MUTINYQUE
КошикпорожнійМагазинНаша перша колекція: футболки та кепка в яхтовому стилі, на замовлення.Команда MUTINYQUEХто стоїть за MUTINYQUE і де зустрітися зі мною у 2027 році
MUTINYQUE
Консалтинг

Ця сторінка поки що недоступна Вашою мовою і відображається англійською.

Privacy Policy

Last updated: October 2026

Protecting your personal data matters to us. We process it in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This policy applies to the website www.mutinyque.com with its enquiry and booking forms, instant booking, consultation appointments, shop, customer area, partner area, staff area and the related app, to the journal at journal.mutinyque.com and to our social media pages.

The German version of this policy is authoritative; this English version is provided for information.

1. Controller

PINHOFF GmbH
Am Kluggrund 18
8511 Sankt Stefan ob Stainz
Austria

Email: office@pinhoff.com
Phone: +43 664 6464186
VAT ID: ATU79121102

For all questions about data protection and to exercise your rights, please write to office@pinhoff.com. We have not appointed a data protection officer because we are not required to.

2. Hosting and server logs

The website is operated by Vercel Inc. (USA), which delivers content through a worldwide server network. With every request, Vercel processes technically necessary data: IP address, date and time, requested address, referring page, browser and operating system, and the response status code. This data is used to deliver the website, fend off attacks and find errors. It is kept only briefly in logs and is not combined with other data.

To protect our forms against automated submissions (bots), we check a field invisible to humans, the time taken to fill in the form and the number of requests per IP address. The IP address is held only briefly in memory for this purpose.

We serve fonts from our own server. No connection to Google Fonts is made when you visit the website.

The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

3. Cookies and similar technologies

We store information on your device only where it is strictly necessary for functions you request, or with your consent (§ 165(3) TKG 2021). In detail:

You can set your browser to notify you about cookies, allow them only case by case, or delete them. Without the strictly necessary cookies, the cart and login will not work.

4. Google Analytics and Google Ads (only with consent)

With your consent in the cookie notice, we load the Google tag (gtag.js) or Google Tag Manager and, through it, Google Analytics 4 and Google Ads (conversion measurement). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without consent, none of these scripts is loaded.

After consent, usage data such as pages viewed, time on page, approximate location, device and browser details, your IP address (shortened by Google) and the following events are sent to Google: enquiry sent, payment started and purchase completed (with amount and product, without your name or email address). We use this to measure how the website is used and which advertising leads to enquiries. Google may also process this data in the USA (see section 17).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time via "Cookie settings" at the bottom of every page. Data in Google Analytics is deleted after the retention period set there, at most 14 months. More: https://policies.google.com/privacy

4a. Meta Pixel (only with consent)

With your consent in the cookie notice, we load the Meta Pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Without consent the pixel is not loaded, and it is never loaded in the login, customer, partner and staff areas, even with consent.

After consent, the following is sent to Meta – in the browser via the pixel and additionally directly from our server (Conversions API): pages viewed, device and browser details, your IP address and the following events: enquiry sent, payment started and purchase completed (with amount, without your name or email address). Meta may link this information to your Facebook or Instagram account. We use this to measure which advertising on Facebook and Instagram leads to enquiries and to show relevant advertising to visitors of our website. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR); Meta may also process the data in the USA (see section 17).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time via "Cookie settings" at the bottom of every page. More: https://www.facebook.com/privacy/policy

4b. TikTok Pixel (only with consent)

With your consent in the cookie notice, we load the TikTok Pixel. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Without consent the pixel is not loaded, and in login, customer, partner and staff areas it is not loaded even with consent.

After consent, pages viewed, device and browser information, your IP address and the following events are transmitted to TikTok: inquiry sent, payment started and purchase completed (with amount, without your name or email address). TikTok may link this information to your TikTok account. This lets us measure which advertising on TikTok leads to inquiries and show relevant advertising to visitors of our website. TikTok may also process data outside the EU; for this TikTok uses the EU Commission's standard contractual clauses (Art. 46 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time via “Cookie settings” at the bottom of every page. More information: https://www.tiktok.com/legal/privacy-policy-eea

4c. Pinterest Tag (only with consent)

With your consent in the cookie notice, we load the Pinterest tag. The provider is Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Without consent the tag is not loaded, and in login, customer, partner and staff areas it is not loaded even with consent.

