Atlas Sailing · Privacy notice / Privacybeleid

PART I — PRIVACY NOTICE How BV Buddha Events processes personal data for Atlas Sailing, from the first website visit until after the trip. 1. Controller and privacy contact Identity. BV Buddha Events, trading as Atlas Sailing, with its registered office at Ouden Heirweg 50A, 9340 Lede, Belgium, company and VAT number BE 0722.807.475, is the controller for processing whose purposes and means it determines. For privacy questions or to exercise your rights, contact maxim@atlassailing.be with the subject “Privacy”. Telephone: +32 476 58 66 90. Trading name. Atlas Sailing is a trading name, not a separate legal entity. References in this notice to “Atlas Sailing”, “Atlas”, “we” or “us” mean BV Buddha Events. 2. Scope and responsibilities Scope. This notice applies to www.atlassailing.be, account functions, quotations and bookings, newsletters, customer service, operational trip communications, competitions or promotions, reviews, and trips or charter intermediation under the Atlas Sailing name. Other controllers. A yacht operator, owner, skipper, port, carrier, insurer, payment service or other travel supplier may be an independent controller for its own legal and operational purposes. Its privacy notice then also applies. Atlas remains responsible for its own decisions and cannot transfer that responsibility through a contract. 3. Core principles Data minimisation. Atlas processes personal data lawfully, fairly and transparently, only for specified purposes, keeping it as accurate as possible and collecting no more and retaining it no longer than necessary, with appropriate security. Access is limited according to role and need. No implied consent. Visiting the website, opening an account or accepting general terms does not itself constitute consent to marketing, image use or non-essential cookies. Where consent is required, Atlas requests it separately and keeps evidence of it. 4. People whose data Atlas may process Website visitors, newsletter subscribers, prospective customers and people submitting questions or quotation requests. Lead bookers, travellers, crew members, beneficiaries, emergency contacts and legal representatives. Contacts at schools, employers, suppliers, skippers, yacht operators and other partners. People providing a review, photograph, video, complaint, damage claim, job application or other communication. 5. Categories of personal data Identity and contact details: name, address, email, telephone, nationality, date of birth and preferred language. Account and authentication data: account ID, verified email address, protected authentication data, roles and sign-in logs; when Google Sign-In is used, the information Google provides following authorisation. Trip and booking data: selected trip, dates, travelling party, cabin or sleeping arrangements, preferences, participant list, supplier, vouchers and operational arrangements. Identity and border information: passport or identity-document details, document number, expiry date, visa and crew-list information, only to the extent necessary. Financial and administrative data: price, invoicing details, payment status, bank or transaction reference, refund and security deposit. Atlas does not retain full card details when a payment service processes them. Communications and evidence: emails, telephone notes, chat and WhatsApp messages, consent logs, complaints, incident reports, photographs, reviews and contract versions. Technical data: IP address, time, device and browser information, security events, pages visited and cookie preferences. Special-category information a traveller voluntarily and necessarily shares, such as allergies, diet, mobility or health information. 6. Sources and information about fellow travellers Sources. Atlas receives information directly from the person concerned, from the lead booker or group organiser, from a school or employer arranging the trip, from travel suppliers, from the account or booking environment and, when the user chooses it, from an external authentication service such as Google. Lead booker. Anyone providing fellow travellers’ information to Atlas confirms that they may lawfully share it and gives those travellers a link to this notice in good time. Atlas provides the required information itself when it communicates directly with the person and no later than the legal deadline. 7. Purposes and legal bases Purpose | Main data | Legal basis Handling questions, quotations and bookings | Contact, trip, group and price information | Steps before entering a contract and performance of a contract Providing the trip or intermediation | Participant, crew, identity and operational information | Contract; legal obligation Payments, invoicing and accounting | Invoice, transaction and payment information | Contract; legal obligation Safety, assistance and incidents | Contact, location, incident and necessary health information | Contract; vital interests; legitimate interests; explicit consent where required Account and website security | Account, IP, device and log information | Contract; legitimate interests Customer service and disputes | Communications, contract, evidence and complaint information | Contract; legal obligation; legitimate interests Newsletters and offers | Name, email, preferences and consent evidence | Consent; legitimate interests only where legally permitted Publishing photographs, videos and reviews | Image, voice, name and text | Separate consent or another demonstrably appropriate basis Preventing fraud and abuse | Transaction, account, device and log information | Legitimate interests; legal obligation Service improvement and statistics | Feedback and aggregated or pseudonymised usage data | Legitimate interests; consent for non-essential trackers Balancing interests. When relying on legitimate interests, Atlas weighs its business or security interests against the person’s rights and reasonable expectations. The main interests are network and account security, fraud prevention, service provision, maintaining evidence and defending legal claims. 