Privacy policy

Effective date 6 November 2026

1. About this policy

1.1 Purpose. This Privacy Policy explains how Headland Yachting Limited (“Headland Yachting”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit https://www.headlandyachting.com (the “Website”), contact us, enquire about a yacht charter, book a charter through us or receive our newsletter.

1.2 Legal framework. We are established in the United Kingdom and process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”). Sections 21 and 22 explain additional points for clients in the European Union and the United States.

1.3 Related documents. This policy should be read with our Terms of Business and Website Use and our Cookie Policy, both available on the Website. Terms such as “Supplier”, “Central Agent”, “Charter Contract”, “Escrow Account”, “Lead Charterer”, “Party” and “Services” have the meanings given in our Terms of Business and Website Use.

2. Who we are and how to contact us

2.1 Controller. Headland Yachting Limited is the controller of the personal data described in this policy. We are a company registered in England and Wales under company number 17532233, with our registered office at 128 City Road, London, EC1V 2NX, United Kingdom.

2.2 ICO registration. We are registered with the Information Commissioner’s Office under registration number ZC291520.

2.3 Contact. For any question about this policy or your personal data, email hello@headlandyachting.com with “Privacy” in the subject line, or write to us at the address in Section 2.1. We have not appointed a data protection officer because we are not required to do so.

3. The personal data we collect

3.1 Enquiry and contact data. Your name, email address, telephone number and the content of your messages, together with your preferred dates and flexibility, number of nights, number of adults and children, type of charter and yacht, preferred destinations, approximate budget, yachts of interest and anything else you choose to tell us, such as celebrations or sailing experience.

3.2 Booking data. The information the Supplier needs to prepare the Charter Contract and clear the yacht with customs and immigration, usually the full name, date of birth, nationality, passport number, issue and expiry dates, and home address of each member of the Party, together with arrival and departure travel details and emergency contacts.

3.3 Sailing experience data. For bareboat and skippered charters, the nominated skipper’s and crew’s sailing resume, qualifications and certificates.

3.4 Preference data. Food and drink preferences, interests, activities and celebrations relevant to planning the charter.

3.5 Health, dietary and accessibility data. Allergies, dietary requirements, medical conditions, mobility or accessibility needs, as explained in Section 5.

3.6 Payment and verification data. Records of payments you make into our Escrow Account or that we confirm on your behalf, including the paying bank account name, bank and reference, and, where required, identity documents and information about the source of funds. We do not collect or store payment card details.

3.7 Communications data. Messages exchanged with us by email, telephone, WhatsApp or live chat, including your telephone number, WhatsApp profile name and the date and time of messages.

3.8 Marketing data. Your newsletter subscription status, your marketing preferences and, where we use an email service that records them, whether you open our emails or click their links.

3.9 Technical and usage data. Your IP address, device type, browser, operating system, pages viewed, referring site and approximate location, collected through the technologies described in Section 14 and our Cookie Policy.

3.10 Reviews and social data. Reviews or testimonials you give us, and your public profile name if you interact with our social media accounts or leave a Google review.

4. Information about other members of your Party

4.1 Lead Charterer. The person who enquires or books usually gives us information about the other members of the Party, including children. If you do so, please make sure you have their agreement, or that of a parent or guardian, and show them this policy.

4.2 How we treat it. We use information about Party members only to arrange and deliver the charter as described in this policy.

5. Health, dietary and accessibility information

5.1 Why we ask. Allergies, medical conditions and accessibility needs help us choose a suitable yacht and allow the captain and crew to look after the Party safely. Information about health is special category data under the UK GDPR.

5.2 Explicit consent. We process this information on the basis of your explicit consent, which you give when you tick the consent box on our enquiry form or when you confirm it to us in writing. Where you provide it for another member of the Party, you confirm that they, or their parent or guardian, have agreed.

5.3 Who sees it. We share it only with the Supplier, Central Agent, captain and crew of the yacht you are considering or have booked, and only to the extent they need it.

5.4 Emergencies. If a member of the Party is in danger and cannot give consent, we may share relevant health information with the captain, medical services or emergency services to protect that person’s vital interests.