After consent, the pages you visit, device and browser details, your IP address and the following events are sent to Pinterest: enquiry sent and purchase completed (with amount, without your name or e-mail address). Pinterest may link this information to your Pinterest account. This lets us measure which advertising on Pinterest leads to enquiries and show suitable advertising to visitors of our website. Pinterest may also process data in the USA; for this Pinterest uses the EU Commission’s standard contractual clauses (Art. 46 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time via “Cookie settings” at the bottom of every page. More information: https://policy.pinterest.com/en/privacy-policy

5. Enquiries, contact and call-back

When you contact us via a form (for example a charter enquiry, including a repeat enquiry from the customer area, the quick enquiry on the home page, a search request for a charter yacht or a yacht to buy, a yacht valuation, a request for our media kit, an enquiry about a brokerage yacht, a meeting request at a boat show, call-back, contact, or an application as a partner), by email, phone or WhatsApp, we process your details: name, email address, phone number, company where applicable, preferred yacht or cruising area, travel dates, number of guests, budget, preferred size, shipyard, condition and timing of a yacht purchase, details of your own yacht (shipyard, model, year of build, length, berth, asking price and what you plan to do with the yacht), when you request our media kit, the brand or yacht and your goal, the preferred plan when you apply as a partner and, where applicable, the page that led you to the application, preferred boat show and day, time window for a call-back, your message, the language selected, the page on which you sent the form and, where applicable, the campaign information from section 3.

We store this information in our customer relationship management system (CRM) Salesforce in order to answer your enquiry, prepare offers and ask follow-up questions. For call-backs, meetings at boat shows, search requests to buy a yacht, yacht valuations and media kit requests we create a task for our team there. The legal basis is pre-contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in handling enquiries and attributing them to our campaigns (Art. 6(1)(f) GDPR).

After an enquiry, booking or application we send you an email with a link to confirm that the email address belongs to you (valid for 30 days). This also applies when our team records your details, for example at a boat show. We handle your enquiry even without confirmation, but we only create a customer account (contact and company in Salesforce) once you have confirmed. For this we only store the time of confirmation with all records that have your address. If you sign in to the customer area via a link sent by email or confirm your newsletter subscription, your address also counts as confirmed. The legal basis is our legitimate interest in creating customer accounts only for people who actually use the address given and in avoiding mix-ups (Art. 6(1)(f) GDPR).

Files you attach to an enquiry (for example photos, plans or documents about a yacht) are stored with your enquiry record in Salesforce and as a copy in our internal Google Drive (Google as processor, see section 15); the transfer runs via Zapier. If you apply for a position at MUTINYQUE, we process your name, email address, phone number, message and documents (for example CV and references) in the same way in order to decide on your application (Art. 6(1)(b) GDPR). This also applies to the quick application in our iPhone app, which works without signing in: there you can add up to two photos and a short video (up to 20 seconds), taken with the camera or chosen from your library. The app uses the camera and microphone only while you take a photo or record a video for this yourself; only the files you choose are transferred. We also keep a copy of the photos and videos from the quick application in a private file storage of our hosting provider Vercel in Frankfurt am Main (processor, see sections 2 and 16) so that they load quickly in the app. The copy can only be accessed through links that are valid for a few minutes and are created only after access rights have been checked; we delete it as soon as the file is deleted in Salesforce. If you are signed in to the app as a customer, your name, email address and the phone number from your most recent own enquiry are already filled in; you can change them before sending. Applications that do not lead to employment are deleted no later than seven months after the process ends, unless you allow us to keep them longer for future positions. On the website, applications for positions of our partners or from the job portal go directly to the employer concerned, not to us. In the iPhone app, you can also use the quick application for positions of our partners. In that case we store your name, email address, phone number, message, photos and video in Salesforce on behalf of the partner who posted the position (processing on behalf under Art. 28 GDPR), without a copy in our Google Drive. The controller is the partner, who also decides on the selection; its legal basis is pre-contractual measures (Art. 6(1)(b) GDPR). Only that partner's company sees the application in its partner area; other partners do not, and our staff access it only for operation and support. The partner receives an email notice of the new application, without your details. We delete such applications no later than seven months after the job ad ends, unless the partner keeps them longer with your consent. Applications for positions from the job portal go directly to the employer, not to us, including in the app.

