PER CURIAM

[DO NOT PUBLISH] Non-Argument Calendar D.C. Docket No. 1:19-cv-01551-MHC Appeal from the United States District Court for the Northern District of Georgia Before WILSON, LUCK, and ANDERSON, Circuit Judges. PER CURIAM:

The Diuluses challenge the district court's order dismissing their suit against American Express Travel for failure to state a claim and their suit against The Palms Resort for lack of personal jurisdiction. We affirm.

FACTUAL BACKGROUND AND PROCEDURAL HISTORY

While staying at Palms's resort in the Turks and Caicos Islands south of the Bahamas, Daniel Diulus won some money at an island casino. He returned to Palms with his winnings and, outside the resort's lobby, he was stabbed, shot, and robbed. According to the complaint, the attack left him with "a collapsed lung, extensive deep tissue loss of left thigh, a massive hemorrhage and invasive surgery."

The Diuluses alleged in their complaint that "The Palms Resort invited [them] to stay at its resort via its agent," Amex Travel. They alleged that Palms had breached its duty "by failing to exercise ordinary care to keep their premises safe" and that Amex Travel "had a duty to make safe, or warn guests" that the resort was not safe, but it failed to do so.

Palms filed a motion to dismiss for lack of personal jurisdiction. In the motion, Palms alleged that the Diuluses failed to make a prima facie case that the court had personal jurisdiction because the Diuluses alleged neither that jurisdiction was appropriate under Georgia's long-arm statute nor that Palms had sufficient minimum contacts with Georgia such that jurisdiction could be proper under the Due Process Clause.

Amex Travel also filed a motion to dismiss, arguing that the Diuluses failed to state a claim for relief. Amex Travel argued that "the bare allegation that American Express is a 'travel agent' does not give rise to a theory of liability." Amex Travel argued that the Diuluses' claim was one of premises liability, and because Amex Travel "at no time owned, operated, or managed the property," it could not be held liable on such a theory.

The district court granted both motions to dismiss. As to Palms's motion, the court applied Georgia's long-arm statute and determined that "it cannot fairly be said that [Palms has] performed any act or transaction related to this case that would amount to the 'transaction of business' in Georgia." The court observed that the complaint alleged neither that the Diuluses "visited or used Palms's website in electing to go to the resort or to pay for the services" nor "that Palms exhibited an intent to reach out to [the Diuluses] or persons living in Georgia."

The court also denied what it construed as the Diuluses' "request for leave to take jurisdictional discovery." The court found that the Diuluses had failed to establish a prima facie case of personal jurisdiction over Palms. The court also found that the Diuluses made "no allegation that Palms conducted any business in Georgia related to activity that forms the factual predicate of this case." The court declined to grant the request to take jurisdictional discovery in the absence of any alleged facts that could "support specific personal jurisdiction over Palms."

As to Amex Travel's motion to dismiss, the court granted the motion because it found that the Diuluses failed to assert a cognizable claim against Amex Travel. The Diuluses asserted two claims against Amex Travel, one based on premises liability and the other on negligence. Because the Diuluses made no allegation that Amex Travel "had possession or exercised any control over the premises in question," their complaint failed to support a cause of action based on premises liability against Amex Travel. Nor did it establish any legal duty for Amex Travel to warn the Diuluses that they could be robbed if they vacationed at Palms.

The Diuluses appealed.

STANDARDS OF REVIEW

We review the district court's ruling on a motion to dismiss de novo. See Am. Dental Ass'n v. Cigna Corp., 605 F.3d 1283, 1288 (11th Cir. 2010) (reviewing de novo a motion to dismiss for failure to state a claim); Cable/Home Commc'n Corp. v. Network Prods., Inc., 902 F.2d 829, 855 (11th Cir. 1990) (reviewing de novo a motion to dismiss for lack of personal jurisdiction). And we review the district court's decisions not to take judicial notice and to deny jurisdictional discovery for abuse of discretion. Paez v. Sec'y, Fla. Dep't of Corr., 947 F.3d 649, 651 (11th Cir. 2020) (reviewing for abuse of discretion "a district court's decision to take judicial notice of a fact"); United Techs. Corp. v. Mazer, 556 F.3d 1260, 1280 (11th Cir. 2009) (reviewing for abuse of discretion the denial of jurisdictional discovery).

DISCUSSION

The Diuluses contend that the district court erred in three ways: (1) by dismissing their claim against Amex Travel for failure to state a valid claim, (2) by dismissing their claim against Palms for lack of personal jurisdiction, and (3) by denying their request for jurisdictional discovery.

