Privacy policy
Last updated: 7 October 2026
This policy explains what personal data we collect on sail-mallorca.com, why, how long we keep it and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
[to be added] ([to be added]), trading as Sail Mallorca Charter, [to be added]. Email: info@sail-mallorca.com · Phone: +34 662 506 693
2. What we collect and why
| What you do | Data we receive | Why we use it | Legal basis |
|---|---|---|---|
| Request a trip in the booking calendar | Name, email, phone, number of guests, chosen trip and time, your message, and that you accepted this policy and confirmed you are 18 or over | To check and confirm your booking, contact you about it and run the trip | Taking steps at your request before a contract, and performing the contract (GDPR art. 6(1)(b)) |
| Send a contact, berth or technical enquiry form | The details you type in (name, email, optional phone, your message, and for berths your company and vessel details) | To answer your enquiry and prepare a quote. We email your message to our inbox and send you a short confirmation. The website doesn't keep a copy | Steps at your request before a contract (art. 6(1)(b)); for company contacts, our legitimate interest in answering business enquiries (art. 6(1)(f)) |
| Email, phone or WhatsApp us | Your contact details and what you tell us | To answer you | Art. 6(1)(b) and 6(1)(f) |
| Use the "Ask a question" assistant | The questions you type and the answers. We don't ask for your name or contact details there, so please don't type them in | To answer questions about our trips and services | Our legitimate interest in answering visitors' questions (art. 6(1)(f)) |
| Submit the booking form or an enquiry form | A one-way scrambled (hashed) form of your internet address, with personal parts of IPv6 addresses removed, and for enquiry forms a hashed form of your email address | To stop spam and abuse of the forms | Our legitimate interest in keeping the service secure (art. 6(1)(f)) |
| Allow "External media" in cookie settings | Your internet address is sent to OpenStreetMap when the map loads | To show where we meet | Your consent (art. 6(1)(a)), which you can withdraw at any time |
| Book on GetYourGuide | GetYourGuide sends us the booking details we need to run the trip | To run the trip you booked | Performing the contract (art. 6(1)(b)) |
When we have to keep booking and invoice records for tax and accounting, the legal basis is our legal obligation (art. 6(1)(c)).
You don't have to give us your data, but without your name, email and phone we can't confirm a booking. We don't sell your data, we don't use it for advertising, and we don't make decisions about you by automated means.
3. Marketing emails
We don't send newsletters or marketing emails. If we ever do, we will only send them with your prior consent, and every email will have an unsubscribe link. The booking emails you receive are about your booking only.
4. Who else processes your data
We use these service providers. They process data only on our instructions:
- Lovable and the infrastructure it uses (such as Supabase and Cloudflare): website hosting and the booking database.
- Lovable AI Gateway and OpenAI: generate the assistant's answers. OpenAI doesn't use messages sent through its business API to train its models.
- Apple (iCloud Mail): our email inbox, info@sail-mallorca.com.
- Lovable email sending: sends booking emails, enquiry emails and confirmations.
These organisations make their own decisions about your data:
- GetYourGuide, if you book with them. Their privacy policy applies.
- WhatsApp (Meta), if you message us there.
- OpenStreetMap Foundation, only if you allow external media.
- Authorities, when the law requires us to share data.
5. Transfers outside the EU
Some providers (for example OpenAI, Cloudflare and Apple) may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
6. How long we keep your data
- Booking requests that don't go ahead (declined, expired or cancelled): guest details are deleted automatically 90 days after the trip date.
- Confirmed bookings: kept for the trip and then as long as Spanish tax and commercial law require (up to 6 years). After that, guest details are deleted automatically.
- Enquiry emails in our inbox: kept while we deal with your enquiry and for up to 12 months after our last contact, unless they lead to a contract.
- Assistant conversations: deleted automatically 90 days after the last message. You can delete yours at any time with "Delete conversation" in the assistant.
- Hashed internet and email addresses used against spam: deleted after 24 hours.
- Your cookie choice: kept in your browser for 12 months.
7. Children
Our booking and enquiry forms are for adults. Whoever requests a booking must be 18 or over and books on behalf of their group. We only ask for the number of guests, not children's details. Under Spanish law (LOPDGDD art. 7), children under 14 can't consent to the use of their data themselves, so please ask a parent or guardian to contact us for them.
8. Your rights
You can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- stop using it (objection);
- send it to you or another company in a common format (portability).
You can also withdraw any consent you gave, without affecting what we did before.
How to ask: email info@sail-mallorca.com, or use the data request form below. Tell us the email or phone you used with us, so we can find your data and check it's yours. We answer within one month.
You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
9. Security
The booking database can only be reached by our own staff, through a private sign-in. Website connections are encrypted (HTTPS).
10. Changes
If we change this policy, we'll update the date at the top. If a change is important, we'll tell people with an upcoming booking by email.