Privacy policy

Last updated: May 2026

1. DATA CONTROLLER

In accordance with Regulation (EU) 2016/679 General Data Protection Regulation (“GDPR”), Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), and any other applicable data protection regulations, VIVABOAT informs users of this Privacy Policy.

The entity responsible for processing personal data collected through this website is:

Company name: VIVABOAT SLTax Identification Number (CIF): B22536296Registered office: C/L’Estruc 14, 1º-1ª, 07819 Nuestra Señora de Jesús, Ibiza, Balearic Islands, SpainPrivacy contact email:

Website domains:

• www.vivaboat.com
• www.vivaboat.es

VIVABOAT operates as a digital platform and nautical marketplace specialized in the intermediation of boat rentals, nautical experiences and services related to the nautical and tourism sectors.

This Privacy Policy governs the processing of personal data carried out by VIVABOAT through:

• web forms;
• booking processes;
• electronic communications;
• customer support;
• WhatsApp;
• social media;
• technological tools;
• cookies;
• analytics services;
• automations;
• and other functionalities related to the operation of the platform.

2. PURPOSES OF PERSONAL DATA PROCESSING

VIVABOAT may process users’ personal data for the following purposes:

a) Booking management and service provision

To manage information requests, bookings, contracts, nautical experiences, customer support, incidents, cancellations, payments, booking-related communications and any processes necessary for the proper management of services offered through the platform.

b) User, boat owner and collaborator management

To manage relationships with users, boat owners, skippers, brokers, partners, charter companies and other collaborators linked to the platform’s activity, including administrative, operational, commercial and support processes.

c) Customer support and communications

To respond to inquiries, requests, incidents, complaints or communications submitted through web forms, email, telephone, WhatsApp, social media or any other contact channels enabled by VIVABOAT.

d) Payment processing and fraud prevention

To manage payments, collections, verifications, anti-fraud processes, transaction security and risk control related to bookings and services contracted through the platform.

e) Commercial communications and newsletters

To send commercial communications, promotions, updates, advertising campaigns, newsletters and content related to VIVABOAT, the nautical sector, experiences, boats or services that may be of interest to users, always in accordance with applicable regulations and, where legally required, subject to prior user consent.

f) Personalization of the user experience

To analyze browsing habits, preferences, interactions and use of the platform in order to improve user experience and personalize content, recommendations, results and functionalities offered by VIVABOAT.

g) Analytics, statistics and platform improvement

To conduct statistical analysis, usage metrics, internal studies, web analytics, performance measurements and technical, operational and functional improvements to the platform and services offered.

h) Platform security and protection

To ensure the security, integrity and proper functioning of the platform, prevent unauthorized access, fraudulent activities, unlawful uses, cyberattacks, spam, scraping, automated bots and any actions contrary to applicable regulations or VIVABOAT policies.

i) Compliance with legal obligations

To comply with legal, tax, administrative, regulatory and security obligations applicable to VIVABOAT under current legislation.

3. LEGAL BASIS FOR DATA PROCESSING

The processing of personal data carried out by VIVABOAT is based on the following legal grounds in accordance with the General Data Protection Regulation (“GDPR”):

a) Performance of a contractual or pre-contractual relationship

Certain data processing activities are necessary to manage requests, bookings, contracts, payments, customer support and other services related to the use of the platform and the provision of services requested by users.

b) Compliance with legal obligations

VIVABOAT may process personal data when necessary to comply with legal, tax, accounting, administrative, regulatory, fraud prevention, security or any other obligations required under applicable law.

c) User consent

Where required, VIVABOAT will request the user’s free, specific, informed and unambiguous consent for the processing of personal data, particularly regarding:

• commercial communications and newsletters;
• certain cookies and analytical or advertising technologies;
• marketing and remarketing activities;
• certain optional platform functionalities.

Users may withdraw their consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

d) Legitimate interest

VIVABOAT may process certain personal data based on its legitimate interest, provided that such interest does not override the fundamental rights and freedoms of users.

