Privacy Policy

1. Introduction

GSBY Leisure Limited ("we", "us", "our"), registered in England and Wales (Company No: 16552322), is committed to protecting your personal data. This privacy policy explains how we collect, use, store, and safeguard your information when you use our website and services, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect personal data that you voluntarily provide through our website forms, specifically:

Register Interest Form

• First name and last name
• Email address
• Phone number (optional)
• Preferred charter dates (optional)
• Selected charter package (optional)
• Group size (optional)
• Additional message (optional)
• Marketing consent preference

Contact Form

• First name and last name
• Email address
• Phone number (optional)
• Your message

3. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries: To reply to messages submitted through our contact form
• Managing interest registrations: To process and follow up on charter interest submissions
• Email communications: To send confirmation emails when you submit a form, and marketing communications where you have given explicit consent
• Service improvement: To understand demand and improve our charter offerings

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: When you submit a form on our website, you consent to us processing the data you provide for the stated purpose. You may withdraw consent at any time.
• Legitimate interest: We have a legitimate interest in operating our business, responding to enquiries, and improving our services.
• Contract performance: Where processing is necessary to fulfil a charter booking or related agreement.

5. Data Storage & Security

Your personal data is stored securely in a cloud-hosted database. We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS)
• Database-level access controls and row-level security policies
• Server-side input validation to prevent injection attacks
• Restricted access limited to authorised personnel only

Our cloud infrastructure is hosted within the European Economic Area (EEA). We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

6. Third-Party Processors

We use the following third-party service providers to process data on our behalf. Each operates under a data processing agreement and processes data only as instructed by us:

• Cloud database provider: Secure storage of form submissions and interest registrations
• Resend (email service): Sending transactional and notification emails on our behalf

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

7. Cookies

Our website uses essential cookies to ensure proper functionality. We do not use tracking or advertising cookies. For full details, please see our Cookie Policy.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where there is no compelling reason for continued processing
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

You can manage your marketing preferences or request deletion of your data at any time using our self-service data management portal.

To exercise any of these rights, you can also contact us at hello@gsbyleisure.com. We will respond to your request within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

11. Contact

If you have any questions about this privacy policy or how we handle your data, please contact us:

GSBY Leisure Limited
Email: hello@gsbyleisure.com