Data protection

Privacy Policy

Version 0.2 · Effective 24 August 2026

1. Scope

This Policy covers personal data processed through the Crew portal, Crew ID, professional profile, document capture, verification, controlled sharing, support and security functions.

2. Data we process

• identity and contact data;
• account, authentication and security data;
• profile photographs, positions, availability and biographies;
• identity documents, certificates, licences and maritime records;
• sea service, career and vessel assignments;
• verification evidence, reviewer responses and audit history;
• medical-certificate and limited medical-status information;
• payment references, payment status, amounts, IVA, Revolut payment-link and transaction references;
• promotion-code redemptions, referral relationships and Token ledger records;
• sharing permissions, access records, support messages and technical data.

3. Data sources

Data may come from the user, an authorised organisation, vessel, issuer, training centre, medical provider, surveyor or other verification participant. SIGVORA also generates security, access, analysis and audit information.

4. Purposes and legal bases

Service performance

Registration, profiles, authentication and requested functions are processed to perform the user agreement and requested pre-contractual steps.

Security and integrity

Access logs, verification records and security events are processed where necessary for legitimate interests in protecting users, documents and the platform.

Legal obligations

Information may be processed or retained to meet applicable legal, accounting, security or authority requirements.

Controlled sharing

User-selected sharing is performed at the user's request. Recipients may retain information where required for their own legal obligations.

Consent

Where consent is appropriate, it will be requested separately and may be withdrawn without affecting earlier lawful processing.

5. Medical and special-category data

Health-related data receives restricted access and is processed only where a legal basis and an applicable Article 9 GDPR condition are available, such as explicit consent or another condition permitted by law. SIGVORA seeks to display only the minimum status needed.

6. Analysis and verification

Images may undergo normalisation, optical character recognition, field extraction, QR detection and preliminary consistency checks. Preliminary analysis is not authoritative verification.

Verification may require sharing information with an issuer, approved surveyor, medical provider, training centre or authorised reviewer. SIGVORA does not make a legally or similarly significant decision solely through preliminary automated processing.

7. Recipients

• authorised SIGVORA personnel and contracted processors;
• Revolut as payment service provider for payment-link checkout and payment processing;
• issuers and approved verification participants;
• vessels or organisations with confirmed role-based access;
• recipients selected through controlled sharing;
• authorities where disclosure is legally required.

8. Processors and international transfers

Hosting, database, communications and technical providers may process data under contract. Transfers outside the European Economic Area will use an applicable transfer mechanism and safeguards where required.

9. Security

SIGVORA uses role-based access, encrypted connections, restricted document storage, integrity controls and audit records. No internet service can guarantee absolute security. Users must protect credentials and report suspected misuse.

10. Retention

• Account and profile data: while the account is active and as legally required.
• Documents and verification evidence: while needed for the service, verification or obligations.
• Security and audit records: for the period needed to investigate incidents and demonstrate integrity.
• Support and legal records: for applicable compliance and limitation periods.

Data is deleted or anonymised when no longer necessary unless continued retention is legally required or needed for legal claims.

11. User rights

Users may request access, correction, deletion, restriction, portability or objection where applicable, and may withdraw consent where consent is the basis. Requests can be sent to info@sigvora.eu. Identity may need to be confirmed.

Users may complain to the Spanish Data Protection Agency (AEPD) or another competent authority.

12. Profile sharing

The user selects permitted sections and duration. Restricted identity or medical data is not made public merely because a general profile is shared. Links should be revoked when no longer needed.

13. Browser storage and cookies

The portal may use session storage and essential technical mechanisms required for authentication, security and operation. Non-essential analytics or advertising technologies will not be activated without required notices and choices.

14. Children

Crew accounts are intended for adults. A child's documents must not be submitted unless SIGVORA has expressly introduced an appropriate authorised process.

15. Changes

This Policy may change when functions, providers or legal requirements change. Material changes will be communicated and the effective date updated.

16. Contact

Privacy questions and rights requests may be sent to info@sigvora.eu.