Privacy.

SailSeeker Ltd, registered in Malta with its office at Ta’ Xbiex, is the data controller for the platform. Write to privacy@sailseeker.io for anything in this document.

The operator you book becomes a controller in their own right for the charter itself, and for the safety and licensing records they are required to keep. What we pass to them is listed below and nothing more.

Browsing the site collects nothing that identifies you. Everything in this table is triggered by an action: making a booking, sending a message or writing a review.

Four parties, and no others.

• The operator you booked. Your name, phone number, guest count, ages where children are aboard, and your licence where the boat requires one. They do not receive your card details, and they do not get the details of anyone whose request they declined.
• The payment processor. Card data goes directly to them and is tokenised. We see the last four digits, the outcome and the amount.
• Hosting and email. Infrastructure providers inside the European Economic Area, acting on our instructions under a processing agreement.
• Authorities, where the law requires it. A Transport Malta or tax enquiry, or a court order. This is rare and we will tell you unless we are prohibited from doing so.

We do not sell personal data, and we do not share it with advertising networks or data brokers. There is no commercial arrangement under which anyone pays us for access to our guest list, and there will not be one.

The retention column above is the whole policy. The six-year figure is not arbitrary: it is the period for which Maltese VAT and company records have to be retained. Once a record passes it, the booking is reduced to an anonymous line for reporting, holding the boat, the date and the value, with nothing that identifies a person.

Requests that an operator declined, and abandoned bookings, are deleted after 90 days.

On servers in the European Union. Where a processor operates outside the EEA, the transfer runs on the European Commission’s standard contractual clauses and we hold the documentation. We do not transfer booking data outside the EEA for any purpose of our own.

Under the GDPR you can exercise all of the following, free of charge, and we answer inside 30 days.

• Access. A copy of everything we hold about you.
• Rectification. Correction of anything wrong, which for most people means a phone number that has changed.
• Erasure. Deletion, subject to the records we are legally required to keep for tax. A guest can do this themselves under Account, Profile, Delete this account.
• Restriction and objection. Including objecting to anything we do on the basis of legitimate interests.
• Portability. Your booking history in a machine-readable file.
• Withdrawal of consent. For a published review, at any time, without affecting what was lawful before.

Write to privacy@sailseeker.io. We may ask you to confirm the email address a booking was made from before releasing anything.

Traffic is encrypted in transit. Access to booking records is limited to the people who need it and is logged. Card data never touches our systems. If a breach occurs that is likely to put your rights at risk, we notify the Information and Data Protection Commissioner within 72 hours and tell you directly.

The platform is not for use by children, and accounts are for adults. Children aboard are recorded only as an age, given by the person booking, so the operator brings correctly sized life jackets. That age is deleted with the rest of the booking record.

Come to us first at privacy@sailseeker.io. If you are not satisfied, the supervisory authority in Malta is the Office of the Information and Data Protection Commissioner, at idpc.org.mt, and you may also complain to the authority in your own country of residence.

The date at the top of this page moves when the document does. A material change is emailed to anyone with a live booking rather than quietly published.