Privacy Policy

We collect as little personal data as possible. This website uses no cookies that require consent and no analytics, advertising or tracking tools. Fonts, images, videos and music are served from our own website. Apart from the services described below, no third-party content is embedded.

1. Who is responsible

Marlet Yachting Ltd, a private limited liability company registered in Malta (C 106822)
Registered office: 171 Old Bakery Street, Valletta VLT 1455, Malta
E-mail: privacy@windkind.com

Marlet Yachting Ltd is the controller within the meaning of the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).

2. Hosting and server log data

This website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you visit the website, your browser automatically transmits technical information: your IP address, the date and time of the request, the page or file requested, the referring website, and your browser and operating system. Cloudflare needs this information to deliver the website to you and to protect it against attacks and misuse.

Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare processes this data on our behalf under a data processing agreement. Cloudflare is certified under the EU–US Data Privacy Framework; in addition, standard contractual clauses apply. The log data is deleted by Cloudflare after a short period and is not combined with other data. Technical logs of our website’s functions (for example whether an e-mail could be sent) are deleted automatically after seven days at the latest.

3. No visitor statistics

We do not use analytics, advertising or tracking tools. We only see the technical totals that our hosting provider Cloudflare produces from the log data described in section 2, for example the number of requests, without any script on your device.

4. Contact form

If you send us a message through the contact form, we process your name, e-mail address, the subject you select and your message. Our website (hosted by Cloudflare, see section 2) forwards your message by e-mail to our mailbox through the e-mail service Resend (Plus Five Five, Inc., San Francisco, USA). Resend sends the e-mail from Ireland but stores it and its delivery logs in the USA for 30 days. Resend acts as our processor under a data processing agreement; it is certified under the EU–US Data Privacy Framework, and standard contractual clauses apply in addition. The website itself does not store your message. To prevent misuse, we limit the number of messages that can be sent per hour; for this purpose, a shortened, hashed value of your IP address is stored with Cloudflare in the EU and deleted automatically one hour after your last message.

Legal basis: the steps you request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). Providing your data is voluntary, but without it we cannot respond.

5. Guest preference sheet

Before a charter, our crew needs to know about the guests’ arrival, dietary requirements and wishes. Charter brokers usually send us this information on their own forms; it then reaches us by e-mail (see section 6). Our own guest preference sheet is available as a PDF on this website. For some charters, we also invite guests to complete it online through a page of this website that we share only by direct link.

Online, we process the details you enter: the charterer’s contact details and an emergency contact ashore; the names, sex, dates of birth, nationalities and passport numbers of the guests in your party; travel details; details about children on board; special occasions; and your preferences for activities, food and drinks. If you tell us about medical conditions, allergies, intolerances, dietary requirements or the need for a buoyancy aid, this is health data within the meaning of Art. 9 GDPR. Dietary choices such as halal or kosher may reveal religious beliefs, which Art. 9 GDPR protects in the same way. Passport details are required for clearing in and out of a country; health information and preferences are voluntary.

While you fill in the form, your answers are saved only in your own browser (local storage), so that you can continue later. They are removed when you send the form; otherwise they stay in your browser until you clear them, with “Start again” or by deleting your browser’s data for windkind.com. When you send the form, our website (hosted by Cloudflare, see section 2) creates a PDF from your answers and stores it encrypted with Cloudflare in its storage in the European Union; it is deleted automatically 120 days after you send it. We receive an e-mail through the e-mail service Resend (see section 4) with a download link; the e-mail contains only your contact details, the charter dates and the link, not your other answers. You can download a copy of the PDF on screen when you send the form and, if you choose, receive the download link by e-mail at the address you entered. Resend stores the e-mails our website sends, including these notifications, in the USA for 30 days (see section 4). To protect the form against misuse, we limit the number of sheets that can be sent per hour in the same way as for the contact form (see section 4).

