Privacy Policy

1. Data Controller

Reboated OÜ (Registry code: 17284214) is the data controller for all personal data collected through this website and our services. We are registered in Tallinn, Estonia.

Contact: info@reboated.com

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number
• Vessel information: boat make, model, size, location — provided voluntarily for service purposes
• Communication records: messages and call notes from discovery calls and ongoing service communication
• Marketing preferences: whether you have subscribed to our mailing list
• Technical data: IP address, browser type, device information — collected via analytics tools when consent is given

We do not collect health data, biometric data, or financial data beyond what is necessary for billing (processed by Stripe on our behalf).

3. Legal Basis for Processing

• Contract performance — processing necessary to deliver our membership services
• Legitimate interests — operational communications relating to your service, improving our offering
• Consent — marketing communications (you may withdraw at any time)
• Cookie consent — analytics and tracking cookies (Google Analytics, Meta Pixel) only activate after you accept via the cookie banner
• Legal obligation — financial record-keeping and compliance with Estonian and EU law

4. How We Use Your Data

• Responding to enquiries and booking discovery calls
• Delivering and managing your membership service
• Sending quarterly updates and service communications (with consent)
• Understanding how visitors use this website (analytics, with consent)
• Improving our service quality and marketing effectiveness

5. Third-Party Data Processors

We share data with the following processors, each under GDPR-compliant data processing agreements:

6. Data Retention

• Account and service data: 3 years after end of service relationship
• Billing and financial records: 7 years (legal obligation under Estonian law)
• Marketing data: until consent is withdrawn, or 2 years of inactivity
• Cookie and analytics data: per the retention periods set in our Cookie Policy

7. Your Rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request limited processing of your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests or for marketing
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise these rights, contact us at info@reboated.com. We will respond within 30 days.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee

8. Cookies

We use cookies for functionality, analytics, and marketing purposes. Analytics and marketing cookies only activate after you give explicit consent via the cookie banner. See our Cookie Policy for full details.

9. Security

We protect your data using SSL encryption, access controls, and data minimisation. Only team members who need access to perform their work can view personal data. We review our security practices regularly.

10. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The effective date at the top of this page will be updated. For significant changes, we will notify active members by email.