8. Requests, quotations, bookings and trip delivery Contract process. Atlas uses necessary information to check availability, prepare a quotation, identify the contracting party, obtain supplier confirmation, manage payments and documents, register participants or crew and provide support during the trip. No automatic marketing. If a request does not lead to a booking, Atlas does not automatically use the information for a newsletter. A separate marketing choice remains necessary, except for a limited customer relationship where permitted by law. 9. Identity documents, crew lists and border formalities Minimum collection. Atlas requests only the document fields or copy actually required by an authority, port, insurer or travel supplier. When fields are sufficient, a full copy is not requested. Unnecessary elements are masked or not collected. Documents are provided through a designated secure channel, not an open group chat. Short retention. After transfer to the relevant supplier or authority and once the operational need has ended, Atlas deletes copies as soon as possible, normally no later than ninety days after return, unless a legal obligation, incident or dispute demonstrably requires longer retention. 10. Health, allergies, diet and accessibility Special-category data. Atlas processes this sensitive information solely to deliver the trip safely and appropriately, based on explicit consent, vital interests or another applicable exception. Only necessary, specific information is requested; unrestricted medical records or irrelevant diagnoses are not required. Need to know. Information is shared only with staff, the skipper or suppliers who need it for safety or delivery. The operational copy is normally deleted within thirty days after the trip, except to the extent needed for an incident, insurance matter or legal obligation. 11. Payments, invoicing and security deposits Payment information. Atlas processes payment status, bank references and refund information to perform the agreement and meet accounting obligations. Where an external payment service processes card or bank-account information, Atlas generally receives only a token, status and limited transaction details, not the full card number or security code. Security deposits. Deposit information and evidence of damage are used only for reserving, releasing, disputing or recovering proven damage, and are restricted from staff without an operational or financial role. 12. Accounts, passwords and Google Sign-In Authentication. An Atlas account may involve processing a name, email, account ID, roles and security logs. Passwords are stored as technical hashes and are not readable by Atlas. When Google Sign-In is used, Atlas never receives the Google password, only the information and technical identifier Google provides under the chosen authorisation. Account security. Atlas may block suspicious sign-ins, terminate sessions and retain limited security information to protect accounts, bookings and payments. Users should report suspected misuse immediately. 13. Newsletters and direct marketing Consent. Newsletter registration uses a separate choice that is not preselected. Atlas records when, through which form and for which communications consent was given. Every commercial email includes a working, free unsubscribe option. Withdrawal does not affect earlier lawful processing. Existing customers. Atlas may offer similar services to existing customers without fresh consent only within the applicable legal limits. Customers receive a clear opportunity to object when information is collected and in every message. An objection to direct marketing is respected immediately; a minimal suppression record may be retained to prevent further sending. 14. WhatsApp and operational communications Visibility. Users who choose to click a WhatsApp link also communicate with WhatsApp/Meta under its terms. In a group chat, a telephone number, profile name, profile photograph and messages may be visible to other participants. Atlas explains this beforehand and offers an alternative for essential trip information where reasonable. Limited use. WhatsApp groups are solely for practical trip communications. Health information, identity documents, payment information and confidential complaints are handled through a separate secure channel. The group is closed or archived after the trip according to the applicable retention period. 15. Photographs, videos, reviews and social media Separate choice. Publishing recognisable images or a review linked to a person for promotional purposes requires separate, specific and freely withdrawable consent, or another demonstrably appropriate basis. Refusal does not affect the booking. Atlas explains the channel, purpose, possible paid advertising and expected duration beforehand. Withdrawal. After withdrawal, Atlas stops new use and removes its own online material where reasonably practicable. Already printed materials need not be recalled where that would be disproportionate, unless the law requires otherwise. Third parties sharing material outside Atlas’s control bear their own responsibility. 16. Recipients and sharing Categories. Atlas does not sell personal data. It may share necessary information with: yacht operators, vessel owners, skippers, ports, carriers, accommodation providers, activity providers and other travel suppliers; insurers, assistance providers, the Travel Guarantee Fund and competent authorities where their role requires it; hosting, database, account, cloud, email, document, support and payment providers processing under contract; Google when the user chooses Google Sign-In, and WhatsApp/Meta or social media when the user opens their service or consents; accountants, banks, auditors, lawyers, enforcement officers or other professional advisers for statutory administration or disputes; police, courts, regulators and port or border authorities where required by law or to protect essential rights. Contractual controls. Processors receive only the necessary instructions and contractual obligations concerning confidentiality, security, subprocessors, assistance with rights, incident reporting and deletion. Independent controllers receive only what they need for their own legitimate task. 17. Transfers outside the European Economic Area Safeguards. A trip, cloud service or communications service may involve processing outside the EEA. Atlas limits these transfers and uses an adequacy decision, approved standard contractual clauses with additional measures where needed, or another legally recognised safeguard. An occasional transfer necessary for the travel contract is used only within the strict legal conditions. Information. On request, Atlas provides information about the applicable mechanism and how to obtain a copy of relevant safeguards, while protecting confidentiality and third-party rights. 