Privacy Policy
Last reviewed: 10 November 2026. This policy sets out how personal information may be processed when visiting the Alcaidesa Marina website, contacting us, requesting information, calculating marina rates, applying for a berth or using our online services. It should be read alongside our Cookie Policy and any additional notices displayed in individual forms.
1. Identity and contact details of the controller
In accordance with Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR), the controller is ALCAIDESA SERVICIOS, S.A., Spanish tax identification number A11344827, registered contact address Avenida Príncipes de Asturias, s/n, 11300 La Línea de la Concepción, Cádiz, Spain. Email: emorillas@alcaidesa.com; telephone: +34 956 021 660.
Requests concerning data protection may be submitted through these channels, indicating “Data protection”. Providing a general contact address does not imply the formal appointment of a data protection officer. If a data protection officer is appointed, the appropriate separate contact information must be published.
2. Scope and governing principles
This policy concerns processing related to this website, its forms, contact messages, requests for quotations and berths, vessel information, and any messaging or virtual assistance tools enabled in the future. Separate privacy notices may apply to contractual, employment or other activities.
Processing shall follow the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. Information shall not be repurposed incompatibly with the purpose originally notified to the individual.
3. Categories and sources of personal information
Depending on the service requested, information may include: (a) identification and contact details, including names, telephone numbers and email addresses; (b) correspondence, enquiries and any documents voluntarily submitted; (c) vessel and berthing information, such as length, beam, vessel and hull type, berthing regime, intended dates and rate calculations; (d) contractual, invoicing and administration data when required; (e) technical data, including IP address, security logs, time stamps, device or browser characteristics and cookie choices; and (f) chat messages or conversation metadata, but only if an automated assistant is subsequently introduced and used.
Data is primarily collected from the individual directly. It may also be supplied by their duly authorised representative or an organisation on whose behalf they act. Ordinary forms and prospective chatbots should not be used to provide health, political beliefs, biometric information, passwords or other unnecessary sensitive personal data.
4. Purposes of processing and lawful bases
| Activity | Purpose | Lawful basis |
|---|---|---|
| Enquiries and contact forms | Handling questions, requests, customer messages and relevant follow-up. | Article 6(1)(b) GDPR for pre-contractual steps; Article 6(1)(f) for legitimate general enquiries subject to balancing; consent where legally required. |
| Rate calculator and berth applications | Preparing estimates, assessing vessel specifications, processing a berthing request and contacting applicants. | Article 6(1)(b), steps prior to a contract or its performance. |
| Customer and administrative management | Services, reservations, invoices, payments, accounting, tax obligations and related documentation. | Articles 6(1)(b) and 6(1)(c), as applicable to the particular operation. |
| Marketing messages | Sending news, offers and newsletters to eligible recipients. | Article 6(1)(a) and Spanish Information Society Services Act Article 21, or a strictly applicable existing-customer exception together with the appropriate GDPR lawful basis. |
| Security and technical maintenance | Preventing unauthorised access, abuse and incidents, keeping proportionate technical logs and solving errors. | Article 6(1)(f), legitimate interest assessed against individuals’ rights, or Article 6(1)(c) where a legal duty applies. |
| Optional analytics or embedded services | Audience measurement and optional content that stores or reads non-essential information on a device. | Prior consent whenever required by Article 22(2) of the Spanish Information Society Services Act and the GDPR. |
| AI chatbot, if introduced | Responding to initial enquiries and, where requested, routing a conversation to a human representative. | Article 6(1)(b) for pre-contractual enquiries; 6(1)(f) for routine assistance subject to balancing; 6(1)(a) where optional functions require consent. |
Merely accepting general terms does not create valid consent for every processing activity. Where consent is the lawful basis it must be freely given, specific, informed and unambiguous and may be withdrawn at any time without affecting earlier lawful processing.
5. Mandatory information and forms
Fields marked as mandatory are required to handle the particular request, such as replying to an enquiry, preparing a rate estimate or processing a berth application. Failure to provide them may prevent us from delivering the requested service. Browsing the public website does not require submission of an identity form. Where financial or other information is legally necessary, this will be explained in the relevant process.
Consent to advertising must be distinct from the principal request. Refusing marketing messages should not prevent the ordinary handling of a service request. The wording of consent boxes must accurately describe the specific processing they authorise.
6. Data retention and deletion criteria
Enquiries are retained while they are being handled and, afterwards, for a proportionate period necessary to manage possible incidents and legal claims. Berth applications and customer records are retained for the contractual relationship and subsequently restricted or retained where legally required or needed to establish, exercise or defend legal claims.
Accounting, tax and commercial records are retained according to the statutory rules applicable to each record; Spanish commercial obligations may require six years, while tax and other statutory limitation periods may differ. Data used solely for promotional communications is held until a valid opt-out, withdrawal of consent or loss of the applicable lawful basis. Security information and consent preferences are subject to purpose-appropriate periods.
If a chatbot is deployed, a specific conversation retention policy, access rules, deletion criteria and any provider involvement must be determined and disclosed before launch. No indefinite retention or fixed period is assumed for a tool that has not been configured.
7. Recipients and data processors
Access may be granted, to the extent necessary, to hosting providers, technical maintenance and support, email services, form processing, infrastructure, administrative providers and information-security suppliers. Appropriate contractual and legal arrangements must be in place where they act as data processors. Information may also be disclosed to competent public authorities, courts or regulators where required by law.
External components, including maps, video services and review widgets, may involve requests to independent service providers. A resource supplied by Trustindex has been identified on this website; whether it uses non-essential cookies or transfers identifiable data depends on its actual deployment. Such services have their own legal terms and may, depending on the circumstances, be processors or independent controllers. Using a service provider does not, by itself, amount to selling personal data.
8. Transfers outside the European Economic Area
Some technical providers may process information in, or grant access from, countries outside the European Economic Area. Where this occurs, the controller must verify a relevant adequacy decision or establish an appropriate mechanism under Articles 44–49 GDPR, such as standard contractual clauses and additional safeguards where necessary. Countries, providers and safeguards must be determined from the actual services contracted; we do not assume that all data always remains within the European Union.
9. Cookies and similar identifiers
Storage and access technologies may be strictly necessary for the service or may require prior consent. Optional analytics, advertising, tracking and profiling must not be activated before valid consent where legally required. The Cookie Policy explains the categories, identified services, user choices and applicable requirements.
10. Chatbots, virtual assistants and artificial intelligence
If Alcaidesa Marina introduces a chatbot, virtual assistant, generative AI tool or automated support function, users will be informed clearly that they are interacting with an automated system when required by the applicable transparency rules, including Article 50 of Regulation (EU) 2024/1689, as amended. An automated exchange must not misleadingly impersonate a human agent.
Such a system may process messages submitted by the user and technical information reasonably needed to reply, maintain a session, prevent misuse or refer an issue to authorised staff. Before activation, the organisation must disclose the provider’s identity, functions, recipients, access rights, retention periods and any international transfers. Any use of conversations to improve or train AI models must also be assessed and explained, with the relevant lawful basis. Users must not assume chats are anonymous or that no external provider can access them.
Users should avoid sending passwords, complete payment-card details, unnecessary identity documents, sensitive information or third-party personal data. Automated replies may be incomplete, erroneous or out of date; they do not constitute a binding reservation, contractual confirmation or professional advice. Important requests can be reviewed by a human representative using the contact details above.
Introducing an AI tool does not in itself authorise solely automated decisions producing legal or similarly significant effects. If such processing is contemplated, it must be assessed against Article 22 GDPR and any relevant exceptions, information duties and safeguards. The notice and specific rules for the assistant must be completed before it goes live.
11. Automated decision-making and profiling
Ordinary website enquiries and indicative rate calculations are not presented as solely automated decisions intended to produce effects covered by Article 22 GDPR. Basic technical calculations, antispam checks or routine sorting do not automatically amount to such decisions. Any future change that triggers additional disclosure duties will require information about the logic involved, significance and foreseeable consequences.
12. Security and personal data incidents
Risk-appropriate technical and organisational measures shall be applied under Article 32 GDPR, potentially including access controls, secure communications, system maintenance, vulnerability management, backups and data minimisation. No Internet-connected system is completely free of risk. Personal-data breaches will be assessed and, where required, notified to the supervisory authority or individuals under Articles 33 and 34 GDPR.
13. Rights and how to exercise them
Depending on the circumstances, individuals may request access, rectification, erasure, restriction, objection, portability and protection from solely automated individual decisions. Consent may be withdrawn without retroactive effect; direct marketing may be opposed at any time.
Requests can be sent to emorillas@alcaidesa.com or the postal address above, identifying the relevant right and enough information to locate the records. A copy of an identity document is not routinely required; additional proportionate identification may be requested only where reasonable doubts arise. Requests are normally answered within one month, subject to lawful extensions.
Individuals may complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, without prejudice to other available remedies. Contacting the controller first may help resolve an issue quickly.
14. Children and representatives
The site is not specifically intended for children and its forms are not designed for unnecessary sensitive disclosures. Consent-based processing concerning minors in Spain is governed by the age established in Article 7 of Organic Law 3/2018, subject to applicable special rules. Anyone submitting information on behalf of a child or another person must have the necessary authority. Prospective chat services should not be used to send sensitive child-related information.
15. External websites and embedded content
Links to other websites, social platforms, videos or map providers may lead to independently operated services governed by different privacy and cookie notices. Non-essential third-party storage should not be loaded prematurely, and the identity and actual role of each provider should be transparently explained.
16. Amendments and revision dates
This policy may change to reflect legislation, regulatory guidance, services, suppliers and new functions, including AI-assisted support. The review date is shown above. A new publication does not in itself constitute consent; where a new lawful basis or fresh consent is required, it must be obtained before the relevant processing begins.
17. Applicable legal framework
Key references are the General Data Protection Regulation (EU) 2016/679, Spanish Organic Law 3/2018, Spanish Law 34/2002, current AEPD guidance and, where applicable, the EU Artificial Intelligence Act (Regulation 2024/1689) as amended.