Last updated: 20 October 2026
This notice explains how the personal data of visitors of daymar.it, of people who contact us through the website and of customers who book a rental or an excursion online are processed, pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 (the Italian Data Protection Code).
1. Data controller
Daymar S.n.c.
Piazzale del Porto, Box n. 18 – 08022 Cala Gonone, Dorgali (NU), Italy
VAT no. IT01446250910
Email: info@daymar.it
Phone: +39 377 302 2930
The controller has not appointed a Data Protection Officer (DPO), as it is not required to under Article 37 GDPR.
2. What data we process
Browsing data
The systems that run the website collect, during normal operation, some data whose transmission is implicit in the use of Internet protocols: IP address, browser type and operating system, requested page and referring page, date and time of the request, server response status. This data is used to run the website, to protect it from attacks and unauthorised access and to produce aggregate statistics on visits from the server control panel, without cookies. It is not used to identify visitors, but it could be used to ascertain liability in case of computer crimes against the website.
Data you give us when you contact us
When you fill in the form on the Contact page you give us your full name, email address, phone prefix and number, subject and message. We also process the data you send us by writing to our email addresses, calling or writing on WhatsApp to the numbers shown on the website.
Data you give us when you book
When you book a rental or an excursion online you give us, in the checkout form, your full name, email address, phone number, billing address and any tax details; you choose the service, the date, the number of participants and the payment method. If you create an account in the customer area, we also keep your login credentials and order history. PayPal payments take place on PayPal’s website: we neither see nor store card or account details. For bank transfers we receive the payer’s details from our bank.
At boarding, for signing the rental contract and for the requirements of navigation law, you may be asked for an identity document and, where required, your boating licence: this data is processed as part of the contract, according to the Rental & Excursion Policy.
Cookies
The website uses technical cookies and, only with your consent, third-party cookies for statistics (Google Analytics) and for embedded content (Google maps and videos). All details are in the Cookie Policy.
3. Why we process data, on what legal basis and for how long
a) To answer your request for information or availability, send you a quote and settle the details of your booking.
Legal basis: pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
Retention: for the time needed to handle the request; if no booking follows, data is deleted within 24 months from the last contact.
b) To manage the booking and the contract for the rental or excursion: confirmation, payment of the deposit and balance, any refunds, service communications (for example changes due to sea and weather conditions), assistance.
Legal basis: performance of a contract to which you are party (Article 6(1)(b) GDPR).
Retention: for the duration of the relationship and then for 10 years, as required by Italian civil and tax law (Article 2220 of the Italian Civil Code). Account data is kept until you ask for its deletion.
c) To comply with legal obligations, for example tax and accounting obligations or those set by navigation and safety regulations, or with requests from the authorities.
Legal basis: legal obligation (Article 6(1)(c) GDPR).
Retention: for the period set by the applicable law.
d) To run the website and protect it from attacks, spam and unauthorised access, including through the Google reCAPTCHA service on the contact form.
Legal basis: the controller’s legitimate interest in the security of the website and of information (Article 6(1)(f) and recital 49 GDPR).
Retention: server logs are rotated daily and kept for a few days; the website security log for no more than 30 days. Longer periods apply if needed to ascertain crimes.
e) To establish, exercise or defend the controller’s rights, for example in case of damage to the boat or payment disputes.
Legal basis: the controller’s legitimate interest (Article 6(1)(f) GDPR).
Retention: for the duration of the dispute and until the time limits for appeal have expired.
f) To collect aggregate statistics on visits with Google Analytics.
Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of the Italian Data Protection Code), which can be withdrawn at any time.
Retention: cookies last 13 months; data in Google Analytics is not kept for more than 14 months.
g) To display third-party embedded content (Google maps and videos) present in some pages.
Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of the Italian Data Protection Code), which can be withdrawn at any time.
Retention: data collected when the content loads is processed by the provider as an independent controller, under its own privacy notice.
Data is not used to send newsletters or marketing communications, except for service communications about your booking.
4. Is providing data mandatory?
Browsing data is needed to run the website. The mandatory fields of the contact form and of the checkout form are needed to answer you and to conclude the contract: without them we cannot follow up your request or booking. Consent to statistics cookies and to embedded content is optional: if you refuse it you can use the website and book without limitations, but you will not see interactive maps and embedded videos.
5. How we process data
With electronic and, where needed, paper tools, adopting technical and organisational measures appropriate to the risks (Article 32 GDPR): encrypted HTTPS connection, firewall and protection from unauthorised access, daily backups, access to data limited to authorised persons only. Anyone processing data on behalf of the controller is bound by confidentiality.
No decisions are taken solely on the basis of automated processing, including profiling (Article 22 GDPR). The booking system automatically checks the availability of the boats, but decisions on the contract are taken by the controller’s staff.
6. Who data may be disclosed to
- the controller’s staff and collaborators (skippers, dock and office staff), authorised to process data;
- suppliers processing data on behalf of the controller, appointed as processors (Article 28 GDPR): hosting and technical management of the website (OVH, with servers in the European Union, and the agency that maintains the website); Google’s email service used to send confirmation and service emails; the website security service (Wordfence, by Defiant Inc., United States), which processes IP addresses to detect and block attacks; tax and accounting advisors;
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), which processes payment data as an independent controller under its own privacy statement, if you choose to pay with PayPal; the controller’s bank, if you pay by bank transfer;
- Google Ireland Limited, for the reCAPTCHA service on the contact form and, only if you give your consent, for Google Analytics and for embedded maps and videos;
- public, port and judicial authorities, where required by law.
If you choose to write to us on WhatsApp, the conversation data is also processed by WhatsApp Ireland Limited, as an independent controller, under its privacy policy.
Data is neither disseminated nor sold to third parties. The updated list of processors is available on request.
7. Transfer of data outside the European Union
Some suppliers (Google, WhatsApp, PayPal and Defiant for Wordfence) are based or have servers in the United States. Transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for suppliers that adhere to it, or of the standard contractual clauses approved by the European Commission (Article 46 GDPR).
8. Your rights
At any time you can ask the controller:
- access to your data and a copy of it (Article 15 GDPR);
- rectification of inaccurate data or completion of incomplete data (Article 16);
- erasure of data (Article 17);
- restriction of processing (Article 18);
- portability of the data you gave us, in a structured, machine-readable format (Article 20);
- to object, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21);
- to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)). For cookies you can do so from the “Cookie preferences” link at the bottom of every page.
To exercise your rights write to info@daymar.it. We will reply without undue delay and in any case within one month (Article 12 GDPR).
If you believe that the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy, or with the supervisory authority of the EU country where you live or work, or bring an action before the courts (Articles 77-79 GDPR).
9. Changes to this notice
This notice may be updated, for example in case of new services on the website or changes in the law. The date of the last update is shown at the top.