Privacy Policy
Effective 29 August 2026 · Last updated 29 August 2026
Vessbook handles personal data alongside commercially sensitive fixture, compliance, and vessel information. This Policy explains what we collect, why, who we share it with, and the rights available to you — including GDPR/UK GDPR rights for users in Europe and CCPA/CPRA rights for California residents.
1. Introduction and scope
This Privacy Policy explains how Vessbook (“Vessbook”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data and commercially sensitive information in connection with the Vessbook platform (the “Service”), including our website, dashboard, and desk tools. It applies to registered users (shipbrokers, vessel owners, charterers/traders, captains, and their personnel), visitors to our website, and other individuals whose data we process in connection with the Service. It should be read together with our Terms of Service and Cookie Policy.
2. Who we are
Vessbook is the data controller responsible for personal data processed through the Service, except where stated otherwise in this Policy (for example, where another user acts as controller of data they submit about their own counterparties, or where we act as a processor on behalf of a business customer, see Section 17). Vessbook operates from the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates. You can contact us about any privacy matter at [email protected].
3. Information we collect
We collect the following categories of information:
(a) Account and profile data
Name, work email address, phone number, job title, password (stored as a salted hash), and role (broker, owner, charterer/trader, or captain).
(b) Organisation (KYB) data
Legal and trading name, entity type, country of incorporation, registered address, registration number, tax identifier / Legal Entity Identifier (LEI), website, year established, and nature of business.
(c) Verification, compliance, and due-diligence data
Sanctions and politically-exposed-person (PEP) declarations, beneficial ownership information, authorised signatory identification, proof of address, bank references, and, where relevant to your role, professional licensing details (e.g. brokerage licence, regulatory authority, jurisdiction), fleet and vessel documentation (e.g. ISM DOC holder, P&I entry, fleet list), or trading credentials (e.g. trade licence, financial statements, trader authorisation level). Some of this data — such as identity documents or PEP status — may constitute sensitive personal data in certain jurisdictions; we collect it only where necessary for KYB/KYC, sanctions-screening, and financial-crime compliance purposes, and with your consent where required.
(d) Operational and commercial data
Vessel records, marketplace listings and inquiries, negotiation-room messages and status history, shared compliance documents, fixture and recap data, commission and success-fee calculations, voyage and maintenance logs, vetting/inspection records, captain daily position reports, notifications, and audit-trail entries (which record actions taken on the platform, such as approvals or document shares).
(e) Technical and usage data
IP address, browser and device identifiers, log data, and information collected through cookies and similar technologies as described in our Cookie Policy.
(f) Communications
Information you provide when you contact us for support, sales, or other inquiries.
(g) Information from other users
Where you are named as a counterparty, referenced in a negotiation, or included in a compliance document shared by another user in connection with a prospective or actual fixture.
We do not knowingly collect more personal data than is necessary for the purposes described in this Policy, and we do not require you to provide personal data beyond what is needed to register for and use the Service.
4. How we collect information
- Directly from you, when you register, complete KYB/KYC onboarding, use the platform, upload documents, or contact us;
- Automatically, through your use of the Service (technical and usage data, cookies);
- From other users, where they submit information about you as a counterparty, or share compliance documents with you in a negotiation room; and
- From third-party sources, where reasonably necessary for sanctions screening, due diligence, or fraud prevention (for example, publicly available sanctions and PEP lists, or corporate registries).
5. Legal bases for processing (GDPR / UK GDPR)
Where the EU or UK GDPR applies, we rely on the following legal bases:
- Performance of a contract — to create your account, operate the marketplace and negotiation rooms, and provide the Desk Tools;
- Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and communicate with you about your account, weighed against your rights and interests;
- Legal obligation — to perform sanctions screening, anti-money-laundering checks, and record-keeping required by applicable maritime, trade, and financial-crime law; and
- Consent — for certain KYC/due-diligence processing you expressly consent to during registration, and for optional marketing communications and non-essential cookies, each of which you may withdraw at any time (withdrawal does not affect processing already carried out).
6. How we use your information
- To create and administer your account, verify your organisation, and operate role-based access (including captain sub-accounts);
- To operate the marketplace, inquiry, and negotiation-room features, including displaying relevant information to counterparties as directed by platform functionality;
- To perform sanctions, PEP, and other compliance screening, and to detect and prevent fraud, misuse, or security incidents;
- To process subscription billing once payment processing is live, and to calculate commissions, affiliate referrals, and success fees;
- To provide customer support and respond to your inquiries;
- To send you transactional communications (e.g. account alerts, verification status, negotiation updates) and, where you have opted in, product updates or marketing;
- To maintain audit trails and records required for maritime trade, tax, and compliance record-keeping; and
- To analyse and improve the Service, including through aggregated or de-identified analytics.