Amex Travel

The Diuluses argue that the district court erred when it granted Amex Travel's motion to dismiss for failure to state a claim because (a) the district court applied the law for premises liability, rather than for failure to warn; (b) the district court failed to recognize that, as a travel agent, Amex Travel owed a duty of care to the Diuluses; (c) the district court erred by dismissing the case before the Diuluses could conduct discovery; and (d) the district court erred by failing to take judicial notice of online information concerning "recent attacks against American tourists in foreign locales."

As to the Diuluses' argument that the district court applied premises liability law rather than the law for failure to warn, the district court did not err when it applied premises liability law because the Diuluses' complaint alleged in part that Amex Travel and Palms violated Georgia's premises liability law "by failing to use ordinary care to keep the premises safe." But the district court also applied the law for failure to warn when it found "no legal duty that American Express owed to [the Diuluses] to warn them of or to protect them from the hazard or dangerous condition that is alleged to have caused Daniel Diulus's injuries."

As to the Diuluses' argument that it was error to conclude that Amex Travel owed no duty of care as their travel agent, the complaint failed to allege that Amex Travel was their travel agent. The complaint alleged only that Amex Travel was acting as Palms's agent. Thus, even if Georgia law recognized a duty that a travel agent had to warn its client of hazards on an upcoming trip—and the Diuluses acknowledged in their brief that the "law regarding travel agents as fiduciary agents is still developing" and such a duty is very much in dispute, see, e.g., Lavine v. Gen. Mills, Inc., 519 F. Supp. 332, 335 (N.D. Ga. 1981) (concluding, under Georgia law, that travel agent had "no duty . . . to warn [plaintiff] of or to protect her from the hazard that caused her injury")—the Diuluses did not allege that Amex Travel was their agent or that Amex Travel had an agent-client relationship with them.

As to the Diuluses' argument that the district court erred when it granted the motion to dismiss while discovery was ongoing, because their complaint failed to state a claim, they were not entitled to discovery. See Ashcroft v. Iqbal, 556 U.S. 662, 686 (2009) ("Because respondent's complaint is deficient under Rule 8, he is not entitled to discovery, cabined or otherwise."). This court has held that a district court should resolve a motion to dismiss before allowing discovery:

Facial challenges to the legal sufficiency of a claim or defense, such as a motion to dismiss based on failure to state a claim for relief, should . . . be resolved before discovery begins. Such a dispute always presents a purely legal question; there are no issues of fact because the allegations contained in the pleading are presumed to be true. Therefore, neither the parties nor the court have any need for discovery before the court rules on the motion.

Finally, as to the Diuluses' argument that the district court failed to take judicial notice of online news articles concerning attacks against American tourists on the island, we find no abuse of discretion. The Diuluses did not request that the district court take judicial notice of the online news articles, and a court cannot abuse discretion it was not asked to exercise.

Palms

The Diuluses also appeal the district court's order dismissing their complaint against Palms for lack of personal jurisdiction. They argue that we should reverse because the district court wrongly concluded that they did not allege a prima facie case for personal jurisdiction against Palms, the court disregarded evidence attached to and referenced in their response to the dismissal motion, and it abused its discretion in denying their request for jurisdictional discovery.

Where, as here, a defendant moves to dismiss a complaint for lack of personal jurisdiction, the court analyzes the claim under a three-step burden-shifting process. First, the plaintiff "bears the initial burden of alleging in the complaint sufficient facts to make out a prima facie case of jurisdiction." Mazer, 556 F.3d at 1274. Second, if the complaint alleged sufficient facts, and "the defendant challenges jurisdiction by submitting affidavit evidence in support of its position, the burden traditionally shifts back to the plaintiff to produce evidence supporting jurisdiction." Id. (quotation marks omitted). Third, "[w]here the plaintiff's complaint and supporting evidence conflict with the defendant's affidavits, the court must construe all reasonable inferences in favor of the plaintiff." Diamond Crystal Brands, Inc. v. Food Movers Int'l, Inc., 593 F.3d 1249, 1257 (11th Cir. 2010).

"A federal court sitting in diversity undertakes a two-step inquiry in determining whether personal jurisdiction exists: the exercise of jurisdiction must (1) be appropriate under the state long-arm statute and (2) not violate the Due Process Clause of the Fourteenth Amendment to the United States Constitution." Id. at 1257-58. Here, the district court dismissed the Diuleses' complaint because it failed to allege facts sufficient for a court to exercise jurisdiction under Georgia's long-arm statute.

