Privacy Policy

Last updated: 29.09.2026

1. Who we are and the scope of this notice

CREWVECTOR GLOBAL S.R.L. (“Crewvector”, “we”, “us”) provides crew management software to business customers under signed agreements. This notice explains personal data processing relating to our public website, business relationships and platform.

Our registered office is at 36 Poporului Street, 1st Floor, Room 4, Constanța, Romania. Trade Register: J2025041457004; CUI: 51944658; VAT: RO52677397. Contact: privacy@crewvector.com.

This notice is provided for transparency under applicable data protection law. It is not a service agreement or a data processing agreement. The contractual relationship with each customer, including contractual arrangements for processing information supplied by that customer, is governed by the signed Customer Agreement and any validly agreed annexes or amendments.

This notice does not amend those agreements. No contractual provision or statement in this notice overrides mandatory data protection law or restricts individuals' statutory rights.

2. Our different roles

Our own processing. We act as controller when determining the purposes and means of processing website enquiries, business contact details, customer relationship and invoicing records, and information used for our own security and administration.

Customer information. When storing or otherwise processing personal data in a customer's workspace on its behalf, we act as processor under documented instructions. The customer normally acts as controller; where it acts for another controller, the respective roles must be reflected in the contractual arrangements.

Account and support information may fall into either category depending on its purpose. Customer content included in a support request remains subject to the applicable processing instructions; it does not become available for unrestricted use by us.

3. Data for which we act as controller

Depending on your interaction with us, we process:

• contact and business details, such as name, work email, telephone number, employer and role;
• enquiries, demonstration requests and correspondence;
• contract, invoice, payment-reference and business banking information, including payer details where a customer arranges third-party payment;
• information needed to administer access, such as user identity, account settings and authentication-related records;
• technical information, including IP addresses, browser information, timestamps, security events and error reports;
• website analytics and cookie preferences, as explained in the Cookie Policy;
• marketing preferences and correspondence where relevant.

We receive information from you, your organisation or its authorised representatives, through your use of our services, and from payment and service providers where needed for the relevant purpose. Our contract-based payment process uses invoices and bank transfers; we do not ask you to submit payment card details through the public Website.

4. Purposes and legal bases

We use business contact and correspondence data to respond to enquiries, arrange demonstrations and administer customer relationships. For representatives and employees of business customers, the usual basis is our legitimate interest in conducting and supporting those relationships. Where the individual is personally a contracting party, processing necessary to enter into or perform that contract may instead rely on Article 6(1)(b) GDPR.

We use billing and payment information to administer payments and meet applicable accounting and tax obligations. The bases are the relevant legal obligations and, where applicable, contract performance or legitimate interests in managing business payments.

We use technical and security information to protect systems, prevent misuse, investigate faults and maintain our services, relying on legitimate interests and applicable legal obligations.

Optional website analytics are used with consent. Marketing communications are sent only where permitted by applicable law, relying on consent where required. You may object to direct marketing or withdraw consent at any time.

Where we rely on legitimate interests, we consider the impact on individuals and their rights. You may contact us for further information.

Information required for a contract, payment administration or access may be necessary to provide the requested service; without it, we may be unable to do so. Optional analytics and marketing choices are not conditions of receiving contracted services.

5. Recipients

We disclose personal data where necessary to hosting, communications and other service providers; banks and payment institutions involved in transfers; professional advisers; and competent authorities where legally required. Information may also be disclosed where necessary to establish or defend legal claims or in a business transaction, with appropriate safeguards.

Some recipients act as processors on our instructions; others, including banks and certain professional advisers, act as independent controllers. See our Sub-processors page for information about supporting providers and their roles.

We do not sell personal data.

6. Customer workspace information

Customers may supply seafarer and applicant records, contact details, identity and travel documents, certificates, sea-service and employment records, financial information, next-of-kin details and, where included, medical or fitness information.

We process this information to provide the contracted service, including hosting, retrieval, backups, authorised support and features used on the customer's instructions. Customers are responsible for determining their lawful purposes and legal bases, providing required notices and ensuring they are entitled to instruct the processing. This does not remove Crewvector's own legal obligations as a processor.

Where automated document extraction is used, documents are sent to the relevant provider identified on the Sub-processors page. Extracted information is intended for review by the customer's authorised user. Customers remain responsible for decisions made using the information.

Requests concerning seafarer or other customer-controlled records should normally be addressed to the relevant agency, ship manager or other controller. If you contact us, we will assist in directing or forwarding the request as appropriate, without disclosing information about other customers or individuals. We act on authorised instructions and applicable law.

7. Locations and international transfers

The Crewvector application database and document storage are hosted in the European Economic Area. Supporting services may involve other locations or access arrangements, as described on the Sub-processors page.

Where personal data is transferred outside the EEA, applicable transfer requirements must be met. Depending on the recipient and arrangement, safeguards may include an applicable adequacy decision or standard contractual clauses with any necessary supplementary measures.

You may request information about applicable safeguards, including a copy where appropriate, at privacy@crewvector.com. A provider's registered address alone does not establish where all processing takes place.

8. Retention

We retain personal data only for as long as needed for the relevant purpose, taking account of legal obligations and the establishment, exercise or defence of legal claims.

• Business contacts and correspondence are retained while needed to manage the relationship, deal with outstanding enquiries and resolve relevant issues.
• Contract, invoice and accounting records are retained for the applicable statutory period for the category of record.
• Access and security records are retained for the period needed for account administration, security and investigation, with longer retention where required for a specific incident or legal obligation.
• Marketing preferences are retained while relevant; a limited suppression record may be retained to respect an objection.
• Analytics retention depends on the configured tool settings described in the Cookie Policy.

Customer workspace data is returned or deleted in accordance with lawful instructions, binding contractual arrangements and applicable law. Backup removal follows the applicable backup lifecycle, with access restricted during any residual retention. This notice does not introduce a new contractual retention period.

9. Your rights

Where applicable, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may object to direct marketing at any time.

Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Contact privacy@crewvector.com. We generally respond within one month; where an extension is permitted, we will explain it within that period. We may seek proportionate identity verification. Requests are normally free of charge, subject to statutory exceptions.

You may lodge a complaint with a competent supervisory authority, including in the Member State of your habitual residence, place of work or the alleged infringement. In Romania, this is the ANSPDCP.

We do not use the controller processing described in this notice to make solely automated decisions producing legal or similarly significant effects on individuals.

10. Security

We apply technical and organisational measures appropriate to the processing and risk. See our Security page for an overview.

Personal data breaches are handled in accordance with applicable law and binding customer commitments. Our obligations as processor are distinct from a controller's obligations to notify authorities or individuals.

11. Cookies and external resources

The Website and platform use different technologies. See our Cookie Policy for details and available choices. A resource can involve the transmission of an IP address even if it does not set a cookie.

12. Children

The public Website is directed at business audiences. Customer records may include cadets or other individuals under 18; those records are processed on the customer's instructions and require an appropriate lawful basis and safeguards.

13. Updates and contact

We update this notice when our processing changes and provide additional notice where required. A revision does not amend a signed Customer Agreement. If a new purpose requires consent, publication alone does not provide that consent.

Privacy: privacy@crewvector.com

General enquiries: info@crewvector.com

CREWVECTOR GLOBAL S.R.L., 36 Poporului Street, 1st Floor, Room 4, Constanța, Romania

Telephone: +40 734 510 170