Log inRequest a proposal

PRIVACY POLICY

Last updated: January 28, 2026

1. INTRODUCTION

Efforwai Digital Transformation S.L., operating under the trading name BoatConnect (“BoatConnect,” “we,” or “the Controller”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you:

  • Visit our website https://boatconnect.com
  • Use our software service (BoatConnect SaaS)
  • Communicate with us via email, phone, or chat
  • Register for a trial or subscribe to our services

This Policy complies with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
  • Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD)
  • Spanish Law 34/2002 on Information Society Services (LSSI-CE)

We recommend you read this Policy carefully before providing us with your personal data.

2. DATA CONTROLLER

Identity: Efforwai Digital Transformation S.L.
Trading name: BoatConnect
Tax ID (CIF): B67549659
Registered office: Carrer de la Llotja s/n, 08500 Vic (Barcelona), Spain
Email: info@thenauticalstudio.com
Phone: +34 93 702 72 86
Website: https://boatconnect.com

Data Protection Officer (DPO):

The DPO is responsible for protecting the fundamental right to personal data protection at BoatConnect and for compliance with applicable regulations.

Contact the DPO:

3. PERSONAL DATA WE COLLECT

3.1. Data you provide directly

A) When registering for BoatConnect (creating account):

  • Name and surname
  • Corporate email address
  • Company or organization name
  • Job title or position (optional)
  • Phone number (optional)
  • Password (stored encrypted using secure hash algorithm)
  • Country and city (optional, for personalization)

B) When using the BoatConnect Service:

As a user of the software, you enter into the system:

  • Commercial contact data: Names, surnames, emails, phones, companies, positions of your prospects and contacts
  • Sales opportunity information: Opportunity descriptions, estimated value, commercial notes, pipeline status
  • Product configurations: Boat models, technical specifications, prices, options
  • Commercial proposals: Generated documents including your client data and configurations
  • Tasks and notes: Reminders, comments, annotations related to your commercial activity
  • Attachments: Documents, images, PDFs you upload to the system

⚠️ IMPORTANT: You are the Data Controller of this data. BoatConnect acts as Data Processor. See section 9.

C) Billing information:

  • Billing name or legal name
  • Tax ID or VAT number
  • Complete billing address
  • Payment method information (via secure external provider; we do not store complete card details)

D) When contacting us (forms, email, phone):

  • Name
  • Email
  • Phone (if provided)
  • Company
  • Message or inquiry
  • Content of subsequent communications

3.2. Automatically collected data

A) Technical and browsing data:

  • IP address
  • Browser type and version
  • Operating system and device
  • Pages visited on our website
  • Date and time of access
  • Referral source (how you arrived at our site)
  • Time spent on pages
  • Clicks and interactions

B) Service usage data:

  • Features used
  • Frequency of use
  • Errors or issues encountered
  • Usage patterns (to improve the product)
  • Activity logs for security purposes

C) Cookies and similar technologies:

We use cookies to improve your experience. For detailed information, see our Cookie Policy.

3.3. Third-party data

Payment providers:

If you subscribe to a paid plan, our payment provider ([TO COMPLETE: Stripe/PayPal/other]) provides us with transaction confirmation, but we do not store your complete credit card details (only last 4 digits and expiration date for identification).

Commercial referrals:

If you contact us through a commercial partner or event, we may receive your basic contact details (name, email, company).

We process your personal data for the following purposes with their respective legal bases under GDPR Art. 6:

