Privacy Policy

Section 01

Data Controller

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), the data controller of personal data collected through this website is:

Hereinafter referred to as "NautiRoute" or "the Controller".

Section 02

What Data We Collect

We collect only what is strictly necessary to provide our services:

Data you provide voluntarily:

• Name and surname (contact form, session booking)
• Email address
• Phone number (optional)
• Content of messages sent via the contact form or email

Automatically collected technical data:

• IP address
• Browser type and version
• Device type
• Pages visited and approximate time spent

Session booking data (via Calendly):

Name, email, time zone and any information you provide during the booking process. This data is processed by Calendly LLC under their own privacy policy, available at calendly.com/privacy.

Section 03

How We Use Your Data

Your data is used exclusively for the following purposes:

• Responding to enquiries submitted via the contact form or email
• Managing and delivering the 1:1 career strategy sessions
• Sending relevant follow-up communications directly related to your enquiry or session
• Improving website performance and user experience
• Complying with applicable legal and tax obligations

We do not use your data for automated profiling, third-party advertising, or any purpose beyond those listed above.

Section 04

Legal Basis for Processing

Processing activity	Legal basis
Responding to contact enquiries	Legitimate interest / pre-contractual measures
Delivering the purchased session	Performance of a contract
Basic website analytics	Legitimate interest
Legal and tax compliance	Legal obligation
Marketing emails (if applicable)	Explicit consent

Section 05

How Long We Keep Your Data

• Contact enquiries: 12 months from last communication
• Session-related data: 5 years (Spanish tax law requirement, Article 30 of the VAT Law)
• Website analytics: aggregated only — no personal identifiers retained

You may request deletion of your data at any time (see Section 8). Where deletion conflicts with a legal retention obligation, we will restrict processing instead and delete as soon as legally permitted.

Section 06

Who We Share Your Data With

We do not sell, rent or trade your personal data under any circumstances. Data is shared only with:

• Calendly — session scheduling. Processed under their own privacy policy.
• Hostinger — web hosting and server infrastructure only. No access to user data beyond what is technically required.
• Tax advisors or legal authorities — only if required by applicable law.

All third-party providers are subject to data processing agreements and comply with GDPR or equivalent standards.

Section 07

International Data Transfers

Calendly (operated by Calendly LLC, United States) may process your data outside the European Economic Area. Such transfers are carried out under Standard Contractual Clauses approved by the European Commission and/or equivalent appropriate safeguards under applicable data protection law.

Hostinger's primary data centres are located within the European Economic Area and comply with GDPR requirements.

Section 08

Your Rights (GDPR)

Under GDPR and LOPDGDD, you have the following rights with respect to your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, where consent is the legal basis for processing

To exercise any of these rights, contact us at info@nautiroute.com. We will respond within 30 calendar days.

If you believe your rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Authority:
Agencia Española de Protección de Datos (AEPD) · www.aepd.es

Section 09

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or misuse, including:

• Encrypted connections (HTTPS/TLS) across the entire website
• Access controls limiting who can view personal data
• Regular review of data processing practices and third-party providers

No internet transmission is 100% secure. By using this website, you acknowledge this inherent and unavoidable risk.

Section 10

Cookies

This website uses only functional cookies strictly necessary for basic operation. We do not use tracking cookies, advertising cookies, or third-party analytics cookies without your explicit prior consent.

For full details or to request our Cookie Policy, contact us at info@nautiroute.com.

Section 11

Children

This website and our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that data has been collected from a person under 16 without verifiable parental consent, we will delete it immediately. If you believe this has occurred, please contact us at info@nautiroute.com.

Section 12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

Continued use of the website after changes have been published constitutes acceptance of the updated policy. For material changes, we will make reasonable efforts to notify users directly where contact information is available.

Section 13

Contact

For any questions, requests or complaints regarding this Privacy Policy or the processing of your personal data: