Marine-CRM Privacy Policy

Version: 1.29
Last updated: 25 August 2026

1. Who we are

This Privacy Policy explains how CIRCLESEA OÜ, an Estonian private limited company, registry code 17563486, VAT number EE103012063, with its public legal address at Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia (Marine-CRM, we, us, or our), processes personal data in connection with:

• the website at https://marine-crm.com (the Website);
• the Marine-CRM business software platform and related support services (the Service); and
• the professional B2B contact dataset made available through the Service (the Shared Dataset).

Marine-CRM is a B2B service and is not intended for consumer or household use. We do not offer public self-registration, free Service accounts, free trial accounts, or unpaid Customer access. A personal demonstration may be conducted without creating a Service account; any pilot with organisational Service access requires a signed and paid Order Form.

Privacy questions and requests may be sent to privacy@marine-crm.com. We have not appointed a statutory Data Protection Officer. This address is monitored by the person responsible for privacy matters within CIRCLESEA OÜ.

2. When we are a controller and when we are a processor

We act as a controller when we determine why and how personal data is processed, including for:

• Website enquiries and newsletter subscriptions;
• customer and user account administration;
• billing, accounting, security, support, and legal compliance;
• obtaining, verifying, maintaining, and making available professional contacts in the Shared Dataset; and
• handling privacy notices, objections, corrections, opt-outs, and other rights requests.

A business customer generally acts as the controller for personal data that it or its authorised users enter into its own Marine-CRM workspace (Customer Data). For that Customer Data, CIRCLESEA OÜ generally acts as the customer's processor and processes it under the customer agreement and Data Processing Agreement.

An exception applies where an authorised user deliberately selects Contribute to Shared Database for a professional contact. The customer remains responsible as controller for its tenant copy and for the disclosure to us. CIRCLESEA OÜ acts as a controller for reviewing the proposed contribution and, if approved, for the separate copy incorporated into the Shared Dataset. Ordinary Customer Data is not automatically used for this purpose.

The customer independently determines the lawful basis and purpose for using any professional contact it views through Marine-CRM. Our agreements require customers to comply with applicable privacy, direct-marketing, ePrivacy, anti-spam, do-not-call, and suppression rules. Those customer responsibilities do not remove our own responsibilities for the Shared Dataset.

If your data was entered by one of our customers, you should normally contact that customer first. You may also contact us, and we will assist or route the request where appropriate.

3. Personal data we process

Depending on how you interact with Marine-CRM, we may process the following categories.

3.1 Website enquiries and demo requests

Our Contact Us and Request a Demo forms require:

• first and last name;
• business email address;
• company name; and
• company website.

The forms also require a free-text message of no more than 2,000 characters. We do not accept file attachments and instruct users not to include passwords, payment information, or sensitive personal data. We request an email address used for business where possible, but we do not automatically reject an address solely because it uses a public email domain. We also process the content and history of related business correspondence.

We do not collect or retain UTM parameters, referrer data, or other marketing-attribution fields from these submissions. To protect the forms, we process the submission time, IP address, user-agent, and anti-abuse validation result for no more than 90 days. At launch, these controls are first-party and include request-integrity protection, a honeypot, and rate limiting. Any later CAPTCHA or similar provider will be assessed and documented before activation.

We treat a form as successfully submitted once the enquiry is securely saved. A failure to deliver the acknowledgement does not cancel or remove the enquiry. We then show an on-page confirmation and send one English-language automatic transactional acknowledgement from support@marine-crm.com; replies return to that monitored mailbox. This acknowledgement confirms receipt, links to this Policy, and provides our contact details, but does not repeat the submitted fields or message. It does not subscribe the sender to the newsletter, contain promotional material, use open- or click-tracking, or guarantee a response time. If it produces a hard bounce, we do not retry it automatically. We continue to process the submitted enquiry and record the delivery-failure event needed to administer and secure the workflow.

