Privacy Policy
1. Controller
The data controller is TOP LIGHT d.o.o. ("Split Yacht Charter"), Split, Croatia, e-mail: info@splityachtcharter.com. This policy explains how we process personal data on this website, in line with the EU General Data Protection Regulation (GDPR).
2. Data we collect
Inquiries: name, e-mail, phone and your message. Reservations: guest and crew details (name, e-mail, phone, country), booking and payment schedule data. Optional user account: e-mail, password (stored only as a cryptographic hash), profile details and saved favourites. Reviews: rating and text you submit. Technical data: short-lived server logs (IP address, request data) for security and abuse prevention.
3. Purposes and legal bases
We process data to perform the charter contract and handle your requests (Art. 6(1)(b) GDPR), to comply with legal obligations such as invoicing and crew registration (Art. 6(1)(c)), on the basis of your consent for the optional account and reviews (Art. 6(1)(a)), and for our legitimate interest in the security and reliability of the service, including rate limiting (Art. 6(1)(f)).
4. E-mails before and after your charter
If your inquiry turns into a charter, we send you a few service e-mails about it: about 7 days and 1 day before check-in (marina and check-in time, crew list link, checklist, contact) and, the day after your return, an invitation to review the yacht with at most one reminder. To know that the charter takes place, we match the reservation in the NauSYS system — where the yacht owner records bookings, including the guest's name and e-mail — with your inquiry by e-mail address, yacht and dates; from the reservation we use only your name, e-mail, yacht, dates, check-in time and the crew list link. Guests who did not contact us through this website receive nothing. The legal basis is the performance of the charter contract (Art. 6(1)(b) GDPR) for the pre-charter e-mails and our legitimate interest in genuine, verified reviews (Art. 6(1)(f)) for the review invitation. Every such e-mail contains an unsubscribe link, and you can object at any time by e-mail. This data is kept for the same period as inquiries. Reviews are published only after moderation, with your first name, the initial of your surname and the month of the charter.
5. Recipients and processors
Data is shared only as needed to complete your booking: with the NauSYS charter management system in which our fleet and reservations are managed, with our payment provider (card data is entered directly with them and never reaches our servers), with our e-mail delivery provider for transactional messages, and with our hosting provider in the European Union (Germany). We never sell personal data.
6. International transfers
Data is processed within the EU/EEA. Should a provider outside the EEA ever be engaged, we will ensure appropriate safeguards under Chapter V GDPR (e.g. Standard Contractual Clauses).
7. Retention
Booking and invoicing records are kept for the periods required by Croatian accounting and tax law (up to 11 years). Inquiries are kept up to 2 years. Account data is kept until you delete your account — deletion is available in your account settings and takes effect immediately, while booking records are retained as required by law. Security logs are kept briefly.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. Contact info@splityachtcharter.com to exercise any right.
9. Complaints
You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, www.azop.hr) or with the supervisory authority of your EU country of residence.
10. Security
The site is served exclusively over TLS (HTTPS), passwords are stored only as salted hashes, and access to personal data is restricted. Payment card data is handled solely by the certified payment provider.
11. No profiling; children
We perform no profiling or automated decision-making and show no personalised advertising. The service is not directed at children; bookings require legal capacity to contract.
12. Changes to this policy
We will update this policy when our processing changes and indicate the date of the latest revision on this page.
Last updated: 25 October 2026.