Data Management
SUMMARY PRIVACY NOTICE
BoatTheGlobe (registered office: 1025, Budapest, Törökvész út 44/c; Tax ID: 62778363-1-39), as the data controller, provides brief information in this Summary Privacy Notice about the processing of its customers’ personal data and their related rights. More detailed information can be found in our Detailed Privacy Notice.
This Data Management Notice has been established in accordance with the European Union’s General Data Protection Regulation (GDPR) under Regulation (EU) 2016/679 and the Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.
BoatTheGlobe stores its customers’ personal data to fulfill their requests related to boat rentals, sailing, and chartering at the highest possible level and to provide them with the appropriate services. The legal basis for data processing is the customer’s freely revocable consent, the legitimate interest related to the performance of the contract, or the enforcement of other legitimate interests arising from it.
Personal data necessary for service provision are transferred to service providers involved in contract performance (charter companies, booking systems, etc.). These providers are precisely identified in the contract you conclude. In case of data transfer outside the European Union, we pay special attention to the security of your data.
We process our customers’ personal data until the withdrawal of the consent serving as the legal basis for data processing, or until the expiration of the general five-year statute of limitations for claims from contract performance, or until the date specified by relevant domestic and international regulations.
We inform you that you have the right to request information about, access to, correction, deletion, or transfer of your personal data processed by us to another data controller.
If you wish to receive personalized information about the processing of your personal data by us (the purpose, legal basis, scope of data, data transfer, duration of processing, profiling logic), you can do so at the following contact point: (email: info@boattheglobe.com, phone: +36 30 311 3328, address: 1025, Budapest, Törökvész út 44/c).
In case of unlawful processing of your personal data, please first contact us to resolve the issue satisfactorily for both parties. If this proves unsuccessful, you may file a complaint with the National Authority for Data Protection and Freedom of Information at the following contact details: (Mailing address: 1530 Budapest, P.O. Box: 5., Phone: +36 (1) 391-1400, Fax: +36 (1) 391-1410, Email: ugyfelszolgalat@naih.hu, Website: http://www.naih.hu).
DETAILED PRIVACY NOTICE
Content
- The identity and contact details of the data controller
- The legal regulations serving as the basis for data processing
- Definitions
- The principles of data processing
- Data processed by BoatTheGlobe, the purpose, legal basis, and duration of data processing
- Recipients of personal data, or categories of recipients
- International data transfer to third countries
- The customer’s right of access
- The customer’s right to rectification
- The customer’s right to erasure
- The customer’s right to restriction of processing
- The customer’s right to data portability
- The processing deadline for the customer’s request as a data subject
- The right to lodge a complaint
- Modifications to this notice
BoatTheGlobe (registered office: 1025, Budapest, Törökvész út 44/c; Tax ID: 62778363-1-39; contact person for data protection matters: Horváth Arnold; contact person’s email and phone number: info@boattheglobe.com; +36 30 311 3328; hereinafter: BoatTheGlobe) acts as the data controller for your current, former, and future customer personal data.
- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information,
- Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
data controller: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
data processing: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
data processor: a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller;
GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
supervisory authority or NAIH: National Authority for Data Protection and Freedom of Information.
personal data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;
customer: individuals personally interested in the products and services of BoatTheGlobe, whether through the website, phone, or any other means, or those who enter into a boat rental agreement (booking contract, charter agreement, booking confirmation) with BoatTheGlobe.
BoatTheGlobe takes appropriate measures to ensure that customers’ personal data are always
- processed lawfully, fairly, and with appropriate legal basis (lawfulness, fairness, and transparency);
- collected only for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes;
- adequate, relevant, and limited to what is necessary for the purposes of processing (data minimization);
- accurate and, where necessary, kept up to date; inaccurate personal data are erased or rectified without delay (accuracy);
- stored in a form that permits identification of customers only for as long as necessary for the purposes of processing; personal data may be stored for longer periods only for statistical purposes, with appropriate technical and organizational measures in place (storage limitation);
- processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage (integrity and confidentiality).
BoatTheGlobe processes the following personal data of its customers for the listed data processing purposes:
- I. Interest in services on the website, in person, by phone, or other means
| (a) | name | Data essential for customer identification |
| (b) | email address (phone number) | Data essential for future contact with the customer |
| (c) | subject of interest (e.g., boat type, period, destination) | Data necessary to specify and appropriately respond to the customer’s interest, based on the customer’s own disclosure. |
The legal basis for data processing is the inquirer’s consent. Data processing lasts for the duration specified by the inquirer or until consent is withdrawn.