An internal notification containing the submitted fields and message, but not the submitter's IP address or user-agent, is sent to support@marine-crm.com. Access is limited to authorised CIRCLESEA OÜ personnel who need it for sales or support. If a submission is a privacy-rights request, we route it to privacy@marine-crm.com and preserve the original receipt date. Identical content resubmitted from the same email address within 10 minutes is merged with the existing enquiry without another acknowledgement. If saving fails, the Website displays a neutral error and our support address without exposing technical details.

3.2 Newsletter

The newsletter form collects only an email address and accepts valid public or corporate email domains; we recommend, but do not require, a business address. We do not manually add or import an address into the newsletter without recorded affirmative consent and a new double opt-in. We also retain the double opt-in confirmation, consent wording and version, timestamps, and strictly necessary delivery, bounce, complaint, unsubscribe, and suppression events.

The English-language double opt-in email is sent from subscribe@marine-crm.com, with replies returning to that monitored mailbox. Its confirmation link expires after 48 hours and we send no automatic reminder. We delete an unconfirmed subscription after 30 days. A separate first-party anti-abuse event may be retained for no more than 90 days. At launch, the form uses a honeypot and rate limiting without an external CAPTCHA; a later provider requires the applicable assessment and documentation update.

All newsletters are in English and sent from subscribe@marine-crm.com. Content is limited to Marine-CRM, CIRCLESEA OÜ, and relevant maritime or B2B material. We do not include third-party advertising or sponsored promotion without a separate review, and we do not sell, rent, exchange, or otherwise monetise the subscriber list. Each newsletter identifies CIRCLESEA OÜ, provides our legal address, links to this Policy, and includes one-click unsubscribe without an account, password, or reason.

We disable email-open tracking pixels and click tracking. Newsletter links do not contain unique subscriber identifiers or use tracking redirects. A Website enquiry or demo request does not automatically subscribe a person to the newsletter. An unsubscribe takes effect immediately: we stop newsletter delivery and show an on-page confirmation, but we do not send a separate unsubscribe-confirmation email. An “unsubscribe” reply, or a withdrawal sent to subscribe@marine-crm.com or privacy@marine-crm.com, is also actioned immediately. A hard bounce or spam complaint stops newsletter delivery immediately and places the address in the newsletter suppression list without further delivery attempts. Three consecutive soft bounces have the same effect.

Only specifically authorised personnel may access the subscriber list. Full-list export is prohibited except for a documented administrative necessity or protected backup. Once the 90-day anti-abuse record expires, the consent evidence retains the email address, exact consent wording/version, and confirmation and withdrawal timestamps, but not the IP address or user-agent. If we have sent no newsletter for more than 12 consecutive months, we require a fresh double opt-in before resuming.

3.3 Customer organisations, account users, and billing contacts

For account users we may process:

• first and last name;
• work email address and business telephone number;
• job title, employer/company, and assigned role or permissions;
• account status and authentication information;
• multi-factor authentication settings and revocable trusted-device status; and
• account, support, and security events.

For the customer's main administrator and organisation we may additionally process the company name, country, registry and VAT numbers, website, business address, billing email, subscription, contract, invoice, and payment information.

There is no public self-registration. We create the initial customer account after the relevant agreement has been signed and payment received. Customer administrators may then invite personnel within the purchased user limit.

3.4 Customer Data

Customers may enter company and professional-contact records, notes, tasks, deals, projects, vessel records, comments, quotations, invoices, and related documents into their logically isolated workspace.

Customers must not intentionally enter special-category data, criminal-conviction or offence data, children's data, payment-card data, third-party passwords, private webmail addresses, home telephone numbers, home addresses, or other non-business contact data. A detail may be used as a business contact only where it is genuinely used and made available for professional purposes.

When adding a professional contact, an authorised user chooses whether to keep it private to the customer's workspace or intentionally submit it for possible inclusion in the Shared Dataset. A proposed contribution remains visible only to the submitting customer until manual approval by CIRCLESEA OÜ and is never published automatically.

For a proposed contribution, we process the submitted contact, source URL or direct-source declaration, submitting customer and user, timestamp, required user attestation, review decision and reason, suppression result, and privacy-notice status. A rejected contribution does not become Shared Dataset data; the customer's own tenant copy remains under the customer's control.

3.5 Shared professional-contact data

The Shared Dataset may contain the following limited information about a professional contact:

• first and last name;
• job title;
• company;
• corporate email address;
• LinkedIn profile address supplied by an approved provider;
• country and city; and
• business telephone number.

We do not intentionally include private email addresses, home contact details, personal social-media content, special-category data, criminal data, or children's data in the Shared Dataset.

3.6 Company and vessel information

Marine-CRM may compile business and vessel information from sources approved for the relevant use, including official public registers and other lawfully accessible public information, open-data publishers used under applicable licences or terms, licensed or contractually authorised providers, and customer or user contributions that pass our review. Public accessibility alone is not treated as consent or as permission to scrape, reproduce, or commercially reuse information. Company and vessel records are not personal data unless they identify or are reasonably linked to a natural person.

Where supported by an approved and actually used source, vessel information may include data originally generated by AIS or another vessel-reporting or tracking system and received through terrestrial or satellite infrastructure. We do not claim to operate satellite, receiver, or onboard-sensor networks or to access onboard systems directly unless expressly stated for a particular source or product.

Where a vessel source contains a private owner's name, home address, or other private information about an individual, we exclude those fields. We may retain legal-entity owners, company operators or managers, and official professional contacts subject to this Policy.

3.7 Service, usage, and security data

We may process:

• login and logout timestamps;
• failed authentication attempts;
• IP address;
• browser and device information;
• changes to security settings;
• the fact and timestamp of a database request and, where needed to enforce the organisation-level contact-display limit and evidence privacy compliance, a limited internal organisation/contact reference and first-display timestamp, without storing the contact fields in the log or detailed search terms; and
• relevant suspension, extraction-limit, export-attempt, and SMTP send-status events.

Separately from ordinary security and usage logs, we maintain a restricted professional-contact recipient ledger. It identifies the Customer legal entity to which a profile was first disclosed, the relevant disclosure dates or periods, categories of fields disclosed, source/control references, transparency status, and any later correction, restriction, erasure, objection or suppression propagation. It does not store a second copy of the contact values or the customer's search terms. The Customer legal entity is the actual recipient from CIRCLESEA; a person or organisation later contacted by that Customer is a recipient of the Customer's separate processing.

3.8 Website analytics

If a visitor gives analytics consent, we use Google Analytics 4 (GA4) to understand how the public Website is used. Depending on the page and interaction, GA4 may process:

• a first-party analytics identifier and session state;
• page URL and title, referring page, language, approximate country/region/city, browser, device category, operating system and screen information;
• page views, navigation, engagement time and limited interaction events; and
• the visitor's analytics-consent state.

We do not configure GA4 to collect names, email addresses, form content, Customer Data, professional-contact records, account credentials or sensitive data, and URLs, event names and parameters must not contain form values or other direct identifiers. As with any network request, Google necessarily receives the device IP address to receive and route consented analytics traffic; for visitors in the EU/EEA, Google states that the address is used to derive coarse location and is discarded before analytics data is logged. We do not receive the full IP address in GA4. Google Analytics, including its tag, is completely blocked until the visitor selects Accept or enables Analytics in Cookie Settings. We use basic consent mode and do not send cookieless analytics pings after rejection.

Advertising features, Google Signals, User-ID, user-provided data, ads personalisation and sharing for Google's own products are disabled. GA4 is used only for first-party Website audience measurement and service improvement.

3.9 Support and REPORT submissions

We process correspondence sent to support@marine-crm.com. The internal REPORT tool accepts a text-only report that is automatically linked to the relevant record or data element. REPORT content and the reporting user's identity are visible only to authorised CIRCLESEA OÜ personnel.

3.10 Planned customer SMTP function

If enabled for a customer, Marine-CRM will use a separate, customer-provided sending mailbox and the customer's own SMTP server to send quotations or invoices selected by the customer. We will process:

• encrypted SMTP connection credentials or a revocable application token;
• recipient address;
• message content and the relevant quotation or invoice, transiently as required to submit the message; and
• after sending, only the date and time, recipient address, sending status, link to the CRM document, and the quotation or invoice itself.

Marine-CRM will not use IMAP, access the mailbox inbox, or retain a separate full copy of the email body after sending. The customer determines the recipient, content, purpose, and lawful basis.

4. Where personal data comes from

We obtain personal data:

• directly from you, including through forms, email, newsletter subscription, or a privacy request;
• from the customer organisation that creates or manages your account;
• from customers and their authorised users when they enter Customer Data or deliberately submit a professional contact for Shared Dataset review;
• from Snov.io, which supplies contractually authorised professional-contact data and separately provides our newsletter campaign service;
• from approved public registers, open-data publishers, and official company webpages;
• from other approved sources whose terms permit the relevant use; and
• automatically from use of the Website or Service for the limited technical and security purposes described above and, for Website analytics, only after analytics consent.

Our automated public-web collection is limited to company and vessel information and professional contacts published on an official company webpage. For such contacts, we collect only first name, last name, job title, corporate email address, and business telephone number. We do not bypass logins, CAPTCHAs, access controls, or other technical restrictions, and we do not crawl personal profiles or private social content. Public availability is not treated as consent or as an unrestricted licence.

5. Why we process personal data and our legal bases

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases.

Our reliance on legitimate interests for professional contacts is limited by data minimisation, controlled customer access, source and accuracy checks, direct transparency, contractual restrictions, and an effective objection and suppression process. We do not assume that professional or publicly available data falls outside data-protection law.

We do not use sourced professional contacts for CIRCLESEA OÜ direct marketing. We also do not score or profile individuals or make solely automated decisions about them that produce legal or similarly significant effects.

6. Notice to people whose data we obtained indirectly

Marine-CRM does not provide public access to professional-contact profiles. Paid access is limited to authorised users of contracted B2B customers. We do not bulk-import or pre-store unused provider contact profiles. A permitted provider record may be obtained on demand for an entitled customer, and a customer-proposed contribution is reviewed separately before it can enter the Shared Dataset.

Our policy is to check global suppression and provide the information required by applicable data-protection law within the applicable period and no later than the earliest applicable event, including our first communication with the person or the first controlled disclosure of the relevant contact fields to another customer. Where Article 14 or equivalent transparency rules apply and a usable business email address is available, our normal practice is to send a one-time notice when a contact is approved for addition to, or first obtained for, the Shared Dataset rather than waiting for a customer to contact the person. The notice is sent in English from privacy@marine-crm.com and identifies CIRCLESEA OÜ, the relevant data categories and source, purposes and legal basis, recipient categories, retention, rights, the objection/deletion route, and the right to complain to a supervisory authority.

The notice contains no promotional content, tracking pixel, or click tracking. We retain only proportionate evidence needed to demonstrate the notice or other applicable transparency step, honour suppression, avoid duplicate notice, and document the first controlled disclosure. These internal records and statuses are not displayed to customers.

Customers are contractually required to provide the privacy information applicable to their own processing at or before their first communication with a professional contact obtained through the Shared Dataset. This normally includes identifying the customer as controller, its purpose and lawful basis, the relevant source or source category, its privacy notice, and an easy objection or opt-out route. The customer's notice supplements and does not replace CIRCLESEA OÜ's own transparency obligations.

The professional-contact display workflow may not be activated for customers until the applicable suppression, transparency, delivery, and evidence controls have been tested. If direct notice is not legally required or is objectively impossible in a particular case, we document the applicable exception, reason, and proportionate alternative safeguards rather than treating public availability or a future customer communication as automatic compliance.

7. Who receives personal data

We disclose personal data only where necessary for the purposes described above and subject to appropriate contractual, confidentiality, access, and security controls.

7.1 Customer organisations

Authorised users may view Shared Dataset records within their subscription and permission limits. Professional-contact fields may appear automatically in an entitled result or record without a separate Reveal action. Their display does not mean that the individual consented to contact or that a particular use or communication is lawful. The Service prohibits scraping, bulk extraction, database reconstruction, list resale, onward licensing, and unauthorised redistribution.

