Privacy Policy
Version: 1.0
Last updated: 16 July 2026
Preamble
The protection of personal data is a core commitment of CKC-Net in connection with operation of the YachtFlow website and SaaS platform.
This Privacy Policy is intended to provide clear, transparent and complete information to any person using the YachtFlow website, contacting CKC-Net or using the YachtFlow platform about the processing of personal data carried out by CKC-Net when it acts as data controller.
It describes in particular the categories of data collected, the purposes pursued, the legal bases for processing, data recipients, retention periods, measures implemented to ensure their security and the rights available to data subjects.
This Privacy Policy supplements the Legal Notice, General Terms and Conditions of Sale (ToS), Terms of Use (ToU) and Data Processing Agreement (DPA) of YachtFlow.
When CKC-Net processes personal data on behalf of its Clients in connection with provision of the YachtFlow platform, it acts as processor within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (GDPR). The terms of such processing are governed exclusively by the Data Processing Agreement (DPA), which forms an integral part of YachtFlow’s contractual documentation.
This Privacy Policy relates only to processing of personal data for which CKC-Net itself determines the purposes and means of processing.
1. Data controller
The processing of personal data described in this Policy is carried out under the responsibility of:
CKC-Net
Limited liability company (SARL) with share capital of EUR 100,000
Registered office:
1208 route des Lucioles
Building 2B – Espace Beethoven
06560 Valbonne – France
Trade and Companies Register (RCS) Grasse: 452 308 950
SIRET: 452 308 950 00073
Intra-community VAT number: FR70452308950
Email: contact@yachtflow.com
CKC-Net determines the purposes and means of processing carried out in particular in connection with:
- operation of the YachtFlow website
- management of contact requests
- creation and management of Client accounts
- subscription management
- billing
- commercial relationship management
- technical support
- platform and information systems security
- compliance with applicable legal and regulatory obligations
- as well as any other processing necessary for normal operation of the services offered.
For any question relating to this Privacy Policy or exercise of rights provided for by applicable data protection regulations, any data subject may contact CKC-Net at the contact details indicated above.
When CKC-Net processes personal data on behalf of its Clients in connection with use of YachtFlow, it acts as processor. Such processing is not governed by this Privacy Policy but by the Data Processing Agreement (DPA) concluded with Clients in accordance with Article 28 of the GDPR.
2. Scope
This Privacy Policy applies to all processing of personal data carried out by CKC-Net when it acts as data controller in connection with its activities related to YachtFlow.
It relates in particular to processing carried out when:
- browsing the YachtFlow website
- using contact forms, demo requests or any other means of contact
- creating and managing Client accounts
- subscribing to, managing and renewing subscriptions
- managing the commercial relationship
- billing and accounting
- technical support and Client assistance
- handling requests addressed to CKC-Net
- sending communications relating to services offered by YachtFlow, where permitted by applicable regulations
- securing the website, platform and information systems
- managing legal, regulatory and contractual obligations incumbent on CKC-Net.
This Policy does not apply to processing of personal data carried out by Clients through the YachtFlow platform in connection with their own professional activities.
In this context, the Client acts as data controller within the meaning of Regulation (EU) 2016/679 (GDPR), while CKC-Net acts exclusively as processor. The terms applicable to such processing are defined in the Data Processing Agreement (DPA), which forms an integral part of YachtFlow’s contractual documentation.
This Policy also does not apply to processing carried out by third-party services, applications or platforms accessible through links, integrations or features offered by YachtFlow. Such processing remains subject to the privacy policies of their respective publishers.
3. Personal data collected
In connection with its activities, CKC-Net may collect and process different categories of personal data, depending on the nature of the services used, exchanges with data subjects or legal obligations incumbent upon it.
The categories of data that may be collected include in particular:
3.1 Identification data
- first and last name
- title
- photograph or avatar, where such information is voluntarily provided
- preferred language
- company, organisation or corporate name
- position or role held.
3.2 Contact details
- email address
- telephone number
- postal address
- country
- any other contact information voluntarily provided.
3.3 Client account data
Where a person uses YachtFlow as a Client or authorised User, CKC-Net may process in particular:
- user identifier
- account information
- account settings
- connection history
- usage preferences
- security settings
- information relating to licences or subscriptions taken out.
3.4 Commercial relationship data
CKC-Net may also process data necessary for:
- managing demo requests
- managing contact requests
- preparing quotes
- contract management
- subscription management
- billing
- payments
- exchanges with Clients
- support request follow-up.