5.5 Withdrawing consent. You may withdraw your consent at any time by emailing us. This will not affect sharing that has already taken place, but it may limit our ability to match you with a suitable yacht or to ensure that your needs are met on board.

6. Children

6.1 Our services are for adults. The Website and our Services are intended for adults. Only a person aged 18 or over may make a booking, and we do not knowingly collect personal data directly from children.

6.2 Children in the Party. We collect information about children travelling in the Party, such as their ages, dietary needs and passport details, from the Lead Charterer or their parent or guardian, and use it only to plan and deliver the charter safely.

6.3 If a child contacts us. If we learn that we have received personal data directly from a child under 13 without the consent of a parent or guardian, we will delete it.

7. Where we get your personal data

7.1 From you. Most of the personal data we hold comes directly from you through our forms, emails, calls, WhatsApp, live chat or newsletter sign-up.

7.2 From others. We may also receive personal data from the Lead Charterer about other members of the Party; from Suppliers, Central Agents and captains, for example confirmation of payments received, feedback or incident reports; from people who refer you to us; from our bank in connection with payments and verification checks; and from Google through the analytics technologies described in Section 14, and from any advertising platform we later use as described in Section 14.3, where you have consented to them.

8. How we use your data and our lawful bases

8.1 Purposes and lawful bases. We use personal data only for the purposes below, each of which relies on the lawful basis shown:

8.2 New purposes. We will not use personal data for a purpose that is incompatible with the purpose for which we collected it without telling you and, where required, obtaining your consent.

9. Legitimate interests

9.1 Our interests. Where we rely on legitimate interests, those interests are running and developing our brokerage business, responding to enquiries efficiently, keeping in touch with clients who have booked with us, preventing fraud and financial crime, keeping our systems secure and protecting our legal position.

9.2 Balancing. We rely on legitimate interests only where they are not overridden by your interests and rights. You may object at any time, as explained in Section 20.

10. Enquiry forms, email and telephone

10.1 Forms. Our contact and charter enquiry forms are processed by our form provider, Formspree, which receives the information you submit and delivers it to our email inbox. Formspree acts on our instructions as our processor.

10.2 Required and optional information. We mark which fields we need to answer your enquiry. Telephone number, budget and preference fields are optional. If you do not give us the information required for a booking, we will be unable to arrange the charter.

10.3 Calls. We do not record telephone calls. We may keep notes of what was discussed.

11. WhatsApp and live chat

11.1 WhatsApp. If you message us through the WhatsApp button on the Website or by WhatsApp directly, we will receive your telephone number, WhatsApp profile name and your messages. WhatsApp is provided by a Meta group company, which processes your WhatsApp account and usage data as an independent controller under WhatsApp’s own terms and privacy policy. If we use the WhatsApp Business Platform, Meta also hosts our business messages on our behalf.

11.2 Live chat. If you use live chat on the Website, our chat provider will process your messages and technical data on our behalf as our processor so that we can reply to you.

11.3 Sensitive information. Please do not send passport images, bank details or payment card details by WhatsApp or live chat. We will tell you how to send documents securely when we need them.

11.4 Keeping chat records. We keep chat and WhatsApp messages relating to your enquiry or charter with your client records, for the periods set out in Section 19.

12. Payments, escrow and identity checks

12.1 Payment data. Charter payments are made by bank transfer either to our Escrow Account or to a Central Agent’s escrow or client account. We record the details needed to identify, reconcile and, where appropriate, refund each payment.

12.2 Our bank. The bank that provides our Escrow Account receives the payment information you send and may carry out its own identity, fraud and sanctions checks as an independent controller.

12.3 Verification. Where we or our bank need to verify your identity or the source of funds, we will ask for the minimum information required and keep it securely and separately from general correspondence.

13. Marketing and newsletter

13.1 Newsletter. If you sign up for our newsletter, we will send you news about yachts, destinations and offers by email. We rely on your consent, which you may withdraw at any time.

13.2 Existing clients. If you have enquired about or booked a charter with us, we may send you emails about similar charter services we offer, unless you opted out when you gave us your details. This is permitted by PECR.

13.3 Unsubscribing. Every marketing email contains an unsubscribe link. You can also email us to unsubscribe. We will keep a record of your email address on a suppression list so that we do not contact you again.

