Last updated: 8 November 2026
NauticaAdria FINDER is operated by Marko Leh, the data controller for the platform. For privacy requests and support, email info@nauticaadria.eu.
1. Data we process
For owner accounts and listings, we process your email, owner or charter name, mobile and optional WhatsApp number, country preferences, account identifiers, boat details, private registration information, photographs, descriptions, pickup information, availability, prices and your contact or publication approvals. Submitted photographs and text may contain personal data; include only information you are entitled to share.
Booking Requests contain the guest’s name and phone number, their WhatsApp contact preference, and any requested dates, number of persons, message and skipper selection. The form does not ask for the guest’s email address. WhatsApp contact is optional and initially unchecked; when selected, the email to the advertiser includes a WhatsApp contact link using the guest’s phone number. We send the enquiry and contact details to the relevant advertiser by email. We do not store the complete request as a booking record in the platform database; delivery systems and recipients may retain email copies.
We also process technical request data, including IP addresses and browser/request information where needed for delivery and security, cookie identifiers, authentication records, hashed abuse-prevention identifiers, and limited consent and moderation records.
2. Purposes and legal bases
We process the information needed to provide your requested account, listing management and enquiry-delivery services to perform our agreement with you or take steps at your request (GDPR Article 6(1)(b)). Required fields are needed for the relevant function; without them, we may be unable to provide it. Optional fields may be left blank.
Our legitimate interests in reliable service operation, preventing fraud and spam, securing accounts, handling support and defending legal claims support necessary security and operational processing (Article 6(1)(f)). We use consent for optional public disclosure of contact details and optional disclosure of an exact pickup point where that point is personal data (Article 6(1)(a)). You can withdraw such consent through the relevant controls or by contacting us, without affecting earlier lawful processing. Processing required by law relies on Article 6(1)(c).
3. Public listings, location and recipients
Published listing content and photographs are public. Call and WhatsApp numbers are exposed only under the corresponding owner approval. Booking Requests go to the advertiser’s approved email destination. Precise owner pickup coordinates are published only with the applicable explicit approval and successful publication; other pickup references may be approximate.
Registration information is required when an owner adds a boat. The number is visible to the authorised owner in My Boats and is available to authorised administrators for registration checks. NauticaAdria keeps the number entered in the registration field private. Before any future public disclosure, we will establish an applicable lawful basis and inform affected owners.
For fraud prevention and listing review, authorised administrators may manually compare vessel identity, registered purpose and relevant owner or user information when lawfully available from the official Croatian vessel register or documents supplied by the advertiser. We record the verification decision for accountability. We do not publish the register’s owner or user details through this feature.
Optional guest GPS assistance requests your device’s location permission and uses coordinates temporarily in the browser to suggest a search area. NauticaAdria does not retain that precise position as a location history. The selected canonical search area enters the search request.
Advertisers receiving enquiries handle their subsequent communications and rental arrangements independently. Public information, downloaded photographs and messages already delivered to recipients cannot necessarily be recalled from their copies.
4. Authentication and Google
Email sign-in uses a one-time link valid for 45 minutes and a seven-day owner session. Keep sign-in links private.
Google sign-in is optional. The integration requests only openid email. When used, it verifies Google’s account identifier and email-related authentication claims to authenticate you and securely link the identity to your canonical NauticaAdria account. It does not request access to Gmail messages, contacts or Drive files and never receives your Google password. Matching email alone does not claim an existing account or fleet; existing-account linking requires authentication and explicit confirmation.
We retain the linked provider identifier with the account. Temporary authentication proofs are protected and expire; access and refresh tokens are not retained by this integration. Apple sign-in is disabled.
5. Hosting, external services and transfers
Hostinger provides hosting and email infrastructure and processes service data on our behalf. Its Data Processing Addendum describes processing, subprocessors and applicable international-transfer safeguards, including standard contractual clauses where required.
The owner pickup map loads Leaflet resources from unpkg.com and map tiles from OpenStreetMap. These external requests disclose technical connection information, such as your IP address and browser information, and the requested map area. Leaflet itself is a software library, not a separate recipient of your owner profile. See the OpenStreetMap Foundation Privacy Policy.
Following WhatsApp, Google Maps, Apple Maps or Waze links opens the selected provider’s service and sends the information included in that link, such as an advertiser’s phone number or pickup destination. Those services apply their own privacy terms. Google authentication, when available, likewise involves direct communication with Google.
These providers and email recipients may process data outside the EU/EEA. We do not promise EU-only processing. For processing on our behalf, applicable transfer arrangements may include an adequacy decision or standard contractual clauses, depending on the provider and destination. Contact us for information about the safeguards relevant to your data. Choosing an external communication or navigation service also subjects your interaction to that provider’s own practices.
6. Cookies and retention
Necessary cookies support owner sessions (seven days), guest sign-in protection (one hour), legacy draft continuation and Wizard security (up to 30 days), and Booking Request protection (browser session). Google flow cookies last up to ten minutes when a flow is started; private pilot browser authorization lasts at most 30 minutes. A separate deletion-status cookie lasts up to seven days and only checks the accepted deletion request; it cannot sign you in. Browser settings can remove or block cookies, but required functions may stop working.
Account, listing, media, calendar and linked-identity data are retained while needed to provide the requested service, address requests and disputes, maintain necessary security records, or meet legal obligations. We assess deletion against those purposes and retain only what remains necessary. There is no automatic one-year owner-account deletion. Owners can request permanent account deletion through My Boats → My Details → Delete account, after fresh identity confirmation, review and explicit final confirmation. On confirmation, listings are hidden and NauticaAdria sign-ins are revoked; the account remains restricted until its eligible listings and exclusive photographs have been removed. Shared data, recorded retention holds or unclear ownership require administrator review. Minimal pseudonymous erasure and anti-replay evidence is retained where necessary for security and safe recovery. Restoring a backup must preserve and reapply the latest erasure safeguards before the site is reopened.
Temporary authentication and security records expire and are subject to scheduled cleanup. Booking anti-abuse and duplicate-protection records have short validity periods of up to 48 hours and are cleaned in bounded batches; expired records may remain until cleanup runs. The existing 90-day abandoned-draft cleanup covers legacy drafts without an owner association, not all owner accounts. Backups, server logs and delivered emails have separate retention and recovery constraints; deleting live data is not an immediate erasure of every backup or recipient copy.
7. Your rights and requests
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time. We do not use solely automated decisions producing legal or similarly significant effects about you.
Send requests to info@nauticaadria.eu, identifying the account or enquiry concerned. We may seek proportionate additional information to verify identity. We respond without undue delay and normally within one month of receiving a request. Where the law permits an extension, we notify you within that month with the reasons. Erasure is subject to applicable exceptions; if we cannot act, we explain why and the available remedies. Requests are normally free, subject to statutory exceptions.
You may complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr, or another competent supervisory authority, and seek a judicial remedy.
8. Updates
We update this notice when our practices change and communicate material changes as appropriate. The date above identifies this version. See also our Terms of Service.