Datenschutzerklärung

Last updated: 16 October 2026

1. Controller

The controller of your personal data is ACTION YACHTS d.o.o., Savska cesta 32, 10000 Zagreb, Croatia, OIB 16033688533 ("we", "us"). Contact for all data protection matters: info@actionyachts.eu, +385 99 6469 107. This policy applies to the website actionyachts.eu, the online store, bookings, the AI assistant, e-mail and our social media and messaging channels.

2. What data we process, why, and on what legal basis

  • Orders and bookings – name, address, e-mail, phone, order and booking details, payment status. Purpose: concluding and performing the contract, delivery, handover, rentals and charters. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Invoicing and accounting – invoice data. Purpose: tax, fiscalisation and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c)).
  • Enquiries and customer service – data you send us by contact form, e-mail, phone, WhatsApp, Instagram or Facebook. Purpose: answering your request, complaints and warranty claims. Legal basis: contract or pre-contractual steps (Art. 6(1)(b)), legal obligation for complaints (Art. 6(1)(c)), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)).
  • AI assistant on the website – the messages you type, the page you are on and the language. Purpose: answering your questions automatically and, if you wish, passing your request to our team. Legal basis: pre-contractual steps at your request and our legitimate interest in efficient customer service (Art. 6(1)(b) and (f)). See section 4.
  • Rental safety and deposits – rider information needed for safe handover (age, weight category, swimming ability, safety briefing confirmation), deposit and inspection records. Legal basis: contract and our legitimate interest in safety and protection of equipment (Art. 6(1)(b) and (f)).
  • Reminders and review requests – a reminder the day before your booking and one request to review your experience. Legal basis: contract (reminder) and our legitimate interest (one review request); you can object at any time.
  • Newsletter and marketing e-mails – only with your consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link.
  • Website operation, security and statistics – IP address, device and browser data, cookies. Necessary cookies: legitimate interest / necessity; analytics and marketing cookies only with your consent given in the cookie banner.

Providing data needed for an order or booking is necessary to conclude the contract; without it we cannot process your order. We do not use automated decision-making with legal or similarly significant effects.

3. Recipients and processors

We share data only as needed with processors acting on our behalf under data processing agreements:

  • Shopify (online store, checkout, booking apps) – Shopify International Ltd., Ireland;
  • payment service providers chosen at checkout (they process card data; we do not receive full card numbers);
  • Klaviyo, Inc. (e-mail notifications, booking reminders, review requests, enquiry handling) – USA;
  • Google Ireland Ltd. (Google Workspace e-mail info@actionyachts.eu);
  • Cloudflare, Inc. (hosting of the AI assistant service) – USA;
  • Anthropic, PBC (AI language model that generates the assistant's answers) – USA;
  • Meta Platforms Ireland Ltd. (WhatsApp, Instagram, Facebook – when you contact us there);
  • carriers and couriers (delivery), our accountant, IT and legal advisers, insurers, and public authorities where required by law.

We do not sell your personal data.

4. AI assistant (artificial intelligence)

The chat on our website is an AI system, not a person, and is labelled as such (Regulation (EU) 2024/1689, AI Act). It answers on the basis of the information published on our website. Its answers may contain errors; binding are the order process, the order confirmation and our Terms. A member of our team can take over at any time.

Your messages are sent via our service on Cloudflare to Anthropic's language model to generate the answer. The conversation is stored only in your browser for the current session and is deleted when you close the tab. Under the provider's commercial terms, data sent through the service are not used to train AI models and are retained by the provider only for a limited period for operation and abuse prevention. Only if you ask to be contacted and give your e-mail or phone number, the assistant passes a summary of the conversation to our team (stored in Klaviyo and sent to info@actionyachts.eu).

Please do not enter sensitive data (health data, card numbers, ID documents) in the chat.

5. Transfers outside the EU/EEA

Some processors (Klaviyo, Cloudflare, Anthropic, and possibly Shopify and Google sub-processors) are located in the USA or other third countries. Transfers are based on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified, or on the Commission's Standard Contractual Clauses with additional safeguards.

6. Retention

  • Invoices and accounting records: 11 years, as required by the Croatian Accounting Act.
  • Contract, order and booking data: for the duration of the contract and then until claims become time-barred (generally up to 5 years).
  • Written consumer complaints and our replies: at least one year, as required by the Consumer Protection Act.
  • Enquiries and AI-assistant leads that did not lead to a contract: up to 2 years after the last contact.
  • Marketing consent: until withdrawn.
  • Cookies: according to the periods stated in the cookie banner.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest, including objection to direct marketing at any time. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Send your request to info@actionyachts.eu; we will reply within one month.

You also have the right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, or with the authority in your EU country of residence.

8. Children

Our online store is not intended for persons under 18. Data of minors taking part in supervised activities are provided by their parents or guardians.

9. Security

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access restrictions and processors with recognised security certifications.

10. Changes

We may update this policy. The current version is always published on this page with the date of the last update.