Privacy policy

1. Controller

Haller Experiences S.L., Paseo Juan Carlos I s/n, Local 32 | Box 2, 07800 Eivissa, Spain. Represented by Johannes Haller. E-mail: sales@hallerexperiences.com, phone: +34 650 977 081.

2. Visiting the website

The website runs on servers in Germany (Hetzner Online GmbH). When you visit, the web server processes technically necessary data: IP address, date and time, page requested, browser and operating system, referrer. This data serves secure operation and is deleted after a short time.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is a stable and secure website.

3. No cookies, no analytics

This website sets no cookies and uses no analytics or advertising services. Fonts and videos are served from our own server, so no data is passed to third parties for them.

The sales test stores your language choice in your browser (local storage and session storage). This is technically necessary for the function you requested (§ 25 (2) no. 2 TDDDG). It never leaves your device.

4. Forms: demo, contact and sales test

When you submit a form we process the details you enter: name, e-mail, phone (optional), company, role, your message and, for the sales test, your answers and result. An automation (n8n, running on our own server at Hetzner in Germany) passes them into our CRM. The CRM stores the data with Supabase (Supabase Inc., USA) in a data centre in the EU (Stockholm). Any access from the US is covered by EU standard contractual clauses.

We use the data to answer your request and prepare a demo. Required fields are marked; without them we cannot handle your request. The sales test result is an assessment for you and us; no automated decision within the meaning of Art. 22 GDPR takes place.

The legal bases are Art. 6 (1) (b) GDPR (steps prior to a contract) and Art. 6 (1) (f) GDPR (our interest in handling requests).

5. Booking via Calendly

Appointments can be booked via Calendly (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). The calendar only loads after you click to open it. Only then is data passed to Calendly, in particular your IP address and the details you enter when booking, and Calendly sets cookies. Transfers to the US rely on the EU-US Data Privacy Framework, additionally on EU standard contractual clauses.

The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time with effect for the future by no longer opening the calendar and deleting Calendly's cookies in your browser.

6. Buying online via Stripe

If you buy BoatMatch online, we redirect you to a Stripe checkout page (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). There you enter your contact, company, billing and payment details and, if applicable, your VAT ID. Stripe processes the payment and subscription and passes us the data we need for the contract, invoicing and setup. We never receive your full card details.

The legal bases are Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (statutory retention duties under tax and commercial law). Stripe also processes data as an independent controller for fraud prevention and its own legal obligations. Data may be transferred to Stripe, Inc. in the US; Stripe is certified under the EU-US Data Privacy Framework and additionally uses EU standard contractual clauses. Details: stripe.com/privacy.

We keep invoices and contract data for as long as commercial and tax law requires (usually 6 years from the end of the financial year).

7. Using BoatMatch (SaaS)

When customers use BoatMatch we process personal data on their behalf (contact details of leads and clients, communication content, usage data). This is based on a data processing agreement under Art. 28 GDPR. The respective customer is the controller for this data.

8. Disclosure

We only disclose data where this is necessary to perform a contract, where we are legally obliged to, or where we use service providers as processors. Transfers to third countries only take place with appropriate safeguards.

9. Retention

We keep data only as long as necessary for the respective purpose. Statutory retention duties, for example for invoices and contracts, remain unaffected; we restrict such data for other purposes and delete it when the period ends.

10. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Write to sales@hallerexperiences.com. You may also lodge a complaint with a supervisory authority, for example the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or the authority where you live or work.

Right to object (Art. 21 GDPR)

Where we process data based on Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal note to sales@hallerexperiences.com is enough.

11. Security

We transfer all data encrypted (HTTPS) and use technical and organisational measures to protect it against loss and unauthorised access.

12. Changes

We update this policy when the website or the legal situation changes.