Purpose Data processed Legal basis Retention period
Manage your registration and user account Name, email, password, company Contract performance (Art. 6.1.b GDPR) During contractual relationship + 6 years
Provide BoatConnect Service (CRM features) All user data and entered contents Contract performance (Art. 6.1.b GDPR) During contractual relationship + 30 days after cancellation
Payment processing and billing Billing data, transaction history Contract performance (Art. 6.1.b GDPR) + Legal obligation (Art. 6.1.c GDPR) 10 years (legal tax obligation)
Customer service and technical support Contact data, communications history, technical data Contract performance (Art. 6.1.b GDPR) + Legitimate interest (Art. 6.1.f GDPR) During relationship + 3 years
Service improvement and new feature development Aggregated and anonymized usage data Legitimate interest (Art. 6.1.f GDPR) Anonymized data: no time limit
Send commercial communications about the Service (product updates, new features, webinars) Name, email Legitimate interest (Art. 6.1.f GDPR) for current customers
Consent (Art. 6.1.a GDPR) for non-customers		 Until consent withdrawal or objection
Comply with legal obligations (tax, accounting, response to authorities) According to legal obligation Legal obligation (Art. 6.1.c GDPR) According to applicable law (minimum 6 years tax)
Security, fraud prevention, and Service abuse Access data, logs, IP addresses Legitimate interest (Art. 6.1.f GDPR) Logs: 2 years
Incidents: 5 years from detection
Statistical analysis and analytical cookies use Browsing data, website behavior Consent (Art. 6.1.a GDPR) via cookie banner According to cookie settings
Respond to inquiries and information requests (contact form, demo) Name, email, phone, message Consent (Art. 6.1.a GDPR) explicit upon form submission Non-converted inquiries: 2 years
Converted to customer: according to contractual relationship

5. DATA RECIPIENTS (DISCLOSURES AND TRANSFERS)

Your personal data may be disclosed to the following categories of recipients:

5.1. Data Processors

Companies that provide us services and process data on our behalf, under contract guaranteeing GDPR compliance (Art. 28):

A) Infrastructure and hosting:

  • Provider: [TO COMPLETE: e.g., Amazon Web Services EMEA SARL / Hetzner Online GmbH]
  • Location: [TO COMPLETE: e.g., Frankfurt, Germany / European Union]
  • Purpose: Server, database, and application hosting
  • Safeguards: ISO 27001 certification, data encryption

B) Payment processing:

  • Provider: [TO COMPLETE: e.g., Stripe Payments Europe Ltd. / PayPal (Europe) S.à r.l. et Cie, S.C.A.]
  • Location: [TO COMPLETE: e.g., Dublin, Ireland / Luxembourg]
  • Purpose: Secure transaction and payment management
  • Safeguards: PCI-DSS Level 1, card data tokenization

C) Email communications:

  • Transactional email: [TO COMPLETE: e.g., SendGrid Inc. / Mailgun Technologies Inc.]
  • Location: [TO COMPLETE: USA with SCCs / EU]
  • Purpose: Service email delivery (confirmations, notifications, invoices)

D) Web analytics:

  • Google Analytics 4 (Google Ireland Limited)
  • Location: Ireland (data also processed in USA under safeguards)
  • Purpose: Website usage analysis, user experience improvement
  • Safeguards: Standard Contractual Clauses (SCCs), IP anonymization enabled
  • More information: Google Analytics Privacy

[TO COMPLETE if using other tools:]

  • Hotjar / Mixpanel / etc.: [Similar details]

E) Support and customer service:

  • [TO COMPLETE if using: Intercom, Zendesk, Freshdesk, etc.]
  • Location: [Complete]
  • Purpose: Support ticket management, live chat

List updates: Complete and updated list of data processors available upon request at info@thenauticalstudio.com.

We may disclose your data to the following entities when legally required:

  • Spanish Tax Agency (AEAT) and other competent tax administrations
  • Courts and Tribunals in compliance with court orders
  • Law Enforcement Agencies within legal investigation frameworks
  • Spanish Data Protection Agency (AEPD) or other data protection authorities
  • Other public administrations according to specific legal obligations

Legal basis: Legal obligation (Art. 6.1.c GDPR)

5.3. We do not sell your data

BoatConnect DOES NOT sell, rent, or share your personal data with third parties for their own commercial or marketing purposes.

5.4. International data transfers

General principle: All our data is stored on servers located in the European Union [TO COMPLETE specific location: e.g., Frankfurt, Germany].

