Privacy policy

Last updated: 24 October 2026.

This policy explains how we process personal data relating to enquiries, bookings and nautical experiences offered by Boat Trip Barcelona at boattripbarcelona.com.

1. Data controller and contact details

The data controller is SAIL EXPERIENCE HOLIDAY SL, tax identification number B87671889, trading as Boat Trip Barcelona. Registered office and contact address: Port Olímpic, Moll de Mestral, berth 1538, 08005 Barcelona, Spain. For privacy questions or to exercise your rights, email info@boattripbarcelona.com. You can also call +34 659 865 862 or write to the postal address above.

2. Data we receive

• Enquiries: your name, email address and message, plus your telephone or WhatsApp number if you provide it. We also receive the language and the page from which the enquiry is sent. Your message may include the activity, dates and group size you are interested in.
• Bookings: the contact, participant, activity and transaction details needed to process the booking, manage the service and issue an invoice where applicable. The required fields and payment details are requested through the booking or payment channel used, which provides its own information.
• Website use and security: technical connection data, submission references and identifiers needed to manage preferences, prevent abuse and avoid duplicate enquiries. Measurement and advertising services may process identifiers and browsing data according to your choices.

On the general enquiry form, your name, email address and message are required so that we can respond; your telephone number is optional. We cannot process a booking without the necessary information. Do not send identity documents, medical information or other particularly sensitive data through the general form unless they have been requested for a justified reason and through an appropriate channel.

3. Purposes and legal bases

• Handling requests for information, quotes and bookings: taking steps at your request before entering into a contract and performing that contract, under Article 6(1)(b) of the GDPR.
• Answering other enquiries and protecting the service: our legitimate interests in responding to people who contact the company, maintaining security and preventing fraud or abusive submissions, under Article 6(1)(f), while respecting your rights and reasonable expectations.
• Invoicing and applicable obligations: complying with legal, tax and accounting obligations, under Article 6(1)(c).
• Optional analytics and advertising: your consent, under Article 6(1)(a), given through the relevant cookie choices. You can withdraw it through “Cookie preferences”.

Sending an enquiry does not subscribe you to a newsletter or, by itself, authorise advertising messages. Confirmations and communications needed to handle your enquiry or booking form part of managing that request.

4. Retention criteria

• Enquiries that do not lead to a booking: while we respond and follow up, for a maximum of 12 months after the last communication. If a complaint or another obligation justifies retaining some information, we retain only what is necessary for that purpose and for the applicable period.
• Bookings and service delivery: during the relationship and afterwards only for the periods required by applicable obligations or to address potential liabilities.
• Tax and commercial documentation: the tax limitation period is generally four years, calculated subject to the rules and exceptions established by law; relevant commercial documentation must be retained for six years from the last accounting entry. These periods apply to the corresponding documents, rather than to all data equally, and are not automatically added together.
• Security and incident records: for as long as necessary to prevent abuse, control submissions and resolve incidents. References associated with a submission whose outcome is uncertain are reviewed to clarify it and avoid duplicates; that uncertainty does not justify retaining the information indefinitely.
• Browser preferences: your language and cookie choices remain in your browser until you change them or delete the site's data. Other identifiers' lifetimes depend on the service and its terms.

When data is no longer needed, it is deleted or anonymised. If it must be retained to meet an obligation or address potential liabilities, its use and access are restricted to those purposes, and it is blocked where required; once the applicable period ends, it is destroyed. Retention periods may be affected by complaints, interruptions of limitation periods or specific legal rules.

5. Recipients and service providers

Authorised staff and providers involved in website hosting, email, enquiry management, bookings and payments may access data to the extent needed to provide those services. When they act on our behalf, their processing must be governed by an appropriate data processing agreement and subject to instructions and confidentiality.

Activities with a booking calendar use Bókun. Using its calendar or completing a booking provides information to the booking service and the providers involved in the transaction. Read Bókun's privacy policy and the payment channel's information before confirming. Some providers also process data for their own purposes, as explained in their notices.

To deliver the activity, we may provide the professionals involved with the data strictly necessary, in accordance with the legal basis applicable to the service. We may also disclose data to public bodies, authorities or courts when legally required. We do not sell your contact details.

6. International services

Using providers such as Bókun, Google or Meta may involve processing data outside the European Economic Area. Their policies explain the locations and safeguards they apply, including adequacy decisions or standard contractual clauses where applicable. Transfers must meet GDPR requirements. You can request information about transfers and the safeguards applicable to the processing of your data by writing to our privacy contact.

7. Cookies, maps and preferences

Visit measurement and advertising through the Google and Meta services configured in the tag manager are activated after you accept optional cookies. You can reject them or change your choice through “Cookie preferences”. Withdrawing consent does not affect the lawfulness of earlier processing; you can also use your browser settings to delete cookies already stored.

Pages may load external components, such as the Bókun calendar or Google maps. When these components load, your browser connects to their provider and may disclose technical data, such as your IP address. These components are separate from measurement and advertising tags. Read Google's privacy policy and each service's notices. You can find more information in our cookie policy.

8. Your rights

You can exercise your rights to access, rectification, erasure, restriction, objection and data portability in the circumstances provided by law, and withdraw consent where it is the basis for processing. Send your request to info@boattripbarcelona.com or to the controller's postal address, stating which right you wish to exercise. We will request additional identification information only when necessary and proportionate to verify your request.

We will respond without undue delay and, as a general rule, within one month of receiving the request. Where the complexity or number of requests justifies it, this period may be extended by a further two months; we will inform you within the first month and explain the reasons. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority.

9. Data relating to other guests and minors

If you book for other people, provide only the necessary data, inform them of this policy and ensure you have the appropriate authorisation or legal basis. Data relating to accompanying minors must be provided by the responsible adult and limited to what is needed to manage their participation.

10. WhatsApp and social media

If you choose to contact us through WhatsApp or follow links to Instagram or Facebook, those services process data associated with their use under their own terms. Read WhatsApp's privacy policy and Meta's privacy policy. We use the information you share with us to handle your request for the purposes and on the legal bases described here.

11. Security and potential incidents

We apply access controls and security measures designed to protect data and reduce abusive submissions. If a personal data breach occurs, we will assess its effects and make any notifications to the authority required by law. Where a breach is likely to result in a high risk to individuals, we will inform them without undue delay as required by law.

12. Updates to this policy

This policy may be updated if our services or data processing change. We will publish the current version at this same URL and show its update date. Where required, we will provide additional information about significant changes before applying new uses of data.