seawisevdrpro.com
How Seawise VDR Pro handles the personal data of account holders (auditors and company users) and individuals who may appear in recorded voyage data. It forms part of, and should be read with, our Terms of Service.
Effective 11 July 2026 · Version 1.0
Your employer or operating company — the organisation that uploads voyage data — is the controller / data fiduciary for the personal data processed through the Service. A&N Seawise-Maritime Services LLP, Dehradun, Uttarakhand, India, is the processor, acting on that organisation's documented instructions. We handle personal data under India's Digital Personal Data Protection Act 2023 (DPDP) and the EU/UK GDPR where applicable.
| Data | Why we hold it |
|---|---|
| Account data — name, work email, username, role, company, hashed password, MFA secret | Operate accounts and secure access |
| Voyage recordings & parsed outputs — navigation/sensor data, bridge audio which may contain crew voices, radar/ECDIS imagery, alarms | Compliance review and audit of the voyage |
| Operational logs — logins, lockouts, parse runs, deletions | Security and chain-of-custody / tamper-evidence |
Our lawful basis is compliance with a legal obligation together with the contract and our legitimate interests in operating and securing the Service. We do not use personal data for marketing and never sell it.
Voyage recordings may contain personal data and the voices of bridge personnel captured by the recorder. The uploading company is the controller of that data and is responsible for having a lawful basis to process crew voice and behaviour data. Retention of these recordings is tied to the audit engagement.
Your organisation's own authorised users see the data. We use infrastructure sub-processors — cloud hosting, object storage (Cloudflare R2), and transactional e-mail — under equivalent data-protection obligations. We disclose data where legally required, and otherwise make no other disclosure.
Data is processed on secure cloud infrastructure. To let approved auditors stream or download voyages, an encrypted copy may be served from Cloudflare R2 object storage. Where data crosses borders, we rely on appropriate transfer safeguards.
Access is role-based with per-tenant isolation; multi-factor authentication is available for office accounts; passwords are stored as salted hashes; transport is encrypted; and a tamper-evident audit / hash chain records activity. Storage volumes are encrypted at rest. We notify affected parties of a personal-data breach without undue delay.
We retain data for the applicable regulatory period and for as long as needed to provide the Service, after which it is deleted or anonymised. Retention of voyage recordings is tied to the audit engagement; your organisation sets the exact retention period. Backups rotate and expire.
Subject to applicable law you may request access to and portability of your personal data, correction, and erasure; under the GDPR you may also object to or restrict certain processing. These requests are usually handled via the controller company, and we assist. Account holders can export their own account data from their profile page. You may complain to the Data Protection Board of India or, where applicable, an EU/UK supervisory authority. To exercise any right, contact [email protected].
We use only an essential session cookie and a CSRF cookie. We use no advertising or tracking cookies, so no cookie-consent banner is required. Analytics and compliance checks are advisory, and we make no solely-automated decisions with legal effect. We may update this notice; we will notify administrators of material changes, and the current version is always available here.
v1.0 · 11 July 2026 — first published version.