Privacy policy

1. Controller

• Owner: CATMAR SERVEIS NAUTICS S.L.
• Tax identification number (NIF): B65949398
• Registered office: Port Balís, Local 3, 08392 Sant Andreu de Llavaneres, Barcelona, Spain.
• Email: info@catmar.cat
• Domain: catmar.cat
• Barcelona Commercial Registry: volume 43552, folio 30, section 8, sheet B-432048, entry 4.

2. Data processed

The P0 form does not accept file attachments. Do not include passwords, bank details, special-category data or unnecessary confidential information.

• Identity and contact details: name, telephone number, email, company and role where applicable.
• Vessel, location, dates, access and coordination details.
• Engine, generator or other equipment details: type, make, model, optional serial number, hours and notes.
• Request description, operational status, symptoms and worklist.
• Technical data and security signals needed to protect the website and validate the form, according to the actual Cloudflare and Turnstile configuration.
• Consent choice and, only after Analytics consent, analytics identifiers and technical website usage data.

3. Purposes and legal bases

P0 does not use marketing consent, newsletters, profiling, advertising, personalisation or automated decisions.

• Receiving, reviewing and responding to requests and, where appropriate, preparing an assessment or quotation: pre-contractual steps requested by the person.
• Managing professional contacts acting for a company, captain, yacht manager, shipyard, agent or other organisation: the professional relationship and legitimate interests where applicable.
• Security, abuse prevention, deduplication and delivery control: legitimate interests in the security and operation of the service.
• Compliance with legal obligations and the handling or defence of claims: legal obligation and legitimate interests, as applicable.
• Website measurement with Google Analytics 4: consent to the Analytics category. Withdrawal prevents new measurement.

4. Source and required fields

Data is provided by the person making the request or by a professional contact acting for an organisation or the person responsible for the vessel. Required fields are limited to the information needed to review and respond to the request.

5. Recipients and providers

Data is accessed by authorised CATMAR personnel who need it to manage the request. The planned architecture uses Cloudflare Workers to execute and protect the service, Cloudflare Turnstile to prevent abuse, a Cloudflare D1 database configured with EU jurisdiction for minimum technical metadata, and Brevo to deliver the message transactionally to info@catmar.cat.

The info@catmar.cat mailbox distributes the request internally to authorised CATMAR personnel. CATMAR does not sell personal data or use it to build advertising audiences.

CookieYes manages and records the consent choice. Google Analytics 4 operates only after Analytics consent; CATMAR does not use this configuration for advertising audiences. The runtime does not send form content, names, email addresses, telephone numbers, request identifiers, URL parameters or referrer data to Analytics.

D1's EU jurisdiction setting does not mean that all processing carried out by Cloudflare is guaranteed to remain physically within the European Union. Providers may use subprocessors and valid safeguards must apply where an international transfer takes place.

6. Technical delivery metadata

D1 does not store the form content or direct personal data from the request. It may retain minimum technical identifiers for security, deduplication and delivery control, such as a request identifier, versioned HMAC-SHA256 fingerprint, internal ownership tokens, state, provider identifier, reason, and necessary timestamps or lease data.

The fingerprint is treated internally as pseudonymised data, not anonymous data. These details do not replace the applicable access and minimisation controls.

7. Retention

• Requests that do not become work: 12 months from the last relevant interaction, followed by verifiable deletion or restriction.
• Requests that become work: transferred to the actual client or work record and retained under the applicable contractual, accounting, tax and liability requirements.
• Technical logs and metadata: for the minimum period needed under the actual configuration for security, deduplication and delivery control.

8. Rights

Access, rectification, erasure, objection, restriction and portability may be requested where applicable by writing to info@catmar.cat. CATMAR may request only the information needed to verify identity. A complaint may also be submitted to the Spanish Data Protection Agency.

Spanish Data Protection Agency

9. Security and changes

CATMAR applies controls proportionate to risk, including server-side validation, restricted access, secrets kept out of public code, abuse prevention and minimisation. This policy will be updated if the configuration or processing changes materially.