3.5 Technical data
When using the website or YachtFlow platform, certain technical data may be collected, in particular:
- IP address
- connection identifiers
- technical logs
- date and time of connections
- browser information
- operating system
- type of device used
- technical identifiers necessary for operation of the Service
- information relating to access security.
3.6 Browsing data
When browsing the YachtFlow website, browsing data may be collected through cookies or similar technologies, in particular in order to:
- ensure operation of the website
- guarantee its security
- measure its audience
- improve user experience
- remember certain browsing choices
- enable, where the user consents, certain third-party features or services.
The terms for managing these technologies are set out in this Policy as well as in the consent manager made available on the website.
3.7 Voluntarily provided data
CKC-Net also processes information that data subjects choose freely to provide, in particular in connection with:
- a contact form
- a demo request
- a job application
- an exchange with support
- an email
- an information request
- or any other communication addressed to CKC-Net.
CKC-Net ensures that it collects only data strictly necessary for the purposes pursued and invites data subjects to provide only information relevant to their request.
3.8 Origin of data
Personal data processed by CKC-Net may be collected:
- directly from the data subject, in particular when creating an account, making a contact or demo request or exchanging with support
- from the Client or an authorised Administrator, in particular when they create or administer their Users’ accounts
- automatically when using the website or YachtFlow, in particular through technical logs, cookies or similar technologies
- from payment providers, technical services or partners with whom the data subject or Client interacts, where such transmission is necessary for provision of the Service
- from publicly accessible professional sources, where permitted by applicable regulations, in particular in connection with B2B commercial prospecting.
3.9 Mandatory nature of data
Information identified as mandatory in forms or in the subscription process is necessary to process the request, create the account or provide the Service.
Failure to provide such information may prevent CKC-Net from processing the request, concluding or performing the contract, creating the account concerned or providing certain YachtFlow features.
Other information is optional. Its absence does not, in principle, prevent use of the essential features of the Service, unless it is necessary for a particular feature expressly requested by the Client or User.
4. Purposes of processing and legal bases
CKC-Net processes personal data only where necessary for one of the purposes described below and on the basis of a legal ground provided for by Regulation (EU) 2016/679 (GDPR).
The main processing activities carried out are as follows:
| Purpose of processing | Legal basis |
|---|---|
| Management of contact and demo requests | Pre-contractual measures taken at the request of the data subject or legitimate interest of CKC-Net in responding to professional requests, depending on the status of the applicant |
| Creation and administration of Client and User accounts | Performance of the contract concluded with the Client and legitimate interest of CKC-Net in providing, administering and securing the Service |
| Provision of YachtFlow services and subscription management | Performance of the contract |
| Billing, accounting and debt recovery | Performance of the contract and compliance with legal obligations |
| Technical assistance and support | Performance of the contract or legitimate interest of CKC-Net in responding to User requests, depending on the nature of the request |
| Commercial relationship management | Performance of the contract and legitimate interest of CKC-Net |
| Commercial prospecting towards professionals | Legitimate interest of CKC-Net, subject to the right to object and compliance with rules applicable to electronic prospecting |
| Sending commercial communications subject to consent | Consent |
| Management of job applications | Pre-contractual measures taken at the request of the applicant and legitimate interest of CKC-Net in managing its recruitment |
| Sending information necessary for operation, security or administration of the Service | Performance of the contract and legitimate interest of CKC-Net |
| Securing the website, platform and information systems | Legitimate interest of CKC-Net |
| Fraud prevention, incident detection, logging and monitoring | Legitimate interest of CKC-Net |
| Management of requests to exercise rights | Compliance with a legal obligation |
| Compliance with accounting, tax and regulatory obligations | Compliance with a legal obligation |
| Management of cookies and trackers subject to consent | Consent |
CKC-Net undertakes to process personal data only for specified, explicit and legitimate purposes, in accordance with the purpose limitation principle provided for by the GDPR.
Collected data is never used for purposes incompatible with those that justified its collection.
CKC-Net does not sell, rent or commercialise personal data it processes as data controller.
Furthermore, personal data processed by CKC-Net on behalf of the Client is not used to train artificial intelligence models or machine learning systems, except with the Client’s prior written agreement or unless otherwise required by law, in accordance with the DPA.
CKC-Net does not, on the basis of the processing described in this Policy, make any decision based solely on automated processing producing legal effects concerning a person or similarly significantly affecting them.
Any artificial intelligence, analysis, automation or recommendation features offered in YachtFlow serve an assistance function. They do not replace intervention and judgement by Users.
If CKC-Net were subsequently to implement automated decision-making meeting the criteria of Article 22 of the GDPR, data subjects would be informed in advance in accordance with applicable regulations.
5. Recipients of personal data
Personal data processed by CKC-Net is intended for persons authorised to access it in connection with their duties and only to the extent necessary to achieve the purposes described in this Policy.
Data may in particular be accessible to:
- CKC-Net employees involved in commercial, administrative, technical, accounting management or Client support
- technical providers acting on behalf of CKC-Net, in particular for hosting, maintenance, security, monitoring, email, payment processing or any other service necessary for operation of YachtFlow
- CKC-Net’s advisers, statutory auditors, accountants or auditors, where such communication is necessary for performance of their duties
- administrative, judicial or regulatory authorities where such communication is required by law or regulation or is necessary to defend CKC-Net’s rights.
CKC-Net ensures that persons and organisations with access to personal data are subject to appropriate confidentiality and security obligations.
Where providers act as processors within the meaning of the GDPR, CKC-Net enters into the necessary agreements with them to guarantee a level of protection compliant with applicable regulatory requirements.
Personal data is neither sold, rented nor assigned to third parties for commercial purposes.
The list of main categories of subcontractors used by CKC-Net and information relating to their location may be provided on request or made available in YachtFlow documentation where relevant.
6. Data retention periods
CKC-Net retains personal data for no longer than necessary to achieve the purposes for which it was collected, subject to legal or regulatory obligations imposing a longer retention period.
The main retention periods are as follows:
| Data category | Retention period |
|---|---|
| Contact and demo requests | Three (3) years from the last contact from the data subject |
| Data relating to Clients and subscriptions | For the entire duration of the contractual relationship, then for applicable statutory periods |
| Billing data and accounting records | Ten (10) years in accordance with accounting and tax obligations |
| Data necessary for management of legal obligations | For the period provided for by applicable regulations |
| Technical logs and security data | For a period suited to security and traceability needs, in accordance with legal obligations and applicable best practices |
| Data relating to GDPR rights requests | For the period necessary to process the request, then archived in accordance with applicable legal obligations |
| Cookies and similar technologies | According to the periods specified in the consent manager and in accordance with CNIL recommendations |
| Data relating to prospects and commercial prospecting | Three (3) years from collection or last contact from the prospect; for Clients, during the commercial relationship then three (3) years from its end or last contact |
| Data relating to unsuccessful job applications | For the period necessary for recruitment, then, where retention in a talent pool is justified and the applicant has been informed, for a period generally not exceeding two (2) years from last contact |
When data is no longer necessary for the purposes pursued, it is deleted, anonymised or archived where retention remains necessary to comply with a legal obligation, establish, exercise or defend a legal claim, or meet a regulatory obligation.
Data processed by CKC-Net as processor on behalf of its Clients is retained in accordance with the terms set out in the General Terms and Conditions of Sale and the Data Processing Agreement (DPA), in particular regarding the data lifecycle, export, temporary retention and permanent deletion.
8. Transfers of data outside the European Economic Area
Where possible, personal data processed by CKC-Net is hosted and processed within the European Economic Area (EEA).
However, certain technical services, providers or subcontractors used by CKC-Net may process certain data outside the European Economic Area where this is necessary for operation of the website, YachtFlow platform or associated services.
In such cases, CKC-Net ensures that these transfers rely on a mechanism guaranteeing an appropriate level of protection in accordance with Regulation (EU) 2016/679 (GDPR), in particular:
- an adequacy decision adopted by the European Commission
- Standard Contractual Clauses (SCC) approved by the European Commission
- Binding Corporate Rules (BCR), where applicable
- or any other transfer mechanism authorised by regulations in force.
Where necessary, CKC-Net also implements additional technical, contractual or organisational measures intended to ensure a level of data protection essentially equivalent to that guaranteed within the European Union.
Use by the Client or User of certain third-party services, applications or integrations offered within YachtFlow may also result in international data transfers. In such cases, these transfers are the responsibility of the publisher of the service concerned and, where applicable, of the Client who chooses to activate these features.
Information relating to the main subcontractors and providers likely to be involved in data processing may be provided on request or made available in YachtFlow documentation where relevant.
