CLAVE MEDIA LTD, trading as Boatox Ibiza Erofilis 3, Flat/Office 106, 8016 Paphos, Cyprus Company Registration Number: HE 489138 VAT Identification Number: CY60333134S Email: legal@boatoxibiza.com Website: boatoxibiza.com 1. Overview This privacy policy explains how CLAVE MEDIA LTD ("we", "us", "our"), trading as Boatox Ibiza, collects, uses and protects your personal data when you visit boatoxibiza.com or use our services. We process personal data in accordance with the General Data Protection Regulation (GDPR) and all applicable data protection laws. 2. Controller The data controller responsible for this website is: CLAVE MEDIA LTD Erofilis 3, Flat/Office 106 8016 Paphos, Cyprus Company Registration Number: HE 489138 Email: legal@boatoxibiza.com 3. Hosting This website is built on the OnePage.io platform and hosted on infrastructure provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access our website, server log files are automatically recorded, which may include your IP address, browser type, operating system, referrer URL and time of access. This data is processed on the basis of Art. 6(1)(f) GDPR - our legitimate interest in the stable and secure operation of our website and is not used to identify you. Data Processing Agreements pursuant to Art. 28 GDPR are in place with our hosting and platform providers. OnePage.io privacy policy: https://onepage.io/privacy IONOS privacy policy: https://www.ionos.com/terms-gtc/terms-privacy 4. Data We Collect and Why 4.1 Contact Forms and Quiz When you submit a request via our contact form or quiz flow, we collect the data you provide: your name, phone or WhatsApp number, email address, travel dates, group size, budget range and any additional information you choose to share. This data is used solely to respond to your enquiry and to propose services matching your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). Retention: see section 11. 4.2 WhatsApp Communication We communicate with customers and prospective customers via WhatsApp, using WhatsApp Business (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) and the WhatsApp Business API via ManyChat (ManyChat Inc., 535 Mission Street, San Francisco, CA 94105, USA). When you contact us via WhatsApp, your phone number, message content and any information you share are processed to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA via ManyChat are safeguarded by Standard Contractual Clauses. A Data Processing Agreement with ManyChat is in place. WhatsApp: https://www.whatsapp.com/legal/privacy-policy-eea ManyChat: https://manychat.com/privacy 4.3 Email and Newsletter If you subscribe to our newsletter or download a free resource such as our Ibiza guide, we collect your email address and optionally your name. Our email list is managed with Kit (ConvertKit LLC), 750 W Hampden Ave, Suite 110, Englewood, CO 80110, USA. We use a double opt-in procedure: you will only receive emails after confirming your subscription via a confirmation link. Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time via the unsubscribe link in any email or by contacting us at legal@boatoxibiza.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Transfers to the USA are safeguarded by Standard Contractual Clauses. Kit privacy policy: https://kit.com/privacy

4.4 Bookings and Payment Bookings are not concluded through this website. Enquiries submitted here are followed up individually, usually via WhatsApp or email. Boatox Ibiza acts as an intermediary. Where a booking is confirmed, the charter or service agreement is concluded directly between you and the operating partner, who is also responsible for collecting payment. Our current operating partner for charters in Ibiza is Nautiq Charter S.L. Payments are therefore processed by Nautiq Charter S.L., in most cases using Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Your payment details are transmitted directly to the payment provider. We do not receive, store or process your card details. Payments may appear on your bank or card statement under the name of the operating partner rather than Boatox Ibiza. For the purpose of arranging and confirming the booking, we share the personal data described in section 5 with the operating partner, who processes it as an independent controller under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR. Stripe privacy policy: https://stripe.com/privacy 5. Sharing Your Data with Service Partners Boatox Ibiza acts as an intermediary. To arrange the services you request, we share the personal data necessary for that purpose with independent third-party providers, including boat owners, licensed charter companies, captains, crew, villa operators and other experience providers. The data shared is limited to what is required to deliver the booking, typically your name, contact details, booking dates, group size and any relevant preferences or requirements you have communicated to us. These providers act as independent controllers for the data they receive and process it under their own privacy policies. Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures at your request). We do not sell your personal data. 6. Analytics and Advertising The tools in this section are only activated after you have given your consent via our cookie banner. Legal basis: Art. 6(1)(a) GDPR, together with the applicable national rules implementing Directive 2002/58/EC (ePrivacy). You can withdraw or change your consent at any time via the cookie settings on our website. 