18. Retention periods Category | Normal maximum period | Exception Enquiry without a booking | 24 months after the last meaningful contact | Shorter following a valid deletion request; longer with renewed consent or an ongoing dispute Booking and contract file | Contract duration plus the applicable limitation and evidence period, normally no more than 10 years | Longer for ongoing proceedings or a legal obligation Invoices and transactions | Statutory tax and accounting period, generally 10 years where applicable | According to the specific tax obligation Passport copy or identity image | As soon as possible after transfer, normally no later than 90 days after return | Incident, claim or statutory retention obligation Health and accessibility | Normally no later than 30 days after return | Incident, insurance or an explicit request for a subsequent trip Account | Active use plus 24 months of inactivity | Contract documents and the suppression list are retained separately Security logs | 12 months | Longer for a security incident, fraud or legal claim Marketing profile | Until withdrawal or objection; review after 24 months of inactivity | Minimal suppression record to respect an objection Images and recordings | For the communicated campaign or until withdrawal; review at least every 3 years | Reasonable phasing out of already printed material Deletion. A shorter legal or contractually necessary period takes priority. When the period ends, Atlas securely deletes or anonymises the information. Backups are overwritten according to a limited rotation and are not reactivated for ordinary business purposes. These are Atlas’s retention duties; this notice does not imply that every deletion is automated. 19. Security and data breaches Measures. Atlas takes appropriate technical and organisational measures proportionate to risk and sensitivity: encrypted transport, strong authentication and multifactor authentication where appropriate, role-based access, logging, backups, updates, supplier checks, restricted exports and periodic deletion. Incident response. Suspected loss, unauthorised access or misdirected communications are escalated internally immediately. Atlas documents its assessment of risk and reports a notifiable data breach to the regulator without undue delay and within 72 hours where required. Affected people are informed where the risk to them is high. 20. Individual rights information about and access to the personal data Atlas processes; correction of inaccurate data and completion of incomplete data; erasure when no valid basis or retention obligation remains; restriction of processing in the circumstances provided by law; portability for automated processing based on consent or a contract; objection to processing based on legitimate interests and an absolute objection to direct marketing; withdrawal of consent for the future, as easily as it was given; human intervention and a right to challenge a solely automated decision with significant effects. Limits. These rights are not absolute. Atlas explains any lawful restriction, for example where retention remains necessary for invoicing, safety, other people’s rights or a legal claim. 21. Exercising rights and identity checks Procedure. Requests can be sent free of charge to maxim@atlassailing.be with the subject “Privacy”. Provide sufficient information to identify the request and the relevant data. Atlas normally responds within one month. For a complex or multiple request, the law may allow an extension of two months, with timely notice. Proportionate verification. Atlas requests additional identification only when there is reasonable doubt about identity. It does not routinely request a full identity-card copy and masks unnecessary information. Manifestly unfounded or excessive repeated requests may be refused or subject to a reasonable charge within the legal limits. 22. No solely automated decisions Human review. Atlas does not make a decision based solely on automated processing that has legal effects or otherwise significantly affects a traveller, unless permitted by law, necessary for a contract or based on explicit consent with appropriate safeguards. Ordinary fraud filters or availability checks may trigger human review but do not make a final decision without appropriate review. 23. Minors Additional protection. When a minor participates, Atlas processes their data only as necessary and through a parent, guardian, school or other authorised representative. Marketing or image consent is handled separately and in an age-appropriate way. Atlas does not ask a minor to share sensitive documents independently in a group channel. 24. Complaints, changes and applicable version Complaints. Contact Atlas first about a privacy concern so it can investigate. A complaint may also be submitted to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, via www.gegevensbeschermingsautoriteit.be. This does not limit any right to a judicial remedy. Updates. Atlas may update this notice when legislation, technology or services change. The publication date and version appear above. Material changes are announced appropriately; new consent is requested for new processing that requires it.