Privacy Policy ex L. 12/21/2018, n. 171


Dear Customers, Suppliers, Job Applicants and Web Site Users.


  1. Who is the Controller 

The Controller of your Personal Data is Karma Yachting S.r.l. (C.O.E. SM29949), located in Dogana (RSM), Via A. Giangi n. 31, T. 347 9109201, e-mail, (hereinafter referred to “Karma Yachting” or “Controller”).


  1. What are a Personal Data and a processing of Personal Data

Personal Data refers to any information by means of which it is possible to identify, or to render identifiable with reasonable ease, a physical person. The category of Personal Data includes, for instances, name, surname, date and place of birth, fiscal code, address and bank account.

The processing of data includes all the operations regarding Personal Data (ex art. 1, letter b), L. n. 171/2018): collection, registration, organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of Data.


  1. What Data Karma Yachting processes

Karma Yachting processes Personal Data of its clients and suppliers who are NOT legal entities and might process Personal Data of legal entities’ employees, such as for instance the business e-mail addresses which include the employee’s name and surname.


Furthermore, Karma Yachting processes common and particular Personal Data of its employees and collaborators to whom it is submitted an independent privacy policy duly held by the Owner.


  1. How your Personal Data are processed

Your Personal Data shall be processed by Karma Yachting according to the principles stated at Art. 5 of the New Regulation, i.e.: lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

Karma Yachting processes Data in both printed and electronic form. In such context, the Controller will guarantee the logistic and physical security of the Data and, in general, the confidentiality of the Data processed, by taking all necessary technical and organisational measures, so as to reduce the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

Karma Yachting does NOT carry out profiling activities with your Data. Your Data will NOT be disclosed without previous and explicit consent.


  1. Why do we process your Personal Data

The Controller collects and processes Personal Data, without a specific consent, for the following purposes:

a) To complete necessary pre-contractual activities (e.g. sending of quotations, pre-contractual agreement) (lawfulness of processing: execution of pre-contractual activities);

b) To carry out contractual and taxation obligations towards yourself (lawfulness of processing: performance of contractual obligation);

c) To protect our assets and/or defend our rights on the basis of our legitimate interests (lawfulness of processing: defense of rights / legitimate interest);

d) To fulfill legal obligations and Authorities’ requests and to respect legislation in matter of fraud prevention, money laundry etc. (lawfulness of processing: legal obligation);

e) To evaluate the curricula of candidates and manage the selection process, if provided at their own free choice (lawfulness of processing: execution of pre-contractual activities);

f) To send e-mail regarding the users requests on the web site (lawfulness of processing: execution of pre-contractual activities).


  1. Obligation to provide Personal Data

The provision of Personal Data for the purposes set out in previous clause letters a), b), e), f) is NOT obligatory. Should it NOT be provided then contract execution cannot be guaranteed.

The provision of Personal Data for the purposes set out in previous clause letters c), d) is instead obligatory.


  1. Who is Personal Data communicated to 

Without having to obtain express consent, The Controller may communicate Personal Data, for the above referred purposes, to judicial authorities, insurance companies (for the provision of insurance-related services), as well as to parties to which such communication is required by law for the fulfillment of the afore-mentioned purposes.

Said parties will process the Data as autonomous controllers.


  1. Right to withdraw consent

If consent has been given for a specific processing of Personal Data, this may be freely revoked at any time by the interested party, by sending an e-mail or a registered letter with acknowledgment of receipt to the address of the Data Controller.


The withdrawal of consent will NOT affect in any way the existing contractual relationships.


  1. Who can access Personal Data

Personal Data may be made accessible for the above- mentioned purposes:

  • To employees and collaborators of the Controller, in their role as persons responsible for processing and/or internal processors and/or system administrators;
  • To third parties or other parties (such as, for example, credit institutes, professional offices, consultants, insurance companies for the provision of insurance services, etc.) that carry out activities which have been outsourced by Karma Yachting, in their role as external processors.


  1. Where are Personal Data stored and where are they transferred to

The Personal Data are processed at the operative premises of the Controller, in Dogana (RSM), Via A. Giangi n. 31, as well as in any other place where the parties involved in the processing are located, according to the preceding paragraphs.

Personal Data are held in electronic form on servers located within the Republic of San Marino or within the European Union.

The Office guarantees that the transfer of Data abroad will take place in accordance with applicable legal provisions following on from the stipulation of standard contractual clauses according to the Data security.


  1. How long we hold Personal Data 

Your Data will be held in accordance with the principles of proportionality and necessity, and until the purposes for which it was collected have been fulfilled.

In any case, the storing time differs according to the purpose of the processing, as described in the table below.

  • Sending of quotations and e-mail storage: 5 years;
  • Supply of services, purchase of products and services: during the execution of the contract;
  • Supply of services, purchase of products and services (from the conclusion of the business relationship): 11 years after the business relationship conclusion;
  • Assets protection and defense of rights: 11 years after the business relationship conclusion;
  • Sending of information to public authorities: 11 years after the business relationship conclusion;
  • Candidates profiles evaluation: 6 months from their receipt.

Once the above terms have been expired, your Data will be cancelled.


  1. What are Data Subjects right

Each Data Subject has the right to:

a) Know if the Controller holds and/or processes his Personal Data, obtaining information relative to: the origin, category, purposes and method of processing, the recipients to whom such Data can be communicated, the logic applied in the case of processing carried out by electronic means, the period for which Data are held; as well as the right to access the same in its entirety and obtain a copy (art. 15 Right of access);

b) Have rectified his Data and to complete Data which are incomplete (Art. 16 Right to rectification);

c) Obtain the cancellation of Data in possession of the Controller where such cancellation is provided for by the New Law (art. 17 Right to erasure – Right “to be forgotten”);

d)Request the Controller to limit the processing to only certain Data, where this is provided for by the New Law (Art. 18 Right to restrict processing);

e) Be informed as to who the recipients to whom any rectifications, cancellations or processing restrictions have been communicated are (art. 19 Obligation of notification);

f) Request and receive all his Data, in a format that is structured, commonly used and readable on an automatic device or to request its transmission to another controller without impediment (Art. 20 Right to portability);

g) Oppose entirely or in part, the processing of Data for the purposes of marketing (sending of advertising material, direct sales, market research and commercial communications) and for the purposes of profiling connected to such marketing (art. 21 Right of opposition).

Finally, each Data Subject has the right to present a claim/petition directly to the Personal Data Protection Authority, located at 47890 – San Marino, Contrada Omerelli n. 43.


  1. How can each Data Subject exercise his rights

The exercise of the rights described in the previous paragraph is totally free. At any time, you may exercise your rights by sending:

  • A registered letter with return receipt addressed to Karma Yachting S.r.l., located in Dogana (RSM), Via A. Giangi n. 31;
  • An e-mail to