Privacy policy

Who is responsible

AquaStruct E.E. (AquaStruct L.P.), trading as AquaStruct, operates Navis Yacht and the Navis mobile app. Our registered address is 40 El. Venizelou, Glyfada 16675, Greece. General Commercial Registry (GEMI): 194515903000. EUID: ELGEMI.194515903000. Tax identification number: 803319970. AquaStruct is the data controller for website enquiries and our direct account and service relationship. Customer organisations generally control the operational and crew records they place in their workspaces; we process those records under the applicable service and data processing agreements.

Information we process

When you contact us, we process the name, work email, organisation details and message you choose to provide. Please do not include sensitive personal information or confidential vessel records in an initial enquiry.

Our hosting and security services may process technical information such as IP address, request time, browser details, requested pages and error records to deliver and protect the website. If you sign in, authentication and account information is processed to provide access to your workspace.

The website includes Vercel Web Analytics for aggregate audience statistics. When enabled in the hosting environment, it records information such as pages visited, referrers, approximate location and browser or device type. It does not use third-party cookies or an identifier shared across different websites. These statistics help us understand and improve website use.

The Navis mobile app

Navis processes your sign-in details, user identifier, profile and workspace membership to authenticate you and apply the access granted by your organisation. Your actions may create records of who entered, changed, completed or signed work. The records you choose to enter or upload can include vessel and equipment information, maintenance and safety records, crew details, certificates, photos and other attachments.

Camera permission supports scanning equipment and spare-part QR tags and taking photos you choose to attach. Scanning resolves the tag against workspace records; the scanner does not upload a continuous camera stream. Selected or captured attachments are processed and uploaded to the workspace when you submit them. Navis does not require microphone access for these features.

Where biometric confirmation is used, the operating system performs the fingerprint or face check. Navis receives the authentication result, not your fingerprint or face template. A work-completion or document-signing record can identify your user account and the time of the action.

The app stores session information, preferences and selected workspace data on your device. Supported offline workflows may retain queued changes and attachments until they can be synchronized. Device storage and caches can persist between launches; signing out clears your active session and account query cache. Some locally saved workflow progress or temporary files may remain until cleared or the app is removed. Removing the app does not delete server-side records.

Network requests to authentication, API, storage, app-update and hosted-media services disclose technical connection information such as IP address and request metadata to those services. Navis uses Supabase for authentication, data and storage, the deployed web service on Vercel for application APIs, and Expo services for compatible app updates. Update requests include app/runtime information needed to select compatible code. The app’s camera and account access are used for its operational features, not to sell personal data.

If your organisation enables document classification or other AI-assisted features, the selected content is processed through the configured service for that task. Use only information your organisation has authorised you to submit. Applicable provider and processing details depend on that configuration and the organisation’s agreement.

Purposes and legal bases

We use enquiry information to respond to your request, arrange demonstrations and discuss services. Depending on the context, this processing is necessary to take steps at your request before entering a contract, or is based on our legitimate interest in responding to business enquiries.

We process technical information for our legitimate interests in running a reliable and secure website, preventing misuse and investigating faults. We process information when necessary to comply with legal obligations. Where an optional activity requires consent, we request it first; consent may be withdrawn without affecting the lawfulness of earlier processing.

For the app, processing supports account access, the contracted service, organisation-authorised operational workflows, security and auditability. Customer organisations determine the lawful basis for the crew and operational data they control. Device permissions can be changed in your operating-system settings; denying a permission may prevent the corresponding capture or confirmation feature from working.

Service providers and international transfers

We share information only where needed with providers supporting hosting, infrastructure, authentication, website measurement, communications and technical support, and with professional advisers or authorities where legally required. These include Vercel for hosting and website measurement and Supabase for application infrastructure and authentication. Providers processing information on our behalf must follow applicable contractual and data protection requirements.

If personal information is transferred outside the European Economic Area, applicable transfer safeguards are required, such as an adequacy decision or the European Commission’s standard contractual clauses. Contact us for information about the providers and safeguards relevant to your relationship with us.

How long information is kept

We retain information for as long as needed for the purpose for which it was collected, including responding to an enquiry, maintaining a business relationship, meeting legal record-keeping duties and establishing or defending legal claims. Retention depends on the type of record and applicable obligations. Information that is no longer needed is deleted or anonymised.

Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction of processing or a portable copy of your information. You may object to processing based on legitimate interests and withdraw consent where processing depends on it. We may need proportionate information to verify your identity before responding.

Use our contact form or write to our registered address to exercise these rights. We normally respond within one month; where the law allows an extension, we explain the reason. You may lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your competent supervisory authority.

Delete your Navis account

You can request account and associated personal-data deletion at navisyacht.com/delete-account without signing in or reinstalling the app. In Navis, personal account settings also provide Delete account with email verification and a confirmation step. We verify ownership before completing a request and explain any additional steps or retained records.

Personal profile and access data are distinct from organisation-controlled vessel, crew, maintenance, safety, financial and audit records. Some records may need to remain for legal obligations, security, fraud prevention or legal claims. Retention depends on the record and applicable duties; we explain the records and periods relevant to your request. A personal-account request does not automatically cancel an organisation’s subscription or delete its entire workspace.

Customer workspaces and AI features

This notice covers the website, mobile app and our direct service relationship with you. When a customer organisation uses Navis Yacht to manage crew, suppliers or other operational records, read its privacy notices as well. AquaStruct’s obligations as a processor are governed by the relevant service and data processing agreements. Contact us if you need help identifying the responsible workspace administrator.

Website enquiry handling does not involve decisions based solely on automated processing that produce legal or similarly significant effects. Product AI features and integrations are governed by the customer’s configuration and applicable agreements; illustrative marketing screens contain fictional demonstration records.

Cookies, security and updates

Read our cookie policy for browser storage and preferences. We apply organisational and technical measures appropriate to the information and service; no transmission or storage system can be guaranteed completely secure.

We may update this notice as the website, services or applicable requirements change. The date below identifies the latest version.