Privacy Policy
Last updated: April 2026
1. Data Controller
The Data Controller responsible for the processing of your personal data, within the meaning of Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), is: LuxeSailingCharter Registered office: Amalfi (SA), Italy Email: info@luxesailingcharter.it Phone: +39 388 6970193 Website: www.luxesailingcharter.it LuxeSailingCharter operates as a digital intermediary platform connecting clients with independent boat owners and licensed skippers for yacht charter experiences along the Amalfi Coast and surrounding areas. For any question or request regarding the processing of your personal data, you may contact us at the email address above at any time.
2. What Data We Collect
We collect and process the following categories of personal data: Identification and Contact Data: first name, last name, email address, telephone number, billing address, and tax identification number (codice fiscale) where required for invoicing purposes. Booking and Service Data: selected vessel, charter date and time, departure port, number of passengers, special requests (e.g., dietary requirements, accessibility needs, celebrations), preferred itinerary, and any communication exchanged during the booking process. Payment and Transaction Data: payment method selected (credit/debit card, PayPal, Satispay, or cash), transaction identifiers, billing details, and payment status. We do not store full credit card numbers; card payment processing is handled entirely by Stripe in a PCI-DSS compliant environment. Navigation and Technical Data: IP address, browser type and version, operating system, device type (desktop, tablet, mobile), screen resolution, referring URL, pages visited on our website, time spent on each page, click patterns, and session identifiers. Location Data: approximate geographic location derived from your IP address. We do not collect precise GPS location data unless you explicitly grant permission through your device settings. Communication Data: records of correspondence with our customer service team, including emails, chat messages, and phone call logs (where applicable), as well as any reviews or feedback you provide. Cookies and Similar Technologies: information collected through cookies, web beacons, pixels, and similar tracking technologies. For full details, please refer to our Cookie Policy.
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes, each supported by a specific legal basis under Article 6(1) GDPR: Performance of a Contract (Art. 6(1)(b) GDPR): - Processing and managing your charter booking from enquiry through to completion. - Communicating with you regarding booking confirmations, changes, and operational updates. - Facilitating payment processing through our payment service providers. - Sharing necessary booking details with the relevant boat owner and/or skipper to fulfil the charter service. - Providing customer support before, during, and after your charter experience. Legitimate Interest (Art. 6(1)(f) GDPR): - Improving our platform, services, and user experience through aggregated analytics. - Preventing, detecting, and investigating fraud, unauthorized access, or other unlawful activities. - Enforcing our Terms and Conditions and protecting our legal rights. - Sending service-related communications that are not strictly promotional in nature. Consent (Art. 6(1)(a) GDPR): - Sending marketing communications, newsletters, and promotional offers (only where you have given explicit opt-in consent). - Placing non-essential cookies and tracking technologies on your device. - Processing any special categories of data you voluntarily provide (e.g., dietary restrictions that may reveal health or religious information). Legal Obligation (Art. 6(1)(c) GDPR): - Maintaining accounting and tax records as required by Italian fiscal law (D.P.R. 600/1973 and D.P.R. 633/1972). - Complying with requests from competent judicial or administrative authorities. - Fulfilling anti-money laundering obligations where applicable.
4. How We Use Your Data
Your personal data is used in the following ways: Booking Processing: when you make a charter booking, we use your identification, contact, and payment data to confirm your reservation, process the payment, issue booking confirmations and invoices, and coordinate with the boat owner or skipper assigned to your charter. Communications: we contact you with booking confirmations, reminders (e.g., departure time and meeting point), weather-related updates that may affect your charter, and post-charter follow-ups including satisfaction surveys. Service Improvement: we analyse aggregated and anonymised navigation data to understand how users interact with our platform, identify technical issues, optimise the booking flow, and develop new features and services. Fraud Prevention and Security: we monitor transactions and user behaviour patterns to detect and prevent fraudulent bookings, payment fraud, unauthorized account access, and other malicious activities. Legal and Regulatory Compliance: we maintain records and process data as required to comply with Italian and EU legal obligations, including tax reporting, consumer protection laws, and maritime regulations. Personalisation: with your consent, we may personalise your browsing experience by showing you relevant charter options based on your previous searches and bookings.
5. Data Sharing with Third Parties
We share your personal data with the following categories of recipients, solely to the extent necessary for the purposes described in this policy: Boat Owners and Skippers: we share your name, contact number, number of passengers, special requests, and charter details with the independent boat owner and/or skipper responsible for your charter. They act as independent data controllers for the data they receive. Payment Service Providers: - Stripe, Inc. (card payments) — Privacy Policy: https://stripe.com/privacy - PayPal (Europe) S.à r.l. et Cie, S.C.A. — Privacy Policy: https://www.paypal.com/privacy - Satispay S.p.A. — Privacy Policy: https://www.satispay.com/en/privacy/ These providers process your payment data as independent data controllers under their own privacy policies. We do not have access to your full payment card details. Hosting and Infrastructure: our website and data are hosted on servers provided by our hosting partner within the European Economic Area (EEA). Analytics: we use Google Analytics to collect anonymised usage statistics about how visitors interact with our website. Google acts as a data processor on our behalf. IP anonymisation is enabled. Professional Advisors: we may share data with our accountants, legal counsel, and auditors where necessary for professional advice, compliance, or dispute resolution. Law Enforcement and Authorities: we may disclose your data to competent authorities when required to do so by law, regulation, or valid legal process. We do not sell your personal data to third parties. We do not share your data with third parties for their own direct marketing purposes without your explicit consent.