Trade show stand, referral links and forms in ads

If you sign up at a boat show via the QR code at our stand, we process your name, email address, phone number, your request, your note and the show in the same way as any enquiry. Only if you tick the box for it do we send you one email with information about your request the day after the show (Art. 6(1)(a) GDPR, § 174 TKG 2021); for this we record a task in Salesforce with your name, language, topic and the show. No further marketing emails follow from this. You can withdraw your consent at any time by email to office@pinhoff.com.

If you send an enquiry via a personal referral link, we note with your enquiry who recommended you; for this the link contains that person's identifier in our CRM with a check code. This lets us thank the person who recommended you and settle any agreed fee (legitimate interest, Art. 6(1)(f) GDPR). You do not see on the page who recommended you, and the referrer learns nothing about your enquiry without your consent. Customers find their own referral link in the customer area.

If you fill in an enquiry form directly in one of our ads on LinkedIn, LinkedIn passes the details from the form to us. We transfer them to Salesforce via Zapier and handle them like an enquiry via our website (Art. 6(1)(b) GDPR). LinkedIn Ireland Unlimited Company is responsible for the processing on LinkedIn itself: https://www.linkedin.com/legal/privacy-policy

Enquiries that do not lead to a contract are deleted no later than three years after the last contact.

6. Newsletter and email marketing

We send marketing emails only with your express consent (Art. 6(1)(a) GDPR, § 174 TKG 2021): via the tick box in a form or by subscribing to the MUTINYQUE Journal or the press review on our website. Your consent is recorded in Salesforce. All contacts without this consent are automatically blocked from marketing emails.

When you subscribe to the Journal on our website (for example in the footer or on the home page), we first send you an email with a confirmation link that is valid for seven days. You are only subscribed once you choose "Confirm subscription" on the page that opens (double opt-in); until then we do not add your address anywhere. After confirmation we subscribe you to the Journal (Ghost, section 13), which sends the newsletter, and store in Salesforce your email address, the language, the page where you subscribed and the time of subscription and confirmation as proof of your consent. The confirmation email is sent via Salesforce (section 15).

If our team records your details in person (for example at a boat show, in our iPhone app or in the staff area of the website) and you would like to receive the newsletter, the same applies: we send you the email with the confirmation link in the language you gave us, and you are only subscribed once you confirm yourself. Our employee's note alone is not consent; until you confirm, your record remains blocked for marketing emails. With the record we only note that you asked for the newsletter and whether the confirmation email was sent.

For the press review "Industry Insights – Press" you subscribe on the page of the same name (link in the footer) with your email address and choose whether you receive it weekly or monthly. Double opt-in with a confirmation link valid for seven days applies here too. After confirmation we store in Salesforce your email address, the chosen frequency, the language, the page where you subscribed and the time of subscription and confirmation as proof of your consent, and assign you to the campaign for the chosen frequency; if we already know your address, we add this to the existing record. We send the press review via Salesforce (section 15). Changing the frequency later replaces the earlier choice.

You can withdraw your consent at any time via the unsubscribe link in every email, in the customer area (section 12) or by writing to office@pinhoff.com; in the customer area we unsubscribe you in the Journal and in Salesforce. After a withdrawal we keep the proof of consent for no longer than three years (legitimate interest in proof, Art. 6(1)(f) GDPR).

7. Charter booking and instant booking

To broker a charter, we process your contact details, the booked yacht, the dates, the number of guests, prices and payment status. To carry out the charter, charter companies and authorities often need further details: a crew list with names, dates of birth, nationality and ID or passport numbers, and the skipper's licences. We ask for this data only when it is needed for your charter.

