Draft for review. This text is a working draft prepared for the business. The details marked as pending must be completed and the text reviewed by a lawyer or adviser before publication.
Summary
| Controller | Cala Ocre ([PENDING: company name and tax ID]). Contact: hola@calaocre.com |
|---|---|
| Purposes | Managing your booking, answering your enquiries and, only if you ask, sending you news. |
| Legal basis | Performance of the booking contract, your consent and compliance with legal obligations. |
| Recipients | We do not share your data with third parties. It is processed by service providers (web hosting, booking engine, payments and email) under contract. |
| Rights | Access, rectification, erasure, objection, restriction and portability. You can complain to the Spanish Data Protection Agency (AEPD). |
What data we process
- When you book: full name, email, phone, skipper’s language, number of people, date, trip and extras chosen, and any comments you add.
- When you use the contact form: name, email, type of trip and your message.
- Payment: handled by the payment gateway. We never see or store your card details.
We only ask for what we need. We do not ask for ID numbers or dates of birth when you book online. If nautical regulations require a passenger list on the day, the skipper will collect it at the port.
Purposes and legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing the booking, payment and trip | Performance of a contract (art. 6.1.b GDPR) | For the duration of the relationship and then the limitation period |
| Invoicing and accounting | Legal obligation (art. 6.1.c GDPR) | 6 years (Commercial Code) and tax periods |
| Answering enquiries and quotes | Pre-contractual steps and consent | Until the enquiry is resolved, up to 12 months |
| Sending news and offers | Consent (optional box, not pre-ticked) | Until you unsubscribe |
We keep the date and text you accept when booking or subscribing as proof of consent.
Who else has access
Providers acting as data processors under a contract compliant with article 28 GDPR:
- Helioscode, provider of the booking engine and website maintenance.
- Cloudflare, website hosting and delivery.
- [PENDING: payment gateway, e.g. Stripe], deposits and payments.
- [PENDING: email provider], sending confirmations.
Some of these providers may process data outside the European Economic Area. In that case they do so with appropriate safeguards: an adequacy decision (EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
Your rights
You can ask to access your data, rectify or erase it, object to or restrict its use, or receive it in a portable format. Write to hola@calaocre.com stating which right you wish to exercise. We will reply within one month.
You can withdraw your consent to receive news at any time using the unsubscribe link in every email.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority of your country of residence.
Children
Only adults can make bookings. Children under 14 may not give us their data without the consent of their parents or guardians.
Security
The website always uses an encrypted connection (HTTPS). We apply technical and organisational measures to prevent loss, misuse or unauthorised access to your data.