Privacy Policy

1. Introduction

This Privacy Policy describes how SupaSailing SL ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website (https://supasailing.com) and use our contact and demo request forms. We are committed to ensuring the highest level of data protection in accordance with:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
• Ley Orgánica 3/2018, de 5 de diciembre — de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD)
• Ley 34/2002 (LSSI-CE) — regarding electronic communications and cookies
• Directive 2002/58/EC — ePrivacy Directive (as transposed in Spanish law)

2. Information We Collect

2.1 Contact and Demo Request Data

When you submit a contact form or request a demo, we collect:

• Identity Data: First name, last name
• Contact Data: Email address, company name
• Communication Data: Subject, message content, preferred demo module

2.2 Technical and Usage Data

We automatically collect certain technical information when you visit our website:

• Technical Data: IP address (anonymized), browser type and version, operating system, device information
• Usage Data: Pages viewed, time spent on pages, referring website (aggregated and anonymized)
• Location Data: Country-level geographic data only

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies (including localStorage) to enhance your browsing experience. For detailed information about the specific cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

3. How We Use Your Information and Legal Basis

We use your personal information for the following purposes, each with a specific legal basis under GDPR Article 6:

We will never sell, rent, or share your personal information with third parties for their marketing purposes.

4. Data Sharing and Sub-processors

We share your information with the following trusted third-party service providers who assist us in operating our website. All sub-processors are contractually obligated to protect your data under GDPR-compliant Data Processing Agreements:

SCCs = Standard Contractual Clauses approved by the European Commission for international data transfers.

5. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure that all such transfers comply with applicable data protection laws and that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission

6. Data Retention

We retain your personal information only for as long as necessary:

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• TLS/SSL encryption for all data in transit
• Regular security assessments and updates
• Access controls limited to authorized personnel
• All access is logged and monitored
• Staff bound by strict confidentiality agreements

8. Your Rights Under GDPR and LOPDGDD

Under the GDPR and the Spanish LOPDGDD, you have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request that we limit how we use your personal data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw consent for analytics cookies or marketing at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days, as required by law.

9. Children's Privacy

Our website is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

10. Data Breach Notification

In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR Article 33. We will also notify the competent supervisory authority.

11. Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with this Privacy Policy or applicable data protection laws, you have the right to lodge a complaint with your local supervisory authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will update the "Last Updated" date at the top of this policy and, for material changes, we will post a prominent notice on our website.

13. Related Legal Documents

• Terms of Service — Conditions governing the use of our website
• Cookie Policy — Information about cookies and tracking technologies
• Legal Notice — Company identification and legal information (Aviso Legal)

14. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data protection rights: