Controller and contact
For website administration, account security and direct correspondence, the proposed controller is ЧП «Делькредо» (Ukraine), [registered address and number]. Privacy contact: info@stowmate.pro. EU representative: [appoint and publish details if required, or document the applicable exception]. DPO: [name/contact if appointed or legally required; otherwise state the designated privacy contact]. This draft is not a claim that GDPR compliance has been completed.
Different product modes
Local/offline mode: records may be stored on your device or in a folder you choose. That does not by itself send those records to us. This is not an absolute no-network or no-data-collection guarantee: downloads, support submissions, optional integrations and third-party resources require their own assessment.
Hosted/server mode: accounts and authorised vessel workspaces can store crew, work/rest, cargo and document records on the configured server. The inspected local deployment has a database and uploads; it is not a zero-collection application. A production host, country, operator and subprocessor list must be confirmed before launch.
Where a shipping company determines why and how crew/workplace records are used, it will normally have controller responsibilities. If we host/process them only on that company’s instructions, the roles and an Article 28 data-processing agreement must be documented. We may be a separate controller for our own account-security and legal-administration purposes. [Confirm roles for every deployment; no joint-controller or processor status is assumed merely from a label.]
Data, purposes, legal bases and retention
| Processing | Examples and purpose | Proposed basis / retention to confirm |
|---|---|---|
| Website delivery and security | IP address, request time, browser/network information, security and access logs; deliver and protect the service | Documented legitimate interests where applicable; [log retention period and balancing assessment] |
| Accounts and access | Contact/login details, credential hashes, vessel/organisation permissions, session and audit information | Contract where the person is a contracting party; otherwise an appropriate documented basis, such as legitimate interests; [account, audit and backup retention] |
| Support correspondence | Sender details, message and voluntarily supplied attachments; answer the request | Pre-contract/contract where appropriate or documented legitimate interests; [support retention] |
| Hosted vessel and crew records | Crew identity, rank, nationality, service dates, contracts, work/rest entries, job participation, approvals and documents entered by authorised users | Shipping company/controller determines the lawful basis; processor acts on documented instructions; [record-category retention and deletion/export instructions] |
| Marketing or optional analytics | Not identified as enabled in the inspected portal; any future use requires separate information | [Do not enable until the purpose, provider, basis, storage/consent and retention are approved] |
A 15-minute login-cookie lifetime is not the retention period for the account, audit trail or operational records. Complete a category-specific retention schedule, deletion procedure and backup rotation before publication. Do not upload medical diagnoses, biometrics or other special-category data unless the controller has established the necessary additional legal condition and safeguards. Employee consent is not the default basis for workplace records.
Recipients and international access
Potential recipients are authorised organisation/vessel users, approved hosting and support providers, and authorities where disclosure is legally required. [Identify each production hosting, mail, backup, security and support provider, its role and processing/access location.] We do not promise that all data remains in the EU while those facts are unknown.
If a separate recipient outside the EEA, including in Ukraine, receives or can remotely access EEA personal data, assess Chapter V requirements and the actual transfer route. Specify [applicable adequacy decision or other lawful mechanism, appropriate contractual safeguards, transfer assessment and supplementary measures], where required. The company’s Ukrainian registration is not itself a transfer safeguard. Ask the privacy contact how to obtain information about relevant safeguards. A future move to Spain or Estonia does not automatically resolve onward access or transfers.
Your rights
Depending on the applicable conditions, you can request access, correction, erasure, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. You may complain to a competent supervisory authority, including where you habitually reside, work or consider an infringement occurred, where GDPR provides that right. We may need proportionate identity verification. Under GDPR we normally respond within one month, with any lawful extension explained. For records controlled by your employer or vessel operator, contact that controller; we will assist in the role agreed with it.
Required data, automated decisions and security
Account and authorisation information may be necessary to provide restricted access; without it some functions cannot be supplied. Optional correspondence and future marketing have separate purposes. No solely automated legally significant decision-making was identified in the inspected portal. Calculations and warning flags assist human review; [confirm actual workflows before publishing this statement]. We use appropriate safeguards for the actual risk; no absolute-security guarantee is made. [Complete the production security, incident-response and access-review assessment.]
Cookies, external resources and changes
See the Cookies & local storage notice. The inspected embedded source contains references to external font/CDN services; whether each is loaded or blocked in each release must be tested. [Remove/self-host unnecessary resources or disclose approved recipients and any required choice before public release.] Do not claim that such resources are absent until verified.
If the controller, processing purposes or recipients change, we will provide the information required for the actual change. Business succession does not authorise unrelated reuse of personal data. Effective date: [approve after completing this draft].