Privacy Statement (GDPR EU 2016-679)

The following information is made available by Abayachting S.r.l., operating the activity of yacht brokerage, in accordance with the Italian Personal Data Protection Code (Legislative Decree n. 196/2003 and subsequent amendments and additions) and with article 13 and 14 of Regulation (EU) 2016/679 on personal data protection.

Personal Data received from our customers are used for the purposes described here below by ABAYACHTING S.R.L. with registered office in Collegno (TO) – Viale Gramsci n. 16, as the Privacy Treatment Owner, that can be contacted on the following e-mail address gdpr@abayachting.com.

Abayachting S.r.l., in accordance with the purpose of the required treatment and to the extent strictly necessary, collects different types of Personal Data from the customer, normally standard data (personal and contact details) and/or fiscal data. It may also be necessary to treat particular data in order to meet the needs of the customer (after receiving his/her consent).
In addition, Abayachting S.r.l. traits Personal Data given by the user to third parties, such as service providers, or Personal Data that entered public domain, such as commonly recognised Personal Data, Personal Data visible on personal Website or blog, or posted on publicly accessible social media profiles, that use different privacy policies, please consult them on their websites. In particular, Personal Data are treated by the Owner mainly using CRM services called Navis.net, provided by Digibusiness SRL (Navis.net is a specific Information System for Customer Relation Management in the nautical field). The Owner, by establishing the Navis.net service contract, has formally entrusted Digibusiness SRL as external Treatment Controller. Digibusiness SRL is based in Collecchio (PR – Italy), address Strada Consortile n. 2, and the treatment mode of this system ensures conformity to GDPR EU 2016-679, in terms of safety and data protection, as documented in a specific document published on the Website www.navisnet.it in the Privacy section.
Personal Data are collected either on a compulsory or an optional basis, as they are necessary to supply the requested services.
When providing Personal Data is compulsory, they will be labelled as such by Abayachting S.r.l. . If the client does not provide the Data labeled as compulsory, it could be impossible for the Company to execute the process or the activity requested by that Client. In those cases where Abayachting S.r.l. labels some Data as optional, clients are free to abstain from providing those Data, without however affecting the availability of the Service or its being operational.

The above mentioned Personal Data collected by Abayachting S.r.l. are used on the basis of a legitimate justification (so called “Legal basis of the treatment”) and for a number of purposes listed here below. Abayachting S.r.l. can collect Personal Data on the basis of the consent or without the consent of the involved Client, according to the purposes listed here below:

The data (or part of them) collected by Abayachting S.r.l., according and only limited to the described purposes, may be communicated to:

• anyone that collaborates with the company for the execution of the obligations arising from the contract (by way of example but not of limitation: shipping/transport companies);
• public bodies, authorities and/or other subjects for the fulfilment of legal obligations;
• third-party companies and/or bank institutions for the management of credit;
• enterprises, companies, natural persons, named treatment controllers and/or privacy contacts, that cooperate to the execution of the service on behalf of the owner, duly appointed and instructed, whose list is available at the company’s office upon specific request via e-mail gdpr@abayachting.com, under the observance of the duty of confidentiality (information technology service companies, website management, system administration, accountant).

The treatment will be carried out automatically and/or manually, in accordance with art. 32 of GDPR 2016/679 regarding security measures, by persons specifically appointed and educated. The approach of Abayachting S.r.l. is not to store the Personal Data of their customers forever. Personal Data will be stored by Abayachting S.r.l. to the extent necessary and with the sole aim of pursuing the purposes described above. After achieving their aim, Abayachting S.r.l. will delete Personal Data, unless their storage is requested by law, on a national, European or international basis. The criterion used by Abayachting S.r.l. to identify the data storage period takes into account the legal retention period (that is often set in ten years for fiscal and accounting obligations) and the ten-year limitation period within which any rights against the company may be claimed.

