Last updated: 14 May 2026
At NÁUTICA SPRING DE PROA, S.L. (hereinafter, "Rumbo Salou") we take privacy and the protection of personal data very seriously. This Privacy Policy explains transparently how we collect, use, retain and protect the personal data of users of the website rumbosalou.com and of those who book our services.
1. Data Controller
- Company name: NÁUTICA SPRING DE PROA, S.L.
- Tax ID (CIF): B-23932577
- Registered office: Calle Rocinante 25, 28816 Camarma de Esteruelas, Madrid (Spain)
- Place of business: Salou Marina, 43840 Salou, Tarragona (Spain)
- Email: info@rumbosalou.com
- Telephone: +34 614 91 77 78
- Data Protection Officer (DPO): Not appointed (not mandatory under Article 37 GDPR).
2. Personal data we process
We process the following types of personal data depending on the channel and purpose:
- Online booking form: full name, email, telephone, number of passengers, requested date and time slot, chosen service, optional message and payment data tokenised through Stripe.
- Gift voucher: name of the buyer, name of the recipient, buyer's email and personalised message.
- WhatsApp / contact email: the data that the person voluntarily provides in their message.
- Site navigation: IP address, browser type, operating system, pages visited, date and time of access, referrer, cookies (see Cookies Policy).
- Invoicing: name or company name, Tax ID (NIF/CIF), tax address and email (where you book our services).
We do not process special categories of data (Article 9 GDPR: health, ethnic origin, political opinions, religious beliefs, biometric data, etc.).
3. Purposes, legal basis and retention period
Personal data are processed for the following purposes:
| Purpose | Legal basis (Article 6 GDPR) | Retention period |
|---|---|---|
| Managing the booking of charter services and the contractual provision of the service (including confirmations, reminders and logistical communications). | Performance of a contract (Article 6(1)(b)). | Duration of the contractual relationship and, once it has ended, until the limitation period for any potential legal actions has expired (general period of 5 years under Article 1964 of the Spanish Civil Code). |
| Processing the payment of the deposit or the full price through the Stripe payment gateway. | Performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)). | As required by tax legislation and anti-money laundering regulations. |
| Complying with legal obligations (invoicing, accounting, tax legislation, anti-money laundering regulations). | Legal obligation (Article 6(1)(c)). | 6 years (Article 30 of the Spanish Commercial Code) and the specific periods established by each applicable regulation. |
| Handling enquiries, suggestions and complaints received by email or WhatsApp. | Consent (Article 6(1)(a)) or legitimate interest (Article 6(1)(f)). | For as long as the enquiry is being handled and up to 1 year afterwards, unless erasure is requested. |
| Sending commercial communications (newsletter, special offers), only where you have given express consent. | Consent (Article 6(1)(a) and Article 21 of the Spanish LSSI). | Until consent is withdrawn or unsubscription is requested. |
| Web analytics and improvement of the user experience (analytics and marketing cookies). | Consent (Article 6(1)(a)). | See the specific duration of each cookie in the Cookies Policy. |
| Compliance with registration and commercial obligations before maritime and port authorities. | Legal obligation (Article 6(1)(c)). | Periods required by maritime and nautical safety regulations. |
4. Recipients and data processors
Your personal data may be disclosed to the following categories of recipients where strictly necessary:
- Stripe Payments Europe, Ltd. — Online payment processing. Dublin, Ireland. Privacy policy.
- Hostinger International Ltd. — Web hosting services. EU. Privacy policy.
- Google Ireland Ltd. — Google Analytics 4, Google Ads and Google Tag Manager (analytics and advertising). Ireland. Privacy policy.
- Meta Platforms Ireland Ltd. — Facebook/Instagram pixel (advertising and remarketing), only where you give your consent. Ireland. Privacy policy.
- Tax and accounting advisers — For compliance with legal obligations.
- Competent public authorities — Where there is a legal obligation (Spanish Tax Agency, Harbour Master's Office, etc.).
- Courts and tribunals — In the event of legal proceedings.
