Privacy Policy

1. Data Controller

2. Data We Process

2.1 Technical Server Logs

The web server automatically records technical information with each request: IP address, date and time, requested URL, HTTP status, and user agent. These logs are retained for a maximum of 14 days and used solely for security and stability purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

2.2 Session Cookie (Login)

ShipMind sets a server-side session cookie (HTTPOnly, SameSite=Lax) upon login to maintain the authenticated state. The cookie contains no personal data and is deleted when the browser is closed or upon logout. Legal basis: Art. 6(1)(b) GDPR (performance of contract / use of the service).

2.3 CSRF Protection

All forms in ShipMind are secured with a CSRF token (Cross-Site Request Forgery protection). The token is transmitted as a hidden form field and prevents unauthorized form submissions from third-party sites. It is linked to the session and contains no personal data.

2.4 Application Data (SQLite Database)

The app stores operational data locally in an SQLite database: vessel names and details, checklist results and answers, findings, and certificate data. This data does not leave the server automatically and is not shared with third parties.

2.5 Contact and Demo Requests

When you contact us by email (kontakt@oceansphere-service.com), we process the data you submit (name, email address, message content) exclusively to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

4. Hosting and Infrastructure

The publicly accessible ShipMind instance uses server infrastructure provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany as network infrastructure (reverse proxy). Application logic and the database run on a dedicated private server. Hetzner processes technical network data (server logs) on our behalf under a data processing agreement. Hetzner privacy policy:
https://www.hetzner.com/legal/privacy-policy

5. No Third-Party Disclosure

We do not disclose personal data to third parties unless required for contract performance or legally mandated. ShipMind does not embed external CDNs, analytics services, or advertising networks.

6. Your Rights under GDPR (Art. 15–21, 77)

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

For data protection requests: kontakt@oceansphere-service.com

7. Supervisory Authority

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa
uodo.gov.pl

8. Changes to This Policy

We may update this privacy policy as our services evolve. The current version with the date of last modification is always available on this page.

Last updated: July 2026