Privacy Policy

1. Introduction

X-Sailing, operated by Dobromir Dimov ("we", "our", or "us"), is committed to protecting personal data and respecting the privacy of all individuals whose data we process. This includes students, prospective students, website visitors, and instructional staff.

This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, how long we keep it, and your rights under applicable law. It applies to all data collected through our website, booking forms, course registration, medical declarations, contact forms, and staff administration systems.

This policy complies with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Austrian Data Protection Act (Datenschutzgesetz, DSG), the Croatian Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka), and the UK Data Protection Act 2018 where applicable to UK-based students or RYA operations.

2. Data Controller

The data controller responsible for your personal data is:

Dobromir Dimov, trading as X-Sailing
Registered address: Frauenkirchnerstr. 23, 7141 Podersdorf am See, Austria
Operational and training address: Marina Frapa, Uvala Soline 1, 22203 Rogoznica, Croatia
Email: training@x-sailing.com
Phone: +43 650 955 8080

3. Data We Collect

3.1 Student and Prospective Student Data

When you book a course, submit an enquiry, or interact with our website, we may collect:

• Identity Data: Full name, date of birth, nationality
• Contact Data: Email address, telephone number, postal address
• Booking Data: Course selections, preferred dates, number of participants, sailing experience level
• Health and Medical Data: Medical declarations, fitness to sail confirmations, allergies, medications, swimming ability, and any health conditions relevant to safe participation (collected via medical declaration forms as required by RYA)
• Emergency Contact Data: Name and contact details of your nominated emergency contact
• Financial Data: Payment records, deposit and balance information (we do not store full card numbers)
• Communication Data: Messages sent via our contact form, email correspondence
• Certification Data: RYA certificates issued, course completion records, examination results

3.2 Instructor and Staff Data

For instructors and staff working at X-Sailing, we collect and maintain records as required by the RYA Recognition Guidance Notes (RGN B3):

• Identity Data: Full name, date of birth, nationality, passport or national ID number
• Contact Data: Email address, telephone number
• Professional Qualifications: RYA certificate numbers, qualification levels, instructor award expiry dates
• Medical and Safety Certificates: First aid certificate validity, medical fitness certificate expiry dates
• Safeguarding Data: DBS / criminal records check status, safeguarding training completion
• Induction Records: Sign-off confirmations for operating procedures, safety management systems, and centre policies
• Training Records: Staff briefings, in-house training, continuing professional development

3.3 Website Visitor Data

• Technical Data: IP address, browser type and version, device type, operating system
• Usage Data: Pages visited, time spent on pages, referring website
• Cookie Data: As described in Section 8 below

3.4 Marketing Email List (Optional)

If you choose to leave your email address for occasional updates (for example, via the "Some things we only share with a few" prompt on our course pages), we collect:

• Contact Data: Email address only

This is entirely separate from your booking data and is only collected where you have actively chosen to provide it — it is never a condition of booking a course, accessing a free lesson, or using any part of our website.

4. Why We Collect Your Data

4.1 Student Data

• To process, confirm, and manage your course booking
• To assess your fitness to safely participate in sailing activities
• To provide emergency medical information to rescue or medical services if required
• To issue RYA certificates and register your qualifications with the RYA
• To respond to enquiries and provide customer support
• To maintain safety incident records as required by RYA (RGN B6)
• To comply with financial record-keeping and tax obligations

4.2 Staff Data

• To verify instructor qualifications are valid and in date (RYA requirement)
• To maintain the staff register for RYA annual inspections (RGN B3)
• To track first aid and medical certificate validity
• To record safeguarding compliance
• To document induction completion and procedure acknowledgments
• To comply with employment and tax obligations

4.3 Marketing Email List

• To send occasional updates you have opted in to receive — new Logbook stories, last-minute course availability, and rare or exclusive sailing opportunities

5. Legal Basis for Processing

Under Article 6 of the GDPR, we process personal data on the following legal bases:

