1. Data controller
Fondear, S.L. (CIF B-83958975, registered address at Melina Mercury, 71, Las Rozas, 28232 Madrid, Spain) is the controller of the personal data collected through fondear.org. General contact: info@fondear.com / +34 91 631 9190. Data Protection Officer (DPO): fondear@fondear.com.
2. What data we collect and why (purposes and legal basis)
- Contact / interest requests (name, email, phone, message, boat of interest): processed to answer your enquiry and follow up on it, based on your explicit consent, given via an unchecked checkbox at the point of submission.
- Insurance quote requests: your data (and the relevant boat/value data) is shared with our insurance partner to prepare a quote, based on your explicit, informed consent.
- Aggregated usage analysis (dashboards, statistics): based on our legitimate interest in improving the service; IP addresses are pseudonymised (salted SHA-256 hash) before storage.
- Technical security logs (server/WAF, IP, user agent, path): based on our legitimate interest in keeping the service secure.
- Back-office user accounts (staff/collaborators): based on the contractual/employment relationship.
3. Recipients of your data
Data is not sold. It may be shared with: our insurance partner and financing partner only for the request you explicitly submit to them; and processors acting on our behalf (hosting provider, Cloudflare as CDN/security, Sentry as error monitoring), each bound by a data processing agreement.
4. International transfers
Cloudflare and Sentry may process data outside the EU/EEA. Such transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as applicable.
5. How long we keep your data
Leads without further activity: 24 months, then anonymised. Clients with completed sales: 6 years from the last transaction, for tax/commercial obligations, then blocked and deleted. Cookie-consent records: 12 months. Technical logs: 12 months. Full detail in our internal retention schedule (available on request).
6. Your rights
You may exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to our DPO at fondear@fondear.com. We will respond within one month (extendable by two more, with notice). You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), aepd.es.
7. Providing your data
Providing the data marked as required is necessary to respond to your request; without it we cannot process it.
8. Automated decisions
We do not carry out automated decision-making or profiling with your data.