Privacy and Cookies Policy
Last updated: 26 September 2026
This policy explains how your personal data is processed when you use canaryacht.com, in accordance with articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. Who processes your data
| Controller | HOGAR PREMIUM DESIGN SL (trade name “Canary Yacht”) |
|---|---|
| Tax ID (CIF) | B87517884 |
| Registered address | C/ La Parada 16 – Tenteniguada, 35216 Valsequillo de Gran Canaria, Las Palmas, Spain |
| info@canaryacht.com | |
| Telephone | +34 644 734 294 |
We have not appointed a data protection officer. For any matter relating to this policy you can write to info@canaryacht.com.
2. What data we process, why, and on what legal basis
2.1 Booking an activity
Data: your name, email address, telephone number and the language in which you browse; and, from the booking, the departure chosen with its date and time, how many people are coming on board, the amount, the payment method and anything you write in the comments field, which is free text and optional.
Your telephone number is required, and not for convenience: this activity is cancelled because of swell, wind or calima (dust haze), sometimes on the same morning. Nobody reads an email at seven in the morning; a phone call gets through.
Purpose: to formalise and confirm your booking, provide the activity, let you know of any change or cancellation, issue the invoice and deal with incidents and refunds.
Legal basis: performance of the contract (art. 6.1.b GDPR) and, for invoicing and accounting, compliance with legal obligations (art. 6.1.c GDPR).
Providing this data is required: without it we cannot formalise the booking.
2.2 Payment: no payment data is collected
Bookings made on this website are paid in cash at the marina on the day of the activity. This website does not ask for, process or store any card or bank details.
2.3 Health data: this website does not ask for it
The booking form does not ask whether you can swim, your weight, whether you are pregnant or whether you have any medical condition. There is no field for this and no health data is stored in a structured way.
What there is, however, is a free-text comments field. If you decide to write a health circumstance there, that sentence is stored with your booking and used only to provide the activity safely. You can ask us to delete it at any time by writing to info@canaryacht.com.
2.4 Quote requests
Some activities do not show a price and are requested through a form. In that case we process your name, email address, telephone number, the approximate date, how many people would be coming and the message you write to us.
Purpose: to reply to you with a quote. That request is not a booking: nothing is charged, no place is taken and you are not committed to anything.
Legal basis: taking steps at your request prior to entering into a contract (art. 6.1.b GDPR).
2.5 Access to your bookings
To see your bookings you do not need to create an account or remember a password: you request a link to your email address and that link opens a session. We process your email address to send it to you, and a technical cookie in your browser to keep the session open.
Legal basis: performance of the contract (art. 6.1.b GDPR).
2.6 WhatsApp
The WhatsApp button is an ordinary link: it does not load any third-party software or set any cookie until you tap it. If you write to us that way, the channel is provided by WhatsApp Ireland Limited under its own terms, which do not depend on us.
3. Cookies and audience measurement
| Customer area session cookie | Strictly necessary. Keeps open the session you start from the link sent to your email. Set by this website. |
|---|---|
| Operator panel session cookie | Strictly necessary. Used only by our own staff to manage bookings. Set by this website. |
| Google Analytics cookies (“_ga” and “_ga_” followed by an identifier) | Audience measurement. Set by Google Ireland Limited, and only after you accept them. |
The cookies that keep your session open are strictly necessary and do not require your consent (art. 22.2 LSSI-CE).
We also measure how many visits each page receives with Google Analytics, and that does require your consent: nothing from Google is loaded until you accept it in the notice, and if you choose “only what is necessary” no measurement cookie is set. We do not advertise or build profiles: advertising and personalisation are expressly switched off.
Two things are never sent, even if you accept. First: any part of the address that works as a key is removed before it is sent — on this website some links are keys, such as the one that opens your booking or the one that gives you access to your bookings from your email. Only campaign labels in the address (such as “utm_” tags or advertising click identifiers) are passed on, so that we know which campaign brought the visit. Second: no measurement takes place on the booking, login or customer area pages, which are the pages that carry your data.
You can change your mind at any time from the link in the footer. Withdrawing consent is as easy as giving it.
4. How long we keep your data
| Booking data | For as long as the relationship lasts and afterwards, blocked, for the limitation periods of any claims arising from the contract |
|---|---|
| Invoices and accounting | 6 years (art. 30 of the Spanish Commercial Code) |
| Tax obligations | 4 years (art. 66 of the Spanish General Tax Act) |
| Quote requests | Until the request is dealt with, and one further year |
| Links giving access to your bookings | They expire on their own a few hours after being sent; the session, when you log out |
| Measurement cookies | The period set by Google Analytics for each cookie. You can delete them from your browser at any time |
5. Who we share your data with
| Hostinger International Ltd | Hosting of the server and of the email account we write to you from |
|---|---|
| Google Ireland Limited | Audience measurement, and only if you accept measurement cookies |
| WhatsApp Ireland Limited | Only if you are the one who writes to us through that channel |
| Tax authorities, banks and, where applicable, courts | Compliance with legal obligations |
We do not sell your data or pass it on to anyone for their advertising.
Some of these providers may process data outside the European Economic Area. Where this happens, the transfer is covered by the standard contractual clauses approved by the European Commission or by an adequacy decision (arts. 45 and 46 GDPR). You can ask us for a copy of the safeguards applied by writing to info@canaryacht.com.
6. Your rights
You can exercise, free of charge, the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.
How: write to info@canaryacht.com stating which right you are exercising. We do not ask for a copy of your identity document as a matter of course; if there is reasonable doubt about who is making the request, we may ask you to verify your identity. We will reply within one month.
If you consider that we have not dealt with your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to any other remedy.
7. Security and automated decisions
The website is always served over an encrypted connection, and booking data is kept in a database that cannot be reached from the internet.
We do not take automated decisions or build profiles that produce legal effects on you.
8. Changes to this policy
We may update it when the law or the way we process data changes. The version in force is always the one published on this page, with its date of update.