Privacy Policy

Ayra Ventures Private Limited, of G.Handhuvary Gulshan 1, Lonuziyraaraiy Magu, Malé 20143, Republic of Maldives, is the controller of the personal information described in this policy.

Privacy enquiries: support@isletransfer.com

To take and fulfil a booking we collect:

• Contact details of the person booking: full name, email address and telephone number
• Passenger details for each traveller: full name, nationality and passenger type (adult, child, infant)
• Identification details where the operator requires them for boarding
• Booking details: route, date, sailing, vessel and the amount paid

If you create an account we also store your account credentials and any travellers you choose to save for reuse.

When you contact support we keep the correspondence so we can deal with your query and keep a record of what was agreed.

We also collect limited technical information automatically — see our Cookie Policy.

We do not collect, process, transmit or store your card number, expiry date or security code at any point.

Card details are entered directly on the Bank of Maldives payment page and are never sent to our servers. We receive only a transaction reference and the outcome of the payment. See our Payment Security page for the full explanation.

We use your information to:

• Create your booking with the ferry or excursion operator
• Take payment and confirm it
• Issue and deliver your e-ticket
• Contact you about your booking, including schedule changes, delays and cancellations
• Provide customer support and handle refunds and complaints
• Meet our legal, accounting and tax obligations
• Detect and prevent fraudulent transactions

We do not sell your personal information, and we do not use it for advertising by third parties.

We share the minimum necessary with:

• The ferry or excursion operator carrying you, who needs passenger names, passenger types and nationality to issue a boarding pass and to meet manifest requirements
• Bank of Maldives, our payment processor, which receives the transaction amount, currency and reference
• Our email delivery provider, in order to send your confirmation and e-ticket
• Professional advisers, auditors and public authorities where we are legally required to disclose

Operators are independent controllers of the passenger data they receive and handle it under their own privacy policies.

Booking and transaction records are kept for [TODO: confirm retention period, e.g. 7 years] to satisfy accounting, tax and chargeback-evidence obligations.

Account details and saved travellers are kept until you delete them or close your account.

Support correspondence is kept for [TODO: confirm retention period].

• All traffic between your browser and this website is encrypted with TLS.
• Access to booking data is restricted to authorised staff, each with an individual account, and is limited to what their role requires.
• Administrative access is authenticated and session-based; there are no shared logins.
• E-ticket links are cryptographically signed, time-limited and marked not to be cached by shared caches.
• Card data never enters our systems, which removes the largest single category of risk (see Payment Security).
• We review access and apply security updates to our systems on an ongoing basis.

You may ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it where we are not required to keep it.

We may need to keep booking and payment records even after such a request, where retention is required for accounting or legal reasons.

To exercise any of these rights, contact support@isletransfer.com. We will respond within [TODO: confirm response window, e.g. 30 days].

Our service is not directed at children. Children travel as passengers on a booking made by an adult, and we only hold the passenger details that adult provides.

If we change this policy we will update the version and effective date shown on this page. We recommend you retain a copy of the version that applied when you booked.