6. International Data Transfers
Your personal data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred to countries outside the EEA (for example, to Stripe, Inc. or Google LLC in the United States), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including: - European Commission adequacy decisions pursuant to Article 45 GDPR, where the destination country has been recognised as providing an adequate level of data protection (e.g., the EU-U.S. Data Privacy Framework). - Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR, supplemented by additional technical and organisational measures where necessary following a transfer impact assessment. You may request a copy of the relevant safeguards by contacting us at info@luxesailingcharter.it.
7. Data Retention Periods
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law: Booking and Transaction Records: retained for 10 (ten) years from the date of the transaction, in compliance with Italian tax and accounting legislation (Art. 2220 of the Italian Civil Code; D.P.R. 600/1973; D.P.R. 633/1972). Account Data: retained for as long as your account remains active. If you request account deletion, your data will be erased within 30 days, except where retention is required by law. Payment Data: retained in accordance with the retention policies of our payment service providers (Stripe, PayPal, Satispay) and applicable anti-money laundering regulations. Analytics Data: Google Analytics data is retained for 26 months from your last interaction with our website, after which it is automatically deleted. Marketing Consent Records: retained for as long as the consent is valid, plus an additional period to demonstrate compliance with GDPR. Communication Records: customer service correspondence is retained for up to 3 (three) years after the last interaction, unless a longer period is required for ongoing dispute resolution or legal proceedings. After the applicable retention period expires, your data is securely deleted or irreversibly anonymised.
8. Your Rights Under the GDPR
As a data subject, you have the following rights under the GDPR, which you may exercise at any time: Right of Access (Art. 15): you have the right to obtain confirmation of whether your personal data is being processed and, if so, to receive a copy of that data together with information about the processing. Right to Rectification (Art. 16): you have the right to request the correction of inaccurate personal data and the completion of incomplete data. Right to Erasure (Art. 17): you have the right to request the deletion of your personal data where, among other grounds, the data is no longer necessary for the purposes for which it was collected, you withdraw your consent, or the data has been unlawfully processed. This right is subject to legal retention obligations. Right to Restriction of Processing (Art. 18): you have the right to request that we limit the processing of your data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing pending verification of our legitimate grounds. Right to Data Portability (Art. 20): you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. Right to Object (Art. 21): you have the right to object to the processing of your personal data based on legitimate interest or for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately. Right Not to Be Subject to Automated Decision-Making (Art. 22): you have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not currently engage in solely automated decision-making. Right to Withdraw Consent (Art. 7(3)): where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
9. How to Exercise Your Rights
To exercise any of the rights described above, you may contact us at: Email: info@luxesailingcharter.it Phone: +39 388 6970193 Postal address: LuxeSailingCharter, Amalfi (SA), Italy Please include sufficient information to allow us to verify your identity (e.g., your full name, email address used for booking, and booking reference number if applicable). We will respond to your request without undue delay and in any event within one (1) month of receipt. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within the first month. Exercising your rights is free of charge. However, where requests are manifestly unfounded or excessive (in particular due to their repetitive character), we may charge a reasonable fee or refuse to act on the request, in accordance with Article 12(5) GDPR.
10. Cookies
Our website uses cookies and similar tracking technologies to ensure the proper functioning of the site, analyse traffic, and, with your consent, deliver personalised content and advertising. For detailed information about the types of cookies we use, their purpose, duration, and how to manage your preferences, please refer to our dedicated Cookie Policy, accessible from the footer of every page on our website. You can modify or withdraw your cookie consent at any time through the cookie preference centre available on our website.
11. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 GDPR. These measures include, but are not limited to: - Encryption of data in transit using TLS/SSL protocols (HTTPS). - Secure storage of data on servers within the EEA with access controls. - Regular security assessments and updates to our systems and software. - Limiting access to personal data to authorised personnel on a need-to-know basis. - Use of PCI-DSS compliant payment processors for all card transactions. - Regular backups and disaster recovery procedures. While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected individuals and relevant authorities in the event of a personal data breach, in accordance with Articles 33 and 34 GDPR.
12. Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. Charter bookings must be made by an adult (18 years of age or older). Minors may participate in charter experiences only when accompanied by a parent or legal guardian who has made the booking. If we become aware that we have inadvertently collected personal data from a child under 18 without parental consent, we will take steps to delete that data as promptly as possible. If you believe we may have collected data from a minor, please contact us at info@luxesailingcharter.it.
13. Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or business operations. Any changes will be published on this page with an updated "Last updated" date. Where changes are material, we will make reasonable efforts to notify you by email or through a prominent notice on our website prior to the changes taking effect. We encourage you to review this Privacy Policy periodically. Your continued use of our services after the posting of changes constitutes your acknowledgement of the updated policy.
14. Supervisory Authority
If you believe that the processing of your personal data infringes the GDPR or applicable data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The Italian supervisory authority is: Garante per la Protezione dei Dati Personali Piazza Venezia, 11 — 00187 Roma, Italy Website: www.garanteprivacy.it Email: garante@gpdp.it PEC: protocollo@pec.gpdp.it Phone: +39 06 696771 You may also seek a judicial remedy before the competent courts, in accordance with Article 79 GDPR.