Business Directory Privacy Notice

YachtingStack Intelligence maintains a directory of businesses, vessels and charter services across yachting, compiled from publicly available sources. Some records include personal data about named business contacts — typically a name, a business role, and a business email address, phone number or address. Article 14 GDPR requires us to tell you about this processing because the data was not collected from you directly; this notice does that.

The Data Controller is:

Records are compiled from publicly accessible sources: yachting directories and the websites businesses publish about themselves. Every record keeps a reference to the source it came from, so if you ask, we can tell you exactly where we found your details.

We process this data on the basis of legitimate interest (Article 6(1)(f) GDPR): maintaining an accurate, professionally useful directory of yachting businesses, served through our products. We have carried out and recorded a balancing assessment. The directory holds ordinary business contact details only — no special-category data — and no decision producing legal or similarly significant effects is taken about anyone by automated means.

Directory records are available to users of our products. The data is hosted by our processors: Supabase (database) and Railway (application hosting).

A record is kept for no more than 24 months from the date we last verified it against its source; records that cannot be re-verified are removed. A record removed at your request is suppressed permanently — our collection pipeline is built so an erased record cannot re-enter the directory through a future crawl of the same sources.

• Right to Object (Art. 21): Because this processing rests on legitimate interest, you can object at any time on grounds relating to your situation. For personal contact details we will normally simply remove the record.
• Access (Art. 15): Ask what we hold about you and where it came from.
• Rectification (Art. 16): Have inaccurate details corrected.
• Erasure (Art. 17): Have your record deleted and permanently suppressed.
• Restriction (Art. 18): Have processing paused while a request is examined.

Write to privacy@yachtingstack.ai — we respond within 30 days. You also have the right to lodge a complaint with the Spanish supervisory authority, the AEPD (www.aepd.es).