Norwegian Cruise Line

"Your location and activities (e.g., CCTV footage of public areas and records of your entries and exits from the ship). Geolocation data (e.g., your location on board our ships and geolocation data gathered from your devices). We may share geolocation data with your agents and representatives, our advertising and marketing partners, our partners that assist with or provide health services, fraud prevention and operating systems and platforms providers, governmental and recognized law enforcement agencies."

The company tracks your physical location on ships through entry/exit records and CCTV, collects geolocation data from your devices, and shares this location data with advertising partners and law enforcement.

"We may use facial comparison technology to facilitate and expedite your embarkation and/or disembarkation by taking your photograph and matching it against the photograph we collected from you during check-in or embarkation. This may involve the processing of your biometric identifiers or biometric data as defined under applicable privacy laws. Sensory data (e.g., recordings of your calls to our call centers, images from closed circuit television ("CCTV") cameras on board our ships, including at all access points and throughout public areas, temperature readings, which may be taken using thermal imaging cameras)."

Norwegian collects biometric data (facial recognition faceprints), thermal imaging temperature readings, continuous CCTV footage across all public areas and access points, and call recordings — extensive sensory surveillance of guests.

"We may update this Privacy Policy from time to time. If we update this Privacy Policy, we will notify you by posting a new Privacy Policy on this page and as otherwise required by law. You can determine when this Privacy Policy was last revised by checking the updated date. We encourage you to periodically review this Privacy Policy to ensure you understand our privacy practices."

The company can update the privacy policy at any time by simply posting a new version on their website, placing the burden on users to periodically check for changes.

"We may share your personal data with our service providers and other businesses that perform marketing services and other business operations for us or with which we have joint or cooperative business arrangements. We may share certain personal data about you with our family of Norwegian Cruise Line Holdings Ltd. companies, including your buying and browsing history on the Services, contact details, past cruising details, including your use of onboard products and services like casinos and loyalty point information. We may also share your personal data to enable our family companies to market to you."

Personal data is shared broadly across the entire NCLH family of companies and with numerous third-party partners including travel agents, marketing partners, ad tech providers, casino partners, fraud prevention providers, and financial institutions.

"We retain your personal data for as long as we have a relationship with you or in accordance with applicable law, and such relationship includes any request to receive marketing or other promotional materials from us or membership in our loyalty programs. When deciding how long to keep your personal data after our relationship with you has ended, we take into account our legal obligations. We may also retain records to investigate or defend against potential legal claims."

No specific retention timelines are provided, and the definition of 'relationship' is broad enough to include simply receiving marketing emails. Data may be retained indefinitely for potential legal claims.

"Details regarding your use of websites and applications (e.g., usernames, passwords, security answers, geolocation information, details regarding your interaction with websites, applications, and emails, such as whether you opened an email, which may permit us to recognize you across multiple devices). We may share certain personal data about you with our family of Norwegian Cruise Line Holdings Ltd. companies, including your buying and browsing history on the Services, contact details, past cruising details, including your use of onboard products and services like casinos and loyalty point information."

The company tracks users across multiple devices, shares browsing and purchase history across all subsidiary brands (Norwegian, Oceania, Regent Seven Seas, Sixthman), and shares internet activity data with ad tech providers for cross-platform advertising.

"You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive, confirm and verify your request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception to the deletion right applies. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data."

Deletion is subject to unspecified exceptions, requires identity verification that may demand additional personal information, and the company acknowledges some data may not be technically deletable from their systems.