Within a customer's own workspace, its administrator may see records created or changed by its users, sent quotations and invoices, and internal organisational comments. Customers are responsible for informing their personnel about this workplace visibility. Technical and security logs are not visible to customer administrators or ordinary users.

For our disclosure records, the actual recipient is the contracted Customer legal entity whose Authorised User viewed the professional-contact fields. We keep this identity in the restricted recipient ledger so that we can provide legally required recipient information and communicate supported corrections, restrictions, erasures, objections or suppression actions. The Customer is an independent controller for its later use and for anyone to whom it subsequently sends or discloses the data.

7.2 Service providers and other recipients

Current recipients are:

• Hetzner Online GmbH, Germany — backend hosting, primary production database, and encrypted backups;
• Zone Media OÜ (Zone.ee), Estonia — domain, DNS, and corporate email infrastructure, including Article 14 notices and support email;
• Snovio Inc. / Snov.io — contractually authorised professional-contact source and the sole newsletter processor at launch;
• Google Ireland Limited, Ireland — Google Analytics 4 provider for consented Website analytics under the applicable Google data-processing terms;
• Grandex OÜ, Estonia — bookkeeping and tax-compliance services; and
• AS LHV Pank, Estonia — bank-transfer and banking services, acting under its own legal and regulatory responsibilities.

We may also disclose information to competent authorities, courts, professional advisers, or counterparties where required by law or reasonably necessary to protect rights, investigate wrongdoing, or manage a corporate transaction subject to appropriate safeguards.

We will not appoint another newsletter provider without completing the applicable DPA, privacy, security, and international-transfer review.

Only CIRCLESEA OÜ personnel may access production systems and customer data for development, operations, security, or support. Routine personnel access is limited to Estonia and other EU/EEA locations. There are no external developers or technical contractors with production-data access at launch.

We do not provide customer, contact, user, or support personal data to OpenAI, ChatGPT, or another external AI/LLM service.

8. International transfers

Our primary production hosting and backups are located in Germany, and our corporate email infrastructure is located in Estonia.

At production launch, paid customer organisations are limited to entities established in the EU/EEA. The Shared Dataset may nevertheless contain company, vessel, and professional-contact information concerning other countries. A customer established outside the EEA will not receive access until we have assessed the transfer and jurisdiction and implemented an applicable adequacy mechanism or controller-to-controller Standard Contractual Clauses and supplementary measures where required.

Some processing by Snov.io or its sub-processors may take place outside the European Economic Area. Before such processing, we require an appropriate data-protection agreement and a lawful transfer mechanism, such as an applicable adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.

Google collects analytics traffic from EU/EEA devices through EU-based domains and servers before further processing. Google group companies or sub-processors may process analytics data outside the EEA. The applicable Google data-processing terms, Standard Contractual Clauses or another lawful transfer mechanism apply to restricted transfers. We keep Google's own-product data sharing and advertising features disabled.

If we add a provider or enable routine access from outside the EEA, we will first assess the provider, processing role, security, and international-transfer mechanism and update this Policy where required.

9. How long we retain personal data

We retain personal data only for the period reasonably necessary for the relevant purpose, subject to legal obligations, documented disputes, security investigations, and legal holds.

We honour a verified request to delete enquiry or demo data earlier where applicable, unless it must be retained for a customer contract, legal hold, legal obligation, or another documented lawful exception. Separately retained Website-form security events continue only for their approved security period.

We refresh the general dataset approximately every three months. The authenticated Service may display an unobtrusive “Database last updated” date. This does not guarantee that every record is current and does not delay an immediate correction, deletion, or objection.

When an account user is removed, login access and active sessions are disabled promptly. Records, comments, quotations, invoices, and documents created or changed by that user may remain attributed to them where necessary for the customer's business continuity and audit trail and follow the Customer Data lifecycle.

10. Data quality and corrections

Data from licensed, public, automated, and user-contributed sources may be incomplete, delayed, inaccurate, inconsistent, duplicated, or contain errors. Users must independently verify material information before relying on it for operational, safety, compliance, legal, or commercial decisions.