We manage availability, options and bookings in Booking Manager by MMK Systems d.o.o., Zagreb, Croatia. We pass your booking data to the charter company with which you conclude the charter contract; it processes the data as a separate controller. For planning, paid bookings are entered in an internal, non-public Google calendar (yacht, dates, name); the transfer runs via Zapier (see section 15). We send the booking confirmation by email via Salesforce, as well as, before the balance is due, the payment request with a personal link for online payment and the confirmation once it has been received.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and legal obligations such as reporting duties in the charter country (Art. 6(1)(c) GDPR). We keep booking and invoice data for seven years (§ 132 Austrian Federal Fiscal Code, § 212 UGB); crew lists and ID data are deleted after the charter as soon as no claims are to be expected.

8. Consultation appointment (Private Yacht Advisory)

If you book a paid consultation, we process your name, email address, phone number, preferred date, time zone and your note about the conversation. The booking is stored in Salesforce and entered as an appointment in our internal Google calendar (via Zapier). We email you the video call link with the appointment confirmation. If the appointment falls within the withdrawal period, we also store your express request that the consultation begin before the withdrawal period ends, and your acknowledgement that you lose your right of withdrawal once it has been fully performed, with date and time, as proof (in the Revolut payment order and in Salesforce). After the appointment, we create the invoice in Salesforce and email it to you once you have confirmed your email address via the link in our email; only then do we create a contact and an account under your name and store the invoice as a PDF. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our obligation to issue invoices (Art. 6(1)(c) GDPR, § 11 Austrian VAT Act) and, for this proof, also our legitimate interest (Art. 6(1)(f) GDPR); invoice data is kept for seven years.

9. Online payments via Revolut

Deposits and payments for instant bookings, consultation appointments, job ads, the partner subscription and the job subscription are processed via Revolut Business. The provider is Revolut Bank UAB, Vilnius, Lithuania. You enter your card details directly on Revolut's payment page; we receive only the amount, payment status, an order number and, where applicable, the card type and last four digits. For the partner subscription and the job subscription, Revolut stores the payment method for recurring charges. Revolut also processes the data as a separate controller, for example to prevent fraud and to comply with anti-money-laundering rules.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR). More: https://www.revolut.com/legal/privacy

Payments not completed

If you cancel the payment for an instant booking or for booking a consultation, or if it expires after 30 minutes, we store the details from the booking form (name, email address, phone number, yacht, dates and price or preferred appointment, language and, where applicable, the campaign information from section 3) as an enquiry in Salesforce so that our team can help you with any questions. On the following day we send you one email reminder about your open booking, with a link to continue it; the booking form points this out. If you have made another enquiry or booking in the meantime, there is no reminder. No further reminders or marketing follow from this.

The legal basis is pre-contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in supporting you with a booking you started (Art. 6(1)(f) GDPR). You can object to the reminder at any time by writing to office@pinhoff.com. The details are deleted like enquiries (section 5).

10. Shop

Products, cart and checkout of our shop run on Shopify. The provider is Shopify International Limited, Dublin, Ireland. We keep your cart in the "cart" cookie. To order, you switch to the Shopify checkout, where you enter your delivery address, billing address and payment details. We receive the order data (name, address, email address, phone number, items ordered, payment status) in order to produce, ship and invoice the goods. In the Shopify checkout, the shop's privacy policy also applies.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR). We keep order and invoice data for seven years. More: https://www.shopify.com/legal/privacy

If a product or size is sold out or the shop has not opened yet, you can ask to be notified. For this we store your email address, the product and size, the language and the time of your request in Salesforce and write to you once, as soon as the item or the shop is available. You will not receive marketing as a result. The legal basis is pre-contractual measures at your request (Art. 6(1)(b) GDPR); the details are deleted like enquiries (section 5).

11. Partner area

For business partners (charter agencies, yacht brokers, concierge services and travel agencies), we operate a protected partner area at www.mutinyque.com/en/partner. Access is set up only after review and approval by us.