8. International data transfers
Because Vessbook's users, service providers, and infrastructure are located in different countries, your data may be transferred to, stored in, and processed in countries other than your own, including outside the European Economic Area, the United Kingdom, or the United Arab Emirates. Where we transfer personal data internationally, we use appropriate safeguards required by applicable law, such as standard contractual clauses, adequacy decisions, or equivalent mechanisms, and we require service providers to implement reasonable security measures regardless of location.
9. Data retention
We retain personal and commercial data for as long as your account remains active, and thereafter for as long as necessary to fulfil the purposes described in this Policy, including:
- up to 7 years following account closure, to satisfy maritime trade, tax, and financial record-keeping obligations applicable to fixture, commission, and compliance records;
- for as long as necessary to resolve disputes, enforce our agreements, or comply with legal, audit, or regulatory requirements; and
- shorter periods for certain technical/log data, which we retain only as long as reasonably needed for security and operational purposes.
Where data is no longer needed for these purposes, we delete it or render it anonymous. Some data contributed by you may remain visible in the historical record of a completed negotiation or fixture shared with a counterparty, consistent with the confidentiality obligations in our Terms of Service.
10. Data security
We use administrative, technical, and organisational safeguards designed to protect your data, including encryption of data in transit (TLS), access controls scoped to your role and organisation, hashed password storage, and an organisation-private compliance vault where documents remain private until you choose to share them into a specific negotiation. No system of transmission or storage can be guaranteed 100% secure. If we become aware of a security incident affecting your personal data, we will notify you and, where required, the relevant regulator, in accordance with applicable law. Please report any suspected vulnerability or breach to [email protected].
11. Your privacy rights (GDPR / UK GDPR)
If you are located in the EEA, UK, or another jurisdiction with similar protections, you have the right to:
- access the personal data we hold about you and obtain a copy of it;
- rectify inaccurate or incomplete personal data;
- request erasure of your personal data, subject to our legal and record-keeping obligations;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your personal data in a portable, machine-readable format;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact us at [email protected]. We will verify your identity before responding and will respond within the timeframe required by applicable law (generally within 30 days). Some requests may be limited where necessary to comply with our legal obligations (for example, maritime record-keeping) or where fulfilling them would affect the rights of other users.
12. Additional rights for California residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), gives you the right to:
- know what personal information we collect, use, and disclose, and the categories of sources and recipients;
- delete personal information we hold about you, subject to statutory exceptions;
- correct inaccurate personal information;
- opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information as those terms are defined by the CCPA/CPRA;
- limit the use of sensitive personal information to purposes permitted by law; and
- not be discriminated against for exercising any of these rights.
You may submit a request by emailing [email protected]. You may also designate an authorised agent to submit a request on your behalf, subject to verification.
14. Automated decision-making and verification
As part of onboarding, we may use automated tools to assist with sanctions and PEP screening or document checks. Automated results are treated as an input into, and not a substitute for, human review before an account is approved, restricted, or declined. If you believe an automated check has produced an incorrect result, you may contact [email protected] to request human review.
15. Children's privacy
The Service is a business-to-business platform intended for use by commercial entities and their professional personnel. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will delete it.
16. Third-party links and services
The Service incorporates data and links from third-party providers, including AIS vessel-tracking data, market price indicators, and map tiles. These providers operate independently of Vessbook and are governed by their own privacy practices. We encourage you to review their policies; we are not responsible for the privacy practices of third parties.
17. Where Vessbook acts as a service provider / processor
Where a business customer (for example, a vessel owner creating captain sub-accounts, or a brokerage adding its own personnel) directs us to process personal data on its behalf, we act as a service provider or processor with respect to that data, and the business customer remains responsible as controller for its own compliance obligations to those individuals. We will enter into a data processing agreement with business customers on request; contact [email protected].
18. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, the Service, or legal requirements. If we make material changes, we will notify you by email or an in-app notice before they take effect, and we will update the “Last updated” date above. We encourage you to review this Policy periodically.
19. Contact us
If you have questions about this Policy or wish to exercise any privacy right described above, contact us at [email protected].