Exceptions (if applicable):

Some of our service providers may process data outside the European Economic Area (EEA), specifically:

Provider Country GDPR Art. 46 Safeguards
Google Analytics USA Standard Contractual Clauses (SCCs) approved by European Commission + Supplementary measures
[Others if applicable] [Country] [Safeguards]

Safeguards for international transfers:

  • Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914)
  • Supplementary technical measures: Data encryption in transit and at rest, data minimization, pseudonymization where possible
  • Impact assessments: According to CJEU doctrine (Schrems II, judgment C-311/18)

You may request specific information about international transfer safeguards by contacting the DPO: info@thenauticalstudio.com.

6. DATA RETENTION

We retain your personal data for the time necessary for the indicated purposes and according to legal obligations:

Data type Retention period Criteria
User account data During contractual relationship + 6 years Civil action limitation period (Spanish Civil Code Art. 1964)
Billing and accounting data 10 years from invoice issuance Tax obligation (Spanish Tax Law Art. 30)
Data entered by Customer into Service (contacts, opportunities, proposals) During contractual relationship + 30 days after cancellation Allow Customer export. After 30 days: permanent deletion
System and security logs 2 years Security, fraud prevention
Security incident records 5 years from detection Defense of claims
Non-converted inquiry data (contact form) 2 years Possible future interest
Anonymized analytical data No time limit Not personal data (GDPR Art. 4.1)
Webinar recordings (if attended) 3 years Reusable training content
GDPR rights exercise records 3 years from exercise Demonstrate compliance to AEPD

Retention criteria:

  • During contractual relationship: Necessary to provide Service
  • After termination: Only to comply with legal obligations or defend claims
  • Data blocking: Once the necessary period expires, data is blocked (not accessible except for legal obligations) until legal actions prescribe

Secure deletion: After periods expire, data is securely and irreversibly deleted through:

  • Secure database erasure
  • Destruction of backups containing expired data
  • Destruction certificates when necessary

7. DATA SECURITY

BoatConnect implements appropriate technical and organizational measures to protect your personal data against accidental loss, destruction, alteration, unauthorized access, or unlawful disclosure.

7.1. Technical security measures

A) Encryption:

  • Data in transit: SSL/TLS encryption (HTTPS) on all connections
  • Data at rest: Database encryption using [TO COMPLETE: AES-256 / algorithm used]
  • Passwords: Hashed with secure algorithm (bcrypt/Argon2), never stored in plain text
  • Backups: Encrypted storage with periodically rotated keys

B) Access control:

  • Strong authentication: Mandatory strong passwords, two-factor authentication (2FA) option
  • Role-Based Access Control (RBAC): Each user accesses only what’s necessary according to their role
  • Data segregation: Each organization sees only its own data, total isolation between customers
  • Access logs: Logs of who accesses what data and when

C) Infrastructure protection:

  • Firewall: Traffic filtering, suspicious IP blocking
  • Intrusion Detection System (IDS): Continuous monitoring of anomalous activity
  • Security updates: Patches regularly applied to operating system and software
  • Vulnerability scanning: Periodic security audits

D) Backups:

  • Frequency: Daily automatic
  • Retention: [TO COMPLETE: 30 days / according to policy]
  • Location: Secure servers in [TO COMPLETE: EU / region]
  • Encryption: Yes
  • Recovery tests: Periodic to ensure functionality

E) Malware protection:

  • Antivirus and antimalware on servers
  • Scanning of user-uploaded files

7.2. Organizational security measures

A) Security policy:

  • Documentation of security procedures
  • Periodic policy review and update

B) Personnel access:

  • Principle of least privilege: Only authorized personnel with legitimate need
  • Confidentiality agreements signed by all employees
  • Training: Periodic training in data protection and security
  • Access logs: Audit of which employees access Customer data

C) Vendor management:

  • Due diligence: Vendor assessment before contracting
  • Data Processing Agreements (DPA): According to GDPR Art. 28 with all processors
  • Audits: Verification of critical vendor compliance

D) Incident response:

  • Documented procedure for security incident management
  • Assigned responsible team
  • Incident register: Documentation of all security breaches
  • Communication: Notification to AEPD and affected parties according to GDPR Art. 33 and 34

7.3. Security breach notification

In case of security breach posing a risk to data subjects’ rights and freedoms:

A) Notification to Supervisory Authority (AEPD):

