Privacy policy
This page says what happens to the information you give us, and to the little that a visit leaves behind. It is short because the site collects little.
Who is responsible
Water Mate Boats OÜ, registry code 14399000, Lumemarja tee 51, Haabneeme alevik, Viimsi vald, Harju maakond 74001, Estonia, is the data controller. Questions and requests about your data go to [email protected].
What we collect, and why
There are four situations.
When you request a quote
The form asks for your name and email address. Company, country, phone number, model of interest, hull material, passenger numbers and timeline are optional. Your message is whatever you choose to write. We use all of it to prepare and discuss a quotation with you. The legal basis is that you asked us to, which the GDPR calls taking steps at your request before entering into a contract, Article 6(1)(b). Afterwards we keep a record of the enquiry on the basis of our legitimate interest in knowing who we have quoted and what we said, Article 6(1)(f).
The form carries an anti-bot check by Cloudflare Turnstile. What that reads is described under when you just visit below.
When you email, call or message us on WhatsApp
We keep what you send and our replies, for the same purposes and on the same basis as above. WhatsApp is run by WhatsApp Ireland Limited under its own privacy policy, which applies from the moment you open the chat.
When we write to you first
We sometimes contact boat operators and organisations that run boat trips, to offer our boats. We use only the business contact details your organisation publishes, usually the email address on its own website, and we note where we found it. Our basis is our legitimate interest in offering our boats to the businesses that use them. We send at most three messages. You can object at any time: reply that you do not want to hear from us, and we stop and keep your address on a do-not-contact list so that it stays that way. Otherwise we delete your details within 24 months of our last contact. Our email is sent through Resend, from its servers in Ireland.
When you just visit
Our host, Cloudflare, records the technical data every web server records: your IP address, the page requested, the time, and the browser and device type. Cloudflare uses it to serve the site and to protect it against attacks. We use it for nothing else. On the quote page, Cloudflare Turnstile reads similar signals from your browser to decide whether a person or a program is filling in the form. It does not read what you type. The legal basis for both is our legitimate interest in running a secure site, Article 6(1)(f). Cloudflare describes Turnstile in its Turnstile privacy policy.
We count visits with Cloudflare Web Analytics. It records which page was opened, the site you came from, your browser and device type, your country and how quickly the page loaded, and it shows us these as totals. It sets no cookie and stores nothing on your device. Cloudflare states that it does not fingerprint visitors either, so it cannot tell whether you have been here before. The legal basis is our legitimate interest in knowing which pages are read, Article 6(1)(f).
The films on the model pages come from YouTube and load nothing until you press play. From that moment Google Ireland Limited processes your data under Google's privacy policy.
We do not use advertising trackers, and we do not add you to a mailing list. If either changes, this page changes first, and anything that needs your consent will ask for it before it loads.
Where your data goes
Two companies process it on our behalf. Cloudflare, Inc. hosts the site, counts visits, runs the anti-bot check and delivers email to our domain. Resend, the trading name of Plus Five Five, Inc., carries your quote request from the website to our mailbox, and sends the emails we write to businesses first. Neither may use your data for its own purposes. From there your enquiry sits in our company mailbox, with our email provider, like any other email we receive.
We do not sell personal data, and we do not pass it to anyone else unless the law requires it.
Cloudflare and Resend are United States companies. Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to both are covered by the European Commission's standard contractual clauses in their data processing agreements.
How long we keep it
For as long as we are discussing your enquiry with you. If it does not lead to an order, we delete it within 24 months of the last contact between us. If it does, the correspondence becomes part of the contract file, and Estonian accounting law requires us to keep that for seven years after the end of the financial year. Cloudflare keeps server logs for a short time for security purposes under its own retention rules.
Your rights
You can ask us what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it in a particular way, or ask for a copy in a form you can take elsewhere. You can also object to any processing we base on our legitimate interests. Email [email protected] and we answer within one month.
If you think we have handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, aki.ee, or to the data protection authority in your own country.
Cookies
The site sets no cookies of its own. Everything that can end up in your browser, and why, is listed on the cookie policy page.
Changes
Last updated 13 Oct 2026. When we change what the site does with data, we change this page and the date on it.