No data will be disclosed to third parties without your consent, save where there is a legal obligation to do so.
Cookie consent management and an in-house first-party audience analytics system are operated using Rumbo Salou's own technology, with no external platforms involved. This analytics data is not shared with any third party, the IP address is irreversibly anonymised (never stored raw) and it is only collected after the user's analytics consent. The legal basis is consent (Art. 6(1)(a) GDPR) and the data is retained for a maximum of 14 months.
5. International data transfers
Some of our providers (Google, Meta) are established in the European Union (Ireland), but may carry out processing in the United States. Such transfers are covered by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and/or by Standard Contractual Clauses (SCCs) approved by the Commission, in accordance with Articles 45 and 46 GDPR. You may request a copy of the safeguards applied by writing to info@rumbosalou.com.
6. Rights of data subjects
Under the GDPR and the Spanish LOPDGDD, you may exercise the following rights at any time:
- Right of access: to find out which of your data we process and to obtain a copy.
- Right to rectification: to request the correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): to request the deletion of your data when they are no longer necessary.
- Right to object: to object to the processing of your data on grounds relating to your particular situation.
- Right to restriction of processing: to request that the processing be restricted in the cases provided for in the GDPR.
- Right to data portability: to receive your data in a structured, commonly used and machine-readable format, or to request their transmission to another controller.
- Right not to be subject to automated decision-making (including profiling) producing legal effects. Rumbo Salou does not carry out this type of processing.
- Withdrawal of consent: to withdraw at any time the consent you have given, without this affecting the lawfulness of processing carried out beforehand.
7. How to exercise your rights
You may exercise any of the above rights by sending an email to info@rumbosalou.com clearly indicating the right you wish to exercise and attaching a copy of your national identity document (DNI) or equivalent document evidencing your identity. You may also write to the registered office indicated in section 1.
The exercise of these rights is free of charge and will be addressed within a maximum period of one month from the receipt of your request, which may be extended by a further two months depending on the complexity and number of requests (Article 12(3) GDPR).
8. Right to lodge a complaint with the supervisory authority
If you consider that the processing of your personal data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Electronic office: sedeagpd.gob.es
- Address: C/ Jorge Juan, 6, 28001 Madrid (Spain)
- Telephone: 901 100 099 / 91 266 35 17
Before lodging a complaint with the AEPD, we would be grateful if you would contact us first so that we can try to resolve any disagreement.
9. Security measures
NÁUTICA SPRING DE PROA, S.L. has adopted the appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 GDPR, including:
- Encryption of data in transit through HTTPS (TLS 1.3).
- Tokenisation of payment data through Stripe (PCI-DSS Level 1).
- Access control and authentication for the administration panel with strong passwords.
- Regular backups.
- Logging and auditing of access to personal data.
- Staff training in data protection and confidentiality.
10. Processing of minors' data
Our services are aimed at adults. We do not intentionally collect or process personal data of children under 14 without the consent of their parents or legal guardians (Article 8 GDPR and Article 7 of the Spanish LOPDGDD). If we discover that we have received data from a minor without the relevant authorisation, we will proceed to delete them immediately.
11. Accuracy of the data
The user warrants the truthfulness, accuracy and authenticity of the personal data provided, and undertakes to keep them duly updated, notifying Rumbo Salou of any changes. The user shall be liable for any damage or loss that may be caused to Rumbo Salou or to third parties by submitting false, inaccurate, incomplete or out-of-date data.
12. Amendments to the Privacy Policy
Rumbo Salou reserves the right to amend this Privacy Policy in order to bring it into line with legislative or case-law developments or with business practice. Any amendment will be published on this same page, indicating the date of update. We recommend that you review this document periodically.
13. Contact
For any enquiry relating to this Privacy Policy or to the processing of your personal data, you may contact us at:
- Email: info@rumbosalou.com
- Telephone: +34 614 91 77 78
- Postal address: Calle Rocinante 25, 28816 Camarma de Esteruelas, Madrid (Spain)