Name: SupaSailing
Availability: InStock
Author: SupaSailing

Charter season is the most demanding moment in the privacy lifecycle of a yacht. Within a few hours of a guest stepping aboard, the operator may collect their full name, passport number, dietary restrictions, medical conditions, allergies, dietary preferences, alcohol preferences, music preferences, sleeping habits, and even the names and ages of their children. By the time the charter ends, that data has flown across email, WhatsApp, spreadsheets and possibly a half-dozen apps. Under the EU's General Data Protection Regulation — and equivalent regimes worldwide — that situation is, very politely, a problem.

This guide is for charter operators, central agents, captains and yacht managers who want to handle guest data responsibly without drowning in legal complexity.

"The GDPR is not a checklist. It is a continuous discipline of knowing what data you have, why you have it, who can see it, and when you will throw it away."— European Data Protection Board guidance, 2024

What GDPR Actually Demands

The GDPR rests on six lawful bases for processing personal data, and a small set of principles that apply on top of them. For charter operations, the relevant bases are usually contract (you need the guest's name and contact details to deliver the charter they booked), legal obligation (port clearance, customs, flag-state crew lists), and occasionally consent (sending marketing communications after the charter ends).

The principles that always apply are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. In plain English: tell people what you do with their data, only collect what you actually need, keep it accurate and secure, throw it away when you no longer need it, and be able to demonstrate that you do all of the above.

Guest Preference Sheets: The Hidden Compliance Issue

The "guest preference sheet" is one of the most common documents in yachting and one of the most over-collecting. Operators routinely gather data on dietary requirements, allergies, prescription medications, marital status, religious observances, and political preferences (yes, really — to know which newspapers to stock). Much of that data is what GDPR calls special category data — health information, religious beliefs, political opinions — which require an additional explicit lawful basis to process.

Elegant superyacht owner suite at golden hour with panoramic ocean view — The data captured to deliver this experience is some of the most sensitive personal information any service business handles.

The fix is not to stop collecting useful information. The fix is to treat it correctly:

Collect only what is necessary. If you do not actually need to know a guest's blood type, do not ask.
Inform the guest in writing. A short, plain-language privacy notice attached to the preference sheet is enough. It must say what you collect, why, who sees it, how long it is retained, and how the guest can access or delete their data.
Limit access. The chef sees the dietary section. The captain sees medical conditions relevant to safety. The deckhand on tender duty does not need to see anything.
Set a retention policy. Many operators keep preference sheets indefinitely because "the guest might charter again". The compliant approach is to set a defensible retention window (12 or 24 months is common) and delete automatically.

Crew Personal Data: An Equal Concern

Crew data is often overlooked in the privacy conversation, yet it is just as sensitive. Seafarer Employment Agreements, hours of work and rest under MLC 2006, medical certificates, drug and alcohol test results, family contacts, bank details — all of this lives in the operator's systems for years.

The compliant pattern is the same as with guests: minimisation, transparency, access control, and retention. Crew should sign a clear privacy notice at the start of employment. Access should follow least-privilege. And on departure, personal data not needed for legal reasons should be securely deleted.

The Sub-Processor Problem

Every charter operator today uses sub-processors: a payroll system, an accounting tool, a CRM, a maintenance app, sometimes a separate guest experience platform. Under GDPR, you remain the data controller, and you are responsible for ensuring that every sub-processor handles the data properly.

Practically, that means:

Maintain a written sub-processor list, kept up to date.
Sign a Data Processing Agreement (DPA) with each.
Verify that they are GDPR-compliant — ideally via SOC 2 Type 2 or ISO 27001 certification.
Inform guests of the sub-processor list on request.

Cross-Border Transfers

The moment your CRM is hosted in the United States, or your photo gallery uses a Canadian backup provider, you are transferring personal data outside the European Economic Area. After the Schrems II ruling and the EU–US Data Privacy Framework, the rules are workable but not casual.

The practical answer: prefer EU-hosted services where possible (EU data residency clauses), use providers that have signed up to the Data Privacy Framework where US transfers are unavoidable, and document your transfer impact assessment. Most modern SaaS providers — including SupaSailing — let you choose your data residency region explicitly.

"Privacy by design is not a poster on the wall. It is a series of architectural choices that, taken together, make the right behaviour the easy behaviour and the wrong behaviour the difficult one."— Ann Cavoukian, originator of Privacy by Design

Subject Access Requests

Every guest and crew member has the right to ask what personal data you hold about them, to receive a copy, and to ask for it to be corrected or deleted. You have one calendar month to respond. In most cases the answer is straightforward — but if data is scattered across email, spreadsheets, and five different SaaS tools, it can take weeks of staff time to assemble a response. A unified system with proper search and audit makes this a 30-minute task.

Marketing Communications and Consent

Marketing emails after the charter — the gentle "we hope to host you again next season" — are technically a separate processing activity from the charter delivery itself. Operators commonly handle this badly, treating the contractual data as a free pass to send commercial messages. It is not.

The compliant pattern: at the time of booking, offer the guest a clear opt-in to receive marketing communications. Record the opt-in in your CRM with timestamp and source. Honour withdrawal of consent immediately. The European Commission's data protection guidance is unambiguous on this point: legitimate-interest justifications for unsolicited marketing have a high evidentiary bar.