13.4 No sale of contact lists. We do not sell or rent your contact details to anyone for their own marketing.

14. Cookies, analytics and advertising

14.1 Consent first. We ask for your consent through our cookie banner before setting any cookie or similar technology that is not strictly necessary. Analytics and advertising technologies do not load until you accept them.

14.2 Analytics. With your consent, we use Google Analytics, provided by Google, to understand how visitors find and use the Website. We have configured Google Analytics to retain user-level data for no longer than 14 months. We may also use Umami, a privacy-focused analytics tool that does not use cookies or store information on your device and does not keep your full IP address, to count page visits.

14.3 Advertising. We do not currently use advertising technologies on the Website. We may in future use advertising technologies (often called pixels or tags) from Meta (Facebook and Instagram), Google Ads and TikTok. If we do, they will tell those platforms that you have visited the Website and which pages you viewed, so that we can show our adverts to people who have shown an interest, find similar audiences and measure whether our adverts work. They will load only if you consent to advertising cookies, and we will update this policy and our Cookie Policy before they are introduced.

14.4 Platforms’ own use. If we introduce advertising technologies, the advertising platforms may combine the information they collect with information they already hold about you, including through your accounts with them, and use it for their own purposes under their privacy policies. For the collection and transmission of data through a Meta pixel, we and Meta may act as joint controllers. Meta is responsible for its own subsequent processing.

14.5 Changing your choices. You can change your choices at any time through the cookie settings link at the foot of every page. Full details of the cookies and technologies we use, and how long they last, are in our Cookie Policy.

15. Social media, Instagram and Google reviews

15.1 Embedded content. The Website may display our Instagram feed and our Google reviews. These embeds are loaded only after you consent to third-party content through our cookie banner, because the providers may set cookies and collect information about your device and visit.

15.2 Our social media pages. If you follow, message or interact with our Instagram or Facebook pages, Meta processes your data under its own policies. We see your public profile and anything you send us, and we may receive aggregated page statistics from Meta.

15.3 Google reviews. If you leave a Google review, Google publishes it under your Google profile name. We may display or quote it on the Website. Reviews you send us directly are published only with your consent.

16. Who we share your data with

16.1 Charter recipients. To arrange your charter, we share the relevant personal data with the Central Agent, Supplier, owner, manager and charter company of the yacht, and with its captain and crew. These recipients use your data as independent controllers under their own terms and privacy notices, including to clear the yacht and the Party with customs and immigration authorities.

16.2 Our service providers. We use trusted providers who process personal data on our behalf under written contracts that require them to keep it secure and use it only on our instructions. They include our form provider (Formspree), our website host and developer, our email and office software provider, our live chat provider, our email marketing provider, our cookie consent tool, Umami, and our accountants and IT support.

16.3 Independent third parties. We also share personal data with our bank and payment providers; Google, where you have consented to analytics; Meta, Google and TikTok, if we introduce advertising technologies and you consent to them (Section 14.3); our professional advisers, such as lawyers and accountants, and our insurers; and HM Revenue & Customs, law enforcement agencies, courts and regulators where we are required or permitted by law.

16.4 Business transfer. If our business, or any part of it, is sold or reorganised, personal data may be transferred to the buyer or successor, who will be bound to use it in accordance with this policy.

16.5 No sale. We do not sell personal data for money.

17. International transfers

17.1 Why your data leaves the United Kingdom. Most of the yachts we arrange are based in the British Virgin Islands, the United States Virgin Islands and elsewhere in the Caribbean, and Central Agents and Suppliers are often based in the United States, the Caribbean or Europe. Several of our service providers, including Google and Meta, also process data outside the United Kingdom.

17.2 Safeguards. When we transfer personal data outside the United Kingdom, we rely on one of the following: a decision by the United Kingdom that the destination provides adequate protection, including the UK Extension to the EU-US Data Privacy Framework for United States organisations certified under it; the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, as issued for use under UK law; or, where no other mechanism is available, the transfer being necessary for the performance of the Charter Contract or a contract made in your interests, such as sending your details to the Supplier of the yacht you have asked us to book.

