Legal information
This notice explains how LEADER INTERNATIONAL TRADE LTD processes personal data when you use the Aegean Horizon website, submit an initial assessment request, contact us by email or WhatsApp, or choose optional Google Analytics.
Last updated:
Data controller
ЛИДЕР ИНТЕРНЕШЪНЪЛ ТРЕЙД ООД
The controller for personal data processed through this website is the Bulgarian company identified below, operating the Aegean Horizon service. Privacy enquiries and requests to exercise data-protection rights may be sent to the listed privacy contact.
When you request an initial assessment or contact us by email or WhatsApp, we may receive your name, email address, optional phone or WhatsApp number, customer and company type, preferred communication language, yacht type, make, model, length, year, flag, insurance and operational status, known defects or limitations, route, timing, participation and crew preferences, additional requirements, and message content. Please do not provide information that is not needed for your enquiry.
The web server and security systems may process technical request information such as IP address, date and time, requested page, referring page, browser or user-agent details, response status and security events. Initial assessment submissions use Cloudflare Turnstile to evaluate browser, device and network signals for abuse prevention. The application stores only a keyed digest, not the raw IP address, in its durable submission-rate records. Administrator authentication uses strictly necessary session and CSRF-protection cookies. A necessary preference cookie records only the consent version, analytics choice and timestamp. Google Analytics is not loaded and sends no request until analytics consent is granted. After consent, Google may receive the page path without query parameters, browser and device information, language, approximate location derived from IP address and the limited events listed in the Cookie Policy. Google states that individual IP addresses from EU users are discarded before being logged.
Initial assessment and other enquiry information is used to review a requested yacht-delivery service, respond to you and take steps at your request before a possible contract, relying on Article 6(1)(b) GDPR where applicable. Website operation, security, Turnstile verification, rate limiting, abuse prevention and proportionate business correspondence may rely on legitimate interests under Article 6(1)(f) GDPR after considering individual rights. Information may also be processed where necessary to comply with a legal obligation under Article 6(1)(c) GDPR. Optional Google Analytics is used only with consent under Article 6(1)(a) GDPR and the applicable rules for storing or accessing information on a device. The form acknowledgement confirms that the Privacy Notice was made available; it is not consent to processing. Analytics consent can be refused or withdrawn without affecting access to the service.
Personal data may be available only where necessary to website and database hosting providers, Cloudflare as the Turnstile anti-abuse provider, authenticated email delivery and mailbox providers, technical support providers, professional advisers, public authorities where legally required, and service personnel needed to assess or perform a requested delivery. If analytics consent is granted, Google Ireland Limited provides Google Analytics and may use affiliated companies and subprocessors. Each recipient receives only the information needed for its role. Enquiry and queued email content is encrypted in the application database; authorised administrators and the email process decrypt it only when required. Analytics events are designed not to include enquiry form values, contact details, routes, free text, enquiry references or administrator information.
Google Privacy Policy · How Google uses information from partner sites
Cloudflare, Google, email, communications or infrastructure providers may process information outside the European Economic Area. Where GDPR transfer restrictions apply, an applicable transfer mechanism and appropriate safeguards are required. Google describes mechanisms including adequacy decisions and standard contractual clauses for relevant transfers; the mechanism applicable to the final production configuration must be confirmed during legal review. Turnstile verification sends technical anti-abuse information to Cloudflare. If you choose to contact us through WhatsApp, that service processes information under its own privacy terms. Email and the initial assessment form remain available as alternatives.
Initial assessment requests that do not become customer relationships, together with their queued email records, are assigned a twelve-month expiry when received and are deleted after expiry through the controlled retention process, unless earlier deletion is appropriate. Keyed anti-abuse rate records are retained for no longer than thirty days. The analytics preference cookie and configured Google Analytics cookies last for no more than six months. The production GA4 property must use the two-month event and user-data retention setting. Google notes that this setting does not control standard aggregated reports, which may remain available for longer. Information may be retained longer only where necessary for a contract, to establish or defend legal claims, or to meet an applicable legal obligation.
Subject to the conditions in applicable law, you may request access to your personal data, correction, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing. We may need proportionate information to verify your identity before responding.
Contact the controller first if you have a privacy question or wish to exercise a right. You also have the right to complain to Bulgaria’s Commission for Personal Data Protection at 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, or by email at kzld@cpdp.bg. Complaint submission requirements should be checked on the Commission’s official website.
The current website does not use personal data for automated decision-making or profiling. Service enquiries are reviewed by people.
The Cookie Policy explains strictly necessary cookies, optional Google Analytics, the limited events used, cookie durations and how to accept, reject or withdraw analytics consent. Advertising storage, advertising user data and advertising personalisation remain denied, and no advertising or remarketing technology is used.