Pre-launch legal draft
This page is a polished content scaffold. Replace every {PLACEHOLDER}, confirm the processing setup, and obtain professional legal review before relying on it operationally.
1. Who we are
Yachtbase is operated by {LEGAL_ENTITY_NAME}, with registered address at {REGISTERED_ADDRESS}. For privacy questions, contact {PRIVACY_CONTACT_EMAIL}.
Yachtbase may act as a controller for website, account and commercial-contact data. For customer workspace data, the role of Yachtbase and the customer may depend on the service and processing described in the applicable agreement.
2. Information we may process
Depending on how you interact with the service, this may include identity and contact details, company and role information, account credentials, workspace configuration, yacht and booking records, communications, support requests, consent choices, security events and technical information needed to operate the service.
We will not request special-category information unless a specific lawful purpose, safeguard and reviewed product flow exists.
3. Why we use information
Purposes may include providing and securing the service, responding to enquiries, configuring onboarding, supporting customer operations, preventing misuse, maintaining audit and delivery evidence, improving the service where permitted, and meeting legal obligations.
Each purpose must be mapped to a lawful basis before launch. The final version must specify the applicable basis, retention period and recipient category for each processing activity.
4. Providers and international transfers
Potential provider categories include hosting, authentication, email delivery, payment processing, support, analytics and connected communication channels. The final provider list and transfer safeguards will be published at {SUBPROCESSOR_LIST_URL} or in the applicable customer documentation.
No provider, transfer mechanism, retention period or certification should be treated as confirmed until the processing inventory is complete.
5. Your rights
Subject to applicable law, you may request information about processing, access, rectification, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw it without affecting prior lawful processing.
Contact {PRIVACY_CONTACT_EMAIL} to exercise a right. The final version must describe identity checks, response timelines and the right to complain to {GERMAN_SUPERVISORY_AUTHORITY} or the relevant authority.
6. Retention and deletion
Retention periods will be documented by processing purpose and record category at {DATA_RETENTION_POLICY_URL}. We will not claim a universal retention period where different account, legal, security and commercial records require different handling.
7. Security and incidents
We use technical and organisational measures appropriate to the service and risk. No website or service can promise absolute security. The final policy will describe incident contact and notification responsibilities without exposing private security mechanisms.