Privacy Policy

1. Controller within the meaning of the GDPR

Hoeke Yachting
Owner: Julian Hoeke
Ctra. Andratx, 34
07181 Portals Nous
Illes Balears, España
Phone: +34 628 22 15 00
Email: julian@hoeke-yachting.com

2. Collection and Processing of Personal Data

Personal data is only collected when you provide it to us voluntarily in the course of an inquiry, newsletter sign-up or appointment booking. This typically includes your name, email, phone number and your message. Inquiry and booking data is used exclusively to process your request (Art. 6 (1) (b) GDPR). The newsletter is sent only on the basis of your consent, obtained via double opt-in (Art. 6 (1) (a) GDPR); you can withdraw this consent at any time using the unsubscribe link in every email.

When the website is accessed, the host automatically records technical server logs (IP address, browser type, timestamp, requested URL). The legal basis is our legitimate interest in secure and stable delivery (Art. 6 (1) (f) GDPR).

3. Processors

For the technical operation of this website we use the following service providers, with whom data processing agreements pursuant to Art. 28 GDPR are in place:

• Cloudflare, Inc. (hosting / CDN, USA with EU edge): static delivery of this website and automatic server logs.
• Supabase (database, EU region): storage of submissions from the contact and newsletter forms.
• Resend (transactional email, USA): delivery of confirmation and reply emails.
• Mapbox, Inc. (map tiles, USA): on marina pages only, and only after you actively click "Load map" (see section 8).
• Google Ireland Ltd. / Google LLC (YouTube, USA): video embedding in privacy-enhanced mode (youtube-nocookie.com) — on yacht detail pages with a video only, and only after you actively click the preview image (see section 5).
• Meta Platforms Ireland Ltd. (WhatsApp, USA): only if you actively use the WhatsApp button (see section 6).

4. Cookies and Local Storage

This website sets no tracking, statistics or marketing cookies and embeds no web analytics. Technically necessary information — your theme preference (light/dark) and your decision to load the interactive map — is stored exclusively locally in your browser (localStorage) and is not transmitted to us. The legal basis is § 25 (2) TDDDG (strictly necessary storage).

Because no consent-requiring cookies are set, no cookie consent banner is necessary. External content (interactive map, YouTube video, WhatsApp) is loaded only after you actively click — see the following sections.

5. YouTube Videos

On individual yacht detail pages we embed videos in privacy-enhanced mode via youtube-nocookie.com (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When the page loads, only a locally hosted preview image is shown — no connection to YouTube is established. Only when you actively click the preview image is the video loaded from YouTube; this transmits data (including your IP address) to Google, which depending on your Google account status may involve a transfer to the USA (see section 8).

The legal basis for loading the video after your click is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent through active selection). If you do not click the preview image, no data is transmitted to Google or YouTube.

6. Contact via WhatsApp

The website features WhatsApp buttons through which you can message us directly. Only when you actively use such a button are you forwarded to WhatsApp and is data transmitted to Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland); depending on your WhatsApp settings this may involve a transfer to the USA (see section 8). If you contact us via WhatsApp, we process the data you provide in order to handle your inquiry. The legal basis is Art. 6 (1) (b) or (f) GDPR (handling your inquiry, efficient communication). If you use the contact form, email or phone instead, no data is transmitted to Meta.

7. Measuring the Use of Our Contact Channels

We measure which route enquirers use to reach us — contact form, WhatsApp, telephone, email and newsletter. The sole purpose is to understand which contact channels are actually used. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in assessing and improving how reachable our own business is.

When you click a WhatsApp button, the link first passes through our own server and is redirected to WhatsApp from there. When you click a telephone number or email address, a short message is sent to our own server in the background. In both cases the resulting record contains neither your IP address nor your browser (user agent), and we set no cookies or comparable identifiers on your device. We store only: the contact channel used, the page the button was on, the language version, where applicable the name of the yacht being viewed, — if present — the search engine or website you came from (its domain only, never the full address), and any campaign parameters (utm_*) in the link you reached us through. None of this allows you to be identified.

To protect against automated bulk requests, your IP address is held separately from the above in a technical rate-limiting list for at most one hour and then deleted automatically. That list is never joined to the data described above. The legal basis is Art. 6(1)(f) GDPR (security and abuse prevention).

Because no information is stored on or read from your device, no consent under § 25 TDDDG is required — which is why this site continues to use no cookie banner and no third-party analytics services. The data never leaves our own infrastructure and is deleted automatically after twelve months at the latest. If you use the contact form, the resulting record is linked to your enquiry and deleted together with it (see section 9). Clicks on WhatsApp, telephone or email remain anonymous and are never joined to a later enquiry. You may object to this processing at any time under Art. 21 GDPR (see section 10).

8. Transfers to Third Countries (USA)

Some of the service providers used (Cloudflare, Resend, Mapbox, Google, Meta) may process personal data in the USA. Such transfers take place on the basis of the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR and — where the respective provider is certified — on the basis of the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). The USA does not offer a level of data protection fully equivalent to EU law; in particular, access by US authorities cannot be entirely ruled out. The consent-based services (map, YouTube, WhatsApp) are only loaded after your active use or click.

9. Retention Period

Inquiries from the contact form are stored for as long as this is necessary for initiating and processing business and for as long as statutory retention obligations do not preclude deletion. Once processing is complete and any retention periods have expired, the data is deleted.

10. Your Rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21). Where consent has been given, you can withdraw it with effect for the future.

To exercise these rights, an informal email to julian@hoeke-yachting.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority — in Spain with the Agencia Española de Protección de Datos (AEPD, aepd.es), or with the data protection authority responsible for you in Germany.

11. Currency of this Policy

This privacy policy is regularly adapted to current legal requirements and changes to our services. You will always find the version in force at hoeke-yachting.com/en/privacy.

Last updated: June 2026