Privacy Policy | Aysén Fjord - GDPR, Cookies, Your Rights

1. Data Controller

The data controller (the "controller") within the meaning of Art. 4(7) of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") is:

Controller: Aysén Fjord SpA, Coyhaique, Región de Aysén, Chile (company in formation; until registration in the commercial register, its founder and administrator Jaroslav Sokol acts on its behalf)
Address for service in Chile: Martínez & Núñez Abogados, Arturo Prat 551, Coyhaique
Contact person: Jaroslav Sokol, administrator
Email: office@aysenfjord.com
WhatsApp: +420 722 288 191

The controller is established outside the EU; towards visitors and clients from the EU it applies the GDPR (Art. 3(2)). The AysenFjord™ brand is filed with the Czech Industrial Property Office (file no. O-609614) in the name of Jaroslav Sokol.

A Data Protection Officer (DPO) has not been appointed; under Art. 37 GDPR appointment is not mandatory (we are not a public authority, our core activities do not involve large-scale regular and systematic monitoring, nor large-scale processing of special categories of data).

2. Data we process

2.1 Form data

Enquiry form: name, email, message
Newsletter: email
Expedition application: name, email, phone, country of residence, answers about motivation and availability on 20–31 January 2027

2.2 Communication data

The content of emails, WhatsApp messages and other channels you use to contact us regarding an enquiry or the expedition.

2.3 Technical data

IP address (in the web server access log, pseudonymised in analytics)
Device type, browser, operating system, language
Referrer, visited pages, time of visit
Cookie identifiers (only with your consent - see cookies.html)

2.4 Contractual data (only after contract conclusion)

Billing and mailing address, date of birth, travel document number
Health declaration (dietary restrictions, fitness, proof of insurance)
Emergency contact
Payment details (bank transfer - account number, payment reference; we do not process card numbers or other sensitive financial data)

Health data under Art. 9 GDPR is processed only to the extent strictly necessary and only on the basis of your explicit consent, or to protect your vital interests during the expedition.

3. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

Purpose	Legal basis (Art. 6 GDPR)	Data
Answering your enquiry	Legitimate interest (f)	Name, email, message
Sending the newsletter	Consent (a)	Email
Application screening & pre-contract steps	Pre-contract measures (b)	Application data
Performing the expedition contract	Contract performance (b)	Contract & communication data
Accounting & tax archiving	Legal obligation (c)	Billing data, payments
Web analytics (GA4, Ads)	Consent (a)	Cookies, technical data
Security & server logs	Legitimate interest (f)	IP, access log
Protection of vital interests on expedition	Vital interests (d)	Health data, emergency contact

Where we rely on legitimate interest (point (f)), we have balanced our interest in running the service, answering enquiries and securing the site against your rights and freedoms and concluded it does not override them. You have the right to object to such processing (see section 8).

4. Recipients and processors

We share your data only with the following categories of recipients and processors, strictly to the extent required for the purposes above:

Web hosting provider - site hosting and operation, access logs (EU).
EmailJS, Inc. (USA) - delivering form submissions to our inbox. EU Standard Contractual Clauses (SCC) + EU-U.S. Data Privacy Framework certification.
Google LLC / Google Ireland Ltd. (USA/EU) - Google Analytics 4, Google Tag Manager, Google Ads. Only with your consent. SCC + DPF.
Meta Platforms, Inc. / WhatsApp Ireland Ltd. (USA/EU) - WhatsApp conversations if you use that channel. SCC + DPF.
Local suppliers in Chile - during the expedition (lodging, boat charter, insurance, emergency services). Only the necessary data, only after contract conclusion.
Accountants / tax advisors - statutory archiving of billing records.
Public authorities - where required by law (court, police, tax authority).

We do not sell your data nor pass it to third parties for their marketing purposes.