In particular, VIVABOAT may process data based on legitimate interest for:

• improving the quality, operation and security of the platform;
• preventing fraud, unauthorized access, spam, scraping or abusive uses;
• ensuring technological and operational security;
• conducting internal statistical analysis;
• handling requests, inquiries or incidents;
• personalizing the user experience;
• maintaining commercial and customer support relationships related to contracted services.

VIVABOAT carries out reasonable proportionality and data minimization assessments to ensure a fair balance between its legitimate interests and users’ rights.

4. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the relationship maintained with VIVABOAT and the services used through the platform, the following categories of personal data may be processed:

a) Identification and contact data

• full name;
• email address;
• telephone number;
• postal address;
• identification documents such as ID card, NIE or passport when necessary for bookings, boarding procedures or legal compliance.

b) Booking and service-related data

• booking information;
• selected boats;
• dates and schedules;
• ports and destinations;
• number of passengers;
• preferences or requests related to the contracted experience;
• incidents, cancellations or communications associated with bookings.

c) Financial and transactional data

• payment and transaction-related information;
• amounts;
• payment status;
• anti-fraud information;
• booking or transaction identifiers.

VIVABOAT does not directly store complete bank card details, as payments are processed through specialized payment service providers.

d) Browsing and platform usage data

• IP address;
• device identifiers;
• browser information;
• operating system;
• browsing data;
• cookies;
• analytics metrics;
• interactions with the platform;
• browsing behavior and website usage data.

e) Communication data

Information provided by users through:

• forms;
• email;
• WhatsApp;
• telephone;
• social media;
• chats;
• or any other communication channels enabled by VIVABOAT.

f) Boat owner, collaborator and partner data

Professional, identification, tax, operational or contact data related to boat owners, skippers, brokers, charter companies, suppliers, collaborators or partners linked to the activity of the platform.

g) Data obtained through cookies and similar technologies

Information obtained through cookies, analytical tools, advertising technologies, tracking pixels, remarketing tools or similar technologies used by VIVABOAT or authorized third parties.

5. SOURCE OF PERSONAL DATA

Personal data processed by VIVABOAT may originate from the following sources:

a) Data provided directly by users

Data voluntarily provided by users through:

• web forms;
• booking processes;
• information requests;
• electronic communications;
• email;
• WhatsApp;
• telephone;
• social media;
• contact forms;
• newsletter subscriptions;
• or any other channels enabled by VIVABOAT.

b) Data provided by third parties related to a booking or service

In certain cases, data may be provided by third parties involved in the contracting or management of services, including:

• agencies;
• boat owners;
• charter companies;
• brokers;
• partners;
• companions;
• group organizers;
• or persons making bookings on behalf of third parties.

In such cases, the party providing the data must ensure that it has sufficient legal basis to do so and has informed the data subjects in accordance with applicable regulations.

c) Data obtained automatically through digital technologies

VIVABOAT may automatically collect certain data through:

• cookies;
• analytical tools;
• tracking technologies;
• advertising pixels;
• technical logs;
• device identifiers;
• or measurement and security tools used on the platform.

d) Data obtained through social media and external platforms

When users interact with official profiles, campaigns, advertisements or content related to VIVABOAT on social media or external platforms, certain data may be obtained in accordance with the privacy settings and conditions established by those platforms.

e) Data generated through use of the platform

VIVABOAT may generate and process data derived from use of the platform, including:

• booking history;
• interactions;
• incidents;
• preferences;
• communications;
• browsing behavior;
• and use of functionalities and services offered through the platform.

6. RECIPIENTS, DATA SHARING AND ACCESS TO DATA

VIVABOAT may communicate, share or allow access to certain personal data when necessary for the proper provision of services offered through the platform, compliance with legal obligations or the technical and operational functioning of its activity.

Personal data may be accessible to the following categories of recipients or service providers:

a) Boat owners, operators and collaborators related to bookings

Certain data may be shared with boat owners, charter companies, skippers, brokers, partners, nautical operators or collaborators when necessary to manage bookings, boarding procedures, nautical experiences, payments, operational coordination or the effective provision of contracted services.

b) Technology providers and digital services

VIVABOAT may work with external technology providers necessary for the operation of the platform, including services related to:

• web hosting and cloud infrastructure;
• storage and security;
• payment systems;
• analytical tools;
• automations;
• CRM and operational management;
• communications and newsletters;
• support services;
• maps and geolocation;
• digital marketing and remarketing;
• tag management and web analytics;
• or business productivity and collaboration tools.

