ROYAL CARIBBEAN EMPLOYEE PRIVACY NOTICE

Great holidays begin with great employees!

As part of its activities as an employer, Royal Caribbean Cruises Ltd and its affiliates (Royal Caribbean, we, us or our) collects and processes your personal data – that is the information that identifies you as an individual.

Your privacy is very important to us. We are committed to ensuring that any personal data we receive in relation to our workforce is handled in accordance with applicable data protection laws and regulations. The purpose of this notice (the Employee Privacy Notice) is to inform you as a member of our workforce, how we collect, store, use and disclose personal data relating to you before, during and after your working relationship with us and what your rights are. This Employee Privacy Notice only relates to your personal data as a member of our workforce. If you are also a customer of Royal Caribbean your personal data will be processed in accordance with our privacy policy aimed at guests and which is made available through our corporate websites.

Please take the time to read this Employee Privacy Notice carefully to ensure that you have understood all of its terms.

Contents

This Employee Privacy Notice is split into two Sections:

Section I: Global application

Highlights
Who’s responsible for your personal data?
What categories of personal data do we process?
How we use your personal data
Data sharing
Retention of your personal data
Status of this Employee Privacy Notice
Your rights in relation to how we process your data
How you can contact us

Section II: Heightened European Union requirements / compliance with the General Data Protection Regulation

Highlights
Legal grounds for processing
International transfers
Your rights in relation to your personal data
Annex 1: Measures Taken to Control the Spread of Covid-19 Onboard Our Ships

Section I: Global application

1. Highlights

(a) Your privacy matters – We want you to understand how we use your personal data, how we keep it safe and what your rights are.

(b) We collect data about you – In connection with the employment relationship, we collect and process your personal data, including certain sensitive personal data, and produce records based on that personal data. Read more in paragraph 3.

(c) We need to use your data as your employer – We use your data in furtherance of the employment relationship and the operation of the workplace. Read more in paragraphs 4 and 10.

(d) We need to share your data with our partners around the world to provide our services as your employer – As a global business, we share your personal data with other companies in our group and our third party service providers. We choose these service providers carefully and put in place safeguards to ensure that they protect your personal data. Read more in paragraph 5.

2. Who’s responsible for your personal data?

Generally, the entity you are employed by within the Royal Caribbean Group (including, Royal Caribbean Cruises Ltd., its wholly-owned subsidiaries and their respective brands) is the responsible data controller for the personal data collected about you. That means it is responsible for deciding how it holds and uses personal data relating to its workforce and for certain group-wide data processing activities.

3. What categories of personal data do we process?

Generally, we process your data in furtherance of the employment relationship and the operation of the workplace and to comply with applicable law and/or regulation. This data may comprise one or more of the following:

