DATA PROTECTION POLICY

This is the data protection policy of Activitats Nàutiques Ones Litoral SL. It refers to the data processed in the course of its professional activity. The processing is carried out in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016) and the Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights.

Who is responsible for processing personal data?

The data controller is Activitats Nàutiques Ones Litoral SL (hereinafter Ones Club Cadaqués), with tax ID B17773656, registered address at Passeig Fora Muralla, núm. 30, Girona (PC 17004), telephone number +34 635 22 90 22, email address, and website www.onesclubcadaques.com. The company is registered in the Commercial Registry of Girona, volume ……

What is the purpose of processing the data?

At Ones Club Cadaqués, we process personal data for the following purposes:

Contact

To respond to inquiries from individuals who contact us via email, contact forms on our website, or by phone. The data is used solely for this purpose.

Customer services

We register new clients and any additional data that may arise as a result of the business relationship. During the contracting process, we request the necessary data, including bank details (bank account or credit card number), which are shared with financial institutions for payment processing (only for this purpose). The service relationship also involves other processes such as accounting, invoicing, or communication with tax authorities. By accessing the client area of our website, users can manage their data, contract services, view invoices, access promotions, or check the status of inquiries and complaints. Accessing this area also provides us with information about the user’s activity.

Information about our services

While we maintain a contractual relationship with our clients, Ones Club Cadaqués uses their contact data to share information related to that relationship, which may occasionally include references to our services, either in general or tailored to the client’s specific needs.

Other service-related information

With the client’s explicit consent, once the contractual relationship has ended, we retain contact details to send advertising or information about our services, either general or tailored to the client’s interests. We also send this information to individuals who are not clients but request it or give their consent through our forms.

Supplier data management

We register and process data from suppliers who provide us with goods or services. This may include data of self-employed individuals or representatives of legal entities. We collect only the essential data for maintaining the business relationship and use it solely for that purpose.

Website users

The browsing system and software enabling our website’s operation collect data typically generated when using internet protocols. This includes, among other things, the IP address or domain name of the computer used to access the site. This information is not associated with specific users and is used solely for statistical purposes regarding website usage. Our site does not use cookies that allow for the identification of individuals. Cookies are only used to gather technical information to facilitate accessibility and efficient use of the site.

What is the legal basis for data processing?

The legal bases for data processing vary depending on the type of processing:

• Pre-contractual relationships: when dealing with potential clients or suppliers before a formal contract is signed (e.g. preparing estimates).

• Contractual obligations: when data is processed as part of a client or supplier relationship.

• Legal obligations: data communications to the Tax Administration are required by law. We may also be required to share data with courts or law enforcement bodies.

• Consent: we use personal data to send service-related information only with the explicit consent of the individual. Data collected via cookies is also based on user consent, which can be revoked at any time by uninstalling the cookies.

Who do we share data with?

As a general rule, we only share data with public authorities and only when legally required. In the case of invoicing, personal data may be shared with banks. In justified cases, we may also share data with law enforcement agencies or judicial authorities. We do not transfer personal data outside the European Union (no international transfers).

How long do we keep the data?

We comply with the legal obligation to minimize data retention periods. Therefore, data is kept only for as long as necessary and justified for the purpose for which it was collected. For example, accounting and invoicing data must be retained as long as required by tax law. Data processed with the data subject’s consent is kept until consent is withdrawn.

What rights do individuals have regarding their data?

Under the General Data Protection Regulation, individuals have the following rights:

• Right to know if data is being processed. Anyone has the right to know whether we are processing their data, regardless of whether there has been a prior relationship.

• Right to be informed upon data collection. When personal data is collected directly from the individual, they must be clearly informed of the purpose, the controller’s identity, and the main aspects of the processing.

• Right of access. This broad right includes knowing exactly what data is being processed, for what purpose, with whom it is shared (if applicable), and the right to obtain a copy or know how long the data will be retained.

• Right to rectification. The right to have inaccurate data corrected.

• Right to erasure. Under certain circumstances, individuals can request that their data be deleted, particularly when the data is no longer necessary for the purposes for which it was collected.

• Right to restriction of processing. Also under certain circumstances, individuals may request a restriction of processing, in which case the data will only be retained for legal claims or defense.

• Right to data portability. The right to receive personal data in a structured, commonly used, machine-readable format, or to have it transferred to another data controller. This applies when data was provided with consent or as part of a contract.

• Right to object. Individuals can object to data processing based on their specific situation, unless there are legitimate reasons or legal claims that override this objection.

• Right not to receive information. We will immediately comply with any request to stop receiving service-related or promotional communications when such communications are based solely on consent.

How can these rights be exercised or defended?

These rights can be exercised by submitting a written request to Activitats Nàutiques Ones Litoral SL (Ones Club Cadaqués) at Passeig Fora Muralla, núm. 30, Girona (PC 17004), or via email to admin@onesclubcadaques.com, indicating “Personal Data Protection” in all cases.

If a satisfactory response is not received, a complaint can be filed with the Spanish Data Protection Agency (AEPD) through the forms or contact channels available on their website: www.aepd.es.