Privacy

The undertaking

NoRemarks, part of organisation number 937 020 260

Where

Ålesund, Norway

Privacy enquiries

post@noremarks.no

Supervisory authority

Datatilsynet, Norway. You may complain to them at any time, and you do not have to raise it with us first.

Almost all the personal data in NoRemarks is about seafarers, and none of it was our decision to collect. A shipowner enters their crew because a crew list, a rest-hour record and a certificate register are things the law obliges *them* to keep. In that arrangement the shipowner is the controller and we are the processor: we hold the data, we do as we are instructed with it, and we have no right to use it for anything of our own.

That is not a disclaimer. It is the reason a request about a seafarer’s record goes to their employer rather than to us — we are not entitled to decide it, and a supplier who offered to would be overstepping. What we owe the shipowner is a written processing agreement, the security described on the security page, and no use of their data beyond running the product for them.

Where we *are* the controller is small and ordinary: this website, and anybody who writes to us. Those two are the rest of this page.

• We do not train anything on your data. No model, ours or anybody else’s, is trained or evaluated on a customer’s records. There is no arrangement under which that could happen.
• We do not sell, share or enrich it. There is no advertising, no data broker, no analytics vendor and no enrichment service anywhere in this product or this site.
• Sub-processors are few and named on request. Hosting in the European Economic Area, an AIS position provider where a customer has asked for vessel positions, and an email provider where a deployment sends email at all. The current list, with what each one processes, is sent on request and before anything changes.

No cookies. No analytics, no tag manager, no pixel, no embedded video, no web font fetched from somebody else’s server — every asset on this page came from this domain. Nothing here follows you anywhere, and there is no consent banner because there is nothing to consent to.

What does exist is the web server’s access log: the page requested, the time, the browser’s user agent and the IP address the request came from. It is kept briefly, to keep the site up and to see an attack, and it is not joined to anything else or used to build a profile. The legal basis is our legitimate interest in operating a working, defended website.

An email gets your address, your name, and whatever you chose to put in it. We use it to answer you and, if it becomes a conversation about buying something, to have that conversation — the basis is our legitimate interest before a contract and the contract itself afterwards.

Correspondence is kept while it is live and for a reasonable period after, so that a question asked last year can be found when it is asked again. Accounting records have their own statutory period, which is longer and is not ours to shorten. Ask us to delete an enquiry and we will, unless it is one of those.

Listed here rather than left vague, because a seafarer is entitled under article 14 to know what their employer put in: who they are and how to reach them, which position they hold and on which vessel, when they signed on and off, which certificates they hold and when each expires, the hours they rested and worked, what they signed, and who to call in an emergency.

Medical records and controlled-drug treatments are in there too where a vessel keeps them, behind their own narrow permission rather than visible to anybody holding an officer’s role. Vessel positions come from the public AIS broadcast and are about a ship rather than a person.

A seafarer who leaves has a right to erasure. A ship has a statutory obligation to retain rest-hour records, the oil record book and drill records for years. Those two obligations genuinely conflict, and the honest answer is not that one of them wins everywhere.

How the product resolves it: erasing a person anonymises the person and deletes the sensitive record, while the statutory entry survives with an unattributed reference. The record that a rest period was worked remains; the name on it does not. The shipowner decides when to do this, because the retention obligation is theirs.

Access to what is held, correction of what is wrong, erasure, restriction, a portable copy, and objection to processing based on a legitimate interest. Where consent was the basis, it can be withdrawn without giving a reason.

Which door to knock on follows the two roles above. For anything in a shipowner’s installation — your crew record, your hours, your certificates — ask your employer: they are the controller and they can do all of it in the product themselves. If they need us to help them answer you, we will. For this website, or for an enquiry you sent us, ask us directly at the address above.

Either way you may complain to Datatilsynet instead of, or as well as, asking us. That right does not depend on having tried us first.

This is the version in force. A change that affects what is held, why, or who it goes to is made here before it is made in the product, and a customer is told rather than left to notice — which is also what the processing agreement requires of a new sub-processor.