- II. Newsletter subscription
| (a) | name | Data essential for customer identification |
| (b) | email address | Data essential for future contact with the customer |
| (c) | subject of interest (if applicable) | Data necessary to specify the subject of the newsletter/other eDM tool, based on the customer’s own disclosure. |
The legal basis for data processing is the inquirer’s consent. Data processing lasts for the duration specified by the inquirer or until consent is withdrawn.
- III. Custom quote request
| (a) | name | Data essential for customer identification |
| (b) | email address | Data essential for future contact with the customer |
| (c) | subject of interest (e.g., boat type, period, destination) | Data necessary to specify and appropriately respond to the customer’s interest, based on the customer’s own disclosure. |
The legal basis for data processing is the inquirer’s consent. Data processing lasts for the duration specified by the inquirer or until consent is withdrawn.
- IV. Booking, entering into a boat rental agreement
| (a) | name | Data essential for customer identification |
| (b) | email address (phone number) | Data essential for future contact with the customer |
| (c) | address | Necessary for issuing commercial documents. |
| (d) | subject of the contract (e.g., boat type, period, destination, number and details of passengers) | Determining the subject of the contract. |
| (e) | passenger list (data required for passenger list for each passenger: surname, first name, gender, place and date of birth, residence, nationality, type and number of personal or travel document, skipper’s license and radio certification number, type, validity) | Data required by the laws of the destination country, mandatory for each passenger. |
The legal basis for data processing is contract performance or ensuring the settlement of potential legal disputes arising from it. The duration of data processing is contract performance plus five years (general civil statute of limitations for claims), or until consent is withdrawn.
Additionally, for passenger list data, data processing is mandatory based on legal regulations, for the duration specified by the laws of the destination country.
- V. Profiling
| (a) | aggregate of data processed in connection with activities under points I-IV for the given customer | Data necessary for customer identification and, based on prior consent, sending personalized offers. |
The legal basis for data processing is the customer’s explicit consent to profiling. Data processing lasts for the duration specified by the inquirer or until consent is withdrawn.
The legal basis for data processing is the fulfillment of the Competition terms, ensuring the settlement of potential legal disputes arising from it, and maintaining contact. The duration of data processing is contract performance plus five years (general civil statute of limitations for claims), or until consent is withdrawn. For billing data, 8 years from data collection [Act on Accounting, Section 169 (1)-(2)]
BoatTheGlobe generally shares customer personal data with the following third parties on a controller-to-controller basis:
- organizations providing services to BoatTheGlobe or customers (e.g., insurance companies, IT service providers, marketing campaign companies);
- third parties involved in boat rental contract performance (charter company, booking system, boat owner and/or lessor, etc.);
- supervisory authorities and other regulatory bodies.
Customers may request personalized information about the processing of their personal data by BoatTheGlobe (the purpose, legal basis, scope of data, data transfer, duration of processing, profiling logic) at the following contact point: (email: info@boattheglobe.com, phone: +36 30 311 3328, address: 1025, Budapest, Törökvész út 44/c).
Customers’ personal data may be transferred to data controllers and processors outside the European Economic Area if necessary for travel contract performance or if the customer has given explicit and informed consent (GDPR Article 49).
BoatTheGlobe informs the customer before concluding the boat rental agreement that the adequate protection of transferred data is ensured for recipients outside the European Union:
- through general data protection clauses adopted by the Commission under the examination procedure referred to in Article 93(2) of the GDPR;
- through general data protection clauses adopted by the supervisory authority and approved by the Commission in accordance with the examination procedure referred to in Article 93(2) of the GDPR;
- through an approved code of conduct pursuant to Article 40 of the GDPR together with binding and enforceable commitments of the third country controller or processor to apply the appropriate safeguards, including regarding data subjects’ rights; or
- through an approved certification mechanism pursuant to Article 42 of the GDPR together with binding and enforceable commitments of the third country controller or processor to apply the appropriate safeguards, including regarding data subjects’ rights. In this regard, BoatTheGlobe strives to have its third-country partners accept the contractual data protection model clauses approved by the European Commission/NAIH.
The customer has the right to access their personal data.
If the customer requests feedback from BoatTheGlobe on whether it processes their personal data, BoatTheGlobe is obliged to provide information.
The customer’s right to receive feedback on whether BoatTheGlobe processes (or does not process) their personal data
- extends to their personal data;
- does not extend to anonymous data;
- does not extend to personal data not related to them; and
- includes pseudonymized data clearly linked to the customer.
BoatTheGlobe provides access and a copy of the customer’s personal data upon request. If the customer requests additional/repeated copies of their personal data, BoatTheGlobe may charge a reasonable fee to cover administrative costs, which fee will be borne by the customer.
The customer is entitled to have their personal data rectified. This right
(a) does not extend to anonymous data;
(b) extends to their personal data;
(c) does not extend to personal data not related to them; and
(d) includes pseudonymized data clearly linked to the customer.
