PRIVACY POLICY

Boataffair Privacy Policy Part 1

Privacy Notice

Valid from 25 May 2018

TABLE OF CONTENTS

Controller

The controller is Boataffair GmbH, Schuetzenstrasse 43, 5454 Bellikon, Switzerland.

Representative in the EU/EEA

The representative for Boataffair GmbH is Mr. Jerzy Sladkowski, Konstytucji 19, 41-200 Sosnowiec in Poland. Email: jerzy.sladkowski@gmail.com, phone: +48 607 722 270

General

Boataffair GmbH considers it important that its website users are informed as to when, for what purposes and which personal data are processed.

Boataffair GmbH reserves the right to amend this Privacy Notice from time to time. You should therefore read this Privacy Notice regularly. The date of the then-current version (valid from) may be found at the beginning of the Privacy Notice.

What are personal data?

Personal data means any information relating to an identified or identifiable natural person (e.g., name, address, telephone number, date of birth or email address).

In general, you can use our website without providing any personal data. The use of certain website services may require personal data to be provided, for instance in order to sign up for a newsletter, to leave a comment in our forum or to purchase participate in a sweepstake.

Personal data are therefore not processed as a matter of course, but rather only under certain circumstances and for specific purposes.

When are personal data processed in connection with BOATAFFAIR GmbH’s website?

In order to provide the Boataffair GmbH’s online services, Boataffair GmbH or third parties process personal data in connection with:

  1. Websites: Personal data are processed using [log files], [cookies], [analysis tools], and [plugins] of social media and other providers.
  2. User platform: Personal data are processed via registration form for our [user platform] in order to connect boat owners with boat renters, to list boats or to swap boats between boat owners.
  3. Order form: Personal data are processed via [order form] to buy e-gift cards which can be used for boat rentals.
  4. Experience newsletter: Personal data are processed on the basis of your consent in signing up for the [experience newsletter]. 
  5. User generated content: Personal data are processed via blog in order to provide information about experiences in various subject areas [user generated content].

For what purposes are personal data processed?

  • Optimising the website (e.g., market research and internet audience measurement)
  • Personalising the website for users
  • Providing users (boat owners or boat renters) with access to our user platform to rent or swap a boat
  • Providing information about listed boats of boat owners
  • Distribution of experience newsletters (email newsletters)
  • Distribution of user generated content via blog about various experiences
  • Dealing with orders of e-gift cards
  • Ensuring data security for the users of our website

On what legal basis does Boataffair GmbH process personal data?

Insofar as we obtain your consent to process personal data, your consent serves as the legal basis. This is the case for example in connection with experience newsletter.

We also process your personal data on the basis of our legitimate interest. This includes processing for purposes of:

  • optimising and personalising our website
  • ensuring data security
  • ensuring quality management of our services
  • granting access to our online platform for boat owners and boat renters
  • providing information for registered users about boat owners and boat renters
  • exchanging information (via messenger) about boat owners and boat renters for matching

When you order products or services within our user platform, we need to process your personal data for the performance of the contract we concluded with you. This includes processing which is necessary prior to entering into a contract.

To the extent personal data is processed based on a legal obligation, this serves as the legal basis. This may be the case for example relating to the disclosure of personal data to third parties or storage or retention periods.

The disclosure of personal data to third parties

Is personal data disclosed to third parties?

In general, we only disclose your personal data to third parties insofar as we have a legitimate interest in doing so or you have provided your consent.

Furthermore, your data may be disclosed to third parties insofar as we may be obliged to do so pursuant to legal provisions or an enforceable administrative or court order.

Are third parties used for processing data?

We use third party service providers for data processing. Service providers are generally involved as so-called "processors", who may only process the personal data of the users of our website in accordance with our instructions. For example, your email address may be passed along to a service provider in order for it to send you a newsletter you requested.

Is personal data sent to recipients in a third country (outside Switzerland, the EU or the EEA)?

