Privacy Policy
Effective Date: 16 July 2025
This Privacy Policy explains how Carpentry and Boat Building Services S.L. located in Palma de Mallorca, Spain ("we," "us," or "our"), collects, uses, and protects your personal data when you visit our website, inquire about our services, or become a client.
We are committed to protecting your privacy and handling your personal data in a transparent and secure manner, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").
1. Who is the Data Controller?
The data controller responsible for the processing of your personal data is:
Carpentry and Boat Building Services S.L.
Calle Asegra 15, 07011 Palma de Mallorca, Balearic Islands, Spain
CIF/VAT Nº: ESB57908485
+34 971075965
2. What Personal Data Do We Collect?
We may collect the following types of personal data:
· Identification and Contact Data: Name, surname, company name, yacht name, email address, phone number, physical address (for invoicing or service delivery), and potentially passport/ID details if required for specific port or customs procedures.
· Professional Data: Job title, role within the yacht/company, details of the vessel you represent.
· Service-Related Data: Information related to your inquiries, quotes, projects, repairs, refits, alterations, and any communications regarding these services. This may include project specifications, photographs of work (with consent and consideration for privacy), and billing information.
· Website Usage Data: Information about how you use our website, collected through cookies and similar technologies (e.g., IP address, browser type, pages visited, time spent on pages). (See our separate Cookie Policy for more details).
· Communication Data: Records of emails, phone calls, and other communications between you and our company.
3. How Do We Collect Your Personal Data?
We collect personal data through:
· Direct Interactions: When you contact us via email, phone, contact forms on our website, or in person to request a quote, inquire about services, or engage our services.
· Website: Through cookies and analytics tools when you visit our website.
· Publicly Available Sources: Occasionally, from publicly accessible sources, such as yacht registries or industry directories, if necessary to establish contact for business purposes.
· Third Parties: From other parties involved in yacht services (e.g., yacht management companies, captains, brokers) if they provide your details to us with your consent or a legitimate basis.
4. What Are the Purposes and Legal Bases for Processing Your Personal Data?
We process your personal data for the following purposes and rely on the following legal bases under GDPR:
· To provide quotes and services (Contractual Necessity):
o To respond to your inquiries and prepare detailed quotes for carpentry work.
o To manage and execute the contracted carpentry services, including project planning, material procurement, and scheduling.
o To communicate with you regarding the progress of your projects and any related matters.
o To issue invoices and manage payments.
· To comply with legal obligations (Legal Obligation):
o To fulfil our tax, accounting, and legal reporting requirements in Spain.
o To comply with any port, maritime, or customs regulations applicable to our services.
· For legitimate business interests (Legitimate Interest):
o To improve our services and website based on feedback and usage patterns.
o To maintain records of our services and client interactions for business administration and internal analysis.
o To protect our legal rights and interests, and to defend against legal claims.
o For direct marketing of our services (if you are an existing client and we believe the services are relevant to you, with an easy opt-out option).
· With your consent (Consent):
o To send you marketing communications about our new services, promotions, or industry updates, if you have explicitly opted in to receive them.
o To use certain types of cookies on our website (as detailed in our Cookie Policy).
o For any other purpose where we specifically request your consent.
5. How Long Do We Retain Your Personal Data?
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Generally, we retain personal data for:
· Contractual data: For the duration of the contractual relationship plus the statutory limitation period for legal claims (e.g., up to 5 years for general commercial claims in Spain, or longer for specific tax/accounting obligations).
· Inquiry data: For a reasonable period to follow up on inquiries, typically up to [e.g., 12-24 months], unless it leads to a contract.
· Marketing consent: Until you withdraw your consent or opt-out.
· Website usage data: As per our Cookie Policy.
Once the retention period expires, your personal data will be securely deleted or anonymized.
6. Who Do We Share Your Personal Data With?
We may share your personal data with:
· Service Providers (Data Processors): Trusted third-party service providers who assist us in operating our business and delivering our services.
· Public Authorities: When legally required to do so, such as tax authorities, courts, or regulatory bodies.
We ensure that all third parties who process your data on our behalf are committed to data protection and have appropriate security measures in place. We will not sell or rent your personal data to any third parties for their own marketing purposes.
7. International Data Transfers
We primarily store and process your personal data within the European Economic Area (EEA).
If we transfer your personal data outside the EEA, we will ensure that appropriate safeguards are in place, such as:
· Transferring data to countries deemed by the European Commission to provide an adequate level of data protection.
· Using standard contractual clauses approved by the European Commission.
· Obtaining your explicit consent where required.
8. How Do We Protect Your Personal Data?
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction. These measures include:
· Physical Security: Secure storage of physical documents.
· IT Security: Firewalls, encryption, strong password policies, regular backups, and secure network infrastructure.
· Access Control: Restricting access to personal data to authorized personnel only.
· Staff Training: Regularly training our employees on data protection principles and best practices.
Despite our efforts, no security system is completely impenetrable. In the event of a data breach, we will take prompt action to mitigate the impact and comply with our legal obligations, including notifying the Spanish Data Protection Agency (AEPD) and affected individuals where required.
9. Your Data Protection Rights
Under GDPR and LOPDGDD, you have the following rights regarding your personal data:
· Right to Access: You have the right to request a copy of the personal data we hold about you.
· Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
· Right to Erasure ("Right to Be Forgotten"): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent and there is no other legal basis for processing.
· Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., if you contest the accuracy of the data).
· Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where technically feasible and the processing is based on consent or contract.
· Right to Object: You have the right to object to the processing of your personal data in certain situations, including processing based on legitimate interests or for direct marketing.
· Right to Withdraw Consent: Where we rely on your consent for processing, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
· Right to Lodge a Complaint: You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your data protection rights have been violated. (Contact details: Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, Spain; Website: www.aepd.es).
10. How to Exercise Your Rights
To exercise any of your data protection rights, please contact us using the details provided in Section 1 ("Who is the Data Controller?"). We may ask you to verify your identity before processing your request. We will respond to your request within one month, which may be extended by two further months where necessary, taking into account the complexity and number of the requests.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on our website, and the "Effective Date" at the top of this policy will be revised. We encourage you to review this policy periodically.
12. Contact Us
If you have any questions about this Privacy Policy or our data protection practices, please contact us at: info@cabbs.es