5. Transfers outside the EU/EEA

Some of our processors are based outside the European Union. This mainly concerns:

USA - Google LLC, Meta Platforms Inc., EmailJS Inc. Safeguard: EU-U.S. Data Privacy Framework certification + Standard Contractual Clauses (SCC) approved by the European Commission under Implementing Decision (EU) 2021/914.
Chile - local service suppliers during the expedition (only after contract conclusion, strictly to the extent necessary to perform the contract under Art. 49(1)(b) GDPR). Chile does not currently benefit from an EU adequacy decision; the transfer relies on the contract-performance derogation.

A full processor list with current contacts and safeguards is available on request at office@aysenfjord.com.

6. Retention periods

Enquiry: 12 months after last contact (then deleted).
Newsletter: until consent is withdrawn (unsubscribe link in the email or email to newsletter@aysenfjord.com).
Application (candidate not selected): 6 months after the screening process closes.
Contract data: term of contract + 4 years after termination (limitation periods under Section 629 of the Czech Civil Code).
Tax / accounting records: 10 years (Section 35 of the Czech VAT Act, Act No. 235/2004 Coll.).
Cookies: by type - see cookies.html. Consent cookie 12 months.
Server access logs: up to 90 days, then auto-deleted.
Photos / video from the expedition: per specific consent (marketing use) - typically 5 years from capture, with the right to withdraw consent.

After the retention period, data is securely deleted or anonymised so that no individual can be identified.

7. Cookies and analytics

The site uses cookies and similar technologies. Essential cookies (site function, consent storage) load without consent - the site would not work without them. Analytics and advertising cookies (Google Analytics 4, Google Ads) activate only after your explicit consent via the cookie banner.

You can change or withdraw consent at any time - delete the cookie-consent entry in your browser storage for this site or email office@aysenfjord.com.

The full text and complete cookie list is on a separate page: Cookie Policy.

8. Your rights

As a data subject, you have the following rights under the GDPR:

Right of access (Art. 15) - confirmation of whether we process your data, and a copy of that data.
Right to rectification (Art. 16) - have inaccurate data corrected or incomplete data completed.
Right to erasure - the "right to be forgotten" (Art. 17) - under the conditions set out in the GDPR.
Right to restriction of processing (Art. 18) - temporarily suspend processing.
Right to data portability (Art. 20) - receive your data in a structured, machine-readable format.
Right to object (Art. 21) - to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3)) - where processing is based on consent, at any time, without affecting processing carried out before withdrawal.
Right not to be subject to automated decision-making (Art. 22) - we do not perform such processing.
Right to lodge a complaint with the competent supervisory authority.

Exercise your rights by emailing office@aysenfjord.com. We reply within 30 days of receiving your request (in more complex cases this may be extended by a further 60 days, with notice to you). Exercising your rights is free of charge; repeated or manifestly unfounded requests may be charged or refused under Art. 12(5) GDPR.

We may request additional information to verify your identity - this protects your data from unauthorised requests.

9. Security

We have adopted appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or leakage, including:

HTTPS/TLS encryption of all communication with the site
HTTP security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy)
Access to data on a need-to-know basis, with two-factor authentication where available
Regular backups and restore tests
Data Processing Agreements (DPA) with every processor
Data minimisation - we collect only the data necessary for the given purpose

In case of a personal-data breach likely to pose a risk to your rights and freedoms, we will notify you without undue delay and report the incident to the competent supervisory authority within 72 hours (Art. 33 and 34 GDPR).

10. Children and minors

The expedition is for adults only (18+). We do not knowingly process personal data of children under 15 (the valid-consent threshold in the Czech Republic under Section 7 of Act No. 110/2019 Coll.). If you believe a child has supplied us data without guardian consent, contact us - we will delete it immediately.

11. Changes and contact

11.1 Updates - We may revise this policy from time to time. The effective version is always on this page with its effective date. Material changes will be communicated by email (if we are in contact) or a visible site notice.

11.2 Privacy contact (data controller)