Ops App Privacy Policy

1 Who we are and what this policy covers

NauticIQ Ops is a business application for vessel inspections, check-in and check-out, findings, maintenance, repair jobs and operational communication. This policy explains how personal data is handled through the NauticIQ Ops mobile app and its connected Ops service, including information about authorised users and people recorded in an organisation’s workspace.

The service is operated by Nautic Information Quality OÜ, registry code 17606480, Jõe tn 3-303, Kesklinna linnaosa, Tallinn, Harju maakond, 10151, Estonia (“NauticIQ”, “we”, “us”). For privacy questions or requests to delete personal data, email [email protected] or write to this postal address.

Your charter operator, employer or other organisation normally determines why operational records are collected and who may use them. For those records, that organisation is the controller, and we process data on its instructions under our service agreement and data processing terms. Its privacy notice also applies. We act as a controller for our own business contacts, service administration, security, support and compliance activities where we determine their purposes and means.

2 Information we handle

Account and access information. Your phone number, name, user and organisation identifiers, assigned roles, permissions and bases, app-generated device identifier, language preference, authentication tokens and verification activity. Your organisation may supply or maintain your account details.

Operational and reservation information. Inspection answers, findings, maintenance and repair records, assignments, comments, timestamps, vessel and base references, customer and agency names, reservation references and dates, transfer details, amounts due and payment status. Where the organisation uses crew features, records may include names, phone numbers, gender, dates of birth, passport or identity-card numbers, crew roles and skipper licence details.

Content you provide. Photos, videos and their audio, selected documents and other attachments, chat messages and reactions, signatures and signatory names, dictated text, feedback, screenshots and support correspondence. Content can identify people shown, heard, named or otherwise described in it.

Technical information. App-generated identifiers, push notification tokens, platform, language and notification preferences, synchronisation information and connection information such as IP addresses and request timestamps. Service operation and troubleshooting may also involve error and security records.

3 Where information comes from and why we use it

We receive data from you, your device, your organisation, other authorised workspace users and reservation or other systems connected by your organisation. We use it to authenticate users, apply access permissions, deliver and synchronise operational records, support inspections and maintenance, enable communication and reports, send requested service notifications, answer support requests and protect the service.

For activities where we are a controller, our legal bases under the GDPR are our legitimate interests in administering and securing a business service, assisting users and resolving problems (Article 6(1)(f)); performing a contract or requested pre-contract steps where you personally are the contracting party (Article 6(1)(b)); and compliance with applicable legal obligations (Article 6(1)(c)). Where an optional activity requires consent, we rely on that consent (Article 6(1)(a)). Your organisation is responsible for the legal basis for operational data it controls, including any additional conditions for sensitive information.

Account identifiers and relevant work records are needed to provide access and carry out the workflows you use. You can choose whether to provide optional media, dictation and feedback. If you decline an optional permission, the related feature may be unavailable; you can still use features that do not require it. Device permission does not by itself establish a legal basis to collect information about other people.

Only include personal information needed for the work. Avoid unrelated identity documents, health information or other sensitive details in photos, chat and free-text fields. Your organisation must provide appropriate information to staff, customers and crew whose details it supplies.

4 Device permissions and your choices

Camera, photos and files. The app uses the camera to capture operational photos and videos and allows you to select media or documents to attach to records, messages or feedback. Selected files may contain personal information and embedded metadata. We do not need access to unrelated files to provide these features.

Microphone and speech recognition. The microphone is used for audio in recorded videos and for voice dictation that you start. Dictation uses the speech-recognition service available on your device, such as Apple’s service or the configured Android provider. Depending on the device, language and provider settings, audio may be processed on the provider’s servers. Do not assume dictation is entirely on-device. The app receives recognised text and saves or sends it when you submit the relevant field. Audio included in an uploaded video is part of that video.

Notifications. If enabled, push tokens and delivery information are used to send alerts about messages and operational activity. Notification content can appear on your lock screen according to your device settings. You can change permissions, notification previews and other available choices in your device settings. Revoking a permission stops future permitted access; it does not automatically delete information already submitted.

5 Location advertising and automated decisions

The app does not request device GPS location or background location tracking. Vessel bases, destinations, transfer locations or location information included in records and uploaded files are separate from device location tracking.

We do not sell personal data or use the app for targeted advertising or tracking across other companies’ apps and websites. Signing in or enabling notifications does not subscribe you to marketing.

We do not use the app to make solely automated decisions about you that produce legal or similarly significant effects. Operational statuses and reports support decisions made by your organisation.

