European Rail Atelier
Governance & Data Stewardship

Privacy Policy

Last updated and effective as of January 1, 2026.

1. Introduction and Data Controller

European Rail Atelier B.V. ("we", "us", or "our"), operating the domain matemintpckbcn.yachts, values your personal discretion as deeply as we value refined travel. This Privacy Policy details how we collect, process, retain, and safeguard personal data acquired through your interaction with our website, editorial guides, and inquiry forms.

The designated Data Controller is European Rail Atelier B.V., registered under Chamber of Commerce number NL864291048B01, with registered offices at Keizersgracht 482, 1016 GD Amsterdam, Netherlands. For all data protection inquiries, you may directly reach our Data Protection Officer at [email protected].

2. Personal Information Collected

We restrict our data intake strictly to what is necessary to respond to your bespoke travel inquiries:

  • Inquiry & Communication Data: When you submit an inquiry through our contact interface, we collect your full name, email address, chosen journey category, message details, and any travel dates or specifications you voluntarily disclose.
  • Technical and Device Data: Our web server logs record anonymized IP addresses, browser types, operating systems, referring URLs, and timestamps to ensure infrastructure stability, prevent distributed denial-of-service abuse, and maintain site performance.
  • Cookie and Local Storage Preferences: We record your explicit cookie selection state in client-side storage to honor your preferences without prompting you repeatedly.

3. Lawful Basis for Processing (GDPR Article 6)

Under the General Data Protection Regulation (EU) 2016/679, we process personal data under the following legal bases:

  • Consent (Art. 6(1)(a)): Where you explicitly submit your details via our contact form requesting itinerary advisory or editorial assistance.
  • Legitimate Interests (Art. 6(1)(f)): Maintaining the operational security, error diagnostics, and anti-fraud verification of the matemintpckbcn.yachts platform.
  • Legal Obligation (Art. 6(1)(c)): Retaining transaction and correspondence records where mandated under Dutch corporate and fiscal reporting requirements.

4. Third-Party Processors and Hosting

We do not sell, rent, lease, or commercially trade your personal information. Data transmission is strictly confined to vetted infrastructure providers acting as Data Processors:

  • EU-based web hosting infrastructure that complies with ISO/IEC 27001 security standards.
  • Encrypted mail routing gateways for dispatching customer inquiries directly to our concierge team.

5. Data Retention Schedules

We maintain personal data only as long as necessary to fulfill the purpose for which it was assembled:

  • General Inquiries: Retained for twenty-four (24) months after the last active correspondence, after which records are permanently expunged or irreversibly anonymized.
  • Server Diagnostic Logs: Rotated and overwritten on a continuous thirty (30) day rolling schedule.
  • Legal & Tax Correspondence: Kept for up to seven (7) years where required by applicable Dutch commercial statutes.

6. Your Statutory Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you enjoy enforceable rights regarding your personal information:

  • Right of Access: You may request a verified copy of any personal data we hold about you.
  • Right to Rectification: You may correct inaccurate or incomplete personal records.
  • Right to Erasure ("Right to be Forgotten"): You may demand the deletion of your records where there is no overriding legal ground for retention.
  • Right to Restriction and Objection: You may oppose our processing based on legitimate interests.
  • Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
  • Non-Discrimination: We will never deny services, charge different rates, or degrade quality if you exercise your privacy rights under California or European statutes.

To exercise any right, submit your written request to [email protected]. We verify identity and respond within thirty (30) calendar days without fee.

7. International Transfers & Safeguards

Our core server infrastructure is situated within the European Economic Area (EEA). In the event that maintenance routing temporarily crosses borders, transfers are governed strictly by European Commission Standard Contractual Clauses (SCCs) ensuring an equivalent level of privacy protection.

8. Updates to this Policy

We reserve the right to revise this policy to mirror changes in legal frameworks or rail advisory offerings. Any amendments will be published on this page with an updated revision date.