Legal
Privacy policy
Last updated: 29 September 2026
Draft
This text is a draft. Items in [square brackets] are still to be completed and checked by a lawyer.
01Who is responsible for your data
The "controller" is the company that decides why and how your data is used. Here, it is:
- Company
- [Company legal name]
- Tax ID
- [CIF]
- Address
- [Registered address]
- hello@alcudiaboatrentals.com
- Data protection contact
- [Data protection contact, if any]
02What data we collect
- Booking data: name, email, phone number, date, boat and number of people. You give it in the booking form of our booking provider.
- Messages: what you write to us on WhatsApp or by email, and your phone number or email address.
- Payment data: handled by the booking provider and the payment company. We do not see or keep your full card number.
- Boat licence details: the licence or skipper information we need before you sail.
- Website statistics: only if you accept analytics cookies. Without your consent, none are collected.
03Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| To handle your booking and rental | Performance of the contract (GDPR article 6.1.b) |
| To answer your questions on WhatsApp or by email | Your request, and our legitimate interest in replying (article 6.1.f) |
| To meet tax, accounting and boating safety rules | Legal obligation (article 6.1.c) |
| To measure and improve the website | Your consent (article 6.1.a), only for analytics cookies |
| To defend our rights in a claim | Legitimate interest (article 6.1.f) |
We do not use your data for advertising, and we do not sell it.
04Who receives your data
We share data only with the companies that help us run the service. They are called "processors".
| Company | Role | Details |
|---|---|---|
| FareHarbor | Booking and payment provider | [FareHarbor legal entity and country] |
| Cloudflare | Website hosting and security | [Cloudflare legal entity and data location] |
| WhatsApp (Meta) | Messaging | [WhatsApp legal entity] |
| [Email provider] | [Details] | |
| Google Analytics 4 (Google Ireland Limited) | Website statistics, only if you accept | [Check the Google data processing terms are accepted in the GA4 account] |
We may also share data with public authorities when the law requires it, for example the maritime authorities or the tax office.
05Transfers outside the European Economic Area
Some of these companies may process data outside the European Economic Area, for example in the United States.
When this happens, the transfer is protected by [Safeguards used for each provider, for example standard contractual clauses].
06How long we keep it
- Booking and invoice data: [Retention period for booking data], then kept only as long as tax and accounting law requires.
- Messages and enquiries: [Retention period for messages].
- Analytics data: [Retention period for analytics data].
When the period ends, we delete the data or make it anonymous.
07Your rights and how to use them
You have the right to:
- ask for a copy of your data (access);
- correct data that is wrong (rectification);
- ask us to delete it (erasure);
- ask us to limit how we use it (restriction);
- receive your data in a usable format (portability);
- object to some uses (objection);
- withdraw your consent at any time, without affecting what was done before.
To use a right, write to us at the email address in section 1. We may ask you to prove who you are. We answer within one month.
08The right to complain
If you think we handle your data badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD): www.aepd.es.