Yachtalia Privacy Policy
At Yachtalia, we are committed to protecting the personal data you entrust to us. This policy explains how we process, store, share, and protect your personal data, and how you may exercise your rights in this regard.
It applies to the personal data we collect online, including through browsing our website, emails, forms, chats, etc., as well as to data collected through other interactions (visits to our offices, phone calls, in-person contacts, participation in trade fairs and events, the provision of our products and services, the establishment of partnership agreements, etc.).
If you are a job candidate responding to a job posting or you have sent us an unsolicited CV, please click here to access the relevant privacy notice.
As Data Controller, Yachtalia processes personal data in full compliance with applicable law (EU Regulation 2016/679 of the European Parliament and of the Council, hereinafter “GDPR”). Below is what we mean by “data controller”, “processing”, and “personal data”:
Data Controller: the entity that determines the purposes and means of the processing of personal data.
Processing: any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
Personal data: any information relating to an identified or identifiable natural person.
DATA CONTROLLER AND DATA PROTECTION OFFICER (DPO)
The Data Controller is GCT33 S.r.l., with its registered place of business at Via Dorsale, 23/A – 54100 Massa (MS), VAT number and Tax code 01238950453 (hereinafter “Yachtalia”). Yachtalia has appointed a Data Protection Officer (DPO), who can be contacted at: dpo@yachtalia.com.
PURPOSES OF PROCESSING
We process your personal data for the following purposes:
1. To provide you with information about our products and services and ensure their proper use; to communicate with you regarding your request; to process, store, retrieve, and provide the requested quotation and send reminders about it; to manage invoicing and payments, including online payments; to identify and authenticate you;
2. To manage complaints and disputes, recover debts, prevent fraud, unlawful activities, and incidents; to ensure quality; for research and development; for training our representatives;
3. To send you emails containing commercial communications relating to our products and services similar to those you have previously used, if you are already our customer (“soft-spam”);
4. To maintain accounting records, manage invoicing, and fulfil tax obligations.
5. To send you commercial and promotional communications, ours or those of third parties; to conduct surveys and market research; to publish your testimonials and satisfaction regarding our products and services on our website, subject to your consent;
6. To send you our newsletter, subject to your consent;
7. For marketing and profiling: analysis of purchasing preferences to provide personalised offers, subject to your consent.
PERSONAL DATA PROCESSING
Only to the extent necessary for each specific purpose, we process the following categories of personal data: Identity and contact information: name and surname, tax code, VAT number, date of birth, email address, postal address, telephone number, employer/company, position/role, username and password, and any information you freely provide that is relevant to the purpose.
Visual and audio information: images and video recordings (including CCTV), recordings of calls with our customer service representatives.
Technical information: IP addresses which may identify geographic location, browser type and language, device type, advertising identifiers associated with the device (such as Apple IDFA or Android AAID), uniform resource locators (URLs) visited before and after leaving our website, activity on our website or associated applications (including date and time of use), information contained in communications such as emails or online chats with customer support (which may include special categories of data when necessary to provide solutions for particular needs), data collected through cookies or similar technologies, geolocation information.
Commercial information: characteristics of your yacht and mooring port, products and services purchased or considered, documentation relating to requests, customer support logs, transaction history, responses to surveys and questionnaires.
LEGAL BASIS FOR PROCESSING
The legal basis depends on the purpose for which we process personal data. With reference to the section “Purposes”: For purpose 1, processing is necessary for the performance of pre-contractual or contractual measures relating to the products and services you request (Art. 6(1)(b) GDPR).
For purpose 2, processing is necessary to pursue the legitimate interest of Yachtalia in safeguarding and conducting its business activities (Art. 6(1)(f) GDPR).
For purpose 3, processing is based on Article 130(4) of the Italian Privacy Code, which allows the use of email addresses without prior consent, while always allowing you to object by following the instructions contained in each communication.
For purpose 4, processing is necessary for compliance with legal obligations to which Yachtalia is subject (Art. 6(1)(c) GDPR).
For purposes 5, 6, and 7, processing takes place on the basis of your consent (Art. 6(1)(a) GDPR).
which has been or will be requested at the time your data is collected. If you do not provide consent, Yachtalia will be unable to send you newsletters and advertising material, and you will not be able to participate in our surveys and market research.
METHODS OF PROCESSING AND RETENTION PERIODS
All processing operations may be carried out electronically or manually, in compliance with the security measures required by Article 32 GDPR, by personnel expressly authorised in accordance with Article 29 GDPR.
Retention periods depend on the specific purpose.
If we have a contractual relationship either relating to products/services or partnerships, we retain data for the duration of the contract and for an additional ten years to comply with legal obligations. If you contacted us but no contract was concluded, we retain your data for a period of two years, after which it will be deleted. We will process your data again only if you contact us again.
If you have given consent, your data will be processed until withdrawal.
DISCLOSURE AND TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION
Yachtalia discloses your data only to third parties tasked with carrying out certain operations necessary for the provision of the requested product or service, or who provide Yachtalia with operational tools, and only after appropriate contractual agreements have been signed to protect your personal data. If these third parties are located outside the European Union or process your data outside the European Union, Yachtalia will transfer your personal data in full compliance with the GDPR, either by using third parties located in countries recognised by the European Commission as providing an adequate level of protection, by relying on the Data Privacy Framework, or by entering into Standard Contractual Clauses.
YOUR RIGHTS
At any time, by contacting the DPO at the email address indicated in the section “Data Controller and Data Protection Officer,” you have the right to:
● request confirmation of whether Yachtalia holds your personal data;
obtain information regarding the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom personal data has been or will be disclosed, and, where possible, the retention period;
● obtain rectification and, in certain circumstances, erasure of data;
● obtain restriction of processing in certain circumstances;
● when processing is based on contract performance or your consent, or is carried out by automated means, obtain data portability—that is, receive your data from Yachtalia in a structured, commonly used, machine-readable format and transmit it to another data controller without hindrance;
● in certain circumstances, when processing is based on the legitimate interest of Yacthalia, object to the processing;
● object to automated decision-making, including profiling;
● withdraw your consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal;
● ask questions or raise concerns about the processing carried out by Yachtalia, and obtain a copy of the Standard Contractual Clauses (if applicable).
Furthermore, if you believe that your personal data has been processed in violation of the law, you may lodge a complaint with the Italian Data Protection Authority:
https://www.garanteprivacy.it/diritti/come-agire-per-tutelare-i-tuoi-dati-personali/reclamo.
CHANGES TO THIS PRIVACY POLICY
This policy was updated in February 2026. Yachtalia reserves the right to amend it as necessary. We will notify you of any changes by indicating the date of the latest update.
Consult the policy on candidates’ data treatment.
