Privacy Policy

Who we are

The Charter Desk is operated by The Charter Desk LLC.

For the purposes of EU and UK data-protection law, where it applies to processing of personal data we carry out, The Charter Desk LLC is the data controller.

We can be contacted about any privacy matter at info@thecharterdesk.com. Where a client is resident in the EU or UK, we will respond to data-subject requests within thirty days. For all other clients, we apply the same standard as a matter of policy.

What data we collect and why

We only collect personal data that we genuinely need to plan, book, and support your charter, or to comply with the law.

Enquiry data. When you write to us via the website form, WhatsApp, email or phone, we record what you tell us: typically your name, contact details, the region and dates you’re considering, group size, budget range, and any preferences or accessibility needs.

Booking data. Once you proceed to a booking, the Operator will require additional information for the Charter Contract: full legal names of all guests, dates of birth, nationalities, passport numbers, and (for skippered or bareboat Charters) sailing qualifications and experience for the nominated skipper.

Payment data. We do not store full card numbers on our own systems. Where you pay by bank transfer, we hold the standard transactional information (your name, bank, amount, reference) for accounting and audit purposes. Where you pay through a card processor, that processor (not us) holds your card data subject to PCI-DSS.

Website data. We log basic technical information about visits to the website — IP address, browser type, pages viewed, referrer — for security and analytics. We also use Google Analytics 4, Google Tag Manager and the Meta pixel; section 8 explains what they do.

Lawful basis for processing

Where EU or UK data-protection law applies, we rely on the following lawful bases.

Contract. To plan, book, and support a Charter you have requested, we process your data on the basis that this processing is necessary to take steps at your request prior to a contract, and to perform that contract once it is in place.

Legitimate interests. We use enquiry and visit data to operate the website securely, to prevent fraud, and to provide aftercare such as following up on a charter that has just ended. We have weighed these interests against your rights and consider them proportionate.

Legal obligation. We retain financial records and bookkeeping data for the period required by United States federal and state record-keeping rules.

Consent. We only send marketing emails (the newsletter) where you have actively subscribed. Every newsletter contains a one-click unsubscribe link; we honour unsubscriptions immediately, with no follow-up.

Who we share your data with

We share your data only where necessary and only with the parties listed below.

Operators. The Operator of the yacht you book receives the personal data required to issue the Charter Contract and to comply with port, customs, and immigration requirements. Operators are independent businesses with their own privacy practices.

Booking partners. Yacht, price and availability information on this website comes from Booking Manager (MMK Systems).

Service providers. Our website and systems run on our own servers, provided by Hetzner Online GmbH in Germany. Google provides Google Analytics 4 and Google Tag Manager; Meta provides the Meta pixel; customer conversations also take place on WhatsApp. Each is bound by its own published terms.

Authorities. We will disclose data to regulators, tax authorities, courts, or law-enforcement bodies where we are legally compelled to do so. We do not provide voluntary disclosures.

We do not sell, rent, or barter your personal data to anyone, ever.

International transfers

The Charter Desk LLC is based in the United States. Our servers are in Germany, in the European Union. Google and Meta process data in the United States and other countries, so your personal data may be transferred to and processed there.

Where data flows from the EU or UK to a country without an adequacy decision, we rely on the safeguards those providers offer, such as the European Commission Standard Contractual Clauses (or the UK International Data Transfer Addendum).

How long we keep your data

Enquiries that do not become bookings are kept for twenty-four months from your last message, so we can pick up where you left off if you return to plan a different trip. After that, your enquiry record is deleted from our active systems.

Booking records are kept for as long as United States federal and state record-keeping rules require. After that, financial records are deleted and any associated personal data is anonymised or removed.

Newsletter subscriptions are kept for as long as you remain subscribed. On unsubscribe we keep your email address only on a suppression list (so we never email you again by mistake).

Your rights

Whatever law applies to your data, we will honour the following rights as a matter of company policy. EU and UK residents have these rights as a matter of law.

Access. You can ask for a copy of the personal data we hold about you. We will provide it in a standard format within thirty days.

Correction. You can ask us to correct any inaccurate or incomplete data we hold about you. We update on receipt and propagate the correction to any Operator who already received it.

Deletion. You can ask us to delete your data. We will do so unless we are legally required to keep it.

Objection and restriction. You can object to particular processing or ask us to restrict it pending a query. Common cases: stop using my data for newsletter, stop sharing my data with a specific Operator.

Portability. Where we rely on contract or consent, you can ask for your data in a machine-readable format and to have it transmitted to another controller.

Complaint to a regulator. EU residents can complain to their national data-protection authority; UK residents can complain to the Information Commissioner’s Office (ico.org.uk). We would always prefer the chance to put a concern right ourselves first — email info@thecharterdesk.com.

Cookies and analytics

This website uses strictly necessary cookies — for example to remember your cookie choice and your currency preference — which are set because the site cannot function without them.

It also uses Google Analytics 4 and Google Tag Manager to understand which pages people read and where they leave, and the Meta pixel to measure our advertising on Facebook and Instagram. These tools set their own cookies and send information about your visit to Google and Meta.

You can clear cookies at any time using your browser controls. Doing so will reset your preferences.

Security

Access to client records is restricted to the operating team and is logged. Provider credentials are stored using authenticated encryption. Our website is served exclusively over HTTPS.

No system is perfect. In the event of a personal-data breach affecting your information, where the breach is likely to result in a risk to your rights, we will notify you and the relevant regulator within seventy-two hours of becoming aware of it, in line with GDPR Article 33.

Contact · changes to this policy

For any privacy matter — to exercise a right, to ask a question, or to make a complaint — write to info@thecharterdesk.com with "Privacy" in the subject line, or by post to the address above. Please include enough detail to identify the data you are asking about; we may ask for a proof of identity for deletion or access requests.

We will revise this policy whenever our practices change. The version above is the one in force.