This Privacy Policy explains how TWILIGHTHARBOR, LDA, trading as GMS Yachting, collects and uses your personal data when you visit www.gmsyachting.com, request a quote or book a boat trip with us. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese Law no. 58/2019.
1. Who is responsible for your data (data controller)
Company: TWILIGHTHARBOR, LDA (trading as GMS Yachting)
NIF/NIPC: 518942503
Agency (visitor address): Passeio Neptuno 19C, Parque das Nações, 1990-170 Lisboa, Portugal
Registered office: Rua das Musas 24, R/C, Parque das Nações, 1990-169 Lisboa, Portugal
Quote and booking requests (website forms, email, WhatsApp, social media or at our agency): name, email address, phone/WhatsApp number, requested boat, date, start time, duration, number of passengers and children, budget, occasion and any message you send us.
Booking and billing data: details needed to confirm your reservation and issue invoices (name, tax number if you request it, amounts paid, payment method). For refunds, the IBAN you provide.
Communications: the content of emails, WhatsApp and social media messages you exchange with us.
Website usage data: IP address, browser and device information, pages visited and similar data collected through cookies and similar technologies, only as described in our Cookie Policy.
We do not ask for sensitive data. Please do not send us health or other special-category data unless it is strictly necessary for your safety on board (for example, a medical condition the skipper should know about); in that case we use it only for that purpose.
3. Why we use your data and on what legal basis
To answer your requests, prepare quotes and manage your booking, including sharing the necessary details with the boat operator: pre-contractual steps and performance of a contract (Art. 6(1)(b) GDPR).
To issue invoices and keep accounting records: compliance with legal obligations (Art. 6(1)(c) GDPR).
To ensure safety on board, handle complaints, prevent fraud and defend legal claims: our legitimate interests (Art. 6(1)(f) GDPR).
Website statistics and advertising measurement (Google Analytics, Google Ads): only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Marketing messages (offers, news): only with your consent, or for existing clients regarding similar services, with an easy way to opt out in every message.
4. Who we share your data with
We never sell your personal data. We only share it when necessary with:
Partner boat operators and skippers who perform your trip (name, contact number, date, number of passengers and relevant booking details).
Service providers acting on our behalf: website hosting (o2switch, France), email and messaging services (including WhatsApp / Meta), payment providers (bank, PayPal), website analytics and advertising (Google), reviews widget (Trustindex) and accountants.
Public authorities (for example tax, maritime or police authorities) when required by law.
5. International transfers
Some providers (for example Google, Meta and PayPal) may process data outside the European Economic Area, notably in the United States. In such cases transfers are based on an adequacy decision (such as the EU-U.S. Data Privacy Framework, for certified companies) or on the European Commission’s Standard Contractual Clauses.
6. How long we keep your data
Quote requests that do not lead to a booking: up to 24 months after our last contact.
Booking, invoicing and accounting records: 10 years, as required by Portuguese tax law.
Data needed for a complaint or legal claim: until the matter is closed and the limitation period has expired.
Cookies: for the periods stated in our Cookie Policy.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (without affecting the lawfulness of processing carried out before withdrawal). To exercise your rights, write to contact@gmsyachting.com. We reply within one month.
8. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Our website uses an encrypted (HTTPS) connection.
9. Children
Our services are booked by adults. We do not knowingly collect personal data from children under 16 other than the number of children travelling, provided by the adult making the booking.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on this page with its date of last update.
Contains information related to marketing campaigns of the user. These are shared with Google AdWords / Google Ads when the Google Ads and Google Analytics accounts are linked together.
90 days
__utma
ID used to identify users and sessions
2 years after last activity
__utmt
Used to monitor number of Google Analytics server requests
10 minutes
__utmb
Used to distinguish new sessions and visits. This cookie is set when the GA.js javascript library is loaded and there is no existing __utmb cookie. The cookie is updated every time data is sent to the Google Analytics server.
30 minutes after last activity
__utmc
Used only with old Urchin versions of Google Analytics and not with GA.js. Was used to distinguish between new sessions and visits at the end of a session.
End of session (browser)
__utmz
Contains information about the traffic source or campaign that directed user to the website. The cookie is set when the GA.js javascript is loaded and updated when data is sent to the Google Anaytics server
6 months after last activity
__utmv
Contains custom information set by the web developer via the _setCustomVar method in Google Analytics. This cookie is updated every time new data is sent to the Google Analytics server.
2 years after last activity
__utmx
Used to determine whether a user is included in an A / B or Multivariate test.
18 months
_ga
ID used to identify users
2 years
_gali
Used by Google Analytics to determine which links on a page are being clicked
30 seconds
_ga_
ID used to identify users
2 years
_gid
ID used to identify users for 24 hours after last activity
24 hours
_gat
Used to monitor number of Google Analytics server requests when using Google Tag Manager