1. Data controller

Company name: Vulcano Ocean Charter, S.L.U.

Tax ID (CIF): B16781916

Registered address: C/ Doctor Heriberto Arroyo 3, ático — 38006 Santa Cruz de Tenerife

Telephone: +34 639 869 575

Email: info@vulcanooceancharter.com

2. Purposes and legal basis for processing

Your personal data will be processed for the following purposes, with the legal basis indicated in each case:

Where the legal basis is consent, users have the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

3. Data retention periods

Personal data will be retained for the following periods, depending on the purpose of processing:

• Booking and contract data: for the duration of the contractual relationship and, once concluded, for 5 years in accordance with the Commercial Code (art. 30).
• Invoicing and IGIC data: for 4 years, in compliance with Law 58/2003 of 17 December (General Tax Law) and Canarian tax regulations.
• Enquiry and contact form data: until the request has been handled and, where the user becomes a client, in accordance with the above periods.
• Web analytics data (analytical cookies): in accordance with the tool provider's configuration, with a maximum of 25 months for Google Analytics (as per AEPD guidelines).

Once the above periods have elapsed, data will be securely deleted or anonymised.

4. Recipients and data processors

Personal data will not be transferred to third parties, except in the following cases:

• Where required by law (tax authorities, maritime authorities, law enforcement agencies or other competent authorities).
• To technology providers acting as data processors under a data processing agreement in accordance with art. 28 GDPR. These providers will not use the data for their own purposes.

User data will not be sold, rented or shared with third parties for commercial purposes.

For the purposes of the transparency required by Article 13.1.e of the GDPR, the data processors providing technical services to Vulcano Ocean Charter, S.L.U. are identified below:

5. International data transfers

The website may use web analytics tools such as Google Analytics (Google LLC), which may involve transfers of data to the United States. Such transfers are made under the EU-US Data Privacy Framework, adopted by the European Commission through an Adequacy Decision of 10 July 2023, which ensures a level of protection equivalent to that required by the GDPR.

Users can check whether Google LLC is listed in the Data Privacy Framework at: www.privacyshield.gov/ps/data-privacy-framework-list

These transfers are subject to the user's prior consent to the installation of analytical cookies, as set out in the website's Cookie Policy.

6. User rights

At any time, users may exercise the following rights recognised under the GDPR and LOPDGDD:

• Access: to find out what personal data is being processed.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request the deletion of data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
• Objection: to object to the processing of data in certain circumstances.
• Restriction of processing: to request the suspension of processing in cases provided for by law.
• Portability: to receive data in a structured, commonly used format, where processing is based on consent or the performance of a contract.
• Withdrawal of consent: where processing is based on consent, users may withdraw it at any time without retroactive effect.

To exercise any of these rights, users must submit a written request, accompanied by a copy of their identity document, to:

Email: info@vulcanooceancharter.com

Postal address: C/ Doctor Heriberto Arroyo 3, ático — 38006 Santa Cruz de Tenerife

The company will respond to requests within a maximum of one month from receipt, extendable by a further two months in cases of particular complexity.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), accessible at www.aepd.es.

7. Data security

Vulcano Ocean Charter, S.L.U. implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data, and to prevent its loss, alteration, unauthorised access or unlawful processing, in accordance with Article 32 of the GDPR.

Users should nonetheless be aware that internet security measures are not infallible and that any privacy-related incident may be reported to the contact address provided.

8. Cookies

This website may use first-party and third-party cookies. For detailed information on the cookies used, their purpose and how to manage or disable them, please consult the Cookie Policy available on the website. The installation of non-essential cookies (analytical, marketing) requires the user's prior and explicit consent.

9. Changes to this privacy policy

Vulcano Ocean Charter, S.L.U. reserves the right to amend this Privacy Policy to reflect legislative, judicial or business practice developments. Material changes will be notified on the website with sufficient notice before taking effect. Users are advised to review this policy periodically.