Privacy Policy

NavScora Pty Ltd (ACN 73 702 089 021) develops and operates maritime technology products and services, including MarineOS and RCF Runsheet. This Privacy Policy explains, in general terms, how NavScora collects, holds, uses and discloses personal information through its websites, applications, customer relationships and support activities. This Policy should be read with any customer agreement, pilot agreement, collection notice or product-specific privacy notice that applies to a particular service. Where a customer organisation provides MarineOS to its personnel, that organisation may also have its own privacy obligations and policies.

NavScora intends to handle personal information responsibly and transparently. Whether the Privacy Act 1988 (Cth) and Australian Privacy Principles apply to NavScora in a particular circumstance depends on the law, including applicable small-business exemptions and exceptions. Nothing in this Policy is intended to represent that an exemption applies where it does not, or that a legal obligation does not apply where it does. Where NavScora is subject to the Australian Privacy Principles, this Policy is intended to support the transparency requirements of APP 1. NavScora may also choose contractual or operational privacy standards that exceed its minimum legal obligations.

Depending on the service and the way it is used, NavScora may collect or hold:

• Account and identity information: name, business email, phone number, organisation, vessel affiliation, account identifier, role, permissions, authentication status and account-security information.
• Crew and professional information: position or duties, qualifications, certificates, training records, competency or assessment records, work or duty information, and other information an authorised customer enters for workforce or compliance management.
• Operational and vessel information: vessel details, voyages, shifts, schedules, logbook entries, operational notes, handovers, fuel and sullage records, maintenance and defect records, risk assessments, safety records, drills, inspections, incidents and related evidence.
• Fatigue and fitness-related operational information: duty and rest records, fatigue declarations, fatigue risk information and operator-entered records relevant to managing fatigue. Some information may be sensitive or health-related depending on what a customer or user records.
• Location information: where a NavScora product requires location functionality, GPS coordinates and associated timestamps, accuracy, speed, direction or operational events may be processed. Device permission will be requested where required.
• Communications and support information: enquiries, support requests, feedback, pilot notes and communications with NavScora.
• Technical and security information: IP address, browser or device information, application version, diagnostic data, error information, audit events, access logs and security events.
• Billing and commercial information: where paid services are introduced or used, business billing details, subscription status, transaction references and information supplied by payment providers. NavScora should not require customers to provide full payment-card details directly where a payment provider handles those details.

Information may be collected directly from an individual, from the individual's employer or contracting organisation, from another authorised user, through a NavScora application or website, from device permissions such as location services, from support communications, or from service providers used to operate the service. Customer organisations are responsible for ensuring that information they provide to NavScora, or direct their users to enter, is collected and disclosed lawfully and that appropriate notices or consents are provided where required.

NavScora may use information to provide and administer its products; authenticate users; apply role-based access; maintain operational, safety and compliance records; support logbook, training, fatigue, maintenance, risk and incident workflows; provide customer support; communicate about service operation; diagnose faults; secure accounts and systems; maintain audit trails; improve reliability and usability; administer pilots and customer relationships; meet legal or contractual requirements; and establish, exercise or defend legal rights. NavScora does not sell personal information.

Operational records entered into MarineOS or another NavScora service for a customer remain customer data subject to the relevant customer agreement. The customer generally determines which authorised users may enter and access that information. Users must not enter personal, sensitive, confidential or third-party information unless they and their organisation are authorised to do so. NavScora may process customer data as necessary to provide, secure, support and maintain the contracted service.

MarineOS may provide AI-assisted features that help users read, summarise, draft, organise or propose information. These features are designed as decision-support tools. They do not independently authorise operational actions, certify regulatory compliance, replace the vessel's approved Safety Management System, or replace professional maritime judgement. Information submitted to an AI-assisted feature may be processed by technology providers engaged by NavScora to deliver that feature. NavScora will seek to configure such services consistently with its contractual, privacy and security requirements. Users should only submit information they are authorised to process through the relevant feature. MarineOS is designed so that consequential operational decisions remain with authorised human users. NavScora does not currently represent MarineOS AI assistance as a system that makes solely automated decisions that determine a person's legal rights, contractual entitlements or access to a significant service. If NavScora later arranges for personal information to be used in automated decision-making of a kind requiring additional disclosure under Australian privacy law, this Policy will be updated before or when those obligations apply.

Where enabled, location information may support vessel tracking, progress against scheduled services, arrival or departure detection, operational events and related analysis. Location access depends on the relevant product, device settings and user permissions. Disabling required location access may prevent some functions from operating correctly.

NavScora uses technical and organisational safeguards appropriate to the service and risk. Measures may include encrypted communications, authentication, access controls, role-based permissions, tenant separation, logging, monitoring, backups, rate limits and security controls provided by hosting and infrastructure services. No internet-connected service can be guaranteed to be completely secure. Customers and users must protect their credentials, use access only for authorised purposes and promptly report suspected unauthorised access or security incidents.

NavScora may use third-party providers for cloud hosting, databases, authentication, email delivery, payment processing, application distribution, software infrastructure, AI model services, monitoring or support. Those providers may process information on NavScora's behalf. Some providers, personnel or infrastructure may be located outside Australia or may process data in other countries. The countries involved can change as providers and configurations change. Where Australian privacy law requires it, NavScora will take reasonable steps in relation to overseas disclosure and provider arrangements. Customer-specific data-location commitments, if any, should be recorded in the applicable customer agreement rather than assumed from this Policy.

NavScora retains information for as long as reasonably required for service delivery, operational or contractual requirements, security, dispute resolution, backup cycles and applicable legal or regulatory obligations. Retention periods may differ between products and customers. Customer agreements may provide specific export, transition or deletion arrangements. Deletion from active systems may not immediately remove information from backups where technically impracticable, but backup data will remain protected and will expire or be overwritten according to applicable retention processes.

Individuals may contact NavScora to request access to, or correction of, personal information held about them, subject to applicable law and the nature of the customer relationship. Where information is controlled by a customer organisation, NavScora may refer the request to that organisation or work with it to respond.

Privacy enquiries or complaints should be sent to privacy@navscora.com. NavScora will assess the matter and respond within a reasonable period. Where the Privacy Act or another law provides a right to complain to a regulator, that right is not affected by this Policy. NavScora maintains processes for assessing suspected data incidents. Where the Notifiable Data Breaches scheme or another notification obligation applies, NavScora will act in accordance with the applicable requirements.

NavScora websites may use essential cookies or similar technologies for security, session management and core functionality. If NavScora introduces non-essential analytics, advertising or tracking technologies, it will update its notices and consent mechanisms where appropriate.

NavScora products are intended for professional and organisational maritime use and are not directed to children.

NavScora may update this Policy as its products, providers, information-handling practices or legal obligations change. The current version and last-updated date will be published on the NavScora website. Material changes may also be communicated through appropriate customer or product channels.