Purpose and legal basis for our data processing

For the fulfilment of contractual obligations

Your data will be processed to provide brokering and yacht services and related ancillary services as part of the execution of our contracts with you. The purposes of data processing are based primarily on the specific service requested.

For the safeguarding of BW’s and third-party interests

In order to safeguard our legitimate interests and those of third parties, we also process your personal data for the following purposes:

• to manage risks within the BUENOWAYS;
• to assert legal claims and enable defence in legal disputes;
• to prevent violations of the law;
• to ensure IT security and IT operations;
• to take measures to ensure the security of vessels, buildings and systems (e.g. entry controls); and
• to take measures for business management purposes and for the development and marketing of services and products;
• to provide tailored customer service

On the basis of your consent

Provided your consent has been given, we are legally permitted to process your personal data for specific purposes. You can withdraw this consent at any time. Please note that the withdrawal of consent has no retroactive effect on the use of your data. Consent is also requirement for sending you Newsletters. This consent can be withdrawn at any time by clicking the unsubscribe link at the bottom of any newsletter.

On the basis of statutory requirements or in the public interest

We are subject to various national and international regulatory obligations under which we are required by law to carry out certain processing.

Access to personal data

Your personal data can be accessed by persons within the BUENOWAYS that need this access to adequately and appropriately carry out their functions. Furthermore, your data will be processed for the same purpose by service providers and subcontractors instructed by us, while taking into account the relevant data protection prerequisites and our instructions. These are companies that provide IT, communication, and advisory services, as well as distribution and marketing. In some instances, for example when you are dealing directly with a broker or agent these parties will gain access to your data and act as independent data controllers in the fulfilment of their services to you.

Data transmission

The transfer of personal data outside of the EU is only allowed under certain conditions. Primarily, the processing of data has to be lawful in the respective country where the data is being processed. Furthermore, a transfer of data may only take place if the recipient ensures an adequate level of protection. This decision is based primarily on the list of safe countries released and periodically adapted by the European Commission (Art. 45 GDPR), as well as on appropriate safeguards (Art. 46 GDPR), binding corporate rules (Art. 47 GDPR), or the codes of conduct (Art. 40 GDPR) and certification procedures.

The recipient must provide a guarantee that appropriate measures are in place to ensure that there is an adequate level of protection, that the data subjects will be able to exercise their rights in case of legal disputes, or that appropriate safeguards have been implemented in order to protect the personal data of the relevant persons.

Generally, BW seeks to avoid transferring personal data outside the EU. However, in a transfer takes place BW will adhere in all cases to the GDPR requirements.

Data storage

We collect and process your personal data only as long as this is necessary in order for us to fulfil any relevant legal or contractual obligations or legitimate business purpose. Based on the nature of the business we generally store your personal data for up to 5 years (depending on the nature of our engagement). Personal data related to tax and legal matters are generally stored for a minimum of 10 years based on legal requirements.

Should the data no longer be necessary for the aforementioned purposes, we are obligated to erase it in a lawful manner, unless further processing of this data, which is limited in time, is required in order to comply with mandatory retention periods.

Your rights under the GDPR

In certain circumstances, you have the following rights relating to your personal data (Art. 13-22 GDPR):

• To request access to your personal data. This is to enable you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.
• To request correction (rectification) of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• To request erasure of your personal data. This enables you to ask us to delete or remove personal data in certain circumstances. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• To object to processing of your personal data where we are relying on the public interest or our legitimate interests (or those of a third party).
• To request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you: for example, if you want us to establish its accuracy or that it is being properly used by us. This means that it can only be used for certain limited purposes, such as dealing with legal claims or exercising our legal rights. In this situation, we would not use or share your information in other ways while it is restricted.
• To request the transfer of your personal data to another party where we process it based on your consent and the processing is carried out by automated means.
• To withdraw any consent you have given, allowing us to send marketing communications to you or collect or use your personal data in any other way.

Please note that exercising some of these rights may mean that we are unable to provide our services to you because some of the information is necessary for some services. In other cases, it may mean that we are providing services based on incomplete information, which may result in those services not meeting your needs or expectations.

Furthermore, you have the right to lodge a complaint with the competent supervisory body (Art. 77 GDPR).

Automated Decision Making

BW does not carry out automated decision making.

Data Processors

In order to provide our wide array of services we utilize a number of Processors. Each Processors has been carefully chosen and Data Processing Agreements have been signed between BW and the data processors which contain the required technical and organizational measures.

In general, these processors include:

• CRM and CMS Providers
• Newsletter Service Providers
• Design and Marketing Agencies
• Server, Storage and other IT Providers
• Event Management Service Providers
• Logistics and Travel Service Providers