• Booking and contact details — Performance of a contract (Art. 6(1)(b))
• Medical and health declarations — Explicit consent; vital interests / safety at sea (Art. 6(1)(a), Art. 6(1)(d), Art. 9(2)(a))
• Certification and RYA registration — Performance of a contract; legitimate interest (Art. 6(1)(b), Art. 6(1)(f))
• Financial records — Legal obligation / tax law (Art. 6(1)(c))
• Safety incident records — Legal obligation; legitimate interest (Art. 6(1)(c), Art. 6(1)(f))
• Staff qualifications and identity — Legitimate interest / RYA compliance; legal obligation (Art. 6(1)(c), Art. 6(1)(f))
• Staff safeguarding data — Legal obligation / child protection (Art. 6(1)(c))
• Contact form enquiries — Consent; legitimate interest (Art. 6(1)(a), Art. 6(1)(f))
• Marketing email list — Consent (Art. 6(1)(a))

6. How We Protect Your Data

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR.

Technical Measures

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security) / HTTPS
• Encryption at rest: Our database is hosted on an encrypted, managed PostgreSQL service with data encrypted at rest using AES-256 encryption
• Access controls: Administrative access to personal data is restricted to authorised personnel only (the Principal) through password-protected, authenticated sessions
• Session security: Administrative sessions use secure, encrypted session tokens with automatic expiration
• Password security: Administrative passwords are stored using bcrypt hashing and are never stored or transmitted in plain text
• Secure hosting: Our application is hosted by Lovable (Lovable Labs Incorporated), and our database, authentication and file storage are provided by Supabase (Supabase Inc.) on EU-hosted infrastructure, with firewall protection and regular security updates

Organisational Measures

• Access limitation: Only the Principal and authorised administrative staff can access personal data through the management system
• Staff awareness: All instructors complete an induction process that includes data protection responsibilities
• Data minimisation: We collect only the data that is necessary for the stated purposes
• Regular review: Data holdings are reviewed periodically to ensure data that is no longer needed is securely deleted
• Incident response: We have procedures in place to detect, report, and investigate personal data breaches in accordance with GDPR requirements (72-hour notification to the supervisory authority where applicable)

7. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Our retention periods are as follows:

• Booking and financial records — 7 years after the course date (Austrian Federal Fiscal Code §132 BAO; Croatian General Tax Act)
• Student medical declarations — Duration of course + 3 years (limitation period for personal injury claims)
• RYA certificates issued — Indefinite, also held by RYA centrally (Permanent qualification record, RGN B10)
• Safety incident reports — 10 years from date of incident (RYA requirements, RGN B6; statutory limitation periods)
• Complaints records — 6 years from resolution (Limitation period; RYA requirements, RGN B13)
• Contact form enquiries — 2 years from date of enquiry (Legitimate interest; deleted when no longer needed)
• Staff qualification records — Duration of engagement + 6 years (RYA inspection requirements, RGN B3; employment law)
• Staff identity documents (passport / ID) — Duration of engagement + 2 years (Right to work verification; then securely deleted)
• Staff medical certificates — Duration of engagement + 3 years (Fitness to instruct verification; limitation periods)
• Staff induction and training records — Duration of engagement + 6 years (RYA compliance evidence, RGN B3; employment law)
• Marketing email list — Until you unsubscribe or request deletion (Consent-based; you may withdraw at any time)

When the retention period expires, personal data is securely deleted from our systems. Where data has been shared with the RYA (e.g., certificate records), the RYA's own retention policies apply to their copy of the data.

8. Cookies

Our website uses cookies — small text files stored on your device. We use only strictly necessary cookies. We do not use analytics, advertising, or profiling cookies of any kind, and no analytics tooling is deployed on this website.

• Essential cookies: Required for the website to function (session management, security tokens, cookie consent preference). These do not require consent.

