Privacy Policy

This Privacy Policy explains how VAOS collects, uses, stores, discloses and protects personal data when you visit our website, create an account, use the VAOS application, contact us or subscribe to our communications.

VAOS is a professional SaaS platform for maritime audit workflows.

1. Data Controller

The data controller responsible for the processing described in this Privacy Policy is:

For legal matters, contact: vaos@vaos.es
For security matters, contact: security@vaos.es

2. Scope

This Privacy Policy applies to:

• visitors of https://vaos.es;
• users of https://app.vaos.es;
• trial users;
• paying customers;
• newsletter subscribers;
• people contacting us by email, form or other support channels;
• business representatives, maritime auditors, superintendents, vetting teams and related professional users.

Where VAOS processes personal data on behalf of a business customer, VAOS may act as a processor and the Data Processing Agreement may also apply.

3. Personal Data We Collect

We may collect the following categories of personal data.

3.1 Account and Registration Data

• name and surname;
• email address;
• company or organisation name;
• role or job title;
• password or authentication credentials;
• account settings;
• subscription or trial status.

3.2 Professional Profile Data

• maritime role;
• audit experience;
• certifications or professional qualifications, if provided;
• organisation or team affiliation;
• user preferences.

3.3 Customer Content and Audit Data

Depending on how you use VAOS, you may submit:

• audit reports;
• checklists;
• observations;
• vessel preparation notes;
• comments;
• supporting evidence;
• photographs or files;
• vessel-related information;
• trip and inspection planning information.

Customer Content may contain personal data if users choose to include it.

3.4 Billing and Subscription Data

• billing name;
• company details;
• tax identification number;
• billing address;
• payment status;
• invoices;
• subscription plan;
• transaction metadata.

Payment card data may be processed directly by our payment provider and not stored by VAOS, unless expressly stated otherwise.

3.5 Technical and Usage Data

• IP address;
• browser type and version;
• device type;
• operating system;
• login timestamps;
• pages or features used;
• application events;
• error logs;
• security logs;
• session metadata;
• cookie identifiers, where applicable.

3.6 Communication Data

• emails and messages sent to us;
• support requests;
• onboarding responses;
• feedback;
• newsletter subscription preferences.

4. How We Collect Personal Data

We collect personal data when:

• you create an account;
• you use VAOS features;
• you upload or enter data into the Platform;
• you subscribe to updates;
• you contact us;
• your organisation grants you access to VAOS;
• technical systems generate logs for security, diagnostics or service operation;
• cookies and similar technologies are used, subject to the Cookie Policy.

5. Purposes and Legal Bases

We process personal data for the following purposes:

Where processing is based on consent, you may withdraw consent at any time.

6. Cookies and Similar Technologies

We use cookies and similar technologies as described in the Cookie Policy.

Non-essential cookies, including analytics and marketing cookies, are used only where legally permitted and, where required, based on your consent.

You can manage cookie preferences through the cookie banner or cookie settings available on the website.

7. Newsletter and Marketing Communications

If you subscribe to VAOS updates, we may send you product updates, early access news, maritime audit workflow insights and related communications.

You can unsubscribe at any time by using the unsubscribe link in the email or by contacting us at privacy@vaos.es.

We do not send marketing emails without a valid legal basis.

8. Sharing of Personal Data

We do not sell personal data.

We may share personal data with:

• hosting and infrastructure providers;
• database providers;
• payment processors;
• email and newsletter providers;
• analytics providers, where consent applies;
• error monitoring and logging providers;
• professional advisers, such as lawyers, accountants or auditors;
• authorities, courts or regulators where legally required;
• subprocessors listed in our Subprocessors page.

All service providers are required to process personal data only under appropriate contractual, confidentiality and data protection obligations.

9. International Transfers

Some service providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, we rely on appropriate safeguards where required, such as:

• European Commission adequacy decisions;
• Standard Contractual Clauses;
• Data Privacy Framework participation, where applicable;
• additional technical and organisational safeguards.

Further details may be provided in the Subprocessors page or upon request.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.

Indicative retention periods:

Actual retention may vary where deletion is requested, legal obligations apply, security incidents occur or data is needed to establish, exercise or defend legal claims.

11. Data Security

We implement technical and organisational measures designed to protect personal data, including:

• access controls;
• authentication mechanisms;
• encryption in transit where applicable;
• secure infrastructure configuration;
• logging and monitoring;
• backup and recovery practices;
• least-privilege access;
• internal confidentiality obligations;
• incident response procedures.

No method of transmission or storage is completely secure. Users are responsible for maintaining the confidentiality of their credentials and using secure devices and networks.

More information is available in the Security Measures page.

12. Your Rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request deletion of your data;
• restrict processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request data portability;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at privacy@vaos.es.

We may need to verify your identity before responding.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with the Spanish Data Protection Agency:

Agencia Española de Protección de Datos (AEPD)
Website: https://www.aepd.es

We encourage you to contact us first so we can try to resolve your concern.

14. Children

VAOS is not intended for children under 16 years of age.

We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to VAOS, contact us at privacy@vaos.es.

15. Customer Responsibility for Uploaded Data

Users and customer organisations are responsible for ensuring that any personal data uploaded to VAOS has been lawfully collected and may be processed through the Platform.

This includes, where applicable, ensuring appropriate notices, permissions, contractual bases or consents for data relating to personnel, crew members, inspectors, contacts, photographs or other individuals.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make material changes, we will take reasonable steps to notify users, such as through the website, application or email.

The updated version will be indicated by the “Last updated” date.

17. Contact

For privacy questions or requests, contact:

DEEP BRIDGE MARITIME CONSULTING
Email: vaos@vaos.es
Website: https://vaos.es