Photography and the Guest Experience Trap

Charter crews routinely photograph the guests' experience aboard for the guest's own enjoyment — drone footage of the yacht under way, candid photos at anchor, video reels for social media. The guest typically loves this. The data protection question is rarely raised. It should be.

Photography of identifiable people is processing of personal data. Sharing photos publicly on the operator's social media — even with positive intent — without explicit guest consent is a GDPR violation that has resulted in fines. The simple remedy: a clear photo consent in the welcome pack. Yes for personal use; explicit additional yes for any commercial reuse.

Why a Single Platform Helps

Privacy compliance is, ultimately, a data architecture problem. The operator with one integrated system can answer a Subject Access Request in minutes, can prove access controls in a single audit log, can sign one DPA covering everything, and can apply retention policies consistently. The operator with seven disconnected tools cannot do any of these things reliably, no matter how many privacy notices they print.

This is why our charter management module, fleet management module, brokerage CRM, marina software and refit project management all run on the same hardened, GDPR-aligned foundation — with EU residency, RBAC, full audit trails, automated retention, and DPA available on request. Read more about our security and compliance posture.

A Practical Checklist

If you take only one thing from this article, take this list. If you can answer "yes" to all twelve, you are in good shape. If not, that is your roadmap.

Have you written a guest privacy notice and provided it before the preference sheet?
Have you written a crew privacy notice and provided it on engagement?
Do you collect only the data you actually use?
Do you have access controls so each role sees only what it needs?
Have you set retention periods and do you enforce them?
Do you maintain a sub-processor list with signed DPAs?
Do you know where your data is hosted geographically?
Can you respond to a Subject Access Request in under a week?
Do you have a documented data breach response plan?
Do you train new crew on privacy basics during onboarding?
Do you have explicit photo consent from guests?
Do you obtain valid opt-in for any marketing communications?

To explore how SupaSailing helps charter operators maintain GDPR compliance without slowing down operations, contact our team or book a demo.

The Yacht Manager and the Joint Controller Question

An often-overlooked legal dimension is the relationship between the yacht owner, the management company, the charter operator, and the central agent. Under GDPR, each of these may be a controller, joint controller, or processor depending on the specifics of the arrangement and the data flow. Getting this wrong is not academic: the supervisory authorities have, in recent enforcement actions, found that opaque controller relationships were themselves a basis for fines.

The compliant pattern is to document the relationships explicitly. The management agreement, the charter agreement and the central agency agreement should each contain a clear data protection clause that identifies who is controller, who is processor, what categories of data are handled, what the lawful basis is, and what each party's responsibilities are. The European Data Protection Board guidelines on controller/processor are the authoritative reference and should be required reading for the legal team that drafts these contracts.

Data Breaches: Anatomy of a Notification

Under GDPR, a personal data breach must be notified to the supervisory authority within 72 hours of discovery, and to affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms. This is not a hypothetical for yachts. Phishing-based credential theft, lost crew laptops, ransomware on the management company's CRM — each of these is a notifiable event.

The operator who has prepared a breach response plan in advance handles the 72-hour clock comfortably. The operator who has not is, by hour 36, frantically trying to assemble the basic facts that the regulator wants to see: what was breached, when, how, what data subjects are affected, what mitigations are in place. The plan is not complicated, but it has to exist before the incident, not after it.

Frequently Asked Questions

Does GDPR apply if our charter operator is registered outside the EU?

Yes, in many situations. The GDPR's territorial scope under Article 3 covers any organisation that offers goods or services to data subjects in the EU, regardless of where the organisation is established. A non-EU charter operator who markets to EU clients, or whose vessel operates in EU waters, is generally within scope.

Is consent always the safest legal basis to rely on?

No. Consent is often the weakest legal basis because it can be withdrawn at any time, and it must be freely given, specific, informed and unambiguous. For most charter data processing, contract or legal obligation are stronger and more reliable bases. Use consent only where it is genuinely the right basis, typically for marketing communications.

What is a Data Protection Officer and do we need one?

A Data Protection Officer (DPO) is an internal or external resource responsible for advising on GDPR compliance and acting as a contact point with supervisory authorities. Mandatory designation under Article 37 applies primarily to public bodies, organisations whose core activities involve large-scale systematic monitoring, or those processing special category data on a large scale. Most charter operators are not required to designate a DPO formally but benefit from a clearly-named privacy lead.

How long should we keep guest preference data after the charter ends?

There is no fixed answer in GDPR — the requirement is that retention is proportionate to the purpose. A common defensible retention period for charter operations is 12 to 24 months, on the basis that a returning guest may be more efficiently served if their preferences are retained. Beyond two years, the case becomes harder to defend; setting an automatic deletion at the appropriate window is the cleanest approach.

What happens if we suffer a data breach?

You have 72 hours from awareness to notify the relevant supervisory authority, plus an obligation to notify affected data subjects without undue delay if the breach is likely to result in high risk. Have the playbook ready in advance: who calls whom, what facts get gathered, how the regulator is contacted, what gets communicated externally and when.

GDPR for Charter Operators: Protecting Guest Data on Board