Categories of personal data	When/how we got it
Personal Information Name, contact information (physical address, email address, telephone number), photograph, date of birth, gender, nationality, ethnicity, personal characteristics, including information relating to, or that may otherwise reveal, your physical, economic, cultural, or social identity (e.g., education, employment and earning history, professional certifications or the like, language and skill proficiency, marital status, dependents, beneficiaries, etc.), etc. Please note: personal information may include information relating to individuals other than yourself, such as emergency contact information, marital information, dependent information, and beneficiary information.	Personal Information is provided by you when you apply for positions at Royal Caribbean via our websites and other online platforms and when you are being considered for employment and/or during your employment. Personal Information is provided by third party service providers when you apply for positions at Royal Caribbean through third party websites, third party online platforms, or third party employment agencies (e.g., staffing agencies, recruiters, hiring partners, etc.) and when you are being considered for employment. Personal Information is provided by third party service providers when you are being considered for employment, such as information provided by background check service providers, references, medical facilities, and/or during your employment, such as information provided by various third party service providers as described below.
Sensitive Personal Information Personal Information related to, or otherwise revealing, physical and mental health (e.g., pre-employment and re-employment medical examinations, etc.), racial and ethnic origin (e.g., dietary restrictions, etc.), sexual orientation, criminal history, trade union membership, and biometric information that uniquely identifies an individual.	Same as above. We also collect information about your health when we require that you participate in health screening and testing processes, and when we ask you to provide relevant medical information to us for the purposes of preventing the spread of Covid-19, as further detailed in Annex 2.
Photographs, Videos and CCTV footage Images of you and your activities.	We take an identifying photograph of you or ask one to provide one of yourself for our records. We also take photographs and videos of you onboard our ships at the point of embarkation and debarkation, and onboard our ships. We also use CCTV onboard our ships and in and around some of our office locations.
Documentation Documents related to your identity (e.g., passport, driver’s license, etc.), employment eligibility (e.g., work permit, visa, etc.), travel, and documentation to establish, substantiate, or support certain personal information, sensitive personal information, and other information provided by you or by a third party service provider to Royal Caribbean or otherwise required for the employment relationship (e.g., marriage certificate, birth certificate, tax documentation, etc.). Please note: documentation may contain specific identification numbers or other identifiers, Royal Caribbean’s receipt of which may include the document itself and/or any identification numbers, identifiers, etc. thereon. Please note: documentation may be include documents relating to individuals other than yourself, such as martial information, dependent information, and beneficiary information.	Same as above.
Records: Recruitment and On-Boarding Records relating to your recruitment and on-boarding; generally, these records contain one or more items of personal information, sensitive personal information (see above), and/or unique codes (see below). These records include your resume or curriculum vitae, results of background checks, credit checks (where applicable), and medical testing (e.g., pre-employment and re-employment medical examinations, drug testing, etc.)	Same as above.
Records: Employment Records relating to your employment; generally, these records contain one or more items of personal information, sensitive information (see above), and/or unique codes (see below). These records include your offer letter, letter of employment, and other employee agreements, your term of employment and working hours, your position, job description, department, and reporting structure, your location of employment, short- and/or long-term relocation, records related to attendance and leave, travel, performance and development management (e.g., career planning, appraisal, disciplinary, and/or grievance information, etc.,), learning and development (e.g., training), survey answers and general feedback, records related to remuneration, enrolment in, or receipt of, benefits, rewards, or other services offered shoreside or shipboard, physical capabilities and fitness for work, requests for variances to company policy and/or procedures and other ad hoc requests, reporting of concerns, claims, demands, and/or litigation against the Company, and information related to recruitment and/or application for, and/or promotion to internal positions, termination and retirement.	Royal Caribbean generally produces these records based on data obtained from or provided by you or by third party service providers.
Financial Information Financial details required for remuneration of wages and/or salaries, including, bank information and tax information, wire transfers, use of corporate credit cards, and payment for benefits, rewards, or other services offered shoreside or shipboard.	Financial Information is provided by you when you accept a position with Royal Caribbean and from time-to-time during your employment. Financial Information may be provided by third party service providers, including those you engage independently.
Remuneration, Benefits, Rewards, and Other Services Offered Records and information related to the receipt and disposition of remuneration, benefits, rewards, and other services offered, including information required to accomplish the aforementioned (e.g., bank and other financial information, tax information, etc.); generally, these records contain one or more items of personal information, sensitive information (see above), and/or unique codes (see below), These records include records related to your remuneration, including payment and disposition of wages, salaries, bonuses, and incentive compensation and their equivalent (e.g., stock compensation, etc.), deductions related to that remuneration (e.g., taxes, insurance, retirement, and other benefits)), set up and use of credit cards issued by the Company, deductions related to the receipt of benefits, rewards, and other services offered shoreside or shipboard and/or participation in certain corporate initiatives (e.g., payroll deductions representing the contributions to charities, etc.), records and information related to your enrolment in, or receipt of, benefits, rewards, and other services offered shoreside or shipboard, including those related to insurance, financial and retirement plans, wellness and work life balance, etc., and records and information related to payout related to the aforementioned (e.g., insurance payouts, retirement payouts, social contribution payouts, etc.) Please note: personal information may include information relating to individuals other than yourself, such as martial information, dependent information, and beneficiary information.	This information is provided by you to Royal Caribbean and our third party service providers when you accept a position with Royal Caribbean and from time-to-time during your employment. This information may be provided by third party service providers such as in the case of your enrolment in, or receipt of, benefits, rewards, and other services offered by these third party service providers (e.g., payroll service providers, including shipboard payroll providers (Salary at Sea), insurance companies, plan administrators, etc.) Royal Caribbean either creates some of this data itself via internal human resources and payroll processes, or receives this data via benefits providers, payroll providers and processors.
Accounts, Contact Information, and Credential Information. Information and records related to accounts, contact information, and credential information (e.g., workplace identification and other unique codes, identifiers, credentials, etc.) and the like assigned to, or created for, you as a member of our workforce (e.g., Peoplesoft account, c-Trac account, employee badge, work email address, work telephone number, Peoplesoft identification number, passwords, etc.).	Royal Caribbean generally produces this information and related records.
Communication and Workplace Access Records: Information and records related to your use of Royal Caribbean’s information technology and communication systems; these records include details of the creation, transmission, and/or storage of information or communications on or using those systems, including your computer and telephone usage (of both stationary and mobile devices), activity of internet provider (IP) address, computer usage, including browser history, telephone call history and voicemails) and access to, and use of, the workplace and assets owned or operated by Royal Caribbean (e.g., closed-circuit television (CCTV), body camera, and still photo imagery, building and vessel access, etc.).	Royal Caribbean creates these records through its use of electronic monitoring systems.
Contact Tracing Information Information and records relating to where you have been onboard and at what time, and information about which other individuals you have or may have been in close contact with. By ‘close contact’ we mean contact sufficient for Covid-19 to be transmitted between individuals e.g. when two people embrace or when two people are within 6 feet of each other for a period of 15 minutes or more.	We take information from the systems which tell us information about your shifts, and which guests you served during your shift or otherwise came into contact with. We also collect this data from wearable devices that you may be required to wear from time to time.

