Privacy Policy

Last updated: 25 September 2026

1. Who we are

This Privacy Policy explains how we collect, use and protect your personal data when you
visit karisma-yachts.com (the “Website”) or contact us about a yacht charter.

The controller of your personal data is:

Company: LEB Ship One d.o.o.
Registered office: Turinina ulica 5, 10010 Zagreb, Croatia
Company ID (OIB): 64455853958
Registration number (MB): 05603714
Registered with the Commercial Court in Zagreb, registration no. (MBS): 081443720
EUID: HRSR.081443720
Share capital: EUR 2,600.00, paid in full
Management board: Christian Štenta, director
Bank: Zagrebačka banka d.d., Zagreb
IBAN: HR6323600001103002629
IBAN: HR7123600001503121956
E-mail: office@karisma-yachts.com

We have not appointed a Data Protection Officer. For all privacy matters, please write to
office@karisma-yachts.com.

We comply with the General Data Protection Regulation (GDPR) and Croatian data protection law.

2. What data we collect

Data you give us:
– name and surname
– e-mail address
– telephone number
– the content of your message or enquiry
– charter enquiry details, such as preferred dates and number of guests

Data collected automatically:
– IP address
– browser type and version, device and operating system
– pages visited and time spent on the Website
– referring website
– cookie and consent data

We do not collect special categories of data and we do not ask you to submit payment card
details through the Website.

3. Why we use your data and on what legal basis

Purpose: answering your enquiry and preparing a charter offer
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)

Purpose: arranging and performing a charter booking
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

Purpose: issuing invoices and keeping accounting records
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR)

Purpose: website security and protection against spam and abuse, including reCAPTCHA
Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR)

Purpose: statistics and advertising through cookies and similar technologies
Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time

Purpose: establishing, exercising or defending legal claims
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR)

4. Do you have to provide your data?

Providing your data is voluntary, but the data marked as required in our contact form is
necessary for us to answer your enquiry. If a booking is made, providing the data needed for
the contract and for issuing an invoice is a contractual and legal requirement, and without it
we cannot provide the service.

5. Who we share your data with

We do not sell or rent your personal data. We share it only with:

– Touch Adriatic, Njegoševa 6, 21000 Split, Croatia, which handles charter bookings and
enquiries on our behalf
– Web 2 Brothers, which developed the Website and provides its
ongoing technical maintenance and support
– IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which
provides hosting for the Website
– Google Ireland Limited, for Google Analytics, Google Tag Manager, Google Ads and reCAPTCHA
– our accounting service, bank and, where required, insurers
– competent public authorities, where we are legally obliged to do so

All our service providers are bound by confidentiality and, where they process data on our
behalf, by a data processing agreement under Art. 28 GDPR.

6. International transfers

Some of our service providers, in particular Google, may process data outside the European
Economic Area, mainly in the United States. Such transfers are protected by the EU–US Data
Privacy Framework or by the European Commission’s standard contractual clauses. You may
request a copy of the safeguards in place by writing to office@karisma-yachts.com.

7. How long we keep your data

– enquiries that do not result in a booking: up to 2 years from our last contact
– contract and booking documentation: for the duration of the contract and for as long as
claims may be raised
– invoices and accounting records: 11 years, as required by Croatian accounting and tax rules
– cookie consent records: up to 1 year
– analytics data: up to 14 months

8. Cookies and similar technologies

The Website uses:

– essential cookies, which are needed for the Website to work, to remember your cookie choices
and to protect forms against abuse (reCAPTCHA); these are used without consent
– statistics cookies (Google Analytics), which show us how the Website is used
– marketing cookies (Google Ads), which help us measure the results of our advertising

Statistics and marketing cookies are set only if you consent through the cookie banner. You can
change or withdraw your consent at any time through the “Manage Consent” option in the footer of
the Website, or by deleting cookies in your browser settings. Withdrawing consent does not affect
the lawfulness of processing carried out before the withdrawal.

This Website is protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.

9. Data security

We use appropriate technical and organisational measures to protect your data against
unauthorised access, alteration, disclosure or destruction, including an encrypted (HTTPS)
connection, access control and regular software updates of the Website.

10. Your rights

You have the right to:
– access your data and receive a copy of it
– have inaccurate data corrected
– have your data erased
– restrict processing
– data portability
– object to processing based on our legitimate interests
– withdraw consent at any time, where processing is based on consent

To exercise any of these rights, write to office@karisma-yachts.com. We will reply within one
month of receiving your request.

11. Right to lodge a complaint

If you believe we process your data unlawfully, you may lodge a complaint with the Croatian
Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia,
e-mail azop@azop.hr, www.azop.hr. You may also complain to the supervisory authority in the
country where you live.

12. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects for you
or similarly significantly affects you.

13. Children

The Website is not intended for children under the age of 16 and we do not knowingly collect
their personal data. If you believe a child has provided us with data, please contact us and we
will delete it.

14. California residents

If you are a California resident, you may have additional rights under the California Consumer
Privacy Act (CCPA), including the right to know what personal information we collect and the
right to request its deletion. We do not sell personal information. To exercise these rights,
write to office@karisma-yachts.com.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page
together with a new “Last updated” date.

16. Contact

LEB Ship One d.o.o.
Turinina ulica 5, 10010 Zagreb, Croatia
E-mail: office@karisma-yachts.com

Website development and maintenance: Web 2 Brothers.