Privacy Policy

Last updated: 3 May 2026

1. Who we are

MaviSail Ltd is a private limited company registered in England & Wales. We operate mavisail.com, a charter directory and concierge service for Turkish gulets, catamarans, motor yachts, and sailboats. In data-protection terms, MaviSail Ltd is the data controller for the personal data you submit on this site; partner charter agencies are separate controllers for the booking data they receive from us to fulfil charters.

2. What we collect

We collect personal data only when you provide it, namely:

  • Inquiry data: name, email address, phone number (optional), travel dates, group size, charter type, budget hint, and the free-text message you write to us.
  • Account data (if you register): name, email, password (hashed), and any preferences you save.
  • Communications: messages you exchange with us via WhatsApp, email, or our in-site inbox.
  • Usage data: aggregated, non-identifying analytics (page views, vessels viewed, inquiries submitted). We do not use third-party advertising trackers.
  • Cookies: session cookies for authentication and locale/currency preference. No marketing cookies.

3. Why we use it (lawful basis)

  • Performance of contract / pre-contractual steps: to respond to your inquiry, match you with a vessel, and introduce you to a partner agency for booking.
  • Legitimate interest: to operate our website, prevent abuse, improve the service, and contact you about an inquiry you submitted.
  • Consent: for any marketing communications (we do not currently send these) and for sharing your contact details with a partner agency for the introduction phase of a booking.
  • Legal obligation: when we must respond to lawful requests from authorities, or retain records for tax and accounting purposes.

4. Sharing with partner agencies (broker model)

MaviSail operates as a charter broker, not as the contracting party. When you submit an inquiry about a partner-fulfilled vessel:

  • We initially share an anonymised summary (vessel, dates, group size, scrubbed message — no contact details) with the partner agency to confirm availability and pricing.
  • We share your contact details (name, email, phone) with the partner agency only after you have confirmed you wish to proceed with the booking. This is the "introduction" step.
  • The partner agency is then a separate data controller for the booking and any data they collect from you directly. Their privacy policy applies.

5. Other recipients

  • Email service providers: we use a transactional email provider to deliver inquiry receipts and notifications.
  • Hosting and infrastructure: our application runs on managed cloud infrastructure (DigitalOcean, EU/UK regions where possible).
  • Payment processors: when payment is processed through MaviSail (currently rare; most bookings are paid directly to the partner agency), Stripe handles card data.

6. International transfers

When we share data with Turkish partner agencies for booking fulfilment, that data is transferred to Türkiye, which the UK ICO does not currently treat as having an adequacy decision. We rely on the Article 49(1)(b) derogation: the transfer is necessary for the performance of a contract you have requested (the charter booking). You can withdraw consent for this transfer at any time, in which case we cannot proceed with the introduction.

7. How long we keep it

Inquiry data is retained for up to 24 months after your last interaction, to allow follow-up and to handle any disputes. Account data is retained for as long as your account is active, plus 12 months. We delete or anonymise data sooner on request, unless we are required to keep it for tax or legal reasons.

8. Your rights

Under UK GDPR you have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate data.
  • Erase your data (the "right to be forgotten"), subject to legal-retention exceptions.
  • Restrict or object to processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these, email [email protected] with the subject line "Data request". We respond within 30 days.

9. Children

MaviSail is not directed at children under 16. We do not knowingly collect data from children. If you believe we have, email us and we will delete it.

10. Changes to this policy

We update this policy from time to time. Material changes will be flagged on this page; the "last updated" date at the top is always current.

11. Contact

MaviSail Ltd, UK. Email: [email protected]. See also our Cookie Policy, Terms of Service, Booking Terms, and Refund & Cancellation Policy.

Privacy Policy — MaviSail | MaviSail