Among others, VIVABOAT may use services provided by:

• Amazon Web Services (AWS);
• Stripe;
• Google;
• Meta;
• WhatsApp;
• Mailchimp or Acumbamail;
• Make;
• AppSheet;
• and other technological tools related to the operation of the platform.

VIVABOAT does not sell users’ personal data to third parties.

7. INTERNATIONAL DATA TRANSFERS

Certain technology providers, digital tools or services used by VIVABOAT may involve international transfers of personal data outside the European Economic Area (“EEA”).

In particular, some services related to:

• cloud hosting;
• web analytics;
• digital advertising;
• remarketing;
• automations;
• communication platforms;
• payment services;
• newsletters;
• social media;
• or productivity and management tools,

may be provided by entities located or operating infrastructure outside the EEA, including the United States or other countries.

Among others, VIVABOAT may use services provided by:

• Amazon Web Services (AWS);
• Google;
• Meta;
• Stripe;
• WhatsApp;
• Mailchimp;
• Acumbamail;
• Make;
• AppSheet;
• and other technological providers related to the operation of the platform.

In such cases, VIVABOAT adopts reasonable measures to ensure that these international data transfers are carried out with an adequate level of protection and in accordance with applicable data protection regulations.

Where required, such transfers may be based on:

• adequacy decisions approved by the European Commission;
• Standard Contractual Clauses;
• appropriate safeguards recognized under applicable regulations;
• or other legally valid mechanisms under the GDPR.

8. DATA RETENTION PERIOD

VIVABOAT will retain personal data only for as long as necessary to fulfill the purposes for which it was collected, while a contractual, commercial or legitimate relationship exists with the user, and for the periods required under applicable law.

As a general rule:

• data related to bookings, payments, invoicing and legal obligations may be retained for the periods required under tax, accounting, administrative and fraud prevention regulations;
• data used for commercial communications and newsletters will be retained until the user withdraws consent or unsubscribes from such communications;
• data related to customer support, inquiries, incidents or assistance may be retained for the time necessary to properly manage the relationship with users and address potential liabilities;
• data derived from cookies, analytics tools, digital advertising or similar technologies will be retained in accordance with the periods established in the Cookie Policy and the configuration of the corresponding tools;
• certain data may be retained in a blocked or restricted manner when necessary for the establishment, exercise or defense of legal claims, compliance with legal obligations or responding to administrative or judicial requests.

Once the applicable retention periods have expired, personal data will be deleted, anonymized or blocked in accordance with reasonable technical and organizational measures adopted by VIVABOAT.

9. USERS’ RIGHTS

Users may exercise their data protection rights at any time in accordance with applicable regulations.

In particular, users may request:

• access to their personal data;
• rectification of inaccurate or incomplete data;
• deletion of their data when, among other reasons, it is no longer necessary for the purposes for which it was collected;
• restriction of processing;
• objection to the processing of their data under certain circumstances;
• portability of their data to another service provider;
• withdrawal of previously granted consent.

Users may exercise their rights by sending a written request to:

VIVABOAT SLC/L’Estruc 14, 1º-1ª07819 Nuestra Señora de JesúsIbiza, Balearic Islands, Spain

or by email to:

Requests may need to include sufficient information to reasonably verify the identity of the applicant when necessary.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their personal data does not comply with applicable regulations:

https://www.aepd.es

VIVABOAT undertakes to respond to data protection-related requests within the legally established timeframes and in accordance with applicable regulations.

10. COOKIES AND SIMILAR TECHNOLOGIES

The VIVABOAT website uses its own and third-party cookies, as well as similar technologies, for technical, analytical, functional, personalization, security, measurement and digital advertising purposes.

These technologies may allow:

• proper technical functioning of the website;
• remembering browsing preferences;
• analyzing platform usage and performance;
• measuring audiences and statistics;
• improving user experience;
• personalizing content and functionalities;
• carrying out digital marketing and remarketing activities;
• displaying personalized content or advertisements;
• preventing fraud and strengthening platform security.

