Privacy Policy

Global personal data processing policy. The primary legal framework is the GDPR (EU/EEA), with regional provisions for other markets.

1. About the company and scope

CharterNavi is the trading name under which NORINOHI Sp. z o.o. (the “Company”, “CharterNavi”, “we”) carries on an international business as an intermediary in the charter of yachts, catamarans, motor boats and other vessels. Website: https://www.charternavi.com.

This Policy describes how we process the personal data of website visitors, people who send enquiries and make bookings, payers, skippers, passengers and crew members, contact persons at our partners, and users of our support and communication channels.

NORINOHI Sp. z o.o. acts as the data controller where it determines the purposes and essential means of processing. Where we carry out a particular operation on behalf of, or jointly with, another controller, the legal roles are determined by the actual relationship and the relevant arrangements. Some charter operators, payment institutions and other partners may be independent controllers.

This Policy is based on Regulation (EU) 2016/679 (GDPR), as the Company is registered in Poland. Where the laws of other countries apply to a particular activity, the relevant local requirements described in section 19 also apply. Not every regional law applies automatically merely because a user can access our website from the country concerned.

2. The nature of CharterNavi's business: agent and intermediary

CharterNavi acts as an independent yacht broker / intermediary agent between the customer and the vessel owner, charter company or operator (the “Operator”). We help select an offer, pass on enquiries, arrange bookings and communication, accept payments within the scope of our authority as agent, prepare the relevant documents and administer refunds in accordance with the applicable terms.

The yacht itself is provided, and the charter agreement performed, by the Operator, unless the specific agreement provides otherwise. Arranging such an agreement may require the exchange of the personal data of the customer and crew members between NORINOHI and the Operator. The charter relationship is governed by separate booking terms and the Operator's agreement; this Policy governs data processing only.

3. What personal data we may process

We do not require special categories of data under Article 9 GDPR as a general condition of booking. Where a particular request (for example, assistance for a passenger with reduced mobility) requires health information or other special category data, we identify a separate legal basis, minimise the data and apply specific safeguards. The full payment card number and CVV may be processed directly by the payment provider; we make no statement as to whether we do or do not store such details without verifying the specific integration.

4. Where we obtain information

• Directly from you: through the website, enquiry form, booking, email, telephone, messaging apps, payment or support.
• From the person organising the booking: when they enter details of other crew members or passengers.
• From the Operator, a booking technology provider or other partners: to confirm a booking or a change of dates, crew composition, payments or claims.
• From banks, payment and anti-fraud providers: transaction confirmations and checks on transactions.
• Through technical logs, cookies, analytics and advertising: only within the limits of an appropriate legal basis and the user's settings.

5. Purposes and legal bases of processing (GDPR)

For individuals whose data processing falls within the GDPR, the legal basis is determined for each specific operation. The matrix below sets out the general approach; it is subject to reconciliation with the actual booking flow and the Company's processes.

Where we rely on legitimate interests, we carry out a balancing test between the Company's needs and the individual's rights. Withdrawing consent does not affect the lawfulness of processing before its withdrawal and does not cancel processing based on another appropriate legal basis.

6. Which data is required and what happens if it is not provided

Contact details, information needed to prepare an offer and certain crew details may be necessary to process an enquiry or make a booking. Some passport details and documents may be required under the Operator's terms or port, border or other applicable requirements. If the required information is not provided, we or the Operator may be unable to arrange or perform the booking concerned.

Providing data for optional advertising, advertising personalisation and most analytics trackers is not a condition of access to the website's core features.

7. Personal data of all crew members and passport documents

The person organising the booking may provide data about other people. We ask them to inform the participants that the information is being passed on and to give them a link to this Policy, but this does not replace NORINOHI's obligations under Article 14 GDPR towards individuals whose data has been obtained indirectly.

Where Article 14 GDPR applies, the information is provided to those individuals within a reasonable period, but no later than one month after the data is obtained; if the data is used to make first contact, no later than the first communication; and if disclosure to another recipient is envisaged, no later than the first disclosure, save in the situations provided for by law. Where we hold no contact details for crew members, we assess lawful ways of informing them and document the approach chosen.