Categories of personal data

When/how we got it

Personal Information

Name, contact information (physical address, email address, telephone number), photograph, date of birth, gender, nationality, ethnicity, personal characteristics, including information relating to, or that may otherwise reveal, your physical, economic, cultural, or social identity (e.g., education, employment and earning history, professional certifications or the like, language and skill proficiency, marital status, dependents, beneficiaries, etc.), etc.

Please note: personal information may include information relating to individuals other than yourself, such as emergency contact information, marital information, dependent information, and beneficiary information.

Personal Information is provided by you when you apply for positions at Royal Caribbean via our websites and other online platforms and when you are being considered for employment and/or during your employment.

Personal Information is provided by third party service providers when you apply for positions at Royal Caribbean through third party websites, third party online platforms, or third party employment agencies (e.g., staffing agencies, recruiters, hiring partners, etc.) and when you are being considered for employment.

Personal Information is provided by third party service providers when you are being considered for employment, such as information provided by background check service providers, references, medical facilities, and/or during your employment, such as information provided by various third party service providers as described below.

Sensitive Personal Information

Personal Information related to, or otherwise revealing, physical and mental health (e.g., pre-employment and re-employment medical examinations, etc.), racial and ethnic origin (e.g., dietary restrictions, etc.), sexual orientation, criminal history, trade union membership, and biometric information that uniquely identifies an individual.

Same as above. We also collect information about your health when we require that you participate in health screening and testing processes, and when we ask you to provide relevant medical information to us for the purposes of preventing the spread of Covid-19, as further detailed in Annex 2.

Photographs, Videos and CCTV footage

Images of you and your activities.

We take an identifying photograph of you or ask one to provide one of yourself for our records. We also take photographs and videos of you onboard our ships at the point of embarkation and debarkation, and onboard our ships. We also use CCTV onboard our ships and in and around some of our office locations.

Documentation

Documents related to your identity (e.g., passport, driver’s license, etc.), employment eligibility (e.g., work permit, visa, etc.), travel, and documentation to establish, substantiate, or support certain personal information, sensitive personal information, and other information provided by you or by a third party service provider to Royal Caribbean or otherwise required for the employment relationship (e.g., marriage certificate, birth certificate, tax documentation, etc.).

Please note: documentation may contain specific identification numbers or other identifiers, Royal Caribbean’s receipt of which may include the document itself and/or any identification numbers, identifiers, etc. thereon.

Please note: documentation may be include documents relating to individuals other than yourself, such as martial information, dependent information, and beneficiary information.

Same as above.