17.3 Further information. You can ask us for more information about the safeguards that apply to a particular transfer.

18. How we protect your data

18.1 Security measures. We use technical and organisational measures appropriate to the risk, including encrypted connections to the Website, access controls and strong authentication on our business accounts, separation of identity and payment documents from general correspondence, and limiting access to personal data to those who need it.

18.2 Our providers. We choose providers that offer appropriate security commitments and require them, by contract, to protect personal data.

18.3 Breaches. If a personal data breach occurs, we will notify the Information Commissioner’s Office within 72 hours where the law requires, and will tell you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

18.4 Your part. No system is completely secure. Please follow the payment safety steps in Section 10 of our Terms of Business and Website Use and check our bank details by telephone before you pay.

19. How long we keep your data

19.1 Retention periods. We keep personal data only for as long as we need it for the purposes in this policy:

19.2 Longer retention. We may keep personal data for longer where it is needed to establish, exercise or defend a legal claim, or where the law requires it. When data is no longer needed, we delete it or anonymise it securely.

20. Your rights under UK data protection law

20.1 Your rights. Subject to conditions and exceptions set by law, you have the right to:

(a) access the personal data we hold about you and receive a copy;

(b) have inaccurate personal data corrected and incomplete data completed;

(c) have your personal data erased;

(d) restrict our use of your personal data;

(e) object to our use of your personal data where we rely on legitimate interests, and to object at any time to direct marketing;

(f) receive personal data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller, where we rely on consent or contract and process it by automated means; and

(g) withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

20.2 How to exercise them. Email hello@headlandyachting.com. We may need to verify your identity before responding. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.

21. Clients in the European Union and elsewhere

21.1 EU clients. Where the EU General Data Protection Regulation applies to our processing of your personal data, you have rights equivalent to those in Section 20, and you may complain to the data protection supervisory authority in the EU member state where you live or work.

21.2 Other countries. If you live elsewhere, you may have additional rights under local law. Contact us and we will consider your request in line with the law that applies.

22. United States residents

22.1 State privacy laws. A number of US states have consumer privacy laws that give residents rights over their personal data. Where those laws apply to us, you may have the right to know what personal data we hold, to access, correct and delete it, to obtain a portable copy, and to opt out of the sale of personal data, the sharing of personal data for cross-context behavioural advertising, and targeted advertising.

22.2 Advertising technologies. We do not sell personal data for money, and we do not currently use advertising technologies on the Website. If we introduce advertising pixels from Meta, Google or TikTok as described in Section 14.3, their use may be treated as a “sale” or “sharing” of personal data, or as “targeted advertising”, under some state laws. You will be able to opt out by declining or withdrawing consent to advertising cookies through the cookie settings link on the Website.

22.3 Global Privacy Control. If your browser sends a Global Privacy Control signal, we will treat it as a request to opt out of any advertising technologies for that browser.

22.4 Sensitive information. We use health information only with your consent and only to plan and deliver your charter. We do not use it to infer characteristics about you or for advertising.

22.5 Making a request. You or an authorised agent may make a request by emailing hello@headlandyachting.com. We will verify the request before acting on it and will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line, and we will respond to the appeal in writing.

22.6 Categories of data. The categories of personal data we collect, their sources, the purposes for which we use them and the categories of recipients are described in Sections 3, 7, 8 and 16. We retain each category for the periods in Section 19.

23. Automated decisions and profiling

23.1 No automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Every recommendation and booking decision is made by a member of our team.

23.2 Advertising audiences. If we introduce advertising technologies and you consent to them, the advertising platforms may use automated means to decide whether to show you our adverts. This does not produce legal or similarly significant effects for you.

24. Complaints

24.1 Tell us first. If you are concerned about how we have handled your personal data, please contact us first so that we can try to put it right. We will acknowledge your complaint promptly and respond as soon as we can.

24.2 Information Commissioner’s Office. You have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

25. Changes to this policy

25.1 Updates. We will update this policy when our data practices change, for example if we introduce new technology or service providers. The Effective Date at the top shows when it was last revised.

25.2 Significant changes. If we make a significant change that affects how we use personal data we already hold, we will tell you by email or by a notice on the Website before the change takes effect.