1. Who the controller is and how to contact us
The controller of personal data, in respect of the processing operations for which it alone determines the purposes and means, is NORINOHI Sp. z o.o., trading under the CharterNavi brand. CharterNavi acts as a booking agent and broker for yachts, catamarans and other vessels offered by independent charter operators.
| Legal entity | NORINOHI Sp. z o.o. |
| Address | pl. Wolności 2/215, 35-073 Rzeszów, Polska |
| Company details | KRS: 0000986517 • NIP: 8133882807 • REGON: 522791109 |
| Website | https://www.charternavi.com |
| Privacy enquiries | office@norinohi.com |
2. Whose data we process and where we obtain it
We may process data relating to website visitors, enquirers, customers, payers, skippers, crew members and passengers (including minors), and representatives of our partners. Sources: the data subjects themselves, the person organising the booking, the charter operator, and providers of booking and payment systems.
Depending on the booking: full name, contact details and address, date of birth, nationality, passport details and copies of documents (only where reasonably necessary), crew composition, skipper licences and VHF certificates, booking details, payments, correspondence and technical identifiers.
3. Why we process data and on what legal basis
| Purpose | Legal basis under the GDPR |
|---|---|
| Handling enquiries and offers, brokered bookings and the contract with the customer | Art. 6(1)(b) GDPR and, for persons who are not party to the contract, Art. 6(1)(f) GDPR, as the case may be. |
| Information about other crew members, the crew list, document checks and transfer to the operator | Art. 6(1)(f) GDPR following a legitimate interests assessment; Art. 6(1)(c) GDPR only where the obligation rests on NORINOHI itself; another basis where required. |
| Collecting agency payments, accounting and tax | Art. 6(1)(b) or (f) GDPR depending on the actual relationship; Art. 6(1)(c) GDPR for NORINOHI's legal obligations. |
| Communication, security, prevention of misuse, protection of rights | Art. 6(1)(b) or (f) GDPR depending on the specific processing operation. |
| Marketing, advertising pixels, cookies and analytics | Consent under Art. 6(1)(a) GDPR where required; in certain permitted cases Art. 6(1)(f) GDPR, in compliance with the specific Polish rules on electronic communications. |
4. Who we share information with
The relevant independent charter operators, fleet owners and managers, port partners, competent authorities, banks and payment service providers, insurers (where required), providers of IT, hosting, CRM, booking platforms and marketing systems, accountants and legal advisers, in each case to the extent there is a lawful need. The charter operator is often a separate controller rather than a processor acting for NORINOHI; agreements under Art. 28 GDPR are concluded with genuine processors.
5. Transfers outside the EEA
In international charters, data may be transferred outside the European Economic Area. Where Chapter V GDPR applies, we rely on appropriate mechanisms: adequacy decisions, standard contractual clauses with supplementary measures where needed, or, in specific cases, narrowly applied statutory derogations. Information about the safeguards is available on request within the limits laid down by law.
6. How long we keep data
Enquiries: until they have been dealt with and for a reasonable period to protect against claims. Bookings and accounting records: in line with the specific periods laid down by law and the limitation periods for claims. Copies of crew passports: only until the necessary transfer or verification procedure has been completed, unless further retention is required by law or for a specific dispute. Marketing data: until consent is withdrawn or a justified objection is made, with records of consent possibly being retained. The specific periods are to be finalised in the internal retention policy.
7. Data subject rights and complaints
You may request access, rectification, erasure, restriction of processing and, where applicable, data portability; you may object to processing based on legitimate interests and, at any time, to direct marketing. You may withdraw your consent without affecting the lawfulness of processing carried out before its withdrawal. The safeguards under Art. 22 GDPR concerning decisions based solely on automated processing also apply.
Requests may be sent to NORINOHI's postal address or to the verified contact email address. We normally respond within one month, which may be extended as permitted by law. A complaint may be lodged with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) (www.uodo.gov.pl).
8. Crew data received from the booking organiser
Where information about a crew member is provided by the organiser, this document also serves as the notice under Art. 14 GDPR: the source is the organiser, and the categories of data are set out in section 2. Unless a statutory exemption applies, we inform the data subject within a reasonable period, and at the latest within one month of obtaining the data, or, where we communicate with the data subject or disclose the data to another recipient earlier, at the latest at that time, in accordance with the law.
We ask the organiser to inform the passengers, but this does not automatically release NORINOHI from its own information obligation. Passport data are not used for advertising profiling.
9. Whether providing data is mandatory
Data required for the enquiry, the contract, the crew list and procedures laid down by the operator or by law may be mandatory for a particular booking. Without them, the booking or participation in the charter may not be possible. By contrast, consent to advertising or optional analytics is not required for the core service.
10. Automated decisions, cookies and the full policy
Where there is a lawful basis, analytics and advertising platforms may segment users. This does not necessarily amount to a decision within the meaning of Art. 22 GDPR. If decisions based solely on automated processing with significant effects are introduced, we will provide the additional information and safeguards required by law.
Detailed provisions on cookies, international transfers and service providers are set out in the Privacy Policy. This short notice does not replace the full policy or the actual consent mechanisms.