When you apply as a partner, we process the details from the form (name, company, email address, phone number, website, activity and message) to review the application. For approved partners, we process in particular:

Each partner sees only their own bookings and commissions. Approved job ads are published at www.mutinyque.com/jobs, in the job feed for search engines such as Google and on our LinkedIn page; publication on LinkedIn runs via Zapier. Partners who see customers' personal data in the partner area undertake in the partner agreement to treat it confidentially and in compliance with data protection law.

In the off-market exchange, partners register prospective buyers they act for: name or company and, for a company, optionally the beneficial owner. These details come from the registering partner, who confirms that the buyer has allowed them in text form to name them. We store them in Salesforce with the time of receipt and pass them on to the selling side, i.e. the partner who listed the yacht or made the offer; the selling side is bound to confidentiality by the framework non-disclosure agreement. The selling side can object if it already knew the buyer; the registering partner receives its objection with the date of first contact. The purpose is to document who introduced a buyer first and to split the commission under the cooperation agreement. The legal basis is the legitimate interest of the partners involved and our own in this record (Art. 6(1)(f) GDPR). We keep registrations and objections for as long as commission claims can arise from them or be asserted, as a rule until three years after the end of the protection period under the cooperation agreement.

The legal basis is the performance of the partner agreement or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in secure access control and proof of signature (Art. 6(1)(f) GDPR). We store the data for the duration of the partnership and thereafter in line with statutory retention periods. Applications that do not lead to a partnership are deleted after 12 months at the latest.

11a. Job portal (job ads)

When you place a job ad as an employer, we process: company, registered country and, where applicable, VAT ID, for paid ads the billing address (street, postcode, town, country), the contact person's name, email address and phone number, the details of the position including the application address, and your voluntary details (type of employer, name, type, length and year of build of the yacht, fleet size, interest in buying, selling or chartering out a yacht). We store them in Salesforce as a lead or with your existing contact in order to review, publish and invoice the ad and to remind you before the run time ends (Art. 6(1)(b) GDPR). We use your voluntary details to offer you suitable services for your yacht or fleet (legitimate interest, Art. 6(1)(f) GDPR); you can object to this at any time. You only receive marketing emails if you tick the newsletter box yourself (section 6).

The ad itself, with company name, location and application address, is public: on our website, on Google Jobs, in the newsletter and on our social media channels. Applications for job portal ads (Basic, Plus or free of charge during the launch phase) go directly to you; we do not receive or store applicant data for them. For positions you post as a partner in the partner area, including with the job subscription, the MUTINYQUE app also offers the quick application: we store these applications on your behalf (Art. 28 GDPR) and show them only to your company in the partner area (section 5). Payment is made via Revolut (section 9). We create the invoice in Salesforce and email it to you once you have confirmed your email address using the link in our email (section 5); only then do we create a contact and a company record with your billing address and store the invoice as a PDF. We keep invoicing data for seven years (section 18) and delete the other details no later than three years after the last contact.

12. Sign-in, customer area, staff area and app

Customers, partners and staff sign in at www.mutinyque.com/en/login. We email a link that is valid for 15 minutes; you are signed in only once you choose "Sign in now" on the page that opens. There are no passwords. We then set one cookie per area (section 3). Each time you open a page, we check in Salesforce whether your access still exists. On the sign-in page and in the protected areas we do not load any Google services, not even with your consent. If you have several roles (for example customer and partner), you can switch between them without a new email; "Sign out" ends all logins in this browser.

Signing in with a passkey: within 30 minutes of signing in, you can set up a passkey for this device in the customer, partner or staff area and then sign in on this browser with Face ID, Touch ID, your fingerprint or your device PIN, without a new link. Only your device checks your face, finger or PIN; biometric data never leaves your device and never reaches us. For this, your device creates a key pair and keeps the private key (depending on the device in its password manager, such as iCloud Keychain or Google Password Manager). We store only the public key with its ID, your email address and the area in the cookie "__Host-mq_device" on your device (section 3), not on our servers and not in Salesforce. Each time you sign in, we check your device's signature with this public key and then, as with every sign-in, check in Salesforce whether your access still exists. The passkey works only in the browser in which you set it up. "Sign out" leaves it in place; "Remove passkey from this device" deletes the cookie and, where your browser supports it, also the passkey in its password manager (otherwise you can delete it in your device settings). Use is voluntary; signing in with a link always remains possible. The legal basis is our legitimate interest in simple and secure sign-in (Art. 6(1)(f) GDPR).