Records: Recruitment and On-Boarding

Records relating to your recruitment and on-boarding; generally, these records contain one or more items of personal information, sensitive personal information (see above), and/or unique codes (see below). These records include your resume or curriculum vitae, results of background checks, credit checks (where applicable), and medical testing (e.g., pre-employment and re-employment medical examinations, drug testing, etc.)

Same as above.

Records: Employment

Records relating to your employment; generally, these records contain one or more items of personal information, sensitive information (see above), and/or unique codes (see below). These records include your offer letter, letter of employment, and other employee agreements, your term of employment and working hours, your position, job description, department, and reporting structure, your location of employment, short- and/or long-term relocation, records related to attendance and leave, travel, performance and development management (e.g., career planning, appraisal, disciplinary, and/or grievance information, etc.,), learning and development (e.g., training), survey answers and general feedback, records related to remuneration, enrolment in, or receipt of, benefits, rewards, or other services offered shoreside or shipboard, physical capabilities and fitness for work, requests for variances to company policy and/or procedures and other ad hoc requests, reporting of concerns, claims, demands, and/or litigation against the Company, and information related to recruitment and/or application for, and/or promotion to internal positions, termination and retirement.

Royal Caribbean generally produces these records based on data obtained from or provided by you or by third party service providers.

Financial Information

Financial details required for remuneration of wages and/or salaries, including, bank information and tax information, wire transfers, use of corporate credit cards, and payment for benefits, rewards, or other services offered shoreside or shipboard.

Financial Information is provided by you when you accept a position with Royal Caribbean and from time-to-time during your employment.

Financial Information may be provided by third party service providers, including those you engage independently.

Remuneration, Benefits, Rewards, and Other Services Offered

Records and information related to the receipt and disposition of remuneration, benefits, rewards, and other services offered, including information required to accomplish the aforementioned (e.g., bank and other financial information, tax information, etc.); generally, these records contain one or more items of personal information, sensitive information (see above), and/or unique codes (see below), These records include records related to your remuneration, including payment and disposition of wages, salaries, bonuses, and incentive compensation and their equivalent (e.g., stock compensation, etc.), deductions related to that remuneration (e.g., taxes, insurance, retirement, and other benefits)), set up and use of credit cards issued by the Company, deductions related to the receipt of benefits, rewards, and other services offered shoreside or shipboard and/or participation in certain corporate initiatives (e.g., payroll deductions representing the contributions to charities, etc.), records and information related to your enrolment in, or receipt of, benefits, rewards, and other services offered shoreside or shipboard, including those related to insurance, financial and retirement plans, wellness and work life balance, etc., and records and information related to payout related to the aforementioned (e.g., insurance payouts, retirement payouts, social contribution payouts, etc.)

Please note: personal information may include information relating to individuals other than yourself, such as martial information, dependent information, and beneficiary information.

This information is provided by you to Royal Caribbean and our third party service providers when you accept a position with Royal Caribbean and from time-to-time during your employment.

This information may be provided by third party service providers such as in the case of your enrolment in, or receipt of, benefits, rewards, and other services offered by these third party service providers (e.g., payroll service providers, including shipboard payroll providers (Salary at Sea), insurance companies, plan administrators, etc.)

Royal Caribbean either creates some of this data itself via internal human resources and payroll processes, or receives this data via benefits providers, payroll providers and processors.

Accounts, Contact Information, and Credential Information.

Information and records related to accounts, contact information, and credential information (e.g., workplace identification and other unique codes, identifiers, credentials, etc.) and the like assigned to, or created for, you as a member of our workforce (e.g., Peoplesoft account, c-Trac account, employee badge, work email address, work telephone number, Peoplesoft identification number, passwords, etc.).

Royal Caribbean generally produces this information and related records.

Communication and Workplace Access Records:

Information and records related to your use of Royal Caribbean’s information technology and communication systems; these records include details of the creation, transmission, and/or storage of information or communications on or using those systems, including your computer and telephone usage (of both stationary and mobile devices), activity of internet provider (IP) address, computer usage, including browser history, telephone call history and voicemails) and access to, and use of, the workplace and assets owned or operated by Royal Caribbean (e.g., closed-circuit television (CCTV), body camera, and still photo imagery, building and vessel access, etc.).

Royal Caribbean creates these records through its use of electronic monitoring systems.