  • Deadline: Maximum 72 hours from becoming aware of the breach (GDPR Art. 33)
  • Content: Nature of breach, affected data, probable consequences, measures adopted

B) Notification to data subjects:

  • If high risk exists: Communication without undue delay to affected parties (GDPR Art. 34)
  • Content: Clear description of breach, possible consequences, recommended measures

C) For Customers (as Data Controllers):

  • If breach affects data Customer processes (their commercial contacts), we will notify Customer so they can fulfill their notification obligations

D) Mitigation measures:

  • Immediate actions to contain breach
  • Investigation of causes
  • Implementation of corrective measures
  • Control improvements to prevent recurrence

8. YOUR RIGHTS AS DATA SUBJECT

As a person whose data we process, you have the following rights recognized by GDPR:

8.1. Right of access (Art. 15 GDPR)

What you can request:

  • Confirmation of whether we are processing your personal data
  • Access to your personal data
  • Information about processing purposes, data categories, recipients, retention period, data origin, existence of automated decisions

Format: Free copy of data in electronic format. Additional copies may involve reasonable administrative cost.

8.2. Right to rectification (Art. 16 GDPR)

What you can request:

  • Correction of inaccurate personal data
  • Completion of incomplete personal data

You can rectify many of your data yourself from your user panel in BoatConnect (account settings).

8.3. Right to erasure - “Right to be forgotten” (Art. 17 GDPR)

What you can request: Deletion of your personal data when one of the following circumstances applies:

a) Data no longer necessary for purposes for which collected b) You withdraw consent on which processing was based and no other legal basis exists c) You object to processing and no overriding legitimate grounds exist d) Data has been unlawfully processed e) Data must be erased to comply with legal obligation

Exceptions (we cannot delete data if necessary for):

  • Complying with legal obligation (e.g., retaining billing data for 10 years under tax law)
  • Establishing, exercising, or defending legal claims
  • Performing task carried out in public interest

After account cancellation: Your data is retained 30 days (for export) then automatically deleted.

8.4. Right to restriction of processing (Art. 18 GDPR)

What you can request: Temporary suspension of data processing when:

a) You contest data accuracy (while we verify) b) Processing is unlawful but you don’t want data deleted c) We no longer need data but you need it for legal claims d) You have objected to processing (while we verify whether our legitimate grounds override)

Effect: Data is retained but only used with your consent or for legal claims.

8.5. Right to data portability (Art. 20 GDPR)

What you can request: Receive personal data you have provided in structured, commonly used, machine-readable format (CSV, JSON) and transmit to another controller.

Applicable to:

  • Data you have actively provided
  • Processing based on consent or contract
  • Processing carried out by automated means

Not applicable to: Data generated by our system (e.g., logs, internal statistics)

BoatConnect facilitates portability: You can export your data anytime from your administration panel in standard formats (CSV, Excel, PDF).

8.6. Right to object (Art. 21 GDPR)

What you can request:

A) General objection: Object at any time to processing of your data when:

  • Processing is based on legitimate interest (Art. 6.1.f GDPR)
  • For reasons related to your particular situation

Effect: We will stop processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for establishment, exercise, or defense of legal claims.

B) Objection to direct marketing: Object at any time to processing of your data for direct marketing purposes (including profiling related to marketing).

Effect: We will immediately stop processing your data for these purposes.

How to object to marketing: You can:

  • Click “Unsubscribe” link in any commercial email
  • Contact info@thenauticalstudio.com
  • From your account settings (communication preferences)

8.7. Right not to be subject to automated individual decision-making, including profiling (Art. 22 GDPR)

What this right protects: Not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

Status at BoatConnect: BoatConnect DOES NOT make automated decisions that produce legal effects or significantly affect users. We do not use automated decision-making systems (e.g., automatic account approval/rejection, algorithm-based price changes, etc.).

Any decision affecting your account or service is reviewed and approved by a person.

If processing is based on your consent (GDPR Art. 6.1.a), you may withdraw it at any time.

