Privacy Policy
This policy explains how VesselSuite handles personal data in its applications, customer correspondence and website. Sections 10 to 12 explain what applies to crew members, customer contacts and website visitors.
Who we are
VesselSuite develops shipboard applications for vessel operations, from Tallinn, Estonia. We are the controller for our customer contact, licence and correspondence data: we decide how and why it is used. Where we process operational records on an operator's behalf to provide a hosted service or requested support, we act as a processor under that operator's instructions. Records stored only in a shipboard application are not automatically sent to us.
For questions about personal data, write to support@vesselsuite.app.
The data involved
The data falls into four groups. Some is sent to us; some remains in the operator's own systems.
- Contact data. Name, company, role, email and phone, when you write to us, request a trial, or are named as a licence contact.
- Licence data. Vessel name and identifiers, licence period, and the version installed.
- Assessment and support material. Forms, itineraries, invoices, screenshots or diagnostic files you choose to send so that we can assess a task or investigate a fault. These may contain personal data.
- Operational records. Readings, events and documents entered in an application, including names and signatures where recorded. Shipboard records remain local unless the operator sends them ashore, uses a hosted service or shares a copy with us.
How we use the data
We use the information you send to answer enquiries, assess a proposed job, supply and support a licensed application, investigate reported faults, and meet our accounting and statutory obligations. Where we process operational records on an operator's behalf, we use them for the agreed service under its instructions.
We do not sell data or use customer operational records for advertising or for training third-party models.
Where data is stored
- Shipboard applications. Local records are stored on the vessel's computer and can be used offline. The operator controls copies sent ashore.
- Fleet. Where the operator uses the optional hosted office application, the records it sends to Fleet are also held in that hosted service.
- Hosting location. The hosted services (WasteBook Fleet, and WasteBook Shore, which publishes port and charging data and reads documents an officer sends for reading) run on Google Cloud in the European Union, in Belgium (europe-west1). Their databases are backed up daily, and each backup is kept for 30 days. Sign-in is the exception, below.
- Signing in. Sign-in to the hosted services uses Google's Firebase Authentication, which Google runs only from data centres in the United States. Sign-in details (your email address and account identifiers) are therefore stored and processed in the United States. Section 5 explains how that transfer is protected.
- VesselSuite business records. Contact, licence, assessment and support information we receive is held in the business systems used to provide those services.
Who can receive the data
Suppliers supporting hosting, email and accounting may receive the data needed for their services. Suppliers processing personal data on our behalf do so under written agreements and our instructions. We disclose records to an authority where the law requires it.
Document reading. When an officer chooses the shore reader for a receipt or document, the page is sent to WasteBook Shore and read by Google Cloud's Vertex AI in the same EU region. Only the page itself is sent; the on-device reader, which sends nothing, remains the default.
International transfers. Sign-in details are transferred to Google LLC in the United States, which runs Firebase Authentication. Google LLC participates in the EU-U.S. Data Privacy Framework, and the transfer relies on the European Commission's adequacy decision for that framework. No other hosted data leaves the European Union.
The operator chooses the recipients of reports it exports, such as ports, authorities or classification societies.
How long we keep it
| Data | Retention |
|---|---|
| Correspondence | Two years after the last exchange. |
| Licence and invoicing records | For the period required by applicable accounting law. |
| Assessment and support material | Handled with the related correspondence, or under the operator's instructions where we process it on its behalf. |
| Operational records held by the operator | The operator manages retention and deletion, taking account of the requirements that apply to each record. |
| Hosted operational records | Retention and deletion follow the operator's instructions and the applicable service agreement. |
| Backups of hosted data | Daily; each backup is deleted after 30 days. |
| Error reports sent from an application | Deleted automatically 90 days after they arrive. |
Your rights
Under the GDPR you can request access to your personal data, correction or erasure, restriction of or objection to its use, and a portable copy where the relevant right applies. The rights available depend on the processing and any applicable legal requirements.
Write to support@vesselsuite.app and we will respond within one month. You can also complain to the Estonian Data Protection Inspectorate or your relevant data protection authority. For records controlled by your operator, see section 10.
This site
This site sets no advertising or tracking cookies. Section 12 explains website request logs and how to contact us. The enquiry form on the front page sends us the name, company, email address, topic and message you give it, the page you sent it from and, if you attach one, a file; nothing else is collected. The enquiry and any attached file are stored in Google Cloud in the European Union (europe-west1) and emailed to us. The stored file is deleted automatically after 90 days; the enquiry, and the emailed copy, are held with the correspondence described above. It sets no cookie.
Changes
When this policy changes, the date above changes with it. Material changes are sent to licence contacts by email.
The following notices explain what applies to each group.
Seafarers and crew
Your operator determines how operational records are used. Where VesselSuite processes those records on its behalf for hosting or requested support, we follow its instructions.
What is held. Depending on the forms and workflow, records may include your name, rank, entries and signatures, together with readings, events, times and the documents prepared from them.
Why. To document vessel operations and identify the people making or approving entries, including where a statutory record requires this. VesselSuite does not use these records to build individual productivity measures.
Where it is stored. In the shipboard application, and in office systems or the optional hosted Fleet service where the operator sends it. A copy may also reach us when the operator requests support.
Retention and requests. Ask your operator about the period that applies to a particular record and about exercising your rights. Some records must be retained to meet legal requirements. You can also write to support@vesselsuite.app; where your request concerns a record controlled by the operator, we will pass it on and tell you we have.
Customer contacts
For the people named on a licence, a trial or an enquiry, we are the controller.
What is held. The contact details you provide and our correspondence with you, including material you send for an assessment or support request. Licence records identify the vessels covered and the licence period.
Why. To answer enquiries, assess requests, manage licences and keep accounts. We rely on contract where processing is needed to arrange or perform a contract with you, legitimate interests in answering business enquiries and managing customer relationships, and legal obligations for statutory accounting records.
Marketing. We do not run a mailing list or newsletter, or share contact details with third parties for their marketing. Supplier access needed to provide our services is described in section 5. Our correspondence concerns your enquiry, assessment, licence or support request.
Site visitors
Cookies. This site uses no advertising or tracking cookies, as described in section 8.
Server logs. Our host records request data, including IP address, to serve pages and prevent abuse. These logs are not used to profile visitors.
Writing to us. The addresses on this site open your own mail client. The enquiry form on the front page is submitted to us directly; what it carries is listed in section 8. To stop a spam run we count recent submissions against a one-way digest of the sending address, which is deleted an hour later. What you send becomes correspondence under section 11.