Privacy Policy

1. Introduction

This Privacy Policy describes how SupaSailing SL, operating under the commercial brand SupaMaritime ("we", "us", or "our"), collects, uses, and protects your personal information when you use the SupaMaritime commercial maritime management platform and website (https://supamaritime.com). We are committed to ensuring the highest level of data protection in accordance with:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
• Ley Orgánica 3/2018 — de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD)
• Ley 34/2002 (LSSI-CE) — regarding electronic communications and cookies

2. Information We Collect

2.1 Account & Identity Data

When you create an account, we collect:

• Name (first and last name), job title, role
• Email address and telephone number
• Password (encrypted, never stored in plain text)
• Organization details (company name, type, size, fleet composition)
• Country of operation and billing address

2.2 Vessel & Operational Data

To provide our commercial maritime management services, we collect and store:

• Vessel information (name, IMO number, flag state, specifications, class)
• Voyage planning and scheduling data
• Cargo manifests and port call records
• Maintenance records, dry-dock schedules, and deficiency logs
• Safety documentation (ISM Code records, ISPS security plans)
• Port operations data (berth allocation, terminal schedules, gate management)
• Compliance and certification documents
• Files, documents, and images uploaded to the platform

2.3 Workforce & Crew Data

When crew managers and operators use workforce management features, we collect:

• Crew member names, ranks, and contact details
• STCW certificates and qualification records
• MLC 2006 compliance documentation (seafarer employment agreements, working hours)
• Working hours, timesheets, and watch schedules
• Leave records and rotation planning

2.4 Usage & Technical Data

We automatically collect:

• IP address (anonymized for analytics)
• Browser type, device information, and operating system
• Access times, pages viewed, and features used (aggregated only)

3. Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following legal grounds:

4. Data Sharing & Sub-processors

We share your information with trusted third-party service providers who assist us in operating the platform. All sub-processors are contractually obligated to protect your data under GDPR-compliant Data Processing Agreements:

SCCs = Standard Contractual Clauses approved by the European Commission (Decision 2021/914) for international data transfers.

We will never sell, rent, or share your personal information with third parties for their marketing purposes.

5. Data Security

We implement robust technical and organizational measures to protect your data:

• Encryption in transit: All data transmitted using TLS/SSL protocols
• Encryption at rest: AES-256 encryption for all stored data
• Infrastructure: Hosted on AWS EU (Frankfurt) with SOC 2, ISO 27001 certifications
• Access controls: Role-based access, multi-factor authentication for admin access
• Data isolation: Each account's data is completely isolated from other accounts
• Monitoring: Regular security audits, penetration testing, and vulnerability assessments
• Passwords: Hashed using state-of-the-art cryptographic algorithms

6. Data Retention

We retain personal data for specific periods depending on the type and our legal obligations:

You can delete your account at any time from your account settings or by contacting us at legal@supasailing.com. Upon deletion, all data will be permanently removed from active databases within 30 days, except where retention is required by law.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

7.1 Right of Access (Art. 15)

Request a copy of all personal data we hold about you.

7.2 Right to Rectification (Art. 16)

Request correction of any inaccurate or incomplete personal data.

7.3 Right to Erasure (Art. 17)

Request deletion of your personal data ("right to be forgotten") under certain circumstances.

7.4 Right to Restrict Processing (Art. 18)

Request that we limit how we use your personal data.

7.5 Right to Data Portability (Art. 20)

Receive your data in a structured, machine-readable format.

7.6 Right to Object (Art. 21)

Object to processing based on legitimate interests or direct marketing.

7.7 Right to Withdraw Consent (Art. 7(3))

Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact us at legal@supasailing.com. We will respond within 30 days as required by law.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure all transfers comply with GDPR through:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
• Adequacy decisions by the European Commission where applicable

Sub-processors based in the United States are protected by SCCs as detailed in Section 4 above.

9. Cookies & Tracking Technologies

We use cookies and similar technologies to improve your experience. Analytics and advertising tools (Google Analytics, Google Tag Manager, Google Ads, the ChatGPT Ads pixel) are loaded only after you accept the matching category in the cookie banner. For detailed information about the specific cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

10. Children's Privacy

Our Service is a professional B2B maritime platform not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal data, please contact us immediately.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects:

• We will notify the Agencia Española de Protección de Datos (AEPD) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, as required by GDPR Article 34.

12. Complaints & Supervisory Authority

If you believe we have not handled your personal data in accordance with this Privacy Policy or applicable data protection laws, you have the right to lodge a complaint with your local supervisory authority.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. For material changes, we will notify you by email at least 30 days in advance and update the "Last Updated" date at the top of this page.

14. Contact Information

For any questions about this Privacy Policy or to exercise your data protection rights:

15. Related Legal Documents

• Terms of Service — Conditions governing the use of the platform
• Cookie Policy — Information about cookies and tracking technologies
• Legal Notice — Company identification and legal information (LSSI-CE)