Privacy Policy

This policy explains how Aqua Azur Yacht Charters ("Aqua Azur", "we") handles personal data when you use this website, make a booking, send an enquiry or share suggestions with us. It applies to this website and our charter booking pages.

1. Who we are and how to contact us

The controller of your personal data is Aqua Azur Yacht Charters, a charter business based in Malta. For any privacy question or to exercise your rights, please email ncrossey@icloud.com or call +356-77773324. We have not appointed a Data Protection Officer.

2. Personal data we collect

• Bookings: your full name, email address, telephone number, country (optional), charter date and departure time, number of guests, chosen boat and extras, any special requests you write, and the booking reference, price, deposit and payment status.
• Enquiries: your name, email address, preferred date, number of guests, chosen experience, your message and your agreement to be contacted about the enquiry.
• Guest suggestions: your answers, ratings and preferences, and — only if you choose to give them — your name and email. Dietary or accessibility notes are optional; please do not include medical records or other sensitive details.
• Extras suggestions: if you use "Suggest extras", the interests and occasion you type, with the boat, date and group size.
• Messages: emails, calls and WhatsApp messages you send us.
• Technical data: to limit abuse of our forms we keep a one-way coded version of your network (IP) address for a short time; the address itself is not stored. Our hosting providers keep standard server logs.

We do not take card payments on this website and we do not ask you to create a customer account.

3. Why we use it and our legal basis

• To handle your booking — reserving your charter, contacting you about it, taking payment and providing the trip: necessary to take steps at your request before a contract and to perform it (GDPR Article 6(1)(b)).
• To reply to your enquiry — necessary to take steps you ask for before a possible booking (Article 6(1)(b)).
• Trip safety and weather checks linked to your booking — our legitimate interest, and that of our guests, in running safe trips (Article 6(1)(f)).
• Accounting, invoicing and tax records — to meet our legal obligations (Article 6(1)(c)).
• Guest suggestions and extras suggestions — our legitimate interest in improving our service and answering your request (Article 6(1)(f)). Suggestions stay private and are not published as reviews.
• Protecting our forms from misuse — our legitimate interest in keeping the service available (Article 6(1)(f)).

Where we rely on legitimate interests you can object at any time (see section 7). Booking with us or sending a form does not sign you up for marketing; we do not currently send newsletters or promotional emails.

4. Who we share it with

Only authorised Aqua Azur staff can see booking and enquiry details, each according to their role (for example, the captain of your trip or our accountant). We use service providers who process data on our behalf:

• Lovable — website and booking-system hosting, database and staff sign-in, using cloud infrastructure providers.
• Lovable AI and its AI model provider — only the text you enter in "Suggest extras", together with boat, date and group size, to generate suggestions. Your name and contact details are not sent.
• MET Norway and Open-Meteo — weather forecasts. Only the departure location and dates are sent, never your personal details.

We may also share data with our accountant and professional advisers, and with authorities where the law requires it. We do not sell personal data.

5. International transfers

Some of our service providers, or their own sub-processors, may process data outside the European Economic Area, including in the United States. Where this happens, the transfer must be covered by an appropriate safeguard under Chapter V of the GDPR, such as an EU adequacy decision or the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.

6. How long we keep it

We keep booking and accounting records for as long as needed to provide your charter and then for as long as Maltese tax and accounting law requires. Enquiries and suggestions are kept only as long as needed to respond and to improve our service. We are finalising specific retention periods for each type of record; until then, you can ask us at any time to delete data we no longer need. Encrypted backups are kept for a limited rolling period and then replaced.

7. Your rights

Under the GDPR you may have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased;
• restrict how we use it;
• receive data you gave us in a portable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, where we rely on consent, without affecting earlier processing.

These rights have conditions and exceptions under the law — for example, we must keep some records for tax purposes. To make a request, email ncrossey@icloud.com. We may need to confirm your identity first. We will respond without undue delay and within the time limits set by the GDPR.

You also have the right to complain to Malta's data protection authority, the Information and Data Protection Commissioner (IDPC) — see how to file a complaint. We would appreciate the chance to address your concern first.

8. Security

The website is served over an encrypted (HTTPS) connection. Access to booking and guest information is limited to signed-in, authorised staff according to their role, and backups are encrypted. No system is completely secure, but we work to protect your data and to act promptly on any incident.

9. Cookies and similar technologies

We do not use advertising cookies, analytics or tracking tools on the public website, so we do not show a cookie banner. The site stores only small items needed for it to work: for example, a temporary note in your browser that helps reload the page after we publish an update, and — for staff only — the sign-in session and portal preferences. If we ever add analytics or marketing tools, we will ask for your consent first where the law requires it and update this policy.

10. Children

Our booking and enquiry forms are intended to be completed by adults. Children may join charters with their family or group; their details are only collected where the lead guest provides them for the trip.

11. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI extras suggestions are optional ideas only and never decide prices or availability. Weather alerts support, but never replace, the captain's decision.

12. Changes to this policy

We may update this policy when our services or the law change. The date above shows the latest version, and we will tell guests with active bookings about significant changes.

Related: Contact us. Legal references: GDPR (Regulation (EU) 2016/679) and the Data Protection Act (Cap. 586, Laws of Malta).