We also provide personal data to third parties, respectively processors, that are not based in the EU/EEA or Switzerland. In this case, we ensure prior to disclosure either that the recipient provides an adequate level of data protection (e.g., on the basis of an adequacy decision for the relevant country, self-certification by the recipient for the EU-U.S. Privacy Shield, the application of standard contractual clauses of the European Union) or that our users have provided their consent.

We can provide you with an overview of the third country recipients along with a copy of the terms specifically agreed to in order to ensure an adequate level of data protection. Please use the details provided in the Contact section to do so.

 

Duration of storage and retention periods

For how long does Boataffair GmbH retain the personal data?

We store your data for as long as is necessary in order to provide our website services and the related services or for as long as we have a legitimate interest in continuing storage. In all other cases, we delete your personal data, with the exception of any data that we are required to retain in order to comply with legal obligations (e.g., retention obligations).

Rights of users

What are your rights as a data subject?

  1. Right of access: Users have the right to request confirmation from the controller as to which personal data concerning them is being processed and whether these data are being transmitted to a third country.
  2. Right to rectification: Users have the right to request the controller to correct any incorrect or incomplete personal data relating to them.
  3. Right to erasure: Users have the right to request the controller to erase promptly any personal data relating to them if these data are no longer necessary for the purposes for which they were collected or processed. The same applies if the data subject withdraws consent or objects to the processing in absence of an overriding legitimate interest of the controller or if these data are being unlawfully processed. The data subject may additionally execute this right in case where the controller is subject to a legal obligation to delete these personal data or when the personal data have been collected in the context of information society services.
  4. Right to restriction of processing: Users have the right to request the controller to restrict processing.
  5. Right to withdraw consent: Users have the right at any time to withdraw their consent to the processing of any personal data relating to them for any specific purpose or purposes if that processing is based on their express consent. The withdrawal of consent will not affect the lawfulness for the processing on the basis of that consent carried out prior to the withdrawal of consent.
  6. Right to object: Users have the right at any time to object to the processing of any personal data relating to them if the processing occurs on the basis of the legitimate interest of the controller or of a third party. Where personal data are processed for direct marketing purposes, users have an absolute right to object to such processing at any time.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection authority. In order to do so, you may contact the data protection authority competent for your place of residence or your federal state, or the data protection authority competent for us. This is:

Landesbeauftragter für Datenschutz und Informationsfreiheit
Baden-Württemberg
Postfach 102932
DE-70025 Stuttgart
Tel. 0711 / 61 55 41-0
Email: poststelle@lfdi.bwl.de

How can you exercise your rights?

In order to exercise your rights, please contact: privacy@boataffair.com.

Data protection contact

Please do not hesitate to contact us, respectively our Boataffair GmbH Data Protection Officer, by email to privacy@boataffair.com. for any information or with any suggestions regarding data protection.

If you wish to contact us, you may reach us as follows:

Boataffair GmbH
Schutzenstrasse 43
5454 Bellikon
privacy@boataffair.com

Boataffair Privacy Policy Part 2

Table of Contents

Log files

Each time you use the internet certain data is automatically transferred from your browser and stored by us in so-called log files. Some of the following log files are stored on our web server or on our web app.

  1. Information about the browser type and the version used
  2. The user's operating system (name/version) if available
  3. The user's browser name
  4. The user's IP address
  5. The date and time of access
  6. URL of our site pages
  7. Data of those users who are logged in (initially submitted at registration)
  8. When user edits his data when logged into his personal profile on boataffair.com
  9. Web app technical session id (not from cookies)
  10. GET/POST request parameters (from user browsers to us) for each request

The log files are stored by us in order to investigate defects and for security reasons. The rotation period for the web server is 52 weeks. Log files on the web app are stored for up to 10 days, after which they will be deleted. Log files that must be retained for longer periods for evidence purposes are excluded from deletion until the applicable incident has been reviewed and may in particular cases be passed along to investigating authorities.