Customer area

If you have sent an enquiry, booking, consultation or order through our website yourself, you can sign in to the customer area on the website or in our iPhone app with the same email address. There we show your own enquiries, bookings and options (yacht, period, base, total price of paid bookings and status), paid consultation appointments and shop orders (date and status), your name, your email address and whether you receive our newsletter. The data comes from Salesforce; we synchronise the booking status with the Booking Manager every night. We do not show internal notes, commissions or other people's data. Records that our staff or partners have created for you do not appear there. The only exception, on the website and in the app: under "Selected for you" we show the yachts our team has sent you personally from the app (name of the yacht, the day it was sent, for charter the period, a photo and the link to the yacht on our website), likewise matched by your email address. We do not show the text of the message, who sent it or internal details there, and we do not record in Salesforce when you open these yachts. For each booking we also show check-in, check-out and base from the Booking Manager, the payment status and the documents we have provided to you (for example confirmation, contract, invoice); we do not show internal files. Under "Yachts" we show charter yachts with the public prices of our website; we do not store your search.

Records are matched solely by your email address. Anyone with access to your mailbox can therefore open the customer area, so please keep your mailbox secure. In the customer area you can unsubscribe from the newsletter: we then block all records with your address from marketing emails and record the unsubscription with its time in Salesforce. On the website and in the app you can also send a new enquiry, including directly about a yacht; we take your name and email address from the customer area, fill in the phone number from your most recent own enquiry (you can change it) and process the enquiry like an enquiry sent through the website (section 5); in Salesforce we note that it came from the customer area. On the website and in the app you can choose "Enquire again" next to a booking: we take the yacht and base from that booking, your name and email address from the customer area and the phone number from your most recent own enquiry (you can change it). We note the earlier booking with the new enquiry and assign it to the campaign "Existing customer" in Salesforce; otherwise we handle it like an enquiry sent through the website (section 5). You can ask us a question about a booking (topic, message, phone number): we create a customer case in Salesforce with your name, your email address and the booking details, inform our team by email and show you the topic, date and status of the question with the booking. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); the case is kept as long as the booking (section 18). The customer area stores no data of its own; the retention periods of the respective enquiry, booking or order apply (section 18). The legal basis is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in simple and secure access to your own data (Art. 6(1)(f) GDPR). Use is voluntary; you can still exercise your rights (section 19) by email.

Staff area and app

For our employees there is a protected staff area and an iPhone app, which partners and customers can also use; in the app, customers see the same data and have the same options as in the customer area of the website (see Customer area). Login works as on the website, via a link sent by email. In the browser we then set the "__Host-mq_staff" cookie (section 3); in the app the login is stored as a key on the device (up to 30 days, with Face ID up to 12 months). Face ID is checked only by your iPhone; we receive no biometric data. Open positions and the quick application for them (section 5) are also available in the app without signing in.

In the staff area, authorised employees can see customer data from Salesforce (contact details, enquiries, status, communication history) to the extent they need it for their work, and can create journal articles. Access is restricted to approved persons. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure organisation (Art. 6(1)(f) GDPR). If an employee records your details from a business card, they paste its text into the app or the staff area; it is split into name, company, email address and phone number on their device, and only the details they then submit are stored, not the card itself. Our employees can download your name, company, email address, phone numbers and city and country as a contact card (vCard) to their device in order to call or write to you; we only provide the file to signed-in employees and do not cache it.

If our staff share a yacht from the app or the staff area of the website with a personal link (www.mutinyque.com/y/…), we record in Salesforce when the link is first opened within 12 hours and inform the person who shared it. This lets us advise you in a targeted way. The legal basis is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR); you can object at any time (section 19). The record is kept as long as your enquiry.