We collect passport details and copies only where their necessity has been confirmed for the specific charter. The data may be passed to the Operator and, where required by law, to the competent port, border or other authorities. Access to such documents is granted only to authorised persons; they are not passed to advertising networks and are not used for behavioural profiling. The retention period for passport copies is set separately and is not automatically equated with the retention period for accounting records.

8. Who we share personal data with

• Operators and vessel owners, fleet managers, agents at the charter location and their authorised persons: solely for the booking concerned.
• Booking platforms (including Booking Manager and Nausys): where personal data actually passes through the relevant integration, rather than vessel availability data only.
• Banks and providers of payment, acquiring, anti-fraud and refund services: within the scope of the transaction.
• Providers of hosting, CRM, cloud storage, email, SMS, messaging, technical support and cybersecurity services.
• Analytics and advertising services: only for tools that are actually active, in compliance with consent, opt-out and regional legal requirements.
• Accountants, auditors, legal advisers, insurers and public authorities: where there is an appropriate basis.

Appropriate agreements under Article 28 GDPR are entered into with suppliers acting as processors of personal data. Independent controllers are themselves responsible for their own processing operations. Where necessary, we specify the particular recipient, its legal role and its data protection rules.

9. Payments, invoices, checks and refunds

NORINOHI may receive payment from the customer as the Operator's authorised agent and keep the related records. To accept and refund payments, we process identification, contact, payment and accounting data, including the transaction status and invoice details. A bank or payment system may act as an independent controller or as a processor, depending on its function.

To prevent fraud, payment providers may carry out checks within the scope of their own legal obligations. The terms of the charter, refunds and the parties' liability are also set out in the CharterNavi General Terms & Conditions and in the documents of the Operator concerned. This Policy does not in itself change the contractual or tax roles of the parties.

10. Cookies, analytics, advertising and marketing

The website may use strictly necessary technologies (session, security, storing the user's choices), functional cookies, analytics tools, advertising pixels, and attribution and personalisation tools. Examples of platforms that may be used, depending on the services actually connected, include Google, Meta, TikTok, Microsoft and CRM/email marketing providers. Naming a platform does not confirm that it is currently in use.

For users in the EU/EEA and other jurisdictions that require prior consent, optional device access or tracking technologies must remain disabled until valid consent is obtained. We provide a clear choice of “Accept”, “Reject” and category settings, together with the option to change that decision at any time via the “Cookies” link at the bottom of the website.

The current Cookie Policy / cookie table must separately describe the tools actually deployed, the names of the cookies or SDKs/pixels, the providers, purposes, lifetimes and information on cross-border transfers. Consent to cookies is not a substitute for a legal basis for any other processing operation.

We may send commercial communications only in compliance with the applicable electronic marketing rules (including local consent requirements, “soft opt-in” where permitted, and the option to unsubscribe). Customers may opt out of marketing communications; service messages needed for a booking may continue to be sent on another appropriate basis.

11. International transfers of personal data

As charters take place worldwide, certain data may be transferred to Operators and technology providers outside the European Economic Area (EEA), in particular to the country where the yacht is located, to the Operator's jurisdiction or to the country where a service is hosted. The specific countries depend on the booking and the actual infrastructure.

Where Chapter V GDPR applies, we use an appropriate mechanism: a European Commission adequacy decision, appropriate safeguards, in particular standard contractual clauses (SCCs) with the necessary risk assessment and supplementary measures, or another lawful mechanism. The derogations in Article 49 GDPR are applied only in accordance with their conditions and are not treated as an ordinary, general-purpose basis for systematic international transfers.

Where another jurisdiction lays down its own rules on international disclosure of data, we assess them separately. On request, we provide appropriate information about the applicable safeguards and, where required by law, the opportunity to obtain a copy of them, subject to lawful restrictions.

12. Retention and deletion

We retain information only for as long as is justified by the purpose of processing, legal obligations or the defence of rights. Where a single retention period cannot be stated, the criteria below apply. For the operation of its processes, NORINOHI maintains an internal register of retention periods for each system.

At the end of the relevant period, data is deleted, reliably anonymised or, where there is a separate legal basis, moved to a restricted archive. Erasure requests are considered subject to the exemptions provided for by law.

13. Information security and breach response

We implement technical and organisational measures appropriate to the risk, such as segregation of access rights, secure transmission channels, account protection, backups, access logging, policies for handling passport copies and supplier checks. The list of specific measures in a public policy must not overstate the protection actually implemented.

In the event of a personal data breach, we assess its consequences. Where the GDPR applies and the relevant conditions are met, we notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach; we notify individuals where the breach is likely to result in a high risk to their rights and freedoms. Other applicable national deadlines are also taken into account.

14. Your rights under the GDPR (EU/EEA)

Where processing falls within the GDPR, you may, subject to the conditions laid down by law: obtain information about and access to your data; have it rectified; request erasure or restriction of processing; obtain data portability where applicable; object to processing based on legitimate interests; object at any time to the use of your data for direct marketing; withdraw consent; and exercise your rights in relation to decisions based solely on automated processing as defined by law.

Requests may be sent to the address in section 22. We normally respond within one month; this period may be extended on lawful grounds, in which case we will inform you. To protect your data, we may ask for proportionate proof of identity. These rights are not absolute: in particular, mandatory accounting records cannot always be deleted immediately.

You may lodge a complaint with the Prezesa Urzędu Ochrony Danych Osobowych (UODO, https://uodo.gov.pl/) or another competent data protection authority in the EEA. This remedy does not limit your judicial rights under the law.

15. Children, minors and group bookings

The booking service is intended for adult organisers. However, a yacht charter may include minor passengers. We process their data only to the extent necessary to arrange the specific charter and comply with applicable requirements, with due regard for the rights of parents or legal guardians. The service is not intended for marketing directed at children. Children's passport documents are not used for advertising profiling.

Where specific legislation on online services for children applies (including in certain US jurisdictions), we assess its applicability and implement the additional measures it requires.

16. Automated decision-making and profiling

Analytics and advertising systems may help analyse audiences and the relevance of offers on an appropriate legal basis. Such marketing segmentation does not in itself mean that NORINOHI takes decisions based solely on automated processing that produce legal or similarly significant effects for an individual. If such a process is introduced, we will assess its lawfulness in advance and provide information about the logic involved and the safeguards to the extent required by applicable law.

17. External resources and partners

Our website may link to the resources of operators, banks, booking system providers, social networks or other independent organisations. Their own data processing may be governed by separate privacy notices. We recommend reviewing the policy of the partner concerned, particularly before submitting documents or making a payment. An external link does not make that resource a processor of NORINOHI.

18. Marketing opt-out rights and requests from other countries

Individuals of any nationality may contact NORINOHI with questions about data processing. Where the local law applicable to a particular processing operation grants additional rights (for example, opting out of targeted advertising or of the “sale/sharing” of data within the specific meaning of that law), we give effect to those rights in accordance with that law. A voluntary response to a request does not mean that we automatically accept that every national law applies.

19. Additional regional provisions

19.1. Poland and the European Economic Area

NORINOHI's activities in the EU are subject to the GDPR, Polish personal data legislation and the rules on storing information / accessing terminal equipment under ePrivacy and Polish electronic communications law. Where the provisions of this Policy conflict with mandatory rules, those rules prevail.

19.2. United Kingdom

Where the UK GDPR, the Data Protection Act 2018 and the applicable electronic communications rules, as amended, apply to a particular activity, we provide the relevant notices, rights of access, rectification and erasure, and the other safeguards required by law. Where appropriate, we also assess the need to appoint a UK representative and the local international transfer mechanisms. Complaints may be made to the UK Information Commissioner's Office (ICO, https://ico.org.uk/).

19.3. Switzerland

Where the Swiss Federal Act on Data Protection (FADP) applies to processing, we take into account the requirements of transparency, information, rights of access/rectification and the other safeguards required by law, as well as the restrictions on international transfers. Where necessary, we assess the requirements for a representative in Switzerland.