You can review your current cookie choice at any time through the Cookie Settings option in the website footer, or clear cookies through your browser settings. Your choice is recorded, without any personal identifier, so that we can evidence consent under Art. 7(1) GDPR.

All fonts used on this website are self-hosted. We do not load fonts from third-party CDNs such as Google Fonts, in line with the Munich Regional Court ruling (3 O 17493/20).

9. Data Sharing

We do not sell, rent, or trade your personal data. We may share your data with the following recipients, only to the extent necessary:

• Royal Yachting Association (RYA): Student names, dates of birth, and course completion data are shared via the RYA's secure Certificate Registration Hub for the purpose of issuing official RYA certificates (RGN B10)
• Emergency and medical services: Medical declaration data may be shared with coastguard, rescue services, or medical professionals in an emergency situation to protect the vital interests of the individual
• RYA inspectors: Staff qualification records and safety documentation may be reviewed by RYA inspectors during annual inspections, as a condition of RYA recognition
• Supabase (Supabase Inc.): Processor providing our EU-hosted database, authentication and file storage — all booking, medical declaration, document and administrative data is stored here under a data processing agreement
• Lovable (Lovable Labs Incorporated): Processor providing website hosting and the managed transactional email delivery service used to send booking confirmations, invoices and course reminders, under a data processing agreement — also used to send optional marketing emails to those who have opted in.
• Tax authorities: Financial records may be shared with Austrian or Croatian tax authorities as required by law
• Legal advisers: In the event of a dispute or legal claim

All third-party recipients are required to process your data in accordance with GDPR. Where we use data processors, we have appropriate data processing agreements in place.

10. International Data Transfers

X-Sailing operates across Austria and Croatia, both EU member states covered by the GDPR. Data transfers between these countries do not require additional safeguards.

Where data is transferred to the RYA in the United Kingdom, this is covered by the EU adequacy decision for the UK (European Commission Decision of 28 June 2021), which recognises the UK as providing an adequate level of data protection.

All of our website and application data — including hosting, the database, authentication, file storage and transactional email — is processed on infrastructure located within the EU/EEA. Fonts are self-hosted from our own servers, so no data is transferred to font content delivery networks or other providers in the United States when you browse this website. Where a processor's parent company is established outside the EU/EEA, Standard Contractual Clauses (SCCs) approved by the European Commission are in place.

11. Your Rights Under GDPR

You have the following rights in relation to your personal data. These rights apply to both students and staff:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data where there is no compelling reason for continued processing (right to be forgotten)
• Right to restriction (Art. 18): Request that we limit how we use your data
• Right to data portability (Art. 20): Request a machine-readable copy of data you provided to us
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7): Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)

Please note: Some data cannot be deleted where we have a legal obligation to retain it (e.g., financial records for 7 years, safety incident records for 10 years). In such cases, we will inform you of the specific reason.

To exercise any of these rights, please contact us using the details in Section 13. We will respond within one month of receiving your request, as required by GDPR.

12. Children's Data

X-Sailing accepts students from age 12. For students under 18, we require a signed Parent Consent Form. Personal data of minors is processed with the consent of their parent or legal guardian. Parents and guardians may exercise data rights on behalf of the minor by contacting us.

13. Contact and Complaints

For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern about how your data is handled, please contact:

Dobromir Dimov (Data Controller), trading as X-Sailing
Email: training@x-sailing.com
Phone: +43 650 955 8080
Registered address: Frauenkirchnerstr. 23, 7141 Podersdorf am See, Austria
Training centre: Marina Frapa, Uvala Soline 1, 22203 Rogoznica, Croatia

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

• Austria: Österreichische Datenschutzbehörde (DSB) — www.dsb.gv.at
• Croatia: Agencija za zaštitu osobnih podataka (AZOP) — azop.hr
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page at /privacy with an updated revision date. Where changes are significant, we will make reasonable efforts to notify affected individuals.