Shared charter links. For some charters, we use personal links instead of a single form: the organiser of the charter (the charterer or their charter broker) or we enter the details that concern the whole group, and each guest enters their own details through a link that we share with the party. Until you send them, your answers are also saved in your own browser (local storage). Our website stores the details entered so that they can be completed and changed until we pass the complete preference sheet to our captain. The details are stored encrypted with our hosting provider Cloudflare (see section 2) in its storage in the European Union and deleted automatically no later than 92 days after the end of the charter; we can delete them earlier at any time. Each guest sees only their own details and receives a personal link to change them, on screen and, if they give an e-mail address, by e-mail. The organiser sees the names of the guests who have already filled in, but not their details. We receive an e-mail each time someone fills in the form and, once everyone has, we check the complete preference sheet; only then do we send our captain a download link. The file behind the link is stored in the same way and deleted automatically no later than 92 days after the end of the charter.

Recipients. The preference sheet is used by our captain and crew to prepare your charter. Names, dates of birth, sex, nationalities and passport numbers are passed on to port, marina, customs and immigration authorities where this is required for clearing in and out of a country (crew and guest list). Outside the EU, for example in the Caribbean, many of these countries have no EU adequacy decision; the transfer is necessary to carry out your charter (Art. 49(1)(b) and (c) GDPR). If you ask us to book transfers, restaurants or guides, we pass on the names and travel details they need. In an emergency, we pass relevant health information to doctors (Art. 9(2)(c) GDPR).

Legal basis: preparing and carrying out your charter (Art. 6(1)(b) GDPR); for passport details, also our legal obligations under EU and Maltese law for clearing in and out of a country (Art. 6(1)(c) GDPR); and, for health data and dietary choices, your explicit consent (Art. 9(2)(a) GDPR), which you give with the checkbox at the end of the form. If someone else gave us your details (the charterer, the organiser or your charter broker), this section applies to you too; if you give us other guests’ details, please show them this privacy policy. For children, the details and the consent are given by a parent or guardian, or with their consent. You can withdraw your consent at any time by writing to privacy@windkind.com; this does not affect processing carried out before you withdraw it. The protection against misuse is based on our legitimate interest in a secure form (Art. 6(1)(f) GDPR).

We keep the preference sheet only as long as we need it to prepare and carry out your charter. On our website, it is deleted automatically, as described above. Copies that we download, or that charter brokers send us by e-mail, are deleted from our mailboxes automatically no later than six months after we receive them. Statutory retention periods may require us to keep individual details for longer.

6. E-mail

When you write to us by e-mail, or a contact form message reaches our mailbox, we process your message and contact details to answer it. Our e-mail service is Microsoft 365, operated by Microsoft Ireland Operations Ltd, Dublin, Ireland, and provided to us through GoDaddy (GoDaddy Operating Company, LLC, Tempe, USA), which administers our Microsoft 365 account. Both act as our processors. Microsoft and GoDaddy may also process data in the USA; both are certified under the EU–US Data Privacy Framework, and standard contractual clauses apply in addition. Legal basis: as in section 4.

7. Social media and external links

Our website links to our profiles on Instagram, Facebook and YouTube and to other websites, for example our film on YouTube and the websites of charter broker associations. These are plain links: no content from these providers is embedded, and no data is transmitted to them until you click a link. After that, the privacy policy of the respective provider applies.

On our home page we show the latest photos from our Instagram profile. Our server retrieves them from Instagram and delivers them from windkind.com, so your browser does not connect to Instagram while you view them and no data about you is transmitted to Instagram.

8. Charter bookings

We do not take charter bookings through this website. Your charter contract is arranged by your yacht charter broker, who will inform you about its own processing. We receive the details we need to carry out the charter and keep the records required by law, for example for accounting and tax (Art. 6(1)(b) and (c) GDPR).

9. How long we keep your data

We delete enquiries once they have been fully dealt with and there is no reason to keep them, unless statutory retention periods require us to keep them longer. Contact form messages are not stored on the website (see section 4). Guest preference sheets are deleted from our website automatically (120 days after they were sent; for shared charter links, 92 days after the end of the charter) and from our mailboxes no later than six months after we receive them, unless statutory retention periods require us to keep individual details for longer (see section 5). Resend deletes copies of e-mails sent by our website after 30 days.

10. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing and to receive it in a portable format (Art. 15–20 GDPR). Where we rely on our legitimate interests, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). To exercise your rights, simply write to privacy@windkind.com.

We do not use automated decision-making or profiling.

11. Right to complain

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.org.mt.

12. Changes

We will update this Privacy Policy if our website or the law changes. Last updated: 23 October 2026.