Cookies

What are cookies?

Cookies are small text files that are sent whenever a webpage is visited and are stored in the user's browser. If the corresponding webpage is visited again, the user's browser will send back the content of the cookie, thereby enabling the user to be recognised.

For how long are cookies stored in the browser?

Some cookies are automatically deleted at the end of the browser session (so-called session cookies), others are stored in the user's browser for a specified period of time or indefinitely and thereafter deleted themselves (so-called temporary or permanent cookies).

Blocking or cancelling cookies?

Use the link provided below, you can see whether cookies from various providers have been activated and object to the collection or analysis of your data using their cookies: www.youronlinechoices.com

It is possible to object to various cookies in a blanket fashion, including in particular those of US providers, by clicking on the following link: optout.networkadvertising.org

Comprehensive information concerning cookies may be found on the following user portal: www.allaboutcookies.org

What cookies do we use and for what purpose?

We use cookies in order to make our website more user-friendly and to measure and analyse the usage of our website. Some elements of our website require that the browser which accesses the site can also be identified after switching to a different page. We also use cookies on our website that enable an analysis of the browsing habits of the users.

Absolutely essential cookies

Some cookies are essential in order for us to be able to securely provide our online services. This category includes, for example, cookies that are used in order to identify or authenticate our users.

Tracking cookies in connection with social plugins

The embedding of social plugins often results in plugin cookies being saved by providers.

Web analysis tools

We need statistical information in order to be able to make our website more user-friendly and to conduct market research.

We use the following web analysis tools for this purpose. The usage profiles generated by the tools using analysis cookies or from an analysis of the log files are not cross-referenced with personal data. The tools either do not use the IP addresses of users at all or abbreviate them immediately after collection. The providers of web analysis tools only process data as processors in accordance with our instructions and not for their own purposes.

For each web analysis tool, you can find information regarding the corresponding provider, as well as how to object to the collection and processing of data through the tool. Please note in relation to tools that work with opt-out cookies that the opt-out function is device- or browser-specific and generally only applies for the specific end device or browser used. In addition, you can also prevent usage profiles being generated overall by deactivating cookies in general.

  • Google Analytics: Google Analytics is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). We use Google Analytics along with the additional IP address anonymisation function offered by Google: This means that IP addresses will generally already by anonymised by Google within the EU, and only in exceptional cases not until they reach the USA, and that in any case they will only be stored in abbreviated form. You can object to the collection and analysis of your data through this tool by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Social plugins (plugins)

What are plugins?

Plugins enable the integration of social media into the website of Boataffair GmbH. The various providers of plugins are referred to below collectively as "plugin providers".

Plugins are deactivated as the default setting in order to prevent the automatic disclosure of user data to providers. Only after the user clicks on the plugin (Shariff plugin) is it activated and is data transmitted. Log files (including the IP address) are thereby transferred by your internet browser directly to a server of the relevant plugin provider and may be saved at that location. This server may be located outside the EU or the EEA (e.g., in the USA).

Prevent the activation of plugins?

If you do not wish to have data exchanged between you and social media, you should log out of social media before using the website of Boataffair GmbH. In addition, you should activate the private mode in your browser.

In addition, it is also useful to deactivate or restrict cookies in your browser settings in order to prevent third parties from being able to monitor your browsing habits. You can generally also completely prevent the loading of plugins by using add-ons for your browser (so-called script blockers).

Does Boataffair GmbH have any influence over the scope of data processing by plugins?

Plugins are independent extensions of the plugin provider. Boataffair GmbH does not therefore have any influence over the scope of the data collected and stored by the plugin providers through plugins. If any of the named plugin providers has stored a cookie on your device, it may record your browsing habits and generate detailed usage profiles using tracking data.

