Privacy Policy

TideCharter is a yacht charter broker for Croatia. You tell us what kind of trip you want, and our team finds suitable yachts, sends you a quote and, if you accept, places the reservation with the charter company that owns or runs the yacht.

The company responsible for your personal data (the "controller") is:

• Lerna d.o.o. (limited liability company)
• Registered address: Ulica grada Vukovara 11, 10000 Zagreb, Croatia
• OIB (Croatian tax number): 84840714884 · VAT ID: HR84840714884
• Registered at: Trgovački sud u Zagrebu, MBS 080516590
• Email: hello@tidecharter.com (for privacy requests, please write "Privacy" in the subject line)

In this policy, "TideCharter", "we" and "us" mean the company named above.

2.1 When you send an enquiry

What we collect through our enquiry form:

• Required: your first name and email address.
• Optional: last name, phone number, travel dates, number of guests, preferred marina, budget range, whether you want a skipper or crew, and a message.
• Added automatically: a reference number (for example TC-1A2B3C4D), the date and time, the yacht you enquired about (name, type and indicative rate), the page you enquired from and the site language.
• For security: your IP address and your browser type (the "user agent", a short text naming your browser and device).
• Our team's notes on your enquiry, for example what you told us on a call, its status and when to follow up.

Why. To answer your enquiry, check availability, send you quotes and follow up on them. We also send you an automatic email confirming that we received your enquiry. If you do not reply to a quote, we may send you up to 2 reminders about that quote, for example before an option expires. We do not send you offers for other trips unless you ask for them.

Legal basis. We need this to answer the request you sent us (GDPR Art. 6(1)(b)). We keep the IP address and browser type to protect the form from spam, abuse and fraud, which is our legitimate interest (Art. 6(1)(f)).

Health and other sensitive details. Please do not put health information or similar private details in your message unless we really need them for your trip (for example a mobility need or a serious allergy). If you tell us anyway, we use it only to reply to you. We will not pass it on to anyone until we have asked you by email whether you want us to share it with the charter company, and you have clearly said yes (your explicit consent, GDPR Art. 9(2)(a)). If you do not confirm, we delete it together with the rest of your enquiry. You can withdraw your consent at any time by emailing us.

2.2 When we hold a yacht for you and arrange your charter

What we collect.

• Our emails with you, including quotes, your replies and any documents you send us.
• Skipper documents. For a charter without a skipper ("bareboat"), the charter company needs to see the skipper's boat licence and VHF radio certificate. If you send us copies, we forward them to the charter company. The charter company decides whether to accept them; we do not check or confirm that a licence is valid. Please send only the licence and VHF certificate, not your passport or ID card, unless the charter company asks for them.
• Crew list. The charter company needs a crew list for everyone on board: usually full name, date of birth, nationality, and the type and number of each person's passport or ID card. Croatian law requires the charter company to register the crew with the harbour master and to register guests for tourist tax. Many charter companies collect the crew list from you directly through their own online check-in. If you send it to us instead, we forward it to the charter company.
• Preference sheets. For crewed charters, the charter company may ask for a preference sheet that can include food allergies or other health details, so that the crew can look after you. Where possible, please send it directly to the charter company. If you send it to us, the rule on health details in section 2.1 applies: we ask you to confirm before we forward it.
• You pay the charter company directly under its booking documents. We do not receive your payment details.

Why. To hold the yacht for you (an "option"), place the reservation with the charter company, pass on the documents it needs, send you the booking documents and payment details, and help you before and during your charter.

Legal basis. For you: we need this to arrange the charter you asked for (GDPR Art. 6(1)(b)). For the other people on your crew list: our legitimate interest, and theirs, in arranging the charter they are joining and in giving the charter company what it needs to meet its legal duty to register everyone on board (Art. 6(1)(f)).

If you are on someone else's crew list. We received your details from the person who booked. We use them only to pass them to the charter company for this charter, and we delete our copy as stated in section 6. You have the same rights as everyone else (section 7). If you send us other guests' details, please share this section with them.

Yacht photos in our quote emails. Our quote emails show a photo of the yacht that is loaded from the server where the photo is stored (usually Booking Manager or NauSYS, and for a few yachts the photo library Unsplash). When your email program displays the photo, it connects to that server, which then sees your IP address. You can avoid this by turning off automatic image loading in your email program.

