Privacy Policy

Last updated: 1 June 2026

This privacy policy explains how Boat Rental Marbella (operating the website boatrentalinmarbella.com, hereafter "we", "us", "the Site") collects, uses and protects your personal data when you visit the Site, contact us via WhatsApp, email or the booking form, or charter a boat through us. We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish data-protection law (LOPDGDD 3/2018).

1. Who is the data controller?

The data controller for personal data collected through this Site is:

Boat Rental Marbella
Marbella, Andalucía, Spain (postal code 29602)
WhatsApp / phone: +358 400 406 194

2. What data do we collect?

We only collect data that you give us, or that is generated automatically when you browse:

Booking and enquiry data — name, phone number, email address, date(s) of intended charter, group size, departure port, language preference, and any free-text message you send via the booking form, WhatsApp, email, or Instagram/Facebook DM.
Payment data — for confirmed bookings, payments are processed by the boat operator's own payment provider (typically Stripe, Revolut Business, or bank transfer). We do not store full card numbers on this Site.
Technical data — IP address, browser type, device type, referring page, pages viewed, and timestamps. Collected via standard server logs and Google Analytics 4 (measurement ID G-SPMRYJVTHD).
Cookies — see section 7 below.

3. Why do we use it (legal basis)?

To answer your enquiry and arrange your charter — legal basis: performance of a contract or pre-contractual steps at your request (GDPR art. 6(1)(b)).
To share your booking with the relevant boat operator (e.g. the skipper, charter company, or marina) so they can run the trip — legal basis: contract (art. 6(1)(b)).
To comply with Spanish tax and maritime law — e.g. issuing invoices, recording passenger lists where the captain requires them — legal basis: legal obligation (art. 6(1)(c)).
To improve the Site and measure traffic — legal basis: legitimate interest in operating an effective website (art. 6(1)(f)), with anonymised analytics where possible.
To send you marketing emails or WhatsApp messages — only with your explicit consent, which you can withdraw at any time (art. 6(1)(a)). We do not currently run a marketing newsletter.

4. Who do we share it with?

We only share your data with parties that need it to deliver your charter or run the Site:

The boat operator / skipper assigned to your charter (name, phone, date, group size).
Payment processors (Stripe, Revolut, etc.) when you pay online.
Communication providers — WhatsApp (Meta Platforms Ireland Ltd.), Gmail / Google Workspace, Instagram and Facebook (Meta) for the messages you send through those channels.
Hosting and analytics — GitHub Pages (Microsoft Corp., US), Cloudflare, Google Analytics 4 (Google Ireland Ltd.).
Tax authorities, insurers and law enforcement if we are legally required to do so.

Some of these providers are based outside the EU/EEA (United States). Transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

5. How long do we keep it?

Enquiries that don't lead to a booking — deleted within 12 months.
Booking records and invoices — kept for the period required by Spanish tax law (currently 6 years).
Server logs and analytics — typically 14 months (Google Analytics default).
Marketing consent records — until you withdraw consent, plus a reasonable archival period.

6. Your rights

Under GDPR you can, at any time, ask us to:

Confirm what data we hold about you and give you a copy (right of access).
Correct any inaccurate or out-of-date data (right of rectification).
Delete your data when it is no longer needed (right of erasure / "to be forgotten").
Restrict or object to certain processing.
Receive your data in a portable format.
Withdraw any consent you have given (without affecting prior lawful processing).

To exercise any of these rights, message us on WhatsApp at +358 400 406 194 with a copy of an identifying document. We will reply within 30 days. If you are not satisfied with our response, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos — www.aepd.es).

7. Cookies

The Site uses a small number of cookies and similar technologies:

Strictly necessary — to display the Site, remember your language choice (EN/ES) and your booking-form draft. No consent needed.
Analytics — Google Analytics 4 (cookies _ga, _ga_*) to measure visits anonymously. You can opt out at any time by installing the Google Analytics Opt-out add-on or by clearing cookies in your browser.
Third-party embeds — videos hosted on this domain do not set cookies. Embedded social-media links (Instagram, Facebook, WhatsApp) only set cookies if you click them.

8. Children

The Site is not directed at children under 14. We do not knowingly collect personal data from anyone under 14. Children may, of course, travel on a charter — in that case, their parent or legal guardian provides the booking data.

9. Security

The Site is served over HTTPS. Data sent through WhatsApp is end-to-end encrypted by Meta. Internal records are stored in access-controlled cloud services (Google Workspace) protected by two-factor authentication. No system is 100% secure, but we apply commercially reasonable measures.

10. Changes to this policy

We may update this policy from time to time — the "Last updated" date at the top will always show the current version. Material changes will be highlighted on the homepage for at least 30 days.

11. Contact

Any privacy question or request: WhatsApp +358 400 406 194.