Effect:

  • Consent withdrawal does not affect lawfulness of processing based on consent before withdrawal
  • We may continue processing your data if another legal basis exists (e.g., contract performance)

How to withdraw consent:

8.9. How to exercise your rights

You may exercise any of these rights by contacting us:

By email: info@thenauticalstudio.com (attention: Data Protection Officer)
By postal mail: Efforwai Digital Transformation S.L., Carrer de la Llotja s/n, 08500 Vic (Barcelona), Spain

Information needed in your request:

  1. Name and surname of data subject
  2. Email associated with account (if applicable)
  3. Copy of ID card, passport, or valid identification document
  4. Clear description of right you wish to exercise and reasons (if applicable)
  5. Address to receive response
  6. Signature (if paper request)

Response deadline:

  • 1 month from receiving your request
  • Extendable 2 additional months in complex cases (we will inform you of extension in first month)

Free: Exercising your rights is free of charge.

Exception: We could only charge reasonable fee if requests are manifestly unfounded or excessive (especially if repetitive). In such case, we would inform you beforehand.

Identity verification: To protect your data, we may request additional information to verify your identity before processing your request.

9. PROCESSING OF CUSTOMER’S CONTACT DATA (DATA PROTECTION ROLES)

⚠️ IMPORTANT INFORMATION FOR CUSTOMERS USING BOATCONNECT:

When you use BoatConnect and enter personal data of your commercial contacts (prospects, leads, company contacts), there are two distinct roles in personal data processing:

9.1. Customer as Data Controller

You (the BoatConnect Customer) are the Data Controller of personal data of your contacts that you enter into the Service.

This means you are responsible for:

a) Having valid legal bases to process that data under GDPR Art. 6:

  • Data subject consent
  • Contract performance with data subject
  • Controller’s legitimate interest
  • Legal obligation
  • Public interest task
  • Vital interest

b) Informing your contacts about data processing, including:

  • Your identity as data controller
  • Processing purposes (e.g., “commercial relationship management”)
  • Processing legal basis
  • That their data will be processed by BoatConnect (Efforwai) as data processor
  • Data retention period
  • Data subjects’ rights and how to exercise them
  • Possibility to lodge complaint with AEPD

Suggestion: Include this information in your own privacy policy and ensure your contacts have access to it.

c) Obtaining consents when necessary (e.g., if legal basis is consent)

d) Handling data subject rights requests from your contacts (access, rectification, erasure, portability, objection)

e) Complying with all data protection regulations applicable in your jurisdiction

f) Not entering special categories of data (GDPR Art. 9) without complying with additional requirements:

  • Health data
  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Genetic or biometric data
  • Sexual orientation

g) Not entering data of minors under 14 (13 in other EU countries, 16 GDPR default) without valid parental consent

9.2. BoatConnect (Efforwai) as Data Processor

BoatConnect (Efforwai Digital Transformation S.L.) acts as Data Processor of personal data of contacts that Customer enters into the Service.

Our obligations as Data Processor (GDPR Art. 28):

a) We process data only according to your documented instructions:

  • These Terms and Conditions and this Privacy Policy constitute your instructions
  • We only use data to provide BoatConnect Service
  • We do not use data for our own purposes

b) We ensure confidentiality of personnel with data access

c) We implement appropriate technical and organizational measures to protect data (see section 7)

d) We do not subcontract to other processors without informing you (sub-processor list in section 5.1)

e) We assist Customer in complying with their data protection obligations, to the extent possible:

  • Facilitating data export to handle data subject rights
  • Providing necessary information for impact assessments
  • Cooperating in audits if necessary

f) We delete or return data upon service termination:

  • After 30 days from account cancellation
  • Upon Customer’s express request (erasure right exercise)

g) We make available to Customer all information necessary to demonstrate compliance with our obligations

h) We notify Customer without undue delay of any security breach affecting personal data

9.3. Data Processing Agreement (DPA)

These Terms and Conditions include mandatory Data Processing Agreement clauses under GDPR Art. 28.

If you need a separate or specific DPA for your organization (e.g., corporate compliance requirement), you may request it by contacting:

9.4. Customer responsibility

BoatConnect DOES NOT verify and is NOT responsible for:

  • Legality of personal data entered by Customer
  • Existence of valid legal bases for processing
  • Customer’s compliance with their obligations as Data Controller
  • Specific content of data (e.g., whether accurate, updated, lawful)

Customer assumes full responsibility for personal data processing performed using BoatConnect Service and will hold Efforwai harmless from any claim, sanction, or cost arising from Customer’s breach of data protection regulations.