Authorised users may submit a text-only error report through the internal REPORT tool. A person may request correction of their own personal data at privacy@marine-crm.com. Confirmed corrections, employment changes, objections, and deletions are applied without waiting for the scheduled refresh.

11. Your rights

Depending on applicable law and the circumstances, you may have the right to:

• receive information about our processing and obtain access to your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive data you provided in a portable format where the legal requirements for portability apply;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing performed before withdrawal;
• object to direct marketing at any time; and
• complain to a competent data-protection authority.

Send a request to privacy@marine-crm.com. Self-service rights tools are not available at launch.

We normally verify a request through the corporate email address contained in the relevant record. If you no longer control that address, we request only the minimum additional evidence reasonably necessary to connect you with the record. We do not routinely request a passport or identity-document copy.

GDPR requests are handled free of charge, without undue delay, and normally within one month after receipt and any necessary identity verification. Where permitted because a request is complex or numerous, we may extend the period by up to two additional months and will explain the extension within the initial month. We may charge a reasonable administrative fee or refuse a manifestly unfounded or excessive request only after a documented assessment and as permitted by law.

Where your right of access requires information about recipients, we normally provide the legal names of the actual Customer organisations recorded as having received your professional-contact profile, together with meaningful disclosure dates or periods and relevant data categories. We provide only recipient categories where identification is genuinely impossible after a proportionate search or another lawful limitation applies; commercial sensitivity alone is not treated as a blanket reason to withhold actual recipient identity.

If we correct, restrict, erase or suppress professional-contact data, we communicate the required action to each actual Customer organisation recorded as a recipient unless doing so is impossible or involves disproportionate effort documented for the particular case. On request, we inform you of those recipient organisations as required by law. Each Customer is separately responsible for applying the action to its own copy and notifying its own downstream recipients where required.

If you object to our legitimate-interest processing of a Shared Dataset profile, our normal procedure is to remove and suppress the profile rather than continue displaying it. A limited record may be retained only where necessary to honour the suppression, meet a legal obligation, or establish, exercise, or defend legal claims.

12. Do Not Sell or Share My Personal Information

Marine-CRM does not allow customers to export or resell the Shared Dataset, and we do not share personal data for cross-context behavioural advertising. However, because authorised customers pay for controlled access to Marine-CRM and applicable laws may define making information available broadly, we provide a worldwide opt-out without requiring you to establish that a particular law applies.

Use the Do Not Sell or Share My Personal Information page or email privacy@marine-crm.com. You do not need to create an account. We may ask only for the information reasonably needed to locate the correct professional profile.

The public page, form, and automatic messages are in English. The form accepts no attachments; its optional explanation is limited to 500 characters and warns against unnecessary sensitive information. It uses first-party request-integrity protection, a honeypot, and rate limiting without an external CAPTCHA. A later provider requires the applicable assessment and documentation update.

A form request is received once it is securely saved, and an acknowledgement-delivery failure does not cancel it. We show an on-page receipt and send one acknowledgement from reply-capable, monitored privacy@marine-crm.com. It links to this Policy, provides contact details, and does not repeat the submitted fields or explanation. It contains no verification link and requires no reply. If it hard-bounces, we do not retry automatically and continue processing the request. An internal alert goes only to privacy@marine-crm.com, and access is restricted to specifically authorised privacy personnel. Identical content submitted from the same corporate email within 10 minutes is merged without another acknowledgement.

The corporate email associated with the profile is required because it is the minimum practical identifier used to locate the record. An opt-out request does not routinely require proof that the requester controls that address. If the address matches one profile, we stop making the profile available, remove or suppress it, and use a protected, non-reversible keyed hash of the corporate email address to prevent re-import or re-display. Only where documented reasonable indicators show fraud, targeted suppression abuse, or attempted manipulation of another person's profile may we temporarily hold the disputed action and ask for the minimum information needed to assess that risk; this exception is not used for routine mailbox-control verification or to frustrate a genuine opt-out. If the address is ambiguous or no longer current, we may use the optional name/company or ask only for the minimum additional information needed to locate the correct record. The suppression record is not visible to customers and is not used for marketing. We normally implement the opt-out without undue delay and within 15 Business Days, and sooner where applicable law requires. We do not charge a fee or reduce a service available to you because of the request.