Contact Tracing Information

Information and records relating to where you have been onboard and at what time, and information about which other individuals you have or may have been in close contact with. By ‘close contact’ we mean contact sufficient for Covid-19 to be transmitted between individuals e.g. when two people embrace or when two people are within 6 feet of each other for a period of 15 minutes or more.

We take information from the systems which tell us information about your shifts, and which guests you served during your shift or otherwise came into contact with. We also collect this data from wearable devices that you may be required to wear from time to time.

4. How we use your personal data

We may process your personal data for the purposes of the employment relationship, the operation of the workplace, and to comply with certain legal and regulatory obligations, including:

(a) talent management, (e.g., administering and managing the recruiting and application process, and the assessment of candidates);

(b) onboarding process (e.g., set up (payroll, etc.) and integration into the workplace and offering of, and enrolment in, applicable benefits, rewards, and other services offered shoreside or shipboard);

(c) managing the employment relationship (e.g., managing remuneration and the provision of benefits, rewards, and other services offered shoreside or shipboard, attendance, fitness for work, and performance, learning and development, mobility, compliance with applicable policies and procedures, workplace relations, grievances, discipline and termination processes, staffing levels, and succession planning;

(d) providing services germane to shipboard operations (e.g., medical treatment/care, etc.)

(e) records and business management, including auditing, compliance and risk management activities;

(f) enabling Royal Caribbean to undertake strategic collaborations with other organisations such as our joint venture partners and affiliates;

(g) complying with:

requests from, and reporting obligations of, governmental (e.g., regulatory agencies, departments, etc.), quasi-governmental, and judicial bodies, including port and customs authorities and law enforcement agencies;
disclosure obligations in the context of litigation or government/regulatory audits and/or investigations; and
health and safety obligations, documenting incidents, obtaining medical help and reporting injuries for claim purposes;

(h) protecting the rights and property of Royal Caribbean and any of its staff, customers and others, ensuring the safety of the aforementioned, and conducting related investigations;

(i) prosecuting and defending legal claims and/or disputes;

(j) complying with applicable collective agreements and all applicable laws, regulations and contractual arrangements; and

(k) seeking to control the spread of Covid-19 and other communicable illnesses as further detailed in Annex 2.

5. Data Sharing

We may share your personal data with the following recipients for the purposes listed above:

(a) Members of the Royal Caribbean group.

As a global business, we may need to share your personal data with other companies in the Royal Caribbean group and other internal recipients;

(b) Royal Caribbean and Royal Caribbean group’s third party service providers.

Third party service providers include suppliers and professional advisers engaged by Royal Caribbean and/or companies within the Royal Caribbean to provide and/or offer services related to the employment relationship and the operation of the workplace, including suppliers providing and/or offering background checking, payroll, insurance (including brokers), retirement, medical and health, survey, training, and information technology services.

We choose these suppliers carefully and put in place safeguards to ensure that they protect your personal data.

(c) Ports, customs and other government authorities, law enforcement agencies and courts and parties to litigation.

The laws of countries in which we operate may require us to share certain personal information. For example, port and customs authorities may require crewmember manifests prior to permitting entry, law enforcement agencies may require access to personal data, including in connection with criminal investigations, and Royal Caribbean may be ordered to disclose personal data by a court or in connection with legal proceedings. We may be required to share information which includes personal data relating to you (such as CCTV footage) with public authorities to show compliance with their requirements for sailing. We may share information about your health including test results and information which is relevant to contact tracing with public authorities including port authorities, health authorities and other health care providers and any other third parties as necessary for the operation of the vessel and the safety of all persons onboard. Please note that certain authorities, in particular health authorities, may contact you about information we provide to them which might be relevant to the spread of communicable diseases.

(d) Another organisation for strategic collaboration purposes or with a prospective buyer of any or all of Royal Caribbean’s business or assets.

When we share your personal data as described above, we will do so in accordance with applicable data protection laws and will, where necessary, put in place appropriate or suitable safeguards to protect your personal data.

6. Retention of your personal data

We retain your personal data only for as long as necessary: (i) for the purposes set out in this privacy notice; and/or (ii) to comply with our legal obligations and/or internal policies and procedures, including the Record Management Policy and associated Records Retention Schedule

7. Status of this Employee Privacy Notice

This Employee Privacy Notice applies to employees and temporary employees of Royal Caribbean and extends to all countries in which Royal Caribbean operates. Please note that this Employee Privacy Notice does not apply to contractors and consultants.