6 Who can receive information

Your organisation and authorised users. Workspace administrators and other users can access information according to the roles, permissions and workflows configured for them. Operational messages and records are work information and may be visible to relevant colleagues or contractors.

Service providers. Providers supporting hosting, storage, authentication and verification-message delivery, security, support and notification delivery may receive the information needed for those functions. Push notifications use Expo’s notification service and the relevant Apple or Google delivery service. Speech recognition uses the device’s selected recognition provider as described above. Notification providers may process push tokens and the notification payload, including any content it contains.

Connected systems and recipients you select. Information may pass to integrations enabled by your organisation. When you export, print, email or share a report or attachment, the selected recipients and services receive that information and may keep their own copies. Their handling of those copies is outside the app’s deletion controls. App-store services may also receive technical connection information when the app checks for an available update.

Legal recipients. We may disclose information to competent authorities or professional advisers when required by law or necessary to establish, exercise or defend legal claims.

We require providers processing personal data on our behalf to protect it under contractual obligations, restrict its use to the agreed purposes and provide protection consistent with this policy and applicable law. Separately operated services may also process information under their own privacy notices.

7 International processing

Processing and support may involve access from outside the European Economic Area, depending on the providers and integrations used. Where we make a restricted international transfer, we use a lawful transfer mechanism, such as an applicable European Commission adequacy decision or Standard Contractual Clauses, with additional safeguards where required. You can ask [email protected] about relevant recipients, processing locations and safeguards, including how to obtain a copy.

8 Offline storage and security

The app stores authentication information, preferences, cached work records and pending changes or media on your device so that supported features can work offline and synchronise later. Local information can remain after a session ends. Signing out is not a complete device-data wipe, and clearing a chat on your device does not delete the server conversation.

We use access controls and technical and organisational measures appropriate to the information and risks. The mobile app connects to the Ops service over HTTPS and uses operating-system secure storage for authentication tokens. No system is completely secure. Protect your device with a screen lock and report loss or unauthorised access to your organisation promptly.

9 How long information is kept

Operational records are retained according to your organisation’s documented instructions, the service agreement and applicable legal requirements. Relevant criteria include the active service relationship, completion of inspections and repairs, the organisation’s recordkeeping duties and the handling of disputes. Ending a user’s access does not necessarily erase the organisation’s operational history.

For data we control, we retain account and service-administration information for as long as needed to administer the relationship; support information until the request and necessary follow-up are resolved; and security records for the period needed to investigate and prevent misuse. Where a law or legal claim requires specific records to be kept longer, we retain the necessary information for that purpose and restrict other use.

When retention is no longer justified, information is deleted or anonymised. At the end of the organisation’s service, return or deletion follows its instructions and applicable contractual retrieval periods, subject to legally required retention. Residual backup copies expire through the backup cycle and are not used for ordinary processing after deletion from active systems. Local device copies and separately exported files have their own lifecycle and may need separate removal.

10 Your rights and deletion requests

Depending on applicable law, you may request access to your personal data, correction, erasure, restriction of processing and portability. You may object to processing based on legitimate interests. We will stop that processing unless we demonstrate compelling legitimate grounds or need it for legal claims. You may object to direct marketing at any time and withdraw consent without affecting processing that was lawful before withdrawal.

To request deletion of your account or personal data, email [email protected] with “NauticIQ Ops privacy request” in the subject and identify your organisation and the phone number or other account identifier you use. Tell us whether you want account deletion, deletion of particular data or another privacy action. Do not send your password, verification code or an identity-document copy in your initial request. We may request proportionate information to verify your identity.

For records controlled by your organisation, you may contact its administrator directly. If you contact us, we will help route the request to the relevant controller and assist it as required. Revoking access, signing out, uninstalling the app or clearing a local chat does not itself delete server records. Some information may need to remain for legal duties, justified claims or the organisation’s lawful recordkeeping; we or the relevant controller will explain any applicable restriction.

We normally respond to GDPR rights requests within one month. If a permitted extension is needed, we explain why within that month. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee/en, or the competent authority where you live, work or believe an infringement occurred.

11 Children and changes to this policy

NauticIQ Ops is intended for authorised business users and is not directed to children. An organisation may include a minor’s details in a crew or passenger record where necessary and lawful; it is responsible for the applicable information, legal basis and safeguards.

We update this policy when our practices change and show the date of the latest revision. We will provide additional notice or obtain consent where required for a material change. For questions about this policy, contact [email protected].