Further information concerning the purpose for which data are collected, the extent to which this occurs and the further processing and use of your data by the plugin provider along with your rights and configuration options in order to protect your data may be found in the Privacy Notices of the relevant providers. We use social plugins ("plugins") from the following providers in connection with our website:

  • Plugins from Instagram: Instagram is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"). An overview of Instagram plugins and their appearance may be found here: http://blog.instagram.com/post/36222022872/introducing-instagram-badges; information regarding data protection at Instagram may be found here: https://help.instagram.com/155833707900388/
  • Plugins from LinkedIn: LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (“LinkedIn”). An overview of LinkedIn plugins and their appearance may be found here: https://developer.linkedin.com/plugins; information regarding data protection at LinkedIn  may be found here: https://www.linkedin.com/legal/privacy-policy
  • Plugins from Twitter: Twitter is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA ("Twitter"). An overview of Twitter plugins and their appearance may be found here: https://twitter.com/about/resources/buttons; information regarding data protection at Twitter may be found here: twitter.com/privacy
  • Plugins from the social network Facebook: Facebook is operated under www.facebook.com by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, and under www.facebook.de by Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland ("Facebook"). An overview of Facebook plugins and their appearance may be found here: http://developers.facebook.com/docs/plugins; information regarding data protection at Facebook may be found here: www.facebook.com/policy.php
  • Plugins from Google+ and YouTube: Google+ is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). An overview of Google+ plugins and their appearance may be found here: https://developers.google.com/+/plugins; information regarding data protection at Google+ may be found here: www.google.com/intl/de/+/policy/+1button.html
  • Plugins from Stripe: Stripe is operated by Stripe Inc., 185 Berry Street, Suite 550, San Francisco, CA 94107. An overview of Stripe plugins and their appearance may be found here: https://stripe.com/ch/payments, information regarding data protection at Stripe may be found here: https://stripe.com/ch/privacy

User platform

We offer boat owners and boat renters to register at our user platform for renting or swapping a boat. The personal data collected through the user registration form means (name, surname, email) are necessary to create an account. For the verification of your account it is also necessary to provide your phone number. Additionally, you can upload a personal picture. This user profile offers you to rent or swap a boat, to communicate with registered users and as a boat owner to list your boat for renting and provide personal experiences. The processed personal data are used exclusively for the performance of the contract we have concluded with you or your company as well as to maintain our business relationship. We are not able to conclude a contract with you or your company if you fail to provide your personal data to us since the processing of your personal data constitutes a contractual requirement.

We delete any data that you transmit to us using the user platform as soon as their storage is no longer necessary or required by law (mandatory retention periods).

Order form

We offer you the opportunity to buy e-gift cards for boat rental. The personal data collected through the order form means (name, email, credit card details) are necessary to order e-gift cards. We do not hold credit card details as its white label solution provided by STRIPE – all credit card information is stored by stripe. We do not have access.

Experience newsletter

We offer you the opportunity to subscribe to our email newsletters (experience newsletter) in order to be updated about new experiences of boat owner’s trips. In doing so, you consent to receiving newsletters.

If you no longer wish to receive newsletters, you can revoke your corresponding consent at any time. Please use the unsubscribe function in order to do so, or contact us privacy@boataffair.com

User generated content

We integrate functions into the online content of Boataffair GmbH that enable our users to produce and publish their own contributions. This integration is important for Boataffair GmbH to allow users to participate actively in other users’ experiences. The functions require users to register or, in other words, to create an account.

If you have any questions regarding the processing of your personal data, please use the contact information provided in the receipt confirmation of your message or contact us privacy@boataffair.com

We delete any data that you transmit to us using contact forms as soon as their storage is no longer necessary or required by law (mandatory retention periods).

Technical information regarding browser settings

By using the privacy settings of your browser, you can to prevent third parties from being able to monitor your browsing habits. In order to do so you need to activate the private mode. In addition, it is also useful to deactivate or restrict cookies in your browser settings. You can generally also completely prevent the loading of plugins by using add-ons (script blockers) for your browser.

Further details can be found in your applicable browser instructions: