Privacy Policy for the Partner Portal programme

This policy explains how ESEA Boats B.V. handles personal data in its Partner Portal programme. It is for three groups of people:

• **prospects**: people who ask about an ESEA boat through an ESEA Distribution Partner or an ESEA Ambassador, for example by scanning a partner’s QR code, or whose details a partner registers with ESEA;
• **Ambassadors**: people who refer prospects to ESEA; and
• **Distribution Partners**: the companies that sell and support ESEA boats, and the people who sign in to the Partner Portal for them.

The Partner Portal is ESEA’s online system for partners. It is not the ESEA Boats app, and it is not this website. For the website and the app, see our general privacy policy at https://www.eseaboats.com/privacy-policy/ This policy does not apply to linked third-party websites that are not owned or controlled by ESEA Boats.

We only use your personal data in accordance with applicable data protection law, in particular the EU General Data Protection Regulation (“GDPR”) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG), and only as described in this policy.

Personal data is any information relating to an identified or identifiable individual, for example your name, e-mail address, telephone number or postal address, as well as online identifiers such as your IP address. Information that cannot be used to determine your identity, such as counts, is not personal data.

Who is responsible for data processing

The controller responsible for data processing under the GDPR is:

ESEA Boats B.V.

Jan Vrijmanstraat 305, 1087 MN Amsterdam, the Netherlands

Chamber of Commerce (KvK) number: 96204869

Web: www.eseaboats.com

E-mail: support@eseaboats.com

ESEA is the controller of the personal data held in the Partner Portal. Section “Ambassadors and the data they collect” explains one exception: the personal data an Ambassador collects themselves before passing it to ESEA.

If you are a prospect

What we collect

When you ask about an ESEA boat through a partner, we process:

• your name and e-mail address,
• your country and postal code (both are required on a partner’s QR page),
• your telephone number, the boat model you are interested in and your message, if you give them, and
• the notes the partner writes about your enquiry.

On a partner’s QR page we suggest your country for you. Our content delivery network tells us the country your connection appears to come from, and we pre-select it in the form. We use only the country, never a more precise location, and we do not store that suggestion: what we keep is the country you leave selected.

We also record which partner you came through, so that two partners do not follow up the same person. If you register again through another route while a partner holds your enquiry, we record that. We tell that partner that you showed renewed interest. We do not tell them how, or through whom. We keep a record that you were told how your details would be used: the partner’s confirmation that they told you, or your tick on the QR page. After your details are deleted, that record no longer holds them.

If you use a partner’s QR page, the partner whose code you scanned can see that you registered and the name you typed. They cannot see the other details you entered.

Why we use it

We use your details only to follow up your interest in our boats. We do not use them for marketing, and we do not add you to a newsletter or send you marketing messages.

The legal basis is that you asked about a boat and we take steps at your request before a possible contract (Art. 6(1)(b) GDPR). Where a partner registers your details for you, the legal basis is our legitimate interest in answering an interest you expressed to the partner (Art. 6(1)(f) GDPR). In that case the partner must tell you that your details will be shared with ESEA.

Who receives your details

• The partner or Ambassador you came through.
• The nearest ESEA Distribution Partner in your country, so that someone near you can help. We choose it automatically from your postal code. We match the postal code against a public list of postal-code locations held on our own systems. We do not send your postal code to any outside service. The choice only decides who contacts you. It has no legal or similarly significant effect on you.
• Our hosting provider and e-mail service, listed under “Where your data is stored”.

We do not sell your details.

How long we keep it

We delete your name, e-mail address, telephone number, postal code, message and the partner notes 12 months after your enquiry is won or lost, or 12 months after the last activity on it if it goes quiet.

We then keep a record without your name or contact details. It holds only dates, the source of the enquiry, the country, the boat model and the outcome. We use it for internal analysis, for up to 24 months after the deletion. After that, we make it fully anonymous, so that only counts remain.

You can ask us to delete your details earlier at any time. One request covers all your enquiries.

Ambassadors and the data they collect

An Ambassador is an independent controller for the personal data they collect themselves from a prospect and then pass to ESEA. An Ambassador is not ESEA’s processor. The Ambassador must tell the prospect that their details will be shared with ESEA Boats and, where needed, the ESEA Distribution Partner for their area, solely to follow up the prospect’s interest. When the Ambassador registers a prospect, they confirm this in the Partner Portal. ESEA keeps a record of that confirmation. From the moment ESEA receives the details, ESEA is the controller of the copy it holds, as described in this policy.

