Privacy Policy

1. Who we are

The website deadsea.com (“the Site”, “we”, “us”, “our”) is operated by SEACRET Spa Ltd., an Israeli company. SEACRET Spa Ltd. is the data controller responsible for personal data processed through the Site. Our registered address is in Israel. You can contact us at any time at [email protected].

2. Information we collect

2.1 Information you provide directly

When you contact us, subscribe to our newsletter, or otherwise interact with the Site, we collect only what is necessary for that interaction:

• Your name (if you choose to provide it).
• Your email address.
• The content of your message or inquiry.
• Any other information you voluntarily include in a form submission.

2.2 Information we collect automatically

When you visit the Site, our servers and analytics tools automatically collect:

• Your IP address (truncated to country/region level where the provider supports it).
• Browser type and version, operating system, device type, screen resolution.
• Pages visited, time spent on pages, referring URL, click paths within the Site.
• Approximate geographic location at country or region level (derived from IP).
• Date and time of access.

We do not collect precise GPS-level location. We do not collect special-category data (health, religion, ethnicity, sexual orientation, political opinion, biometric, genetic) through the Site.

2.3 We do not sell products directly

DeadSea.com is an editorial publication. We do not sell products from the Site. We do not collect, store, or process payment information (card numbers, bank details, billing addresses) at any point. Where you choose to make a purchase from a hotel partner, tour operator, or product retailer linked from our site, that transaction is conducted entirely on the third party’s platform under their own terms and privacy policy. We receive only an anonymised referral attribution from the affiliate network that allows the partner to credit us with the click. See Sections 4.3 and 5 for details on affiliate networks.

3. How we use your information, and our legal bases

We use the categories of data above only for the purposes listed below. For visitors in the EU/EEA, UK, or other GDPR-equivalent jurisdictions, our legal basis under Article 6(1) GDPR is shown in brackets.

• To respond to inquiries you submit through the contact form. [Legal basis: contract performance (Art. 6(1)(b)) where you are requesting a service from us, or legitimate interest (Art. 6(1)(f)) in maintaining a public contact channel.]
• To deliver the newsletter you have subscribed to. [Legal basis: consent (Art. 6(1)(a)). You can withdraw consent at any time using the unsubscribe link in every email or by emailing [email protected].]
• To analyze how visitors use the Site, in aggregate, so we can improve content and navigation. [Legal basis: consent (Art. 6(1)(a)) where required by ePrivacy law for non-essential cookies, otherwise legitimate interest (Art. 6(1)(f)) in improving the Site, balanced against your privacy rights.]
• To maintain the security of the Site and prevent abuse, fraud, or misuse. [Legal basis: legitimate interest (Art. 6(1)(f)).]
• To comply with legal obligations that apply to us. [Legal basis: legal obligation (Art. 6(1)(c)).]

What we do not do: We do not sell, rent, or trade your personal information. We do not use your data for automated decision-making that produces legal or similarly significant effects. We do not profile you for advertising on third-party platforms.

4. Cookies and tracking technologies

The Site uses cookies and similar technologies. You can accept, reject, or adjust cookie categories through our cookie banner at any time. Essential cookies are required for the Site to function and cannot be disabled.

4.1 Essential cookies

Required for basic Site function (session, security, cookie-consent state). These cookies are set without consent because the Site cannot function without them. Retention: typically until the end of your browser session, or up to 12 months.

4.2 Analytics cookies

We use Google Analytics 4 to understand how visitors use the Site. Data is collected in aggregated form and is configured to truncate IP addresses where the provider supports it. Analytics cookies are set only after you grant consent through the cookie banner. You can withdraw consent at any time. Retention of analytics data is 14 months.

4.3 Affiliate cookies

Some pages on the Site contain affiliate links (for example, hotel booking partners and tour operators). When you click an affiliate link, the partner may place cookies on your device to attribute the referral. Those cookies are governed by the partner’s own privacy policy. Where we have an affiliate relationship that monetizes a page, we disclose this in plain language on that page.