The Georgia long-arm statute provides as follows:

A court of this state may exercise personal jurisdiction over any nonresident or his or her executor or administrator, as to a cause of action arising from any of the acts, omissions, ownership, use, or possession enumerated in this Code section, in the same manner as if he or she were a resident of this state, if in person or through an agent, he or she:

(1) Transacts any business within this state;

. . . .

(3) Commits a tortious injury in this state caused by an act or omission outside this state if the tort-feasor regularly does or solicits business, or engages in any other persistent course of conduct, or derives substantial revenue from goods used or consumed or services rendered in this state . . . .

The Diuluses contend that their complaint alleged that Palms transacted business within Georgia and regularly conducted business in the state. We disagree. The complaint alleged that Palms: (1) was owned, operated, controlled, and managed in the Turks and Caicos; (2) invited guests to the Turks and Caicos; (3) invited the Diuluses to stay on March 3, 2017; (4) knew about the crime problem in the Turks and Caicos but failed to warn the Diuluses and failed to maintain their property and train their staff; and (5) negligently represented that its property was safe.

Missing is any allegation that Palms transacted business in the state arising out of the cause of action or regularly conducted business in Georgia. The resort was in the Turks and Caicos. The negligent acts—failing to maintain the property and hiring and training staff—all took place in that country. And the complaint did not allege that the invitations sent to guests were sent to Georgia residents.

As to the Diuleses, the complaint alleged that, "[o]n or around March 3, 2017, Defendant The Palms Resort invited Plaintiffs to stay at its resort via its agent, Defendant American Express Travel Related Services Company, Inc." The Diuleses did not allege that they were Georgia residents or in Georgia when they received the invitation. The complaint alleged that "[o]n or about March 4, 2017"—the day after the Diuluses received the invitation—"Plaintiffs resided in Georgia." According to the complaint, the Diuluses became Georgia residents only after they received the invitation from Palms through Amex Travel.

The Diuluses argue that, even if their complaint was deficient, the district court should have looked to their affidavit attached to, and documents referenced in, their response to the motion to dismiss. These attachments, they say, show that Palms transacted business in Georgia arising out of this cause of action and regularly conducted business in the state.

But the Diuluses misunderstand the three-step burden-shifting process for evaluating a dismissal motion for lack of personal jurisdiction. Once the defendant files a motion to dismiss, the plaintiff "bears the initial burden of alleging in the complaint sufficient facts to make out a prima facie case of jurisdiction." Mazer, 556 F.3d at 1274. If the plaintiff doesn't meet his burden, the district court doesn't go to the second and third steps of the burden-shifting process, and the motion should be granted. The court will look to the plaintiff's affidavits and other discovery only if (1) the complaint alleged sufficient facts to make out a prima facie case of personal jurisdiction, and (2) "the defendant challenges jurisdiction by submitting affidavit evidence in support of its position." Id.

Here, Palms's motion to dismiss argued only that the complaint did not allege a prima facie case of personal jurisdiction. The resort's motion did not rely on any affidavits or attach additional documents; it only attacked the Diuluses' complaint. The district court properly reviewed the allegations in the complaint, found them to be deficient, and dismissed the complaint. There was no reason for the district court to look elsewhere after the Diuluses failed to allege a prima facie case of personal jurisdiction.

In any event, the documents the Diuluses rely on to establish jurisdiction under Georgia's long-arm statute—a printout of Palms's website listing Atlanta as one of eleven cities with direct flights to Turks and Caicos and a document from Georgia's corporations division identifying Amex Travel as a registered foreign corporation—are insufficient. The documents establish neither that Palms transacted business in the state arising out of this cause of action nor that the hotel regularly conducted business in the state.

Finally, the Diuluses argue that, even if they did not allege a prima facie case and even if their attachments are deficient, they should have been allowed jurisdictional discovery. The district court erred, they say, by ruling without giving them the chance to prove personal jurisdiction. But, as we've explained, a district court does not abuse its discretion by denying jurisdictional discovery if "the complaint was insufficient as a matter of law to establish a prima facie case that the district court had jurisdiction." Butler v. Sukhoi Co., 579 F.3d 1307, 1314 (11th Cir. 2009). Because the Diuluses did not meet their initial burden to allege a prima facie case of personal jurisdiction, we cannot say it was an abuse of the district court's discretion to deny them jurisdictional discovery.

AFFIRMED.