6.1 OnePage.io Analytics Our website platform provides built-in analytics measuring basic performance such as page visits and traffic sources. Privacy policy: https://onepage.io/privacy 6.2 Google Analytics Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how visitors use our website. IP addresses are shortened before any further processing and are not stored in full. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy 6.3 Google Tag Manager Provider: Google Ireland Limited. Google Tag Manager does not itself collect personal data; it manages and triggers the tags described in this section, each of which is subject to your consent. 6.4 Google Ads Conversion Tracking and Remarketing Provider: Google Ireland Limited. We use Google Ads to advertise our services. Where you have consented, cookies and similar technologies allow us to measure which advertisements lead to enquiries or bookings (conversion tracking) and to show relevant advertisements to users who have previously visited our website (remarketing). We may also use Google's enhanced conversion features, in which hashed contact data is transmitted to Google in order to match conversions more accurately. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy 6.5 Meta Pixel and Conversions API Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. These tools measure the effectiveness of our advertising on Facebook and Instagram and allow us to show relevant advertisements. The Meta Pixel operates in your browser; the Conversions API transmits event data server-side. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework. Meta's certification: https://www.dataprivacyframework.gov/participant/4452 Privacy policy: https://www.facebook.com/privacy/policy 6.6 TikTok Pixel Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. Used to measure conversions and optimise our advertising on TikTok. Transfers outside the EEA are safeguarded by Standard Contractual Clauses. Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea 6.7 Google Search Console Provider: Google Ireland Limited. This tool processes aggregated data about search queries and click behaviour and does not collect personal data directly from visitors to our website. 7. Social Media Our website contains links to, and may embed content from, our profiles on Instagram (@boatoxibiza), TikTok, Facebook and Threads. If you interact with embedded content, a connection to the relevant provider's servers may be established and your IP address transmitted. Embedded content is only loaded after you have given your consent. Legal basis: Art. 6(1)(a) GDPR. Providers: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (Instagram, Facebook, Threads); TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. Instagram: https://privacycenter.instagram.com/policy TikTok: https://www.tiktok.com/legal/privacy-policy-eea Meta: https://www.facebook.com/privacy/policy 8. Photography During Our Services Our captains and crew may occasionally take photographs during a trip for operational and documentation purposes. Legal basis: Art. 6(1)(f) GDPR. We do not publish images in which individual guests are recognisable unless the person concerned has given us their consent (Art. 6(1)(a) GDPR). You may withdraw such consent at any time by contacting us at legal@boatoxibiza.com. Withdrawal does not affect the lawfulness of use prior to withdrawal. Where guests choose to send us their own photos or videos, we use them only with their agreement and, where other people are recognisable, only if those people have also agreed. 9. Cookies Our website uses cookies and similar technologies. Cookies that are not strictly necessary for the operation of the website are only set after you have given your consent. You can review and change your preferences at any time via the cookie settings on our website, or delete cookies through your browser. Disabling certain cookies may affect the functionality of this website. 10. Your Rights Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent at any time (Art. 7(3)). To exercise any of these rights, please contact us at legal@boatoxibiza.com. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for us is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus: https://www.dataprotection.gov.cy 11. Retention We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. - Enquiries that do not result in a booking: deleted no later than 24 months after the last contact. - Booking and transaction records: retained for the period required by Cypriot accounting and tax law. - Newsletter subscriptions: retained until you unsubscribe. - Analytics data: retained according to the settings of the respective tool. 12. Transfers Outside the EEA Some tools we use involve transfers of personal data to countries outside the European Economic Area, in particular the USA. Where this occurs, transfers are safeguarded by an adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses, as specified for each tool in this policy. 13. Security This website uses SSL/TLS encryption, indicated by the "https://" prefix and the padlock symbol in your browser's address bar. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. 14. Changes to This Policy We may update this privacy policy to reflect changes in our practices or in applicable law. The current version is always available at boatoxibiza.com/privacy-policy. Last updated: August 2026