13. Journal

Our journal at journal.mutinyque.com runs on Ghost(Pro) by the Ghost Foundation. This policy applies there accordingly; if you sign up in the journal or on our website (section 6) as a member or for the newsletter, Ghost processes your email address, subscription settings and the language of your subscription on our behalf and sends the newsletter (Art. 6(1)(a) and (b) GDPR). The text of articles shown on www.mutinyque.com is loaded from Ghost by our server; the preview images are loaded by your browser from Ghost's image storage (storage.ghost.io), so Ghost, as our processor, receives the technical access data described in section 2. At the end of articles we link to our enquiry forms; you only enter data there. More: https://ghost.org/privacy/

14. Event calendar, Google Calendar, WhatsApp and social media

On the home page we show a calendar of yacht shows provided by Elfsight. It is loaded only after you have consented in the cookie notice or clicked "Show calendar"; before that, no connection to Elfsight is made. Your browser then loads the calendar script and content from Elfsight servers, transmitting your IP address and browser details to Elfsight. The dates come from a public Google calendar. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). More: https://elfsight.com/privacy-policy/

The show dates on the team page are loaded by our server directly from Google Calendar; no visitor data is passed to Google.

For WhatsApp, Instagram, Facebook, LinkedIn and reviews on Google we only set links. Data is sent to the respective provider only when you click a link. This also applies to the buttons for sharing a page: "Copy link" only places the address in your clipboard, and your device's share menu passes it to the app you choose. If you message us on WhatsApp, WhatsApp Ireland Limited processes your phone number and messages under its own privacy policy; we use your message only to reply. On our social media pages we are jointly responsible with the operator (Meta Platforms Ireland Limited for Instagram and Facebook, LinkedIn Ireland Unlimited Company) for page statistics (Art. 26 GDPR). We load the Meta pixel only with your consent (section 4a); we do not use a LinkedIn tracking pixel on this website.

15. Email, CRM and automation

Our central system for customers, enquiries, bookings and partners is Salesforce (Salesforce, Inc., San Francisco, USA). Website emails (login links, confirmations, reminders about open bookings, messages to partners) are sent via Salesforce. Our mailbox and internal calendars run on Google Workspace (Google Ireland Limited). For certain automated workflows, such as calendar entries, transferring enquiries from forms in LinkedIn ads, publishing job ads and journal articles on LinkedIn and as a fallback for emails, we use Zapier (Zapier, Inc., San Francisco, USA).

16. Recipients and processors

Your data is received only by those who need it for the relevant purpose: the service providers named above as processors (Vercel, Salesforce, Google, Zapier, Shopify, Ghost, MMK Systems), with whom we have concluded agreements under Art. 28 GDPR, and, as separate controllers, charter companies, Revolut, shipping providers, tax advisers, authorities and courts where we are obliged to disclose it. We do not sell data.

17. Transfers outside the EU

Some service providers (Vercel, Salesforce, Google, Meta, Zapier, Shopify) may process data in the USA. For companies certified under the EU-US Data Privacy Framework, the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). Where this does not apply, we have agreed the European Commission's standard contractual clauses (Art. 46 GDPR). You can request a copy from us.

18. Retention

We store personal data only for as long as necessary for the relevant purpose. Contract and invoice data is kept for seven years (§ 132 BAO, § 212 UGB), and beyond that only as long as claims can be asserted (usually three years, § 1489 Austrian Civil Code). Other periods are stated in the individual sections.

19. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Please write to office@pinhoff.com.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object at any time, without giving reasons, to the use of your data for direct marketing; we will then no longer use it for that purpose.

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority. In Austria this is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna
www.dsb.gv.at

20. Obligation to provide data and automated decisions

Providing your data is voluntary. Without the details marked as mandatory in the forms, however, we cannot process your enquiry, booking or order. No automated decision-making including profiling (Art. 22 GDPR) takes place.

21. Data security

The website is encrypted throughout (HTTPS). Protected areas are accessible only after login, and we grant access only where necessary. Because sign-in works via a link sent by email, please protect your mailbox with a strong password. We continuously adapt our technical and organisational measures to the state of the art.

22. Changes

We update this privacy policy when our services or the legal situation change. The version published here applies.