10. MINORS’ DATA

BoatConnect is aimed at businesses and professionals.

We do not intentionally collect data from minors under 14 years (minimum age in Spain under LOPDGDD Art. 7) or under 16 years (GDPR default age, unless Member State establishes lower age not less than 13).

If we detect we have collected minor data without valid parental consent, we will delete that data immediately.

If you are a parent or guardian and believe your child has provided us personal data without your consent, contact us immediately:

Customer responsibility: If Customer enters minor data into the Service (e.g., commercial contacts who are minors), it is Customer’s sole responsibility to ensure they have valid legal bases and consents.

11. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies on our website and Service.

For complete and detailed information about cookies we use, see our Cookie Policy.

Summary:

  • Technical/necessary cookies: Essential for Service operation (no consent required)
  • Analytical cookies: Measure and analyze usage (consent required)
  • Preference cookies: Remember your settings (consent required)

Cookie management: You can configure or reject cookies anytime:

  • From our cookie settings panel
  • From your browser settings

Our website and Service may contain links to third-party websites not under our control.

We are not responsible for privacy practices or content of those third-party websites.

Recommendation: We recommend reading privacy policies of any third-party websites you visit.

13. MODIFICATIONS TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect:

  • Changes in our data processing practices
  • Legislative or regulatory changes
  • New Service features
  • Recommendations from data protection authorities

Last modification date: Always indicated at beginning of this Policy

Notification of substantial changes:

  • Material changes affecting your rights: Email notification to registered users at least 30 days in advance
  • Minor changes or clarifications: Publication of updated version on our website

Recommendation: Review this Policy periodically to stay informed about how we protect your data.

14. RIGHT TO LODGE A COMPLAINT WITH SUPERVISORY AUTHORITY

If you consider processing of your personal data violates GDPR or LOPDGDD, you have the right to lodge a complaint with the competent data protection authority.

In Spain:

Spanish Data Protection Agency (AEPD)

Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
Phone: 901 100 099 / +34 91 266 35 17
Website: https://www.aepd.es
Electronic headquarters: https://sedeagpd.gob.es
Electronic form: Available at electronic headquarters

Filing a complaint:

  1. Identify yourself
  2. Describe facts motivating complaint
  3. Attach supporting documentation (communications with BoatConnect, evidence)
  4. Indicate what rights you consider violated

Deadline: No limitation period, but acting diligently is recommended

Free of charge: Filing complaints with AEPD is free

No prior procedure required: You may file complaint directly with AEPD without contacting us first, although we recommend trying to resolve the matter with us first by contacting our DPO: info@thenauticalstudio.com.

15. CONTACT AND DATA PROTECTION OFFICER

For any questions related to processing of your personal data, exercising your rights, or this Privacy Policy:

Data Controller:

Efforwai Digital Transformation S.L. (BoatConnect)
Tax ID: B67549659
Address: Carrer de la Llotja s/n, 08500 Vic (Barcelona), Spain
Email: info@thenauticalstudio.com
Phone: +34 93 702 72 86
Website: https://boatconnect.com

Data Protection Officer (DPO):

Email: info@thenauticalstudio.com
Postal address: Carrer de la Llotja s/n, 08500 Vic (Barcelona), Spain
Subject: “Attention: Data Protection Officer”

Business hours:
Monday to Friday, 9:00 AM - 6:00 PM CET

Last updated: January 28, 2026
Version: 1.0

STATEMENT:

This Privacy Policy has been prepared in compliance with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
  • Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD)
  • Spanish Law 34/2002 on Information Society Services (LSSI-CE)
  • Guides and recommendations from Spanish Data Protection Agency (AEPD)
  • Guidelines from European Data Protection Board (EDPB)

Efforwai Digital Transformation S.L. commits to processing your personal data with utmost diligence, respect, and transparency, ensuring at all times compliance with data protection regulations and your rights as data subject.