9. Security of personal data
CKC-Net implements appropriate technical and organisational measures to ensure a level of security suited to the risks presented by the personal data processing it carries out.
These measures are intended in particular to guarantee confidentiality, integrity, availability and resilience of information systems and to prevent any unauthorised access, disclosure, alteration, loss or accidental or unlawful destruction of data.
Depending on the nature of the processing concerned, CKC-Net implements in particular:
- encryption of communications using secure protocols (HTTPS/TLS)
- authentication and access control mechanisms
- authorisation management based on user roles
- logical data segregation measures
- regular backups intended to ensure continuity of the Service
- monitoring, logging and security incident detection devices
- a policy for updating software components and correcting vulnerabilities
- internal procedures for managing security incidents and business continuity
- confidentiality commitments applicable to authorised employees and providers.
These measures are regularly improved to take account of technological developments, cybersecurity risks, industry best practices and regulatory requirements.
Despite all measures implemented, no computer system connected to the Internet can guarantee absolute security. CKC-Net therefore undertakes to maintain a level of security in line with the state of the art and to take any reasonably appropriate measure to protect personal data for which it is responsible.
Where a personal data breach is likely to result in a risk to the rights and freedoms of data subjects, CKC-Net implements the procedures provided for by applicable regulations and, where required, makes the necessary notifications to competent authorities and, where applicable, data subjects.
10. Rights of data subjects
In accordance with Regulation (EU) 2016/679 (GDPR) and applicable French regulations, any data subject has rights over their personal data.
Subject to the conditions and limits provided for by applicable regulations, they may in particular exercise the following rights:
- right of access, to obtain confirmation as to whether or not data concerning them is being processed and a copy of such data
- right to rectification, to request correction of inaccurate or incomplete data
- right to erasure (“right to be forgotten”), where the conditions provided for by regulations are met
- right to restriction of processing, in the cases provided for by the GDPR
- right to object, where processing is based on CKC-Net’s legitimate interest or is carried out for prospecting purposes
- right to data portability, for processing based on consent or performance of a contract and carried out by automated means
- right to withdraw consent, where processing is based on consent, without such withdrawal affecting the lawfulness of processing carried out previously
- right to define directives relating to the fate of their data after death, in accordance with French legislation.
Exercise of these rights is free of charge. In the case of manifestly unfounded or excessive requests, in particular due to their repetitive nature, CKC-Net may however request payment of a reasonable fee or refuse to comply with the request under the conditions provided for by the GDPR.
These rights may be exercised at any time by sending a request to CKC-Net:
By email: contact@yachtflow.com
In order to preserve confidentiality of personal data, CKC-Net may request any information or proof reasonably necessary to verify the identity of the applicant before responding to their request.
CKC-Net undertakes to respond to requests to exercise rights within the time limits provided for by applicable regulations and, in principle, within a maximum period of one (1) month from receipt of the request. This period may be extended where the complexity or number of requests so requires, in accordance with the GDPR.
If a person considers, after contacting CKC-Net, that their rights are not being respected, they may lodge a complaint with the competent supervisory authority.
In France, this authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).
11. Amendments to this Privacy Policy
CKC-Net reserves the right to amend this Privacy Policy at any time in order to take account in particular of:
- developments in the YachtFlow platform
- addition or removal of features
- changes in applicable regulations
- recommendations from competent authorities, in particular the CNIL
- or any technical, organisational or commercial development affecting processing carried out.
The version in force is that published on the YachtFlow website. It includes a version number and its last update date.
Amendments take effect upon publication, unless a legal provision requires prior notice or collection of data subjects’ consent.
Where changes to this Privacy Policy are likely to have a significant impact on processing carried out or on data subjects’ rights, CKC-Net may inform users by any appropriate means, in particular by email, notification within the platform or information published on the website.
Users are invited to regularly consult the latest version of this Privacy Policy to be aware of any updates.
12. Contact
For any question relating to this Privacy Policy or how CKC-Net processes personal data, you may contact us:
CKC-Net
1208 route des Lucioles
Building 2B – Espace Beethoven
06560 Valbonne – France
Email: contact@yachtflow.com
Requests relating to exercise of data subjects’ rights are processed as soon as possible and, in any event, within the time limits provided for by applicable regulations.
Where CKC-Net acts as processor on behalf of a Client using the YachtFlow platform, data subjects are invited, in the first instance, to exercise their rights directly with that Client, as controller of the data concerned.