered company specialising in luxury Gulet charter holidays in Turkey, Croatia and Greece.

Company registration number: 304 2283

ATOL licence number: 4171

Registered address: Cumberland House, 80 Scrubs Lane, London, NW10 6RF, United Kingdom

Email: gulet@bluecruise.co.uk

Telephone: 020 8968 7770

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Enquiries and contact forms

Your first name, last name, email address, and the content of your message.

Booking and travel arrangements

Full names of all passengers (as they appear on passports), postal addresses, telephone numbers, email addresses, dates of birth, passport details, nationality, payment and billing information, travel insurance details, dietary requirements, and any medical conditions or accessibility needs you disclose to us.

Website usage

Information collected automatically when you visit our website, including your IP address, browser type, device type, pages visited, time spent on pages, and referring website. This data is collected through cookies and similar technologies operated by our website platform, Squarespace.

3. How We Collect Your Data

We collect personal data in the following ways:

Directly from you — when you complete our contact form, send us an email, telephone us, submit a booking form, or correspond with us in any other way.

From third parties — where your booking is made through a travel agent, they will pass your details to us. Airlines and other suppliers may also provide us with information relating to your travel arrangements.

Automatically — through cookies and analytics tools when you browse our website.

4. Why We Process Your Data and Our Lawful Basis

We only process your personal data where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). The purposes and corresponding lawful bases are set out below.

To respond to your enquiries
Lawful basis: Legitimate interest — it is in our legitimate interest to respond to prospective customers who contact us.

To arrange and manage your booking
Lawful basis: Performance of a contract — processing is necessary to fulfil the travel arrangements you have booked with us.

To process payments
Lawful basis: Performance of a contract.

To pass your details to airlines, hotels, yacht operators, transfer companies and other suppliers
Lawful basis: Performance of a contract — these third parties need your information to deliver the services included in your holiday.

To comply with legal and regulatory obligations
Lawful basis: Legal obligation — including requirements under ATOL regulations, the Package Travel and Linked Travel Arrangements Regulations 2018, and anti-money laundering legislation.

To process special category data (medical conditions, dietary requirements related to allergies or intolerances, accessibility needs)
Lawful basis: Explicit consent — we will ask for your consent before processing this data, and you may withdraw your consent at any time by contacting us.

To improve our website and understand how visitors use it
Lawful basis: Legitimate interest — it is in our legitimate interest to maintain and improve our website.

5. Who We Share Your Data With

We will share your personal data with the following categories of recipients where necessary to provide your holiday arrangements:

Airlines — including but not limited to TUI Airways, Jet2, Pegasus Airlines, Corendon Airlines, Wizz Air, SunExpress, easyJet, British Airways and Turkish Airlines.

Yacht operators and crew — the captain and crew of your chartered vessel require passenger details including any medical, dietary or accessibility information you have provided.

Hotels and villa providers — where your holiday includes a land-based stay.

Transfer and ground transport companies — to arrange airport transfers and other local transportation.

Payment processors — to process your payments securely.

Insurance providers — including AVS (Atlas Voyage Secure) / All Seasons Underwriting Agencies Limited, in connection with the insolvency protection required under the Package Travel Regulations.

Regulatory bodies — including the Civil Aviation Authority (CAA) where required under our ATOL obligations.

Professional advisers — including solicitors and accountants, where necessary.

We will not share your personal data with any organisation for marketing purposes. We will not sell your personal data to any third party.

6. International Data Transfers

Because we arrange holidays in Turkey, Croatia and Greece, your personal data will be transferred to organisations based in those countries to fulfil your booking.

Croatia and Greece are European Economic Area (EEA) member states. The UK recognises EEA countries as providing an adequate level of data protection, so transfers to these countries do not require additional safeguards.

Turkey is not covered by a UK adequacy decision. Where we transfer your data to suppliers in Turkey, we rely on the derogation under Article 49(1)(b) of UK GDPR — the transfer is necessary for the performance of the contract between you and us, or for pre-contractual steps taken at your request. By booking a holiday to Turkey with us, your data will be shared with local yacht operators, crew, transfer providers and other suppliers as needed to deliver your holiday.

7. How Long We Keep Your Data

Enquiries (no booking made) — we retain your data for up to 24 months from the date of your last contact, after which it is securely deleted.

Booking and travel records — we retain your data for up to 7 years from the date of your return from holiday. This is to comply with our legal and regulatory obligations, including ATOL record-keeping requirements, tax legislation, and to manage any potential claims or disputes.

Website analytics data — anonymised or aggregated analytics data may be retained indefinitely. Any identifiable data (such as IP addresses) is retained in accordance with our platform provider's data retention policies.

8. Cookies

Our website is hosted on Squarespace, which uses cookies to enable core website functionality, analyse website traffic, and remember your preferences. Cookies are small text files placed on your device when you visit our website.

The types of cookies used on our website include:

Strictly necessary cookies — required for the website to function properly. These cannot be switched off.

Analytics cookies — help us understand how visitors interact with our website by collecting information about pages visited, time on site, and similar metrics. This data is aggregated and anonymous.

Third-party cookies — our website includes links to Facebook and Instagram. These platforms may set their own cookies when you interact with their content. We do not control these cookies and you should refer to the relevant platform's privacy policy for further information.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access — you may request a copy of the personal data we hold about you.

Right to rectification — you may ask us to correct any inaccurate or incomplete data.

Right to erasure — you may ask us to delete your personal data in certain circumstances.

Right to restrict processing — you may ask us to limit how we use your data in certain circumstances.

Right to data portability — you may request that we transfer your data to another organisation, where technically feasible.

Right to object — you may object to processing based on legitimate interest.

Right to withdraw consent — where we process your data on the basis of consent (for example, special category data such as medical conditions), you may withdraw that consent at any time.

To exercise any of these rights, please contact us at gulet@bluecruise.co.uk or write to us at the address above. We will respond to your request within one month.

You will not normally be charged a fee. If your request is clearly unfounded or excessive, we may charge a reasonable fee or refuse to comply, and we will explain our reasons.

10. Complaints

If you are unhappy with how we have handled your personal data, we would ask that you contact us first at gulet@bluecruise.co.uk so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Website: ico.org.uk

Telephone: 0303 123 1113

11. Children

We do not knowingly collect personal data from children under the age of 16 without parental or guardian consent. Where a booking includes passengers under 16, the personal data of those passengers is provided by the parent or guardian making the booking, and we process it on the same lawful basis as the adult booking data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "last updated" date. We encourage you to review this page periodically.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: