PRIVACY POLICY

1. USER INFORMATION AND DATA CONTROLLER

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), users are hereby informed that personal data provided through this website or in the course of their professional relationship with Navega Costa Ballena will be processed under the responsibility of:

• Owner: José David García Guerra

• NIF (Tax ID): 45937563P

• Contact Email: info@navegacostaballena.com

• Professional Qualification: Professional Yacht Master (Patrón Profesional de Embarcaciones de Recreo - PPER) and Judicial Expert in Recreational Vessel Valuation.

• Main Activity: Comprehensive nautical services, technical-judicial expert assessment, and commercial brokerage for yacht sales, purchases, and charters.

2. PURPOSE OF DATA PROCESSING

Personal data will be processed for the following specific purposes depending on the service requested:

• Yacht Charter (Own or Direct Fleet): Managing reservations, formalizing lease contracts, and complying with maritime safety regulations (vessel clearance and passenger manifests).

• Management and Commercial Operation: Processing management contracts with shipowners, supervising the fleet, and settling economic returns derived from vessel operation.

• Maintenance: Tracking technical interventions, managing repair warranties, and handling safety alerts or preventive maintenance notices.

• Vessel Surveying and Judicial Expert Assessment: Preparing technical reports and expert valuations of nautical movable property for private or judicial proceedings.

• Nautical Brokerage (Sales, Purchases, and Charters): Managing commercial intermediation, preparing brokerage mandates, and providing strictly necessary data to owners, shipowners, or central operators (Central Agents) for the formalization of final sales or charter contracts.

• Customer Support and Communication: Managing inquiries received via web forms, sending quotes, and delivering commercial communications related to the nautical sector.

3. LEGAL BASIS FOR PROCESSING

The legal grounds for processing your personal data are based on:

• Execution of a contract: For the performance of charter, management, maintenance, expert assessment, and commercial intermediation/brokerage services.

• Compliance with legal obligations: In the scope of Judicial Expert Assessments (assisting the administration of justice) and maritime safety regulations (under the Directorate-General for the Merchant Marine).

• Consent of the data subject: For resolving inquiries submitted via the contact form or for subscribing to newsletters.

4. PROCESSING OF MINORS' DATA

Regarding Yacht Charter services, identifying data of minors under 14 years of age (name and ID/Passport number) will be collected solely and exclusively to comply with legal obligations for vessel clearance and maritime safety before the competent authorities. This processing is always carried out with the express consent and signature of the parents or legal guardians in the lease contract.

5. DATA RETENTION PERIODS

Data will be retained for the minimum time necessary to fulfill the purpose for which it was collected, as well as applicable legal deadlines:

• Inquiry Data: 1 year from the last contact.

• Contracts (Charter, Management, Brokerage): A minimum of 5 years (according to the statute of limitations for civil liabilities).

• Tax and Accounting Data: 6 years as stipulated by the Spanish Commercial Code.

• Judicial Expert Reports: For the duration of the judicial proceedings and up to 5 years following the final, non-appealable ruling.

6. RECIPIENTS AND INTERNATIONAL DATA TRANSFERS

Your data will not be transferred to third parties, except under legal obligation, an inherent technical necessity for the service, or the execution of a contract:

• Shipowners, Owners, and Operators (Central Agents): In brokerage services, strictly necessary data of the interested parties will be transferred to the counterparty (sellers, yacht owners, or operators) to formalize and execute the final contract. In international charter operations, this may involve international data transfers, which are legally justified as they are strictly necessary for the performance of the service requested by the user.

• Maritime and Control Authorities: Directorate-General for the Merchant Marine, Maritime Captaincy, and the Maritime Service of the Civil Guard (Servicio Marítimo de la Guardia Civil).

• Administration of Justice: Judicial bodies within the framework of Judicial Expert Assessment activities.

• Technical Providers: Web hosting companies, tax advisors, and communication tools (such as WhatsApp Business or Google Workspace) that comply with European security standards and the Data Privacy Framework regulatory framework.

7. RIGHTS OF THE DATA SUBJECT

You may exercise your rights of access, rectification, erasure, objection, data portability, restriction of processing, and any other rights recognized by law:

• Restriction on Expert Assessments: Please be advised that the right to erasure may be limited by the legal obligation to retain expert reports while active judicial liabilities remain in effect.

• Exercising Your Rights: You must send a written communication to the email address info@navegacostaballena.com, indicating the right you wish to exercise. To process your request, you must verify your identity in a proportionate manner (for example, by sending the request from the same email account used to manage your contract or inquiry). In compliance with the data minimization principle, additional information (such as a copy of an identity document) will only be requested in exceptional cases where there are reasonable doubts regarding your identity.

• Complaints: You are also informed that you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its website: www.aepd.es.

8. SECURITY, CONFIDENTIALITY, AND DATA BREACHES

As an independent professional and owner of Navega Costa Ballena, I implement high-level security measures (file encryption and restricted access) to guarantee the complete confidentiality of expert reports, brokerage files, as well as data belonging to shipowners and clients.

• Incident Notification: In the event of a security breach affecting your data, the affected individuals and the AEPD will be notified within a maximum period of 72 hours.

• Professional Secrecy: The owner guarantees absolute professional secrecy regarding all technical, financial, and personal information obtained in the exercise of his activity as a PPER, Broker, and Judicial Expert.

9. JURISDICTION AND APPLICABLE LAW

This Privacy Policy is governed in each and every one of its aspects by Spanish law. For the resolution of any dispute that may arise, the parties expressly agree to submit to the Courts and Tribunals of Rota (Cádiz), unless applicable consumer protection law imperatively mandates otherwise.