Version: October 2026 (published 21 September 2026, updated 18 October 2026)Versión: octubre 2026 (publicada el 21 de septiembre de 2026, actualizada el 18 de octubre de 2026) · SEAESTA SEAEMPRE S.L. · CIF B26964437
Seaesta Seaempre S.L. ("Seaesta", "we", "us") operates a boat rental service with professional skipper from Port Fòrum, Barcelona, Spain. This Privacy Policy explains what personal data we collect, for what purposes, how long we retain it, with whom we share it, and what rights you have under the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD 3/2018).
This policy covers: (a) visitors to our website seaestaboats.com; (b) customers who make a direct booking; (c) customers who book through third-party platforms (GetYourGuide, Click&Boat, etc.) and subsequently interact with Seaesta directly; and (d) passengers whose data is submitted via the pre-boarding form.
When you book directly through seaestaboats.com, we collect:
Legal basis: Article 6(1)(b) GDPR - performance of the rental contract.
Rentals with a departure date from 1 October 2026 (with professional skipper). Before boarding, the person who booked completes a passenger list with the full name and ID or passport number of every person on board (up to 4 guests). No photographs or scans of identity documents are collected. On the day, each person carries their original identity document, which the skipper may check; we do not copy or store it.
This data is collected to identify the persons on board as required by our insurance coverage, the vessel's despatch documentation and our operational safety procedures, and to manage any incident.
Rentals with a departure date up to 30 September 2026 (without skipper). For these rentals we collected via the pre-boarding form the full name and ID or passport number of drivers and passengers, plus a photograph or scan of the official identity document of the designated driver(s), to verify their identity and eligibility under Spanish maritime law. These copies are kept under the retention rules in section 3 and section 8.
Legal basis: Article 6(1)(b) GDPR - contract performance; Article 6(1)(c) GDPR - compliance with legal obligations under Spanish maritime law; Article 6(1)(f) GDPR - legitimate interest in the safety of the persons on board and incident management.
From 1 October 2026 every rental sails with a professional skipper appointed by Seaesta. The rental contract you sign states the skipper's full name and identity document number, so that the person in command of the vessel is identified in the same way as in the vessel's crew list. These are data of Seaesta staff: you may use them only for the purposes of your rental contract and must not disclose or publish them.
Legal basis: Article 6(1)(b) GDPR - contract performance (both towards you and towards our staff); Article 6(1)(c) GDPR - maritime crew documentation obligations.
From 18 October 2026 you sign the rental contract on our website, seaestaboats.com. We record what you enter (full name, ID or passport number, phone number), your handwritten signature drawn on screen, the date and time you opened and signed the contract, the IP address of your connection and the browser you used. These data are printed on the signed contract and on its electronic signature record; we keep both with your booking and email you a copy at the moment of signature.
Legal basis: Article 6(1)(b) GDPR - contract performance; Article 6(1)(f) GDPR - legitimate interest in being able to prove that the contract was concluded.
Rentals from 1 October 2026: no security deposit, card hold or cash guarantee is requested. The card used to pay for a direct booking is kept on file by Stripe (Seaesta never sees the full card number) for one purpose only: charging, after written notice and as set out in section 07 of our Terms & Conditions, the documented cost of damage caused wilfully or negligently by your group to the vessel, its equipment or the extras. If no damage occurs, the card is never charged again.
Rentals up to 30 September 2026: a security deposit of €250 was required as a temporary hold (pre-authorisation) on your card via Stripe, requested no later than 72 hours before departure, or left in cash at the port. The hold is released within 10 business days after the rental, subject to the conditions in the Terms & Conditions applicable to those rentals.
Legal basis: Article 6(1)(b) GDPR - contract performance; Article 6(1)(f) GDPR - legitimate interest in protecting our assets.
We send booking confirmation emails, the link to complete your booking (contract, passenger list, optional extras), a reminder the day before departure, and operational communications (e.g. weather cancellations, rescheduling). These are necessary for the performance of the contract and do not require separate consent. Around one hour after your rental we may send a single email inviting you to leave a review on Google; it contains only a link, no data is shared with Google unless you choose to write a review, and you can ignore it or ask us at info@seaestaboats.com not to receive it.
Legal basis: Article 6(1)(b) GDPR - contract performance; for the review invitation, Article 6(1)(f) GDPR - legitimate interest in improving our service (Art. 21 LSSI-CE, communication about a service you purchased).
We may in the future offer the option to subscribe to marketing communications (seasonal offers, news, etc.). Any such communications will be sent only with your explicit prior consent, via a clearly marked opt-in mechanism. You may withdraw consent at any time by clicking "unsubscribe" in any email or by contacting info@seaestaboats.com. Withdrawal of consent does not affect the lawfulness of prior processing.
Legal basis: Article 6(1)(a) GDPR - consent.
Our web hosting infrastructure may collect standard server logs (IP address, browser type, pages visited, timestamps) for security and performance purposes.
