What we collect when you book with us or visit our website, why we need it, who we share it with, and your rights.
Aquaholic is run by Fernando Carlos Ildefonso Duarte, who is responsible for the personal data described here (the “controller” under the GDPR).
We’re a small business, so we don’t have a data protection officer. Send any question about your data to the email above.
Your first and last name, your email address and, if you give it, your phone number, plus the details of your booking: boats, date, start time, rental length and price. Your email address is required: it’s where we send your confirmation and your link to My bookings. Your phone number is optional, but it helps us reach you quickly, for example if the sea isn’t safe on your day.
Why: to take and manage your booking, send you emails about it, and contact you if something changes. Legal basis: it’s needed to carry out our contract with you (GDPR article 6(1)(b)).
You pay directly with Stripe (card, Apple Pay, Google Pay, MB WAY and other methods) or with PayPal. They receive your payment details. We only receive the result: the amount, its status, the payment method and a transaction reference. We never see or store your full card number.
Legal basis: our contract with you, and our legal duty to keep accounting records (GDPR article 6(1)(b) and (c)).
After you book, we send you a confirmation, and an email whenever your booking is changed or cancelled. The evening before your rental we send a short reminder, and about a day after it a follow-up asking how it went.
Legal basis: booking emails are part of our contract. The follow-up is based on our legitimate interest in hearing from our customers (GDPR article 6(1)(f)). Just reply or email us and we’ll stop sending it to you. We don’t send newsletters or marketing emails.
When you ask for access to My bookings, we email a sign-in link to the address you booked with. Opening the link stores two small cookies that keep you signed in for up to 30 days (see Cookies).
If you message us on WhatsApp, call us or email us, we receive your name, phone number or email address and whatever you tell us. We use it to answer you and help with your booking. Legal basis: steps you ask us to take before or during a booking, or our legitimate interest in answering your questions (GDPR article 6(1)(b) and (f)).
If you’d like your tax number (NIF) on your invoice, we’ll need your name and tax number. Invoices are issued with our invoicing software from ZoneSoft, Lda. and reported to the Portuguese Tax Authority (AT), as the law requires. Our accountant receives your name and tax number only when they’re on your invoice. Legal basis: legal obligation (GDPR article 6(1)(c)).
We count visits with Independent Analytics, a statistics tool that runs on our own website. It records which pages are visited, which website or link brought the visitor here, the approximate location (country and city, worked out from the IP address) and the type of device and browser. It doesn’t use cookies and doesn’t store IP addresses: to tell new visitors from returning ones, it keeps a one-way scrambled code made from the IP address and browser. The statistics stay on our website’s server and aren’t shared with anyone.
Legal basis: our legitimate interest in knowing how our website is used, so we can improve it (GDPR article 6(1)(f)).
Our home page shows our Google reviews using a widget from Trustindex. To display it, your browser loads files from Trustindex and reviewers’ profile pictures from Google, so they receive your IP address and basic browser information, as with any website you visit. Legal basis: our legitimate interest in showing what other customers think of us (GDPR article 6(1)(f)).
Like every website, ours runs on a server that keeps short technical logs (IP address, date and time, page requested and browser) to keep it working and protect it from attacks. Legal basis: our legitimate interest in a safe, working website (GDPR article 6(1)(f)).
We don’t make decisions about you by purely automated means, and we don’t build profiles.
We never sell your data. We only share it with the companies that help us run the business, under contracts that protect it, and with public authorities when the law requires it.
| Who | What for | Based in |
|---|---|---|
| Hostinger (Hostinger International Ltd.) | Hosts our website and its database, including bookings and statistics | Cyprus, with servers in France and backups in Lithuania |
| Stripe (Stripe Payments Europe, Ltd.) | Online payments and fraud prevention | Ireland |
| PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) | PayPal payments | Luxembourg |
| Google (Google Ireland Limited) | Our email, and reviewers’ pictures in the reviews widget | Ireland |
| Trustindex Ltd. | The Google reviews widget on our home page | Hungary |
| WhatsApp (WhatsApp Ireland Limited) | Only if you message us on WhatsApp | Ireland |
| ZoneSoft, Lda. | Our invoicing software | Portugal |
| Our accountant | Accounting: your name and tax number, only if you asked for them on your invoice | Portugal |
Stripe, PayPal, Google and WhatsApp also decide for themselves how to use some data, for example for fraud checks and their own legal duties. Their own privacy policies explain how.
We may also have to share data with public authorities when the law requires it, such as the Tax Authority, or the maritime authorities and emergency services if someone needs help at sea.
Some of these companies, or their own suppliers, may process data in the United States or other countries outside the European Economic Area. When they do, the transfer is protected by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
We don’t use cookies for advertising, tracking or statistics, so you won’t see a cookie banner here. The few cookies and similar files below are only set when you use a feature that needs them. They’re needed for that feature to work, so the law doesn’t require your consent for them.
| Name | Set by | What it does | Kept for |
|---|---|---|---|
| __stripe_mid | Stripe | Fraud prevention for online payments. Set when you open the Book page. | 1 year |
| __stripe_sid | Stripe | Fraud prevention for your current visit | 30 minutes |
| __paypal_storage__ (browser storage) | PayPal | Makes the PayPal button on the Book page work | Until you clear your browser data |
| maz-resolved-color-mode | Our booking form | Remembers whether your device uses light or dark mode, so the booking form displays correctly | 1 year |
| ameliaToken, ameliaUserEmail | Our booking system | Keep you signed in to My bookings after you open your email link | 30 days |
| wpEmojiSettingsSupports (browser storage) | WordPress | Checks whether your browser can show emoji | Until you close the tab |
Independent Analytics, our statistics tool, doesn’t use cookies. The fonts on our website are stored on our own server, so loading them doesn’t contact Google.
You can delete or block cookies in your browser settings. If you block them, online payments and My bookings may not work.
You can ask us to:
Email us at aquaholicvau@gmail.com. We’ll reply within one month, and we may first ask you to confirm who you are.
If you think we’ve handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the data protection authority of the EU country where you live.
Children are very welcome on our boats, but online bookings must be made by an adult. We don’t knowingly collect personal data from children through our website.
Our website uses an encrypted connection (HTTPS). Only our team can see booking details, and online payments are handled by Stripe and PayPal, which meet the payment industry’s security standard (PCI DSS).
If we change how we use personal data, we’ll update this page and the date below. If a change affects a booking you’ve already made, we’ll tell you by email. Renting with us is also covered by our terms & conditions.
Last updated 14 October 2026