4.4 No advertising cookies

We do not run third-party advertising on the Site and we do not set retargeting cookies. If this changes in future, this policy will be updated with at least 30 days’ notice.

5. Third-party services that may process your data

The following categories of third-party services may receive limited categories of your personal data in order to perform a specific function for us. Each service is bound by its own privacy policy and, where applicable, by a Data Processing Agreement with SEACRET Spa Ltd.

A current and complete list of sub-processors is available on request from [email protected].

6. International data transfers

Personal data collected through the Site may be transferred to, stored, or processed in countries other than your country of residence, including Israel (wher we are established), the United States (where some of our service providers operate), and the European Union.

For transfers from the EEA, UK, or Switzerland to a country that is not subject to an adequacy decision (under Article 45 GDPR), we rely on the European Commission’s Standard Contractual Clauses (SCCs) or equivalent safeguards. Israel currently holds an EU adequacy decision (2011), which is in force at the time this policy was last updated. We do not rely on “continued use of the Site” as a transfer mechanism. that is not a valid basis under GDPR.

You can request a copy of the safeguards we apply for international transfers by emailing [email protected].

7. How long we retain your data

8. Your Rights

Depending on where you live, you may have the following rights regarding the personal data we hold about you:

• Access: you can request a copy of the personal data we hold about you.
• Rectification : you can ask us to correct inaccurate or incomplete data.
• Erasure (right to be forgotten) : you can ask us to delete your data, subject to limited exceptions.
• Restriction : you can ask us to stop processing your data in specific cases.
• Portability : for data you provided to us, you can request a structured, machine-readable copy.
• Objection : you can object to processing based on legitimate interest.
• Withdraw consent : where processing is based on consent, you can withdraw consent at any time without affecting prior lawful processing.
• Complaint to a supervisory authority : see Section 9.

To exercise any of these rights, email [email protected]. We will respond within one month, as required by GDPR Article 12(3). We may need to verify your identity before disclosing or deleting data, to protect you from impersonation requests.

9. Right to complain to a supervisory authority

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection authority. You can complain to the supervisory authority in your country of residence, your place of work, or the place where the alleged breach occurred. For Israeli residents, the competent authority is the Privacy Protection Authority within the Israeli Ministry of Justice. For EEA residents, you can find your national supervisory authority at https://edpb.europa.eu/about-edpb/board/members_en . We would, however, appreciate the opportunity to address your concern before you contact a regulator, so please consider emailing [email protected] first.

10. Notice for California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know what categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete personal information we have collected from you, subject to limited exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of your personal information. We do not sell your personal information for money. We monetise the Site through affiliate referral commissions: when you click an affiliate link, the affiliate network may receive limited referral data (see Section 5). Whether this constitutes “sharing” under the CPRA is fact-dependent and turns on each network’s data practices. To err on the side of your privacy, we provide a “Do Not Sell or Share My Personal Information” mechanism: email [email protected] with the subject line “Do Not Sell” and we will exclude your visits from affiliate tracking where technically possible.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information through the Site.
• Right not to be discriminated against for exercising any of these rights.

To exercise any of these rights, email [email protected] and write “California request” in the subject line.

11. Notice for Israeli residents

Personal data collected through the Site is processed in accordance with the Israeli Privacy Protection Law, 5741-1981, and applicable regulations. You have the right to inspect data we hold about you, request correction of inaccurate data, and demand that we delete data that is no longer needed for the purposes for which it was collected. Contact [email protected] to exercise these rights.

12. Children's privacy

DeadSea.com is not directed at children under 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will delete it promptly

13. Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (TLS) for all Site traffic, access controls on internal systems, and regular review of vendor security. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours, and notify affected individuals where the law requires.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted at the top of this page and, where the change affects the lawful basis for processing or introduces new categories of data or new third parties, we will notify newsletter subscribers by email and post a banner on the Site for at least 30 days. The date at the top of this page indicates when the policy was last updated.

Continued use of the Site after non-material changes constitutes notice. It does not constitute consent to processing where the law requires affirmative consent.

15. How to contact us