This Notice sets forth our data processing activities for Company employees generally. The laws of a particular jurisdiction require data processing activities may be more limited; in those instances we may adopt tailored data protection practices consistent with those laws that may deviate from the practices set forth herein. In addition to this Employee Privacy Notice, we may provide more detailed privacy notices (such as for specific IT systems and human resources processes) where applicable.

If you are sailing on vessels owned or operated by Royal Caribbean or a member of the Royal Caribbean group in a capacity other than an employee (i.e., for pleasure, etc.), even if such sailing is, or resulted from, a benefit or reward offered by Royal Caribbean or a member of the Royal Caribbean group, your personal data will be processed consistent in accordance with our privacy policy aimed at guests and which is made available through our corporate websites.

This Employee Privacy Notice supersedes all previous versions. Royal Caribbean reserves the right to change this Employee Privacy Notice at any time. When there is an important change that will have a relevant impact on the processing of your personal data, we make every effort to notify you. Notwithstanding, any change to this Employee Privacy Notice will become effective when it is published by Royal Caribbean and/or the Royal Caribbean group on relevant corporate websites.

This Employee Privacy Notice does not form part of any contract of employment or other contract to provide services.

8. Your rights in relation to how we process your data

Different privacy regimes apply depending on the terms of your contract of employment with us, where you work in the world or the flag state of the ship on which you sail, where you are when we collect data from you and other factors. Section II below sets out the provisions which apply as a matter of European law, but we respect the rights of employees in and from all countries around the world. Please note that any and all employees may ask to exercise the rights set out in paragraph 13 below.

9. How you can contact us

If you require any other information about any part of this notice, you can contact our Data Protection Officer by completing the Employee Data Subject Request Form or at privacy@rccl.com.

Section II: Heightened European Union requirements / compliance with the General Data Protection Regulation

This Section and Section III below supplement the provisions set out in Section I so that the provisions of both Section I and Section II apply to you if:

(a) you are employed by a Royal Caribbean entity in the European Economic Area (EEA) or United Kingdom (UK); and/or

(b) your personal data is processed on one of our ships when the ship is in the EEA or UK.

10. Highlights

(a) We are committed to processing your data fairly and transparently – We will only process your data under this Section of the Notice if we have a legal basis for doing so. Read more in paragraph 11.

(b) We need to share your data with members of the Royal Caribbean group and third party service providers to provide services as your employer and/or prospective employer, and for the operation of the workplace. As a global business, we sometimes need to transfer your data outside of the EEA for processing, including to the United States, where your data is stored. We have protective measures in place in these situations. Read more in paragraph 12.

(c) You’re in control of your data – You maintain, and may exercise, certain rights related to your personal data. Read more in paragraph 13.

11. Legal grounds for processing

We only process your personal data to the extent that one or more of the following legal grounds applies:

(a) where you have given your consent;

(b) where necessary for the performance of a contract;

(d) where we need to process your personal data to protect your (or somebody else’s) vital interests, including where you are physically or legally incapable of giving consent, for example in case of a medical emergency;

(e) in respect of sensitive personal data, where necessary for the:

(i) purposes of performing or exercising Royal Caribbean’s or your obligations or rights under employment, social security, health and safety or social protection law and processes in accordance with applicable data protection laws; and/or
(ii) establishment, exercise or defence of legal claims; and/or
(iii) to protect the vital interests of Our employees, guests and service providers; and/or
(iv) because it is necessary for the purposes of preventive health care and occupational medicine; and/or
(v) because it is necessary for reasons of public interest in the areas of public health, including protecting against serious cross-border threats to health and ensuring high standards of quality and safety of health care.

(f) where the processing is necessary for the relevant controller’s legitimate interests or the legitimate interests of the third parties to whom we transfer your personal data (provided that such legitimate interests are not overridden by your interests or your fundamental rights and freedoms).

12. International transfers

As global business, we may need to share your personal data with members of the Royal Caribbean group and third party service providers as outlined in this Employee Privacy Notice.

This means that we may transfer your personal data outside of the EEA (including to the United States as this is where the servers that we use for our business and on which your personal data is stored are located). We use the European Commission’s standard data protection clauses (also known as Model Clauses) to provide safeguards for your personal data that is transferred outside the EEA so you can rest assured that we adhere to the strict European standards of data security and usage. The same applies when personal data is transferred from within the United Kingdom to countries outside the United Kingdom.

Section III: Your Rights in Relation to Your Personal data

13. Additional Rights

Certain additional rights apply to you if: (i) Section II applies to you, or (ii) if you are resident in certain US States, including California. If you meet either of these criteria, you may have, subject to the requirements set forth under applicable data protection law, the right to ask Us to:

(a) provide you with access to the personal data that We hold about you;

(b) correct your personal data;

(d) restrict our processing of your personal data

(e) object to our processing of your personal data;

(f) request that we move your personal data to another organization; or

(g) object specifically to us using your personal data for profiling for direct marketing purpose.

To exercise any of the rights listed above, please email the data privacy team at privacy@rccl.com. Note, requests are subject to Us verifying your identity.

You also have the right to make a complaint about how We process your personal data to your data protection supervisory authority.

14. Rights available to residents of certain US States

If you are a resident of certain US States, including California, then you may have certain additional rights under legislation such as the California Consumer Protection Act (‘CCPA’). This paragraph applies to you if you are a California consumer, as that term is defined in the CCPA. You have the right to ask Us to:

(a) provide you access to the personal data we hold about you; and/or

(b) erase your personal data.

We do not discriminate, as that term is defined in the CCPA, against anyone lawfully exercising their rights under the CCPA. To exercise these rights, please email the data privacy team at privacy@rccl.com.

Annex 1: Measures Taken to Control the Spread of Covid-19 Onboard our Ships; Information for Crew Members and Employees Onboard our Ships

We have put in place new measures to help us to manage the current threat to health of Covid-19, enhancing our usual business practices. Through these new measures, we will collect and process your personal data, including certain sensitive personal data relating to your health. This will help us to ensure the health and safety of all those onboard, including you and all our crew, our guests and other third parties such as service providers. Some of the measures will also enable public authorities to control the spread of the virus.

Please note additional measures described in Section II which apply to crew members and employees onboard ships sailing to and from ports in Singapore and ships sailing in Singaporean waters

Section I: Measures in place onboard all ships

1. Health Questionnaires and Health Screening. Before you board Our ship, We may require that you provide certain information about your age, medical history, and current health to make sure that you are healthy enough to perform your contracted duties onboard and to try to identify symptoms of Covid-19. We collect this data from you and We rely on your honesty. We may also require that you undertake a medical examination and We may require that you undertake tests including temperature checks and tests for Covid-19. We may repeat some or all of these screening measures at debarkation and/or embarkation in ports of call, and at the point of debarkation at the end of your contract. All examinations, tests, and checks are to try to identify symptoms of Covid-19, so that We can minimise its spread and in order to comply with applicable laws and regulatory requirements.

2. Temperature Checks. We may test your temperature before embarkation, and we will take your temperature when you are onboard. We may also take your temperature at debarkation and/or embarkation in ports of call. This may be by asking you to walk through a temperature scanner, by presenting in a temperature testing kiosk, or a member of staff or a service provider may take your temperature personally using a thermometer. This is to try to identify symptoms of Covid-19.

3. Tests for Covid-19. We may ask you to undertake a test to identify whether you have Covid-19 or whether you have already had Covid-19 and have recovered from it. We may ask you to take this test at home, at a test centre and/or we may require that you take this test at the port before embarkation. We may also require you to take such tests during your contract and at debarkation on return to port. Crew members may be tested at random or on a schedule. We will also require you to be tested for Covid-19 in the event that we believe that you have come into close contact with someone who has tested positive for Covid-19. Again, these tests are used to identify people who have or who have had Covid-19, to seek to prevent spread of the virus and in order to comply with applicable laws and regulatory requirements.

4. Teleconsultation/Telemedicine. If during a temperature check you have a raised temperature or if you otherwise appear, in our reasonable judgment, to be symptomatic, We may contact you to schedule a teleconsultation in your stateroom. Such consultation may be followed up by an in-person appointment with our medical staff or a telemedicine appointment. Likewise, we may follow up with you by in-person appointment or by a telemedicine appointment if you presented to our medical staff in-person.