2.3 When you email us, complain or report content

If you email us directly, send a complaint, or tell us about content on the website that you think is illegal or infringes your rights, we use your name, contact details and what you write to deal with your message.

Legal basis. To answer your request (GDPR Art. 6(1)(b)). For consumer complaints, our legal obligation under the Croatian Consumer Protection Act to answer complaints and keep them (Art. 6(1)(c)). For reports about content, our legitimate interest in keeping the website lawful (Art. 6(1)(f)).

2.4 Records we must keep

What. Booking confirmations, invoices, payment records and the related correspondence.

Why and legal basis. Croatian accounting and tax law requires us to keep these records (GDPR Art. 6(1)(c)). We may also need them if there is a dispute about a booking (Art. 6(1)(f), our legitimate interest in protecting our legal rights).

2.5 Keeping the website working and secure

What. When you visit any page, our web server automatically records your IP address, the date and time, the web address (URL) of the page, including any search details in it, the page you came from and your browser type. If our spam filter blocks an enquiry, we log the IP address it came from. To stop abuse, the server also counts how many enquiries come from each IP address within a short time. This count is kept only in the server's working memory, is never saved to disk, and is deleted once the time window has passed (at most 24 hours).

Why and legal basis. To deliver the website, find and fix errors, and protect the site and its visitors from attacks and spam. This is our legitimate interest (GDPR Art. 6(1)(f)). We do not use these logs to identify or profile visitors.

2.6 Analytics, only with your consent

If you click "Accept all" (or switch a tool on and click "Save choices") in the cookie banner, we use two tools:

• Google Analytics 4 counts visits and shows us which pages are useful. Google receives the web address (URL) of each page you view. This can include your search details, such as dates, number of guests or the yacht you chose, but never your name or email address. We remove enquiry reference numbers, trip details and message text from the addresses of our enquiry pages before they are sent to Google. Google also receives information about your device and browser, and your IP address, which it uses to estimate your country or city and then discards. We have switched off Google's advertising features: Google Analytics on our site does not set advertising cookies, and we do not allow Google to use our analytics data for advertising or for its own products.
• Microsoft Clarity shows us, as heatmaps and session recordings, how visitors scroll, click and move around our pages, so that we can fix pages that are confusing. We have set Clarity to mask everything you type and the contents of our enquiry form, so your name, email address and message are never included in recordings. Microsoft also uses this data for its own purposes and may recognise your browser on other websites that use Clarity (see section 4).

Legal basis. Your consent (GDPR Art. 6(1)(a) and, for cookies, the Croatian Electronic Communications Act). If you click "Reject all", or ignore the banner, these tools are not loaded at all. Your choice applies for 12 months; after that, or if we change the tools we use, we ask you again. If you are under 16, please do not accept analytics without your parent's or guardian's permission.

Changed your mind? Click Cookie settings at the bottom of any page. The page then reloads without the analytics tools, and we delete the cookies they placed on our website. Cookies that Microsoft may have set on its own domains (such as MUID on clarity.ms) can only be removed in your browser settings. Withdrawing consent does not undo data collected while the tools were on.

2.7 Map view

When search results are shown on a map, your browser loads the map pictures from OpenStreetMap's servers. These are run by the OpenStreetMap Foundation (UK) and delivered through its network provider, Fastly, Inc. (USA). To do this, your browser sends them your IP address and browser type. This happens only when the map is shown, which is when you choose the map view or open a search link that already shows it. To avoid it, use the grid or list view. The OpenStreetMap Foundation decides for itself how it uses this data: see its privacy policy at https://osmfoundation.org/wiki/Privacy_Policy.

Legal basis. Our legitimate interest in showing you the map you asked for (GDPR Art. 6(1)(f)). No cookies are set by us for the map.

2.8 Things saved in your own browser

The website stores your last search (destination, dates, number of guests) and the details of an enquiry you are preparing (yacht, marina, dates, number of guests, indicative rate and any pre-written message from the link you followed) in your own browser tab, so you do not have to type them again. Nothing you type into the enquiry form, such as your name, email or message, is stored in your browser. This data stays on your device, only reaches us if you send an enquiry, and is deleted when you close the tab. It is needed for the function you are using, so no consent is required. If you choose a language with the language menu, we remember it in a small cookie (section 11).

