Purpose of this Privacy Policy
CPTM, a company whose registered office is located at P.O. Box 220, Papeete, Tahiti, hereinafter referred to as the “Company”, “we”, “us”, “our”, is the owner of the website https://www.aranui.com.
The website https://www.aranui.com is operated in Europe by the company Vaima Islands, the official commercial representative of Aranui in the European territory.
CPTM, Vaima Islands, as well as their technical subcontractors, are committed to respecting your privacy and attach great importance to the confidentiality of your online data.
The purpose of this Privacy Policy is to inform users of our website https://www.aranui.com and about the personal data we collect and process, as well as the following information, where applicable:
- the personal data we collect;
- the use of the collected data;
- access to the collected data;
- the rights of website users;
- the website’s cookie policy.
By using the website https://www.aranui.com, you fully accept this Privacy Policy without reservation, modification, or restriction.
Applicable Laws
Your personal data collected via the Website, hereinafter referred to as “Personal Data”, are processed by the Company acting as data controller. The Company undertakes to process your Personal Data in compliance with applicable laws and regulations, in particular French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (the “French Data Protection Act”), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons.
In accordance with the General Data Protection Regulation (GDPR), this Privacy Policy complies with the following principles. Personal data must be:
- processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness, transparency);
- collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible, in accordance with Article 89(1) (purpose limitation);
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation);
- accurate and, where necessary, kept up to date. All reasonable steps must be taken to ensure that inaccurate personal data is erased or rectified without delay (accuracy);
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. Personal data may be stored for longer periods where it is processed solely for archiving purposes in the public interest, scientific or historical research or statistical purposes, subject to appropriate safeguards (storage limitation);
- processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).
Processing shall be lawful only if and to the extent that at least one of the following applies:
- the data subject has given consent to the processing of their personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation;
- processing is necessary to protect the vital interests of the data subject or another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority;
- processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.
Consent
Users acknowledge that they have read this Privacy Policy.
The processing of personal data is based, as applicable, on user consent, the performance of a contract, compliance with legal obligations, or the legitimate interests of CPTM and Vaima Islands.
Consent for the placement and reading of non-essential cookies (in particular analytical and marketing cookies) is obtained via the cookie management tool available on the website.
Personal Data Collected
Your data may be collected, with your consent, when you visit and use our website, in particular through tracking tools used for audience measurement, tag management and advertising purposes, or when you complete a contact form.
The data that may be collected include:
- Information about your visit: IP address, location, devices and browsing software, content viewed on our website (number of pages viewed, number of visits, browsing history), links clicked, date and time of access;
- Information provided via our contact form: title, first name, last name, email address, postal address, telephone number, message, and any other information provided.
We only collect data that help us achieve the purposes set out in this Privacy Policy. No additional data will be collected without informing you beforehand.
Purposes and Use of Personal Data
Personal data collected on our website is used solely for the purposes described in this Privacy Policy or indicated on the relevant pages of the website.
CPTM may use your personal data as prospects, customers or website users for the following purposes:
Audience analysis and website improvement
- to analyse browsing history in order to better understand user preferences and improve services;
- to produce audience statistics (number of visitors, most viewed pages, time spent, etc.);
- to optimise navigation and usability to enhance the user experience.
Management of information requests and commercial exchanges
- to process requests for information relating to Aranui cruises;
- to respond to messages sent via contact forms, email or other communication channels;
- to manage quotations, bookings and commercial follow-up.
Booking management and customer relations
- to manage cruise bookings and related requests;
- to ensure administrative and commercial follow-up before, during and after the cruise;
- to communicate with customers regarding the performance of services (practical information, travel documents, possible changes, etc.).
Communication and marketing
- to send information about cruises, itineraries, Aranui news or editorial content related to travel and Polynesia;
- to send newsletters or electronic communications, subject to prior user consent where required;
- to offer personalised content based on interests and interactions with the website.
Customer reviews and testimonials
- to collect and publish reviews or testimonials, with user consent;
- to respond to reviews or comments published on the website or third-party platforms.
Recruitment
- to review and assess job applications (CVs, cover letters, professional experience);
- to organise interviews and manage recruitment processes;
- to create a CV database with your consent for future opportunities.
Data security and regulatory compliance
- to ensure data security, confidentiality and integrity;
- to prevent loss, alteration or unauthorised access;
- to comply with legal and regulatory obligations.
Sharing of Personal Data
Access by authorised personnel
Personal data may be accessed by authorised staff of CPTM and Vaima Islands strictly within the scope of their duties and subject to confidentiality obligations.
Third parties
Personal data may be shared with third parties only when necessary, including:
- technical subcontractors and service providers (hosting, maintenance, analytics tools, email services, IT support);
- service providers and partners involved in the organisation and operation of Aranui cruises, when required for bookings or service delivery.
These third parties act as data processors under the GDPR and are contractually bound to ensure data security and confidentiality.
No commercial sale of data
CPTM and Vaima Islands undertake not to sell, rent or transfer personal data to third parties for commercial purposes.
Other disclosures
Data may be disclosed if required by law, legal proceedings, to protect legal rights, or to potential buyers in the event of a sale of the company.
Transfer of Personal Data Outside the EU
Personal data is mainly stored within the European Union. However, some data may be accessed or transferred outside the European Economic Area (EEA), in particular:
- when processed by CPTM, headquartered in French Polynesia;
- through third-party services whose servers may be located outside the EU.
When transfers occur to countries without an adequacy decision, appropriate safeguards are implemented in accordance with the GDPR, including standard contractual clauses or equivalent mechanisms.
Data Retention Period
Personal data is retained only for as long as necessary:
- marketing and communication data: 3 years from last contact;
- website data (contact forms, cookies): 13 months;
- customer data: 5 years after the end of the contractual relationship.
Data may be retained longer to comply with legal obligations.
Cookie Policy
A cookie is a small file stored on a user’s device to collect browsing data.
The website uses a cookie management tool allowing users to accept or refuse cookies individually.
Types of cookies used:
- analytical cookies;
- technical cookies;
- marketing cookies.
(Details of cookies such as Google Analytics, Google Ads, Meta Pixel, duration and purpose apply as described.)
Users may disable cookies via their browser, though this may affect the browsing experience.
Data Security
All stored data is secured and accessible only to authorised employees bound by confidentiality agreements. While reasonable security measures are implemented, absolute security cannot be guaranteed due to inherent Internet risks.
Minors
In accordance with EU data protection regulations, individuals under the age of 15 are considered minors. Personal data concerning minors are processed only with parental or legal guardian consent.
User Rights
Under the GDPR, users have the following rights:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to data portability;
- right to object.
Exercising Your Rights
You may object at any time to the processing of your personal data, particularly for marketing purposes. Requests will be handled within the legal time limits. Identity verification may be required.
Amendments
This Privacy Policy may be updated to ensure legal compliance. Users are encouraged to review it regularly. Updates may be communicated by email if necessary.
Contact
For questions or to exercise your rights, contact:
Email: reservation@aranui.pf
Address: CPTM, P.O. Box 220, Papeete, Tahiti
You may also lodge a complaint with the CNIL (France).
Last updated: 14 January 2026