This notice explains what personal data we collect when you ask about availability, when you come on board and when you browse this site, why we use it, who we share it with and what rights you can exercise. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
01
Who handles your data
The data controller is Panormus Boat Charter, operating skippered boat charters in the Gulf of Palermo, departing from Marina Villa Igiea, Salita Belmonte, 43, 90142 Palermo (PA).
For anything concerning your personal data you can write to panormusboatcharter@gmail.com or call +39 373 538 0650: you will talk to us directly, with no intermediaries.
We have not appointed a Data Protection Officer (DPO) because the conditions of Article 37 GDPR do not apply: we carry out no large-scale systematic monitoring and process no special categories of data on a large scale.
02
What data we collect
We only collect what we need to reply to you and to keep the site safe. In detail:
- Data you give us through the request form: first and last name, email address and/or phone number, preferred date, number of guests, itinerary of interest and any free-text notes you write.
- Data you give us by contacting us directly: the content of the conversation and the contact details you write from, whether you call, email or message us on WhatsApp.
- Information about the charter: occasions you are celebrating, pets on board, preferred times, dietary or mobility needs you choose to tell us about.
- Data required for boarding: the number and names of the people on board and, where maritime safety rules require it, identity document details.
- Administrative data: billing details and payment references (bank transfer or cash on boarding). We never handle your card details.
- Data collected automatically by the site: IP address, browser and device type, pages visited, date and time of the visit, recorded in our hosting provider's technical logs.
If you tell us about allergies, intolerances or health conditions relevant to a day at sea, you are providing special category data (Article 9 GDPR): we process it only with your explicit consent, use it solely to run your day safely, and delete it once the charter is over.
03
Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your availability request and preparing a quote | Pre-contractual steps taken at your request — Art. 6(1)(b) GDPR |
| Managing the booking, planning the itinerary and performing the charter | Performance of the contract — Art. 6(1)(b) GDPR |
| Ensuring safe navigation and meeting obligations towards the maritime authority and the insurer | Legal obligation — Art. 6(1)(c) GDPR |
| Issuing invoices or receipts and keeping accounting records | Legal obligation — Art. 6(1)(c) GDPR |
| Taking account of allergies, intolerances or health needs you report | Explicit consent — Art. 9(2)(a) GDPR |
| Publishing your review and photos or videos in which you are recognisable | Freely given, revocable consent — Art. 6(1)(a) GDPR |
| Sending you news about new routes or seasonal availability | Consent, or legitimate interest for past guests with opt-out always available — Art. 6(1)(a) and 6(1)(f) GDPR |
| Keeping the site secure and measuring visits in aggregate form | Legitimate interest in a reliable site protected from abuse — Art. 6(1)(f) GDPR |
| Establishing, exercising or defending legal claims | Legitimate interest in protecting our rights — Art. 6(1)(f) GDPR |
04
What is required and what is optional
In the request form we need your name, at least one contact detail (email or phone), the preferred date and the number of guests: without these we cannot check whether the boat is free and get back to you. Every other field is optional.
Consent to publish photos, videos and reviews, and consent to promotional messages, are always optional: refusing or withdrawing them has no effect whatsoever on the service or the price.
05
Who we share data with
Your data is never sold or transferred to third parties for their own commercial purposes. It may be accessed by:
- The skipper and the people who help run the boat and welcome guests on board, authorised to process data and bound to confidentiality (Article 29 GDPR).
- Vercel Inc., our hosting and content delivery provider, which serves the pages and records the server's technical logs.
- Resend (Plus Five Five, Inc.), the transactional email service that delivers form submissions to our inbox.
- The provider of the channel you choose to contact us: WhatsApp Ireland Ltd. (Meta group) if you message us on WhatsApp, your email provider and ours if you write to us, your telephone operator if you call.
- Our accountant and the professionals who handle tax and administrative obligations.
- The boat's insurance company and its loss adjusters, in the event of an incident or claim.
- The competent authorities — Harbour Master's Office, Coast Guard, police and judicial authorities — where the law requires it or navigation safety demands it.
- Any booking platform or agency you booked through, which passes your data to us as a separate, independent controller.
Providers processing data on our behalf are appointed as processors under Article 28 GDPR. An up-to-date list of processors is available on request by writing to panormusboatcharter@gmail.com.
06
Transfers outside the European Union
Some of the providers listed above — in particular Vercel, Resend, Meta and Google — are US companies that may process data outside the European Economic Area.
Where that happens, the transfer relies on appropriate safeguards under Chapter V GDPR: the providers' certification under the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission, together with supplementary technical measures such as encryption in transit.
07
How long we keep it
| Data | Retention period |
|---|---|
| Availability requests that do not lead to a booking | 24 months from the last contact, then deleted |
| Contractual, accounting and tax records | 10 years from the end of the relevant year (Art. 2220 Italian Civil Code and tax law) |
| List of people on board and data required for safety | The period set by maritime rules, then destroyed |
| Allergies, intolerances and health needs | Deleted once the charter is over |
| Reviews, photos and videos published with consent | Until consent is withdrawn; removed within a few days of withdrawal |
| Email and WhatsApp conversations | 24 months, unless needed to defend a legal claim |
| Server technical logs | 12 months maximum |
Once these periods expire the data is deleted or irreversibly anonymised, unless a legal provision or the need to establish, exercise or defend a legal claim requires us to keep it longer.
09
Photos and videos on board
During the charter we may take photographs or short videos of the boat and the coastline. Images in which guests are recognisable are published on the site or on our social channels only if you have given consent, which we ask for in person or in writing before publishing.
You can withdraw that consent at any time by writing to panormusboatcharter@gmail.com: we will remove the image from our channels as quickly as possible, although we cannot control any re-sharing already done by third parties.
If you are the one photographing or filming other people on board, you are the controller of that processing: please respect the privacy of the other guests and of the crew.
10
How we protect your data
The site is served over HTTPS only and the request form stores nothing in a public database: submissions are delivered straight to our mailbox and stay there.
Access to our mailboxes and devices is protected by personal credentials and two-factor authentication. Any paper records are kept where third parties cannot reach them.
11
Your rights
At any time, and free of charge, you can exercise the rights set out in Articles 15-22 GDPR:
- Access: find out whether we process data about you and obtain a copy of it.
- Rectification: correct inaccurate data or complete incomplete data.
- Erasure: ask us to delete your data, where no obligation to keep it applies.
- Restriction: ask that data only be stored and not otherwise used, pending a check.
- Portability: receive the data you gave us in a machine-readable format, or have it sent to another controller.
- Objection: object to processing based on legitimate interest, and in any case to promotional messages.
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, write to panormusboatcharter@gmail.com stating which right you wish to exercise. We reply without undue delay and in any case within one month, extendable by two further months for particularly complex requests.
12
Complaint to the supervisory authority
If you believe the processing of your data breaches data protection law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome) or bring a claim before the courts. We would be grateful if you tried writing to us first: it is almost always sorted out within hours.
13
Children
Children are welcome on board when accompanied by a parent or guardian. The site and the request form, however, are not aimed at them: requests must be sent by an adult, who is also responsible for the data of any children in their group that they share with us.
14
Updates to this notice
We may update this notice to reflect new services, new providers or changes in the law. The version published on this page is always the one in force and the last-updated date is shown at the top. If changes affect processing based on consent, we will tell you and, where necessary, ask for fresh consent.