• To send an enquiry, you must give us your first name and email address. Without them we cannot reply. Everything else is optional, but it helps us find the right yacht.
• To complete a booking, the charter company and Croatian law require some information, such as the crew list and, for bareboat charters, a valid licence. Without it, the charter cannot go ahead.
• Analytics cookies are entirely optional.
• You can browse the website without telling us who you are. Our server still records basic technical data, such as your IP address, to deliver the pages (section 2.5).

We share your data only where needed for the purposes in section 2. We do not sell your personal data, and we do not share it with anyone for their advertising.

Service providers who work for us. They may only use your data on our instructions, under contracts that meet GDPR requirements.

• Oracle Cloud Infrastructure hosts our website, database and server logs. Location: Frankfurt, Germany (EU).
• Resend (Resend, Inc., USA) sends our emails (enquiry confirmations, quotes and internal notifications). Our sending domain is set up to deliver through Amazon servers in Ireland (EU), but Resend is a US company and processes and may store the emails in the USA (section 5).
• Amazon Web Services (Amazon SES) receives and stores emails sent to hello@tidecharter.com. Location: Ireland (EU).
• Google (Google Ireland Ltd and Google LLC) provides Google Analytics, only with your consent.

Charter booking systems. We place options and bookings through Booking Manager and NauSYS, the booking systems that charter companies use to manage their yachts. The data we enter there (see "The charter company" below) is stored in those systems for us and for the charter company, under the systems' terms.

Others who use your data for their own purposes. They are responsible for it under their own privacy policies.

• The charter company (the owner or fleet operator of your yacht). When we place an option or a booking for you, we give it, through its booking system, your name, the dates and the number of guests. We give it your email address and phone number only when your booking is confirmed, or earlier if it needs them to hold the yacht. For the booking, it also receives the crew list and the skipper's documents. The charter company decides how it uses this data and is responsible for it.
• Microsoft Clarity (Microsoft Corporation, USA), only with your consent. Microsoft collects your usage data through the Clarity tool on our pages. We and Microsoft are jointly responsible for this collection. Microsoft then decides for itself how to use the data it receives, including to improve its own products and to recognise browsers across websites that use Clarity: see https://privacy.microsoft.com/privacystatement. You can use your rights with us or with Microsoft.
• OpenStreetMap Foundation (UK) and Fastly, Inc. (USA), only when the map is shown (section 2.7).
• Booking Manager, NauSYS or Unsplash image servers, which see your IP address if your email program loads the yacht photo in a quote (section 2.2).
• Public authorities, courts and our professional advisers (lawyers, accountants, auditors), when the law requires it or we need it to protect our legal rights.

Some of our providers are in the United States or the United Kingdom, so your data may be stored there or accessed from there. The law requires extra protection when that happens:

• United States (Resend, Google, Microsoft, Fastly, Oracle, Amazon). Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (GDPR Art. 45). Otherwise it relies on the EU Standard Contractual Clauses (GDPR Art. 46(2)(c)).
• United Kingdom (OpenStreetMap Foundation, map only). The European Commission has decided that the UK protects personal data adequately (GDPR Art. 45).

Email us if you want a copy of these safeguards.

If you don't book, we delete your enquiry, and our emails with you about it, 12 months after our last contact. If you book, we keep booking records for 5 years after your charter (the general time limit for legal claims in Croatia) and invoices for 11 years (required by Croatian accounting law). We delete licence copies, crew lists and preference sheets from our mailbox and files no later than 60 days after your charter ends.

The full list:

• Enquiries that do not lead to a booking (form data, our notes, our internal notification email, and our emails with you): 12 months after our last contact with you.
• IP address and browser type stored with an enquiry: 90 days after the enquiry.
• Enquiries our team marks as spam: 30 days. (Messages our automatic spam filter blocks are not stored at all; only the IP address is logged, see application logs below.)
• Health details you sent us but did not confirm we may share: deleted with the rest of your enquiry, or sooner if you ask.
• Booking correspondence and booking records: 5 years after the end of your charter (general limitation period under the Croatian Civil Obligations Act).
• Invoices and accounting documents: 11 years after the end of the business year (Croatian Accounting Act).
• Skipper licence copies, crew lists and preference sheets sent to us: forwarded to the charter company, then deleted from our inbox, sent items and files no later than 60 days after the end of your charter. The charter company keeps its own copy under its own policy.
• Complaints and our replies: 1 year after our reply, or 5 years after the end of your charter if the complaint concerns a booking.
• Web server access logs: 14 days.
• Application logs (including blocked spam IP addresses): 30 days.
• Your cookie choice and language choice: 12 months.
• Google Analytics: detailed data linked to your browser's cookie is kept for 2 months. Statistics combined from many visitors, with no link to you, may be kept longer.
• Microsoft Clarity: as set by Microsoft.