19.4. United States of America

The United States has no single general federal law equivalent to the GDPR for all cases. Depending on the type of activity, the number of users, turnover and other criteria, the CCPA/CPRA in California or the laws of other states may apply to NORINOHI. The rights below therefore apply only where the relevant law applies.

Where the CCPA/CPRA applies to the Company, California residents may have the statutory rights to know the categories of information collected, to access, correct and delete data, to obtain available information about its disclosure, to opt out of “sale” or “sharing” within their specific legal meaning, to limit certain uses of sensitive information, and not to be subjected to unlawful discrimination for exercising their rights.

“Sale” and “sharing” may include disclosing identifiers to advertising partners without direct monetary consideration. Whether the advertising integrations actually deployed amount to such operations must be checked separately. Where required by law, we implement a “Do Not Sell or Share My Personal Information” mechanism and properly process the corresponding opt-out signals, including Global Privacy Control. Without a technical audit, there are no grounds for stating categorically that NORINOHI “never sells/shares” information.

Other applicable state laws may provide for opting out of targeted advertising, the sale of information or certain profiling, as well as for appealing a refusal to act on a request. Information about these mechanisms will be provided through actual request channels and privacy settings. Where the law requires a specific Notice at Collection, or a list of categories and periods covering the last 12 months, this information should be provided in the appropriate form at the point of data collection.

19.5. Ukraine

Where the Law of Ukraine “On Personal Data Protection” No. 2297-VI applies, individuals have the rights defined by law to access, to information about processing, to object, to have data amended and destroyed where applicable, to challenge infringements and to protect their rights. Where data is obtained directly from the individual, the required notice is given at the time of collection; in other cases, within 30 working days of collection, save for lawful exceptions. Transfers abroad are assessed in accordance with Article 29 of that Law and other applicable legislation.

19.6. Canada

Where PIPEDA or applicable provincial laws apply to the relevant operations, we comply with the rules on openness, identifying purposes, meaningful consent, limiting collection and retention, access, correction, safeguards and accountability for processing by service providers. For Canadian recipients of marketing communications, we separately assess the requirements for commercial electronic messages, including CASL.

19.7. Brazil

Where the Brazilian Lei Geral de Proteção de Dados (LGPD) and the regulations of the Autoridade Nacional de Proteção de Dados (ANPD) apply, individuals may exercise their statutory rights to information, confirmation of processing, access, correction, deletion / blocking where applicable, and information about the sharing of data. Cross-border transfers are carried out in accordance with the mechanisms provided for in the LGPD and the ANPD's requirements. A separate language-specific or local notice channel may be required.

19.8. Australia and New Zealand

Where the Privacy Act 1988 and the Australian Privacy Principles apply to NORINOHI's activities, we maintain an up-to-date, openly available policy, rights of access/correction, a complaints procedure, notice of possible disclosures to overseas recipients and appropriate safeguards. Where New Zealand's Privacy Act 2020 applies, we take into account its information privacy principles and the rules on disclosure to overseas recipients (in particular Principle 12).

19.9. Other jurisdictions

Where specific rules of other countries apply to the relevant activity, including Japan, Singapore, the Republic of South Africa, the UAE or other countries, the Company assesses its local obligations, including notices, the appointment of a contact person or representative, legal bases for processing, marketing rules, international transfers and individuals' rights. This section is not a statement that every law listed necessarily applies to NORINOHI.

20. Changes to this Policy

We review this Policy in response to changes in legislation, our business, technology or suppliers. The current version, showing the date of the update, is published on the website. Where a new purpose of processing or a change of legal basis requires notice or fresh consent, we take the appropriate step before such processing begins.

21. How to make a request or complaint

To obtain information, exercise your right of access, rectification, erasure, restriction or objection, withdraw consent or make a marketing opt-out request, write to office@norinohi.com or send a letter to NORINOHI at the address given below. Please do not send unnecessary passport copies through unsecured channels. To verify entitlement to access, we may ask for additional information, limited to the minimum necessary.

Where required by regional legislation, the requester may use other specifically provided channels or lodge a complaint with the competent authority. The procedure for handling requests depends on the applicable law and the nature of the request.

22. Contact and registration details