Teleconsultation and telemedicine means that your appointment will occur while our medical staff is in a different location than you and will use audio and/or video and other electronic software, applications and/or equipment to communicate with you. We will confirm your appointment for a teleconsultation/telemedicine and send you a medical consent and authorization form to your email, and request that you complete the form prior to your teleconsultation/telemedicine.

In scheduling of such appointments, or your otherwise reaching out to our medical staff, including in-person, We may collect certain personal information including sensitive personal information. For example, We may write down your name and stateroom number, how you are currently feeling, etc. Such information will be used to identify you and assess your current condition and will become part of your medical record.

5. Contact Tracing: Wearables. We will require you to participate in our contact tracing program as a part of which you will need to wear a wearable device. This device will identify the device number of any other individual with whom you are in close contact while you are onboard the ship, and approximate information about your location onboard. By ‘in close contact’, we mean within six feet of each other for a period of 15 minutes or more. If someone reports Covid-19 symptoms, the information we hold will then be analyzed to help us identify all those other individuals with whom the reporter has been in close contact onboard. We will then be able to invite individuals who we identify as having been in close contact with the reporter to take the appropriate next steps, which may be to monitor their own health, remain in isolation for a period of time, and/or have a teleconsultation or telemedicine appointment or seek out a medical examination or test for Covid-19, as appropriate. We will use the information we collect from the wearables only for the purposes of preventing the spread of communicable disease.

6. Contact Tracing: Identification and Mitigation Information. We may also use personal data within Our system to identify those individuals who have been in close contact when we suspect that an individual may have Covid-19. As above, by ‘in close contact’, we mean within six feet of each other for a period of 15 minutes or more. This system uses information about where you are working onboard, at what time, and which guests you served. We use roster information in our onboard systems along with details of guest transactions such as when guests purchase a drink at a certain bar, or when they dine in a particular restaurant. If someone reports Covid-19 symptoms onboard, whether they are a crew member or a guest, the information we hold will then be analyzed to help us identify all those other individuals with whom they have been in close contact onboard. We will then be able to invite individuals who we identify as having been in close contact with the reporter to take the appropriate next steps, which may be to monitor their own health, remain in isolation for a period of time, and/or have a teleconsultation or telemedicine appointment or seek out a medical examination or test for Covid-19, as appropriate.

Section II: Additional measures in place on ships sailing to and from ports in Singapore and on ships sailing in Singaporean waters

7. Contact Tracing and Monitoring of Compliance: CCTV and Recordings Onboard To further help the identification of those individuals who may have been in close contact with person who has tested positive for Covid-19, we may review and share with the Singaporean Ministry of Health information including photos, videos and CCTV footage and other information recorded while onboard, during embarkation and debarkation. While the primary purpose of the sharing of this data is contact tracing, the Singaporean authorities may also use these records to ensure our continuing compliance with safe management measures as required for our Singaporean CruiseSafe Certification. To the extent that crew members are seen in such records to fail to comply with the requirements of our healthy sail protocols (such as wearing appropriate personal protective equipment or maintaining appropriate social distance), enforcement action may be taken by the Singaporean authorities against us as a company and against any crew member found to be in breach.

8. Contact Tracing: Wearables: Use of Anonymized Data We will also share anonymized data collected from the wearables with the Singaporean Ministry of Health to allow the Ministry to understand patterns of interaction in different areas on board the ship. The Ministry of Health will only use this information in the event of positive cases of COVID-19 onboard.

9. Contact Tracing: TraceTogether Token The Singapore government requires that you carry a TraceTogether token with you at all times when you are outside your cabin. The ID of the TraceTogether token given to you will be logged. This token uses Bluetooth technology to connect to the TraceTogether tokens held by other individuals onboard, or TraceTogether apps which individuals have downloaded onto their mobile phones. Please note that all crew members must carry the TraceTogether token with them at all times, and all guests must either carry the TraceTogether token or their mobile phone with the TraceTogether app downloaded and in operation. In the event of a case of a positive case of COVID-19 onboard, the Singapore authorities will use the information collected by the tokens and the through the app for contact tracing purposes.