Privacy Policy

    Last updated: 6 October 2026

    This translation is provided for information only. In case of discrepancy, the Spanish version prevails.

    At Cienfuegos Náutica we respect your privacy. This policy clearly explains how we process your personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

    1. Data controller

    For any data protection question, write to bookings@cienfuegosnautica.com.

    2. Data we process

    We only process necessary data you provide via forms, contracts, checklists, email or phone:

    • Identification: name, surname, ID/passport and nationality (required for the nautical charter contract).
    • Contact: email, phone and postal address.
    • Nautical licence: type and number, when chartering without skipper.
    • Booking and payment: service, dates, number of guests, amounts and payment status (we do not store card data).
    • Digitised handwritten signature, engine hours and remarks in contract and checklist.
    • Browsing: IP, device and site usage, only with your consent for analytics.

    We do not process special categories of data. Services are for persons over 18; minors may only take part as companions under an adult's responsibility.

    3. Purposes, legal bases and retention

    PurposeLegal basisRetention
    Manage booking requests, deposit payments and provision of the contracted servicePerformance of a contract and pre-contractual steps (art. 6.1.b GDPR)Duration of the relationship and then 6 years (Commercial Code) and civil limitation periods
    Execute the charter contract and inventory checklist with electronic signature and email a copy to the customerPerformance of a contract (6.1.b) and legal obligations in nautical/insurance matters (6.1.c)5 years after the end of the charter (limitation of actions)
    Answer enquiries by email, phone or WhatsAppConsent (6.1.a) / pre-contractual stepsUntil resolved, max. 1 year
    Manage user registration and account (sailors' club)Performance of a contract (6.1.b)While the account is active; deleted on request
    Comply with tax, accounting and traveller-registration obligations where applicableLegal obligation (6.1.c)Legal periods (4–6 years)
    Analyse site usage with Google AnalyticsConsent via the cookie banner (6.1.a)Max. 14 months; can be withdrawn anytime
    Site security and fraud prevention (technical logs)Legitimate interest (6.1.f)Max. 12 months

    After these periods, data is securely deleted or anonymised. Mandatory fields are required to contract; without them we cannot complete the booking.

    4. Recipients and processors

    We do not sell or share your data. It is only disclosed to authorities (Maritime Authority, Tax Agency, police) when required by law. We use providers acting as processors under art. 28 GDPR agreements:

    • Lovable / Supabase — web hosting, database, authentication and encrypted storage of signed documents (EU servers).
    • Lovable transactional email service — sending confirmations, PINs and copies of contracts and checklists.
    • PayPal (Europe) S.à r.l. et Cie, S.C.A. — deposit payment processing. PayPal also acts as an independent controller.
    • Google Ireland Ltd. — web analytics (Google Analytics 4), only with your consent.
    • Telegram — internal staff notifications of new bookings (minimal data).
    • Tax advisor and insurer — where necessary for accounting or claims handling.

    5. International transfers

    Some providers (Google, PayPal, Telegram) may process data outside the EEA. Such transfers rely on the EU‑US Data Privacy Framework adequacy decision for certified companies or on Standard Contractual Clauses approved by the European Commission (art. 46 GDPR).

    6. Your rights and how to exercise them

    Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD) you have the right to:

    • Access: know which data we process about you.
    • Rectification: correct inaccurate or incomplete data.
    • Erasure: request deletion when no longer necessary.
    • Objection: object to processing based on legitimate interest.
    • Restriction: ask us to store the data without processing it.
    • Portability: receive your data in a structured format.
    • Withdraw consent: at any time, without retroactive effect.
    • No automated decisions: we do not profile or take automated decisions.

    How: email bookings@cienfuegosnautica.com or write to our postal address, subject “Data protection”, stating the right you exercise and proving your identity (e.g. copy of ID or passport). We will reply within one month, extendable by two months in complex cases. It is free of charge.

    If you believe your request was not properly handled, you may complain to the Spanish Data Protection Agency (www.aepd.es) or the authority of your EU country of residence.

    7. Security

    We apply appropriate technical and organisational measures (art. 32 GDPR): HTTPS encryption, access restricted to authorised staff, private storage of signed documents with temporary download links, backups and delivery logs. In case of a breach we will notify the AEPD within 72 hours and, where high risk exists, the affected persons.

    8. Cookies

    We use our own technical cookies and, only if you accept, Google Analytics cookies. Details in the Cookie Policy. You can change your choice at any time:

    9. Changes to this policy

    We may update this policy due to legal or service changes. The current version will always be published with its date and, for relevant changes, we will notify you by email.