BoatTheGlobe rectifies or supplements the customer’s personal data as appropriate upon request. BoatTheGlobe informs the recipients of such personal data (if any) about the rectification. However, BoatTheGlobe does not inform recipients if this proves impossible or requires disproportionate effort.
Under certain conditions, the customer is entitled to have their personal data erased.
BoatTheGlobe is obliged to erase the customer’s personal data without undue delay if
(a) BoatTheGlobe processes these personal data, and
(b) the customer requests the erasure of their personal data, and
(c) the personal data are no longer necessary for the purposes for which BoatTheGlobe processed them.
BoatTheGlobe is obliged to erase the customer’s personal data without undue delay if
(d) BoatTheGlobe processes the customer’s personal data, and
(e) the customer requests the erasure of their personal data, and
(f) the customer withdraws consent on which the processing is based, and
(g) there is no other legal basis for further processing of the customer’s data.
BoatTheGlobe is obliged to erase the customer’s personal data without undue delay if
(h) the processing is necessary for the legitimate interests of BoatTheGlobe or a third party, and
(i) the customer objects to BoatTheGlobe processing their personal data, and
(j) the legitimate reasons for such processing do not override the customer’s objection.
BoatTheGlobe is obliged to erase the customer’s personal data without undue delay if
(k) the customer requests the erasure of their personal data, and
(l) the processing of such data by the Company is unlawful, or
(m) erasure is mandatory under applicable laws, or
(n) the customer’s data were collected in relation to information society services.
BoatTheGlobe informs the recipients of the customer’s personal data (if any) about the erasure. However, BoatTheGlobe does not inform recipients if this proves impossible or requires disproportionate effort.
The customer may request restriction of processing of their personal data.
The customer’s right to request restriction of processing of their personal data
(a) does not extend to anonymous data;
(b) extends to their personal data;
(c) does not extend to personal data not related to them; and
(d) includes pseudonymized data clearly linked to the customer.
BoatTheGlobe restricts processing of the customer’s personal data for the period during which it verifies the accuracy of such data, if the customer requests restriction and disputes the accuracy of such data.
BoatTheGlobe restricts processing of the customer’s personal data if the customer requests restriction of processing of data processed unlawfully and opposes their erasure.
BoatTheGlobe restricts processing of the customer’s personal data if
(a) the customer requests restriction of processing, and
(b) BoatTheGlobe no longer needs the data for processing purposes, and
(c) the customer needs the data for legal claims.
BoatTheGlobe restricts processing of the customer’s personal data if
- the customer objects to processing of their personal data necessary for BoatTheGlobe’s legitimate interests, and
- the customer awaits confirmation whether BoatTheGlobe’s legitimate grounds override their objection.
BoatTheGlobe informs the recipients of the customer’s personal data (if any) about the restriction. However, BoatTheGlobe does not inform recipients if this proves impossible or requires disproportionate effort.
If BoatTheGlobe restricts processing of the customer’s personal data, it
(a) may store such personal data,
(b) may process such personal data with the customer’s consent,
(c) may process the personal data for legal claims or protecting others’ rights.
BoatTheGlobe may not use customer data for direct marketing purposes, including profiling or automated decision-making in individual cases.
The customer has the right to receive their personal data, which they provided to a controller, in a structured, commonly used, machine-readable format, and to transmit those data to another controller without hindrance (where technically feasible) from the controller to which the personal data were provided, if the processing is based on consent or contract and is carried out by automated means.
The customer’s right to data portability
(a) does not extend to anonymous data;
(b) extends to their personal data;
(c) does not extend to personal data not related to them; and
(d) does not extend to pseudonymized data clearly linked to the customer.
BoatTheGlobe responds to requests regarding the above rights within the following deadlines.
| Data subject’s request | Deadline |
| Right to information | when data are collected (if provided by the data subject) or within one month (if not provided by the data subject) |
| Right of access | one month |
| Right to rectification | one month |
| Right to erasure | without undue delay |
| Right to restriction of processing | without undue delay |
| Right to data portability | one month |
| Right to object | upon receipt of objection |
If the customer believes their rights have been violated, BoatTheGlobe recommends initiating consultation with the data controller by contacting the designated contact person above. If such consultation is unsuccessful or if the data subject does not wish to participate, they may turn to the court or the NAIH. For court proceedings, the data subject may choose to initiate proceedings at the court with jurisdiction over their residence.
NAIH contact details: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.; phone: +36 1 391 1400; fax: +36 1 391 1410; email: ugyfelszolgalat@naih.hu; website: www.naih.hu.
BoatTheGlobe reserves the right to modify this notice at any time. BoatTheGlobe will inform customers of such modifications by letter or email as appropriate and in accordance with relevant regulations.