If you are an Ambassador and a natural person, we also process your name, legal name, address, e-mail address and telephone number, and your referral code, to run our relationship with you. The legal basis is our contract with you (Art. 6(1)(b) GDPR). We keep this data while the relationship lasts. We erase it on your request at any time. We also erase it at the end of the relationship. We keep an anonymous record of your partner entry, so that the enquiries you referred stay valid. We do not keep your name or contact details in it.

If you sign in to the Partner Portal

What we collect

• **Your login**: your name, work e-mail address, the status of your login and the time you last signed in. There are no passwords. You sign in with your e-mail address and a six-digit code that we e-mail to you. The code works once and expires after 10 minutes.
• **Sessions**: a record that you are signed in, with your IP address and browser details. We use one strictly necessary cookie, which keeps you signed in.
• **Acknowledgements**: when you confirm that you have read an announcement, we record your name, the time and your IP address. Colleagues at your company see “Acknowledged by” and your name.
• **Downloads**: who downloaded which price list, document or file, which version, the watermark text added to it and the IP address.
• **Action log**: who changed what in the Portal, and when, with the IP address.
• **Contacts**: the name, e-mail address and telephone number of a company’s main contact and of its ESEA manager, so that each company knows whom to call.

We use this data to run and secure the Portal, to prove that safety announcements reached a company, and to trace a leaked price list or image. The legal basis is our legitimate interest in running a secure partner system (Art. 6(1)(f) GDPR). You can object, see “Your rights”.

How long we keep it

When we erase a login, we remove the name, e-mail address and sign-in times and the IP addresses held against it. We keep acknowledgements and download records without any identifying details. We need them as evidence that a safety announcement was delivered and of which version of a confidential price list was downloaded, to establish, exercise or defend legal claims (Art. 17(3)(b) and (e) GDPR).

If you are a customer or boat owner of a Distribution Partner

Distribution Partners use the Portal to issue quotations, place orders, register a boat’s warranty at handover and file warranty claims. Ambassadors cannot do these things. When a partner enters your details, ESEA stores them on its own system. For a warranty registration, the partner hands you a privacy notice at handover. The table shows what we keep, why and for how long.

If you ask us to erase your data, we remove your name and e-mail address from the quotation, order, registration and claim text, as far as the law allows. Photos and videos of a claim are different. We keep them as evidence of the claim under Art. 17(3)(e) GDPR, which allows us to keep data to establish, exercise or defend legal claims. We review each file individually. We delete any file that mainly shows people rather than the boat, and keep the rest.

If you also use the ESEA Boats app, our general privacy policy at https://www.eseaboats.com/privacy-policy/ explains that data.

Where your data is stored

The Partner Portal runs on Amazon Web Services (Amazon Web Services EMEA SARL) in data centres in Ireland, in the EU. The storage is encrypted. Sign-in e-mails, announcements and alerts are sent through Amazon Simple Email Service in the United Kingdom. The UK has an EU adequacy decision. These providers act as our processors.

Each partner can see only its own enquiries, orders and registrations.

Automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR that has legal or similarly significant effects on you.

Your data subject rights

a) Right of access

Upon request, we will provide you, free of charge, with information about the personal data we hold about you. This includes the partners your data was shared with. We find your records by your e-mail address or telephone number, so please write from the address you used.

b) Rectification, erasure and restriction of processing

If your data is inaccurate or no longer required, you can ask us to correct, delete or restrict its processing, insofar as this is legally possible. You have the right to object to processing based on our legitimate interest, including profiling based on it. You can object at any time to processing for direct marketing purposes. We do not use your data for direct marketing in this programme.

c) Right to withdraw consent

You may withdraw any consent you have given at any time, with future effect. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

d) Right to data portability

Where data is processed on the basis of a contract, consent, or automated means, you have the right to receive your data in a structured, commonly used and machine-readable format, and to transfer it to another controller.

e) Exercising your rights and right to complain

To exercise any of these rights, or if you have questions about our data processing, please e-mail support@eseaboats.com. If your details were collected by an Ambassador, you can also contact the Ambassador, who is responsible for what they collected. You also have the right to lodge a complaint with a data protection supervisory authority. For ESEA Boats, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl). We would, however, appreciate the opportunity to address your concerns directly before you contact the supervisory authority.

For your protection, we may ask you to verify your identity before responding to a request. We may decline certain requests where permitted by law, for example where a request would infringe on the privacy of another individual.

Changes and updates to this privacy policy

We may amend this privacy policy from time to time to reflect changes in our data processing activities or in the law. We recommend you review this page periodically. Where changes require your cooperation or individual notification, we will inform you accordingly.

Contact

If you have any concerns about your privacy, a possible compromise of your data, or any other questions about this privacy policy, please contact us at support@eseaboats.com.