We send one completion message from privacy@marine-crm.com confirming removal or suppression and linking to this Policy without reproducing the former profile. If no matching profile is found, we state that outcome without exposing another person's data and close the request. Ordinary completion and no-match messages rely on the Policy link for complaint information. If we refuse or do not act on a privacy-rights request, we provide the reasons and the legally required information about supervisory complaint and judicial-remedy options.

If the submission also requests access, correction, deletion, or another privacy right that could disclose or alter data, we process it under the relevant right without requiring resubmission and may verify that separate part using the least intrusive method reasonably necessary. An authorised representative may act with the minimum evidence reasonably necessary to confirm authority. The internal audit record is limited to request type, status, timestamps, action taken, and documented reason without unnecessary copies of the source data.

13. Cookies and similar technologies

The Website and Service use strictly necessary first-party cookies or equivalent storage for consent preferences, authentication, secure session management and account protection. The public Website also uses Google Analytics 4 after analytics consent. Google Analytics is optional and completely blocked until consent; rejection or withdrawal does not disable the Website, forms or Service.

At launch, third-party embeds and live-chat widgets are disabled, fonts and icons are self-hosted, and social icons are ordinary links without tracking scripts. External assets, widgets, CAPTCHA services, CDN/WAF services, Cloudflare, or similar providers may be introduced later only after the applicable provider, privacy, security, contract, cookie, and international-transfer review and documentation update.

The consent interface offers equally prominent Accept and Reject choices, keeps Analytics off by default, preserves Website/form/Service functionality after rejection, and provides a persistent Cookie Settings route for withdrawal. Withdrawing consent blocks future GA4 collection and removes the analytics cookies we can control from the Website. Consent evidence may be kept for three years without retaining page-visit history. More information is provided in our Cookie Policy.

14. Security

We use technical and organisational measures designed to protect personal data and proportionate to the functionality being operated. These include secure transport, access restrictions, protected credentials, confidentiality duties, logging, backup and recovery measures, and incident-response procedures. Additional controls apply before customer accounts, Shared Dataset access, support access, SMTP functionality, or other higher-risk processing is activated.

Security controls are subject to implementation checks and are not described as certified unless the relevant certification has actually been obtained. No system is completely secure. If a personal-data breach occurs, we will assess, document, and notify affected controllers, authorities, or individuals as required by applicable law.

15. Automated decisions and artificial intelligence

Marine-CRM does not use personal data to score, rank, or profile individuals or to make decisions based solely on automated processing that produce legal or similarly significant effects.

We do not submit Customer Data, provider-sourced contact data, user account data, support content, credentials, or security information to external generative-AI or large-language-model services. Any future product AI feature or change to this rule requires a prior legal, privacy, security, provider, and international-transfer assessment and an update to the relevant documentation before personal data is processed. See our AI Transparency Statement.

16. Children's data

The Website and Service are intended exclusively for professional B2B use and are not directed to children. Customers must not enter children's data, and we do not knowingly include children in the Shared Dataset. Contact privacy@marine-crm.com if you believe that we hold such data.

17. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, providers, or processing practices. The current version and last-updated date will be published on the Website.

We will normally notify customer administrators by email at least 30 days before a material change takes effect. A shorter or immediate period may be used where required by law, a regulator, urgent security needs, or the protection of individuals. Continued use does not replace consent where applicable law requires consent for a new activity.

18. Contact and complaints

CIRCLESEA OÜ
Registry code: 17563486
VAT number: EE103012063
Address: Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia
Privacy: privacy@marine-crm.com
Legal: legal@marine-crm.com
Support: support@marine-crm.com

If you are not satisfied with our response, you may complain to the supervisory authority in your country of residence or work, or where the alleged infringement occurred. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, https://www.aki.ee/en.