It may happen that Abayachting S.r.l. must transfer personal data to extra-EU countries. In any case of transfer of Personal Data to a non-EU country, Abayachting S.r.l. undertakes to:

• Ensure an adequate level of protection by establishing appropriate safeguards and by respecting the provisions of Regulation (EU) 2016/679;
• Manage the transfer of Personal Data on the basis of:
  1. adequacy decisions of the European Union; or
  2. standard contract terms / binding company rules; or
  3. code of conduct approved by the competent control authority / official certificates on security.
• Manage the transfer of Personal Data on the basis of the consent of the Customer whose Personal Data must be transferred, or on the basis of the derogations in accordance with art. 49 of the Regulation (EU) 2016/679 if the transfer presents risks to the rights and freedoms of the Customer, it cannot be carried out on the basis of the above mentioned cases a), b), c).

In case of questions about the protection of their Personal Data or about the exercise of their rights, the user/customer can contact Abayachting S.r.l. at any time by writing to the following e-mail address: gdpr@abayachting.com.
After the treatment of Personal Data, the customer has several rights that can be exerted provided for here below.
The customer has to be as specific as possible any time he/she wants to exert their rights, as Abayachting S.r.l. can respond appropriately only to requests formulated in sufficient detail.
Abayachting S.r.l. will have to verify the identity of the customer in as much detail as possible, in order to avoid the another person tries to exert the rights of the interested subject. To this purpose, the customer will be asked to provide an identification document valid at the moment of such request.
Right of access: if the customer wants to access Personal Data treated by Abayachting S.r.l., or needs further information regarding:

• Purposes of the Treatment;
• Categories of Personal Data involved;
• Categories of addressees to whom Personal Data have been or will be communicated;
• Foreseen period of conservation of Data or criteria used to establish such period;
• Rights of the interested subject;
• Rights that can be exerted by the interested subject regarding the Treatment carried out by Abayachting S.r.l.;
• The existence of an automated decision process, including profiling, and the foreseen consequences;

and any other available information about the Treatment of Personal Data, must e-mail the following address: gdpr@abayachting.com
Abayachting S.r.l. will use Personal Data provided by the interested subject for the sole purpose of verifying and proceeding with the Treatment of the request.
If the customer exerts the right of access, Abayachting S.r.l. will provide a list as complete as possible or a copy of Personal Data.
Right of supplement/rectification/cancellation/limitation of the treatment of one’s Personal Data:
It may happen that some Personal Data stored by Abayachting S.r.l. are not (or have ceased to be) correct. The customer can ask for the correction or integration of their Personal Data at any moment. If the customer wants Abayachting S.r.l. to cancel his/her Personal Data, the request will be processed, unless there is a prohibition or incompatibility in accordance with law or legitimate interests about cancellation. The customer can obtain at any moment the limitation of a Treatment of his/her Personal Data already underway.
Right to data portability: In certain circumstances, the user has the right to receive all Personal Data provided in a structured format, commonly used and in a machine-readable format. He/she can also request Personal Data portability to another proprietor of the treatment, wherever technically possible.
Right to the withdrawal of consent: every time the customer provides Abayachting S.r.l. with their consent to the Treatment of Personal Data, he/she can withdraw such consent at any later moment following the suggested procedure and as easily as he/she has provided it. If the customer wants to withdraw his/her consent, they can do it at any moment, without prejudicing the lawfulness of the Treatment based on the consent provided before the withdrawal.
Right to object to the processing of Personal Data and to the processing by means of automated decision-making systems: The customer has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data, including profiling. The customer has the right not to be subject to a decision which is based solely on automated processing, including profiling, which produces legal effects concerning him/her or which significantly affects him/her. The customer can exercise the above mentioned rights by means of a dedicated written request addressed to: gdpr@abayachting.com
Right to lodge a complaint with the supervisory authority: the Customer who disagrees with the Personal Data Processing methods of Abayachting S.r.l. can lodge a complaint with the Data Protection Authority of his/her residence country.

Abayachting S.r.l. has implemented adequate security measures in order to maintain the integrity and safety, and also prevent the destruction, loss, accidental or illegal alteration, unauthorised disclosure or access to Personal Data transmitted, stored or otherwise processed, in line with Regulation (EU) 2016/679.

This Data Protection Policy can be revised or updated in the light of any future laws on a international, European and national basis.
The customer can always find the most recent version of the Data Protection Policy of Abayahting S.r.l. on their website.