We keep data longer only if we need it for an ongoing legal claim or a request from an authority, and only for as long as that lasts.

To use any of these rights, email hello@tidecharter.com with "Privacy" in the subject line. It is free, and we reply within one month. In complex cases we can extend this by up to two more months, and we will tell you if we do. We may ask you to confirm your identity; usually it is enough to write from the email address you used for your enquiry.

You have the right to:

• See your data: ask what data we hold about you, including our team's notes, and get a copy.
• Correct it: have wrong or incomplete data corrected.
• Delete it: ask us to delete your data, unless we must keep it, for example for accounting.
• Restrict it: ask us to limit how we use your data while a question is being resolved.
• Take it with you: receive the data you gave us in a common machine-readable format, or have it sent to someone else.
• Withdraw consent at any time, for example with Cookie settings at the bottom of every page, or by emailing us about health details you allowed us to share.

These rights are set out in Articles 7(3) and 15 to 21 of the GDPR.

Right to complain. If you think we are handling your data unlawfully, you can complain to the Croatian data protection authority:

Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
Website: https://azop.hr · Email: azop@azop.hr

You can also complain to the data protection authority in the EU country where you live or work. You don't need to contact us first, but if you do, we will try to fix the problem quickly.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you (GDPR Art. 22). Apart from the usage statistics in Google Analytics and Microsoft Clarity, which only run with your consent (section 2.6) and use a random identifier rather than your name, we do not create profiles of visitors.

Our spam filter checks enquiries automatically, for example whether the form was filled in faster than a person could. Because the filter does not tell senders that it blocked them, a blocked enquiry looks as if it was sent. If you do not receive our confirmation email within an hour, check your spam folder, then email us at hello@tidecharter.com and a person will handle it. If too many enquiries come from the same connection, the form shows an error message and asks you to email us instead.

Our service is for adults planning a trip. You must be at least 18 to send us an enquiry or make a booking. Parents or guardians may give us children's details when needed for the booking, such as the number of guests, or a child's name, date of birth and passport or ID number on the crew list. We use these details only to arrange the charter, and we keep and delete them as described in section 6.

We protect your data with appropriate technical and organisational measures. These include encrypted connections (HTTPS), a database that only our own server can reach, individual password-protected staff accounts, protection against automated spam and abuse, and keeping the number of people with access as small as possible.

No system is completely secure. If a data breach is likely to put you at high risk, we will tell you without undue delay.

This list shows everything we use. You can change your choice at any time with Cookie settings at the bottom of every page.

Always on (needed for the website to work, no consent needed)

• tc_cookie_consent (our cookie, 12 months) and tidecharter-cookie-consent (browser storage, 12 months): remember your cookie choice.
• NEXT_LOCALE (our cookie, 12 months): remembers the language you chose with the language menu, so we show the site in that language next time. It is only set if you use the language menu.
• tidecharter-search (browser tab storage, until you close the tab): remembers your last search while you browse.
• tidecharter.inquiry-context (browser tab storage, until you close the tab): keeps the yacht and trip details (yacht, marina, dates, number of guests, indicative rate and any pre-written message from the link you followed) while you fill in the enquiry form.

Only if you click "Accept all" (or switch a tool on and click "Save choices")

• _ga, _ga_* (Google Analytics cookies, up to 2 years): count visits and sessions.
• _clck (up to 1 year) and _clsk (1 day) (Microsoft Clarity cookies): link page views into one visit.
• MUID and similar (Microsoft cookies set on Microsoft's own domains, such as clarity.ms, up to 1 year): used by Microsoft to recognise browsers across websites that use Clarity.

Only when the map is shown

• No cookies are set by us. Your browser requests the map pictures from OpenStreetMap's servers (section 2.7).

Our staff also use a login cookie (tc_admin_session) on our admin pages. It is never set for visitors.

We will update this policy when our services or the law change. The "Last updated" date at the top shows when it last changed. If we make important changes, for example new purposes or new types of recipients, we will show a notice on the website and, where you have an enquiry or booking in progress with us, we will tell you by email.

This policy is available in English, German, French, Italian and Spanish. All versions describe the same processing. If you find a difference, please tell us and we will correct it. Until then, you may rely on the version that is better for you.