VIVABOAT may use tools and technologies provided by third parties, including, among others:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• remarketing tools;
• analytics services;
• advertising platforms;
• maps and geolocation services;
• social integrations;
• or similar technologies related to the operation and improvement of the platform.

Users may configure, accept, reject or modify their cookie preferences at any time through the consent management system enabled on the website.

The use of certain analytical or advertising cookies and technologies may require prior user consent where legally required under applicable regulations.

For more detailed information regarding the use of cookies, similar technologies, categories used, duration and preference settings, users may consult the VIVABOAT Cookie Policy.

11. INFORMATION SECURITY

VIVABOAT adopts reasonable technical, organizational and security measures aimed at protecting personal data and information processed through the platform against unauthorized access, loss, alteration, destruction, improper disclosure or any other unlawful processing.

Such measures include, among others:

• access controls;
• technological infrastructure protection;
• security and monitoring tools;
• authentication protocols;
• encryption and reasonable protection measures;
• permission management;
• backups;
• fraud prevention measures;
• and mechanisms designed to ensure the confidentiality, integrity and availability of information.

VIVABOAT may use specialized technology providers, cloud services and external infrastructures for the hosting, storage, processing and security of information, including services provided by third parties reasonably selected in accordance with security and regulatory compliance standards.

However, users acknowledge that Internet security measures are not absolutely invulnerable and that no technological system can guarantee total or absolute security against incidents, attacks, unauthorized access or malicious actions by third parties.

VIVABOAT makes reasonable efforts to keep its security measures updated and to reduce risks associated with the processing of personal data and the operation of the platform.

12. SOCIAL MEDIA

VIVABOAT maintains official profiles on various social media platforms and digital networks, including, among others:

• Instagram;
• TikTok;
• Facebook;
• LinkedIn;
• and other social or advertising platforms related to the brand’s activity.

Users’ interaction with VIVABOAT’s official profiles may involve the processing of certain personal data in accordance with the privacy settings, terms and policies established by each social media platform.

When users interact with posts, campaigns, advertisements, forms, messages or content related to VIVABOAT on social media, VIVABOAT may receive certain statistical, analytical or contact information through the functionalities provided by those platforms.

Likewise, VIVABOAT may use advertising tools, remarketing technologies, custom audiences, lead generation forms or segmentation functionalities offered by platforms such as Meta or similar services, always in accordance with applicable regulations and, where legally required, subject to prior user consent.

Users are responsible for reviewing the privacy policies and privacy settings of the social media platforms they use.

VIVABOAT shall not be responsible for the privacy policies, data processing practices or activities carried out directly by such external platforms.

13. MODIFICATIONS TO THIS PRIVACY POLICY

VIVABOAT reserves the right to modify, update or adapt this Privacy Policy at any time in order to comply with:

• legislative or regulatory changes;
• technological developments;
• new functionalities or services;
• operational modifications;
• changes in technological tools or providers;
• new requirements regarding data protection, cookies, digital advertising or security;
• judicial criteria;
• or organizational and business needs.

Modifications shall become effective from the moment they are published on the website unless expressly stated otherwise.

VIVABOAT recommends that users periodically review this Privacy Policy in order to remain informed about the processing of their personal data and the conditions applicable at any given time.

Where modifications significantly affect users’ rights or require renewed consent under applicable regulations, VIVABOAT may adopt additional information measures or request such consent again where necessary.

14. CONTACT AND SUPERVISORY AUTHORITY

For any questions related to this Privacy Policy or to the processing of personal data carried out by VIVABOAT, users may contact:

VIVABOAT SLC/L’Estruc 14, 1º-1ª07819 Nuestra Señora de JesúsIbiza, Balearic Islands, Spain

Privacy contact email:

VIVABOAT encourages users to contact the platform first in order to resolve any privacy or data protection-related issues quickly and amicably.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their personal data does not comply with applicable regulations:

https://www.aepd.es

VIVABOAT maintains an active commitment to privacy, information security, transparency and the responsible protection of personal data within the development of its activity as a digital platform and nautical marketplace.