1. Who is responsible for your data
The data controller and website operator is Surf Life, UAB (trading as Yachting Planet), legal entity code 304120427, VAT number LT100009764215, registered office at Pievų Tako g. 17-2A, Klaipėda, Lithuania (referred to as “we”, “us”, or “Yachting Planet”).
For privacy questions or to exercise your data protection rights, contact us at info@yachtingplanet.eu, call +370 614 30591, or write to our registered office.
2. When this policy applies
This policy applies when you visit yachtingplanet.eu, submit a yacht or travel inquiry, contact us by email, telephone or WhatsApp, receive a tailored proposal, or otherwise communicate with us about our services.
Where a specific proposal involves a separate vessel operator, charter company, skipper or other supplier acting as an independent controller, its identity and privacy information will be provided in the proposal or booking documents where required.
3. The data we receive
- Inquiry data: your name, email address, telephone or WhatsApp number, preferred destination and dates, group size, selected journey or vessel type, and the contents of your message.
- Communications data: emails, messages and call details, proposal history, and preferences you choose to share with us.
- Booking and contract data if an inquiry becomes a booking: contracting-party details, services, price, payment and invoice information, and details needed to administer the trip.
- Technical data: IP address, browser and device type, request time, requested URL, system logs and security-event information that may be recorded by our hosting infrastructure.
- Analytics data when you consent: a random client identifier, approximate location, pages visited, interactions, traffic source, browser and device information. Inquiry names, email addresses, telephone numbers and free-text messages are not sent to Google Analytics.
- Information received from your representative, a fellow traveller or a service partner where necessary for a particular inquiry or contract. Only provide another person's data if you are entitled to do so.
We do not ask you to include health information, identity-document copies or other special-category data in a general inquiry message. If accessibility, dietary, safety or legal travel requirements make such information necessary, we will request it separately and explain the relevant legal basis.
4. Why we process data and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Respond to an inquiry, check availability and prepare a tailored proposal | Contact details, travel preferences and communications | Steps taken at your request before entering a contract (GDPR Art. 6(1)(b)) |
| Enter into and perform a booking or services contract | Identity, contact, booking, payment and travel-administration data | Performance of a contract (GDPR Art. 6(1)(b)) |
| Meet accounting, tax and other mandatory legal duties | Contract, invoice, payment and mandatory record data | Compliance with a legal obligation (GDPR Art. 6(1)(c)) |
| Secure the website, administration system and communications | IP address, technical logs, login and security events | Legitimate interests in protecting our systems, information and users (GDPR Art. 6(1)(f)) |
| Understand website visits, content use and inquiry journeys so we can improve the website and evaluate promotion performance | Analytics identifier, visited pages, interactions, traffic source, approximate location, browser and device | Your consent (GDPR Art. 6(1)(a)) |
| Communicate through WhatsApp when you choose that channel | Telephone number, account and message data | Your consent where requested, or pre-contractual / contractual steps (GDPR Art. 6(1)(a) or (b)) |
| Handle complaints and establish, exercise or defend legal claims | Inquiry, contract, payment and communications data | Legitimate interests in protecting our and others' legal rights (GDPR Art. 6(1)(f)) |
We do not use a website inquiry to send newsletters or other direct marketing without a separate, freely given consent. Reading this policy or accepting service terms is not, by itself, consent to marketing.
5. How long we keep data
- Unconverted inquiries and related correspondence are normally retained for up to 24 months after the last meaningful contact, unless you request earlier deletion or the data is needed to handle a dispute.
- Contract, invoice and payment data is kept while the contract is performed and for the period required by accounting, tax and other applicable law; accounting records are generally retained for 10 years.
- Security and server logs are normally retained for up to 30 days. Records connected with a particular incident may be retained longer while the incident is investigated or legal claims are protected.
- Data processed on the basis of consent is kept until consent is withdrawn or the stated purpose ends, whichever occurs first.
- Google Analytics cookies last for up to 12 months after their latest update. Analytics event data is retained for the period configured in Google Analytics and no longer than needed for website analysis.
At the end of the relevant period, we delete or anonymise data unless the law requires a longer retention period.
6. Who may receive the data
- IT and cloud providers that support the website, database and media storage, including Vercel and Supabase infrastructure.
- Google Ireland Limited when you consent to Google Analytics being used to measure website visits and interactions.
- Email, communications, accounting, legal and other professional providers, to the extent needed for their work.
- Vessel operators, charter companies, skippers and other travel-service partners where necessary to check price or availability, prepare a proposal, or deliver the contracted service.
- Payment institutions and banks if you make a payment under a separate booking.
- Public authorities, courts or law enforcement where disclosure is required by law or needed to protect legitimate legal claims.
We disclose only the data required for each recipient's function. Where a provider acts on our behalf, it is contractually required to protect the data and use it only on our instructions. We do not sell personal data.
7. Transfers outside the EEA
Some technology or communications providers may access or process data outside the European Economic Area. Where this occurs, we rely on a European Commission adequacy decision, the EU Standard Contractual Clauses, or another safeguard under Chapter V GDPR and, where necessary, apply supplementary technical and organisational measures.
If you independently choose to contact us through WhatsApp or open a social-media link, that provider processes your data under its own terms and may transfer it outside the EEA. You may contact us for information about the safeguards applicable to transfers made by us.
8. How we protect data
We use access controls, encrypted transport, administrator authentication, backups, restricted provider access, and other technical and organisational measures proportionate to the risk. No method of internet transmission or storage can, however, guarantee absolute security.
9. Your rights
- Be informed and obtain access to personal data we process about you.
- Have inaccurate data corrected and incomplete data completed.
- Request erasure or restriction where the GDPR conditions apply.
- Object to processing based on legitimate interests for reasons related to your particular situation.
- Receive data you provided in a structured, commonly used, machine-readable format where the right to portability applies.
- Withdraw consent at any time without affecting processing lawfully carried out before withdrawal.
- Lodge a complaint with the Lithuanian State Data Protection Inspectorate or the supervisory authority in your country of residence or work.
Send requests to info@yachtingplanet.eu. We may reasonably verify your identity so that data is not disclosed to another person. We respond without undue delay and normally within one month.
10. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
11. Children's data
Website inquiry forms are not intended for children to use independently. Information about a minor traveller should be supplied only by a parent, guardian or another lawfully acting adult, and only to the extent necessary to arrange the journey.
12. Questions and complaints
For privacy-related questions, you may contact us at info@yachtingplanet.eu. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate or with the supervisory authority of another EU / EEA country where you live or work.
We may update this policy when our services, processing activities or legal requirements change. The latest version and effective date will always be published on this page.
