1. Data Controller

SaltyBooker.com is operated by:

2. Personal Data We Collect

When you use the Platform, we may collect the following types of personal data:

• Account and reservation details: name, surname, email, phone number, address, ID or skipper license details (if applicable).
• Reservation information: selected boat, rental dates, booking preferences.
• Payment details: processed directly by secure third-party payment providers. We do not store full credit/debit card details.
• Technical information: IP address, device type, browser information, and security-related data necessary for authentication and platform protection.
• Communication data: customer support inquiries, complaints, or requests.

3. Purpose and Legal Basis of Processing

Your personal data is processed for the following purposes:

• To complete and manage reservations (legal basis: contract performance).
• To process payments securely (legal basis: contract performance and legal obligations).
• To provide customer support (legal basis: legitimate interest).
• To ensure platform security and prevent fraud or abuse (legal basis: legitimate interest).
• To send marketing communications (legal basis: your explicit consent).

4. Data Sharing

Your personal data may be shared with:

• Boat Providers: to fulfill your reservation.
• Payment service providers: to process financial transactions securely.
• IT, cloud, and hosting service providers: for technical infrastructure and platform operation.
• Public authorities: when legally required.

SaltyBooker.com does not sell personal data to third parties.

5. Data Retention

• Reservation and customer records: retained for up to 10 years in line with legal and tax obligations.
• Marketing data (e.g., newsletter subscriptions): retained until consent is withdrawn.
• Authentication session data: retained for a limited period necessary to maintain secure login sessions (currently up to 5 days).

6. International Data Transfers

Your personal data may be transferred outside the EU/EEA (e.g., if using cloud or payment providers based in the United States). In such cases, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Cookies and Similar Technologies

We currently use only strictly necessary cookies required for authentication, security, and proper functioning of the Platform.

In particular, we use a first-party authentication cookie ("session") to maintain secure user login sessions. This cookie expires automatically after a limited period (max 14 days).

We do not use analytical or marketing cookies at this time.

If we introduce analytical or marketing cookies in the future, we will first obtain your consent through a cookie banner in accordance with applicable data protection laws.

You may also control or delete cookies through your browser settings. Please note that disabling strictly necessary cookies may prevent you from using certain features of the Platform.

8. Your Rights Under GDPR

You have the following rights:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object, particularly to marketing communications

To exercise your rights, contact us at info@saltybooker.com.

We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• SSL encryption
• Access controls and authentication mechanisms
• Regular security updates and monitoring
• Backup and disaster recovery procedures

10. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours where required by law, and affected users where there is a high risk to their rights and freedoms, in compliance with GDPR.

11. Complaints

If you have concerns about how we handle your data, please contact us at info@saltybooker.com.

You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or your local data protection authority.

12. Changes to This Policy

We may update this Policy from time to time. The updated version will always be available on the Platform and will take effect upon publication.