1. Who we are (data controller)
Maestral Speedboat Charter, operated by Solaris Villae d.o.o., based in Split, Croatia. Contact: hello@splitspeedboat.com. We are the data controller for personal data collected via this website.
2. What data we collect
When you contact us: what you send us on WhatsApp, by phone or by email — usually your name, the date, the route, how many of you and, for an airport pick-up, a flight number. The message builder on this website writes that text in your browser. Nothing you pick in it is sent to us or stored, on this site or anywhere else, until you press send in WhatsApp or your email app yourself. If we send you a payment link: Stripe collects your card details directly; we receive your name, your email and the amount. When you browse: a cookieless page count via Vercel Web Analytics, which records the page, the country and the device type, sets no cookie and stores nothing that identifies you; and Vercel Speed Insights, which measures how quickly pages load on real devices. Google Ads conversion measurement runs only after you accept marketing cookies. It records that a WhatsApp, phone or email link was tapped, with the price of the route or trip where the page knows it — never the text of your message. On an online payment it also carries an irreversible SHA-256 hash of the email address you gave Stripe; your browser does the hashing, and the hash cannot be turned back into the address. We set no cookies at all until you give explicit consent.
3. Why we use it
Your messages: to reply to you and, if you book, to run your transfer or trip. Legal basis: steps you ask for before a contract, and the contract itself (GDPR Art. 6.1.b). Page counts and speed measurements: to see which pages people actually read and to catch a page that loads badly on a phone. Legal basis: our legitimate interest in a working website (GDPR Art. 6.1.f), which is proportionate because neither sets a cookie nor identifies anyone. Conversion measurement: to learn which advertisement led to a real conversation or booking, so we stop paying for the ones that do not. Legal basis: your consent (GDPR Art. 6.1.a), given through the cookie banner and withdrawable at any time.
4. Who we share it with
WhatsApp (Meta Platforms Ireland) carries the messages you send us there; chats are end-to-end encrypted, and WhatsApp's own privacy policy covers your use of it. Other service providers we use: our email host (for hello@splitspeedboat.com), Vercel (hosting, page counts and speed measurement, EU/US), Sanity (content management, EU), Stripe (payments, only if you pay online, EU/US), and Google Ads (US, under the EU-US Data Privacy Framework). Google receives the conversion event described above only when you have accepted marketing cookies. All processors handle data under standard contractual clauses or equivalent. We never sell your data, and we pass nothing you wrote to advertisers.
5. Retention
WhatsApp chats, emails and call notes: 24 months from our last exchange, then deleted. Page counts and speed measurements: aggregate only, with no record tied to a person. Google Ads conversion data: retained by Google under its own advertising data policy. You may ask us to delete your data at any time.
6. Your rights (GDPR)
Access (Art. 15) — get a copy of your data. Rectification (Art. 16) — correct errors. Erasure (Art. 17) — be forgotten. Restriction (Art. 18). Portability (Art. 20). Object (Art. 21). Withdraw consent at any time. Contact hello@splitspeedboat.com to exercise. You may also lodge a complaint with the Croatian data protection authority (AZOP) at azop.hr.
7. Security
We use TLS 1.3 for all transit, encrypted storage, and minimum-access principles. We do not store payment data — Stripe handles all card information directly under PCI-DSS Level 1.
8. Changes
We may update this policy. Material changes are announced via website banner at least 30 days before taking effect.