Legal basis: Article 6(1)(f) GDPR - legitimate interest in maintaining website security and operational integrity.
With your consent, given through the cookie banner, we use Google Analytics 4 (Google Ireland Ltd) to understand how visitors use seaestaboats.com (pages visited, approximate location, device, traffic source, bookings completed). IP addresses are not stored by Google Analytics 4. Without your consent no analytics cookie is set and no data is sent to Google Analytics. You can withdraw or change your choice at any time through "Cookie settings" in the website footer.
Legal basis: Article 6(1)(a) GDPR - consent (Art. 22 LSSI-CE for the cookies themselves).
| Data type | Retention period | Reason |
|---|---|---|
| Booking records and contracts | 6 years | Spanish tax law (Ley General Tributaria, Art. 70) and commercial law (Código de Comercio, Art. 30) |
| Accounting and payment records | 6 years | Spanish tax obligations |
| Identity document copies (drivers, rentals up to 30 September 2026 only) | 1 year after rental end date, or until any open claim is resolved | Evidence in case of damage, incident, or maritime authority audit |
| Passenger list (name and document number) | 1 year after rental end date, or until any open claim is resolved | Insurance, maritime documentation and incident management |
| Card on file (payment token held by Stripe, rentals from 1 October 2026) | Not used after the rental unless a damage claim is open; you may ask us at any time to detach it | Charging documented damage as described in section 2.3 |
| Email communications | 2 years | Customer service and dispute resolution |
| Server logs | 90 days | Security monitoring |
| Marketing consent records | Until consent is withdrawn + 1 year | Proof of consent (GDPR accountability, Art. 5(2)) |
Data will be deleted or anonymised at the end of the applicable retention period as part of our regular data hygiene process, unless we are required to retain it longer by applicable law or by an ongoing legal or administrative procedure.
We share your personal data only with the following categories of recipients, and only to the extent strictly necessary for the purpose indicated:
Third-party booking platforms: If you booked through GetYourGuide, Click&Boat, or another platform, that platform acts as an independent data controller for the booking data it collects from you. Seaesta acts as an independent data controller only for the additional data it collects directly (pre-boarding form, identity documents). Please refer to the privacy policy of the relevant platform for information on their data practices.
We do not sell, rent, or otherwise monetise your personal data. We do not use data brokers or advertising networks.
Some of our service providers are based outside the European Economic Area (EEA):
In all cases, we have verified that appropriate safeguards are in place in accordance with Chapter V of the GDPR before initiating any transfer of personal data outside the EEA.
As a data subject under the GDPR and LOPDGDD, you have the following rights:
Our website uses two kinds of cookies and similar technologies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| sea_lang, sea_cfg_v4, seaesta_pending_state, sea_promo_shown, seaesta_tc_accepted (browser storage) | Necessary | Remember your language, keep the booking in progress while you pay, remember that you closed a notice. Set by seaestaboats.com only. | Session or up to 2 minutes (config cache); T&C notice until cleared |
| seaesta_cookie_consent (browser storage) | Necessary | Stores your cookie choice so the banner is not shown again. | 12 months |
| _ga, _ga_* | Statistics (Google Analytics 4) | Distinguish visitors and sessions to produce aggregate usage statistics. Set only after you accept statistics cookies. | Up to 13 months (_ga), 13 months (_ga_*) |
Necessary cookies do not require consent (Art. 22.2 LSSI-CE). Statistics cookies are set only if you accept them in the cookie banner; you can accept, refuse or change your choice at any time via "Cookie settings" in the footer, or by deleting cookies in your browser. Refusing statistics cookies has no effect on booking or using the website.
We do not use advertising cookies, remarketing pixels or social media cookies. The embedded Google Map in the "Location" section is loaded only when you click "Show map" and is subject to Google's privacy policy.
For rentals from 1 October 2026 we no longer collect copies of identity documents. Copies of identity documents (passport or national ID card) collected via the pre-boarding form for rentals up to 30 September 2026 may contain data that, in certain contexts, could qualify as sensitive. We treat such data with heightened care and apply the following specific measures:
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of it, and will inform affected individuals without undue delay where required under GDPR Art. 34.
Our booking service is directed exclusively at adults aged 18 and over. We do not knowingly collect personal data directly from children under 16 through our booking process. Passenger data for minors on board is collected solely for maritime safety and legal compliance purposes and is subject to the same retention and security standards as all other passenger data. If you believe we have inadvertently collected data from a minor in circumstances not related to a confirmed rental, please contact us immediately at info@seaestaboats.com.
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we use. The version date at the top of this page indicates the most recent revision. For material changes that affect your rights or how we process your data, we will notify customers with active or recent bookings by email at least 15 days before the change takes effect. We encourage you to review this page periodically.
For any privacy-related questions, to exercise your rights, or to submit a data protection complaint: