Privacy Policy

The controller of your personal data is Dawid Ziniewicz, a private individual not running a registered business, email: dawidziniewicz@gmail.com. For anything related to personal data, write to dawidziniewicz@gmail.com or use the contact form (topic “Data protection”). No data protection officer has been appointed.

1. Account data: full name, username, email address, password (stored only as a cryptographic hash), role, date of accepting the Terms.
2. Sailing data: whether you hold a licence and which, licence number, SRC certificate status and number, STCW training, experience at sea, other qualifications and, for Skippers, whether they act as a business (trader).
3. Private trips: name, dates, area, port, boat, description, price and the Skipper's contact details given in the trip.
4. Messages: data given in the contact form, an illegal content notice or a complaint (name, email, message, URL).
5. Technical data: IP address, browser information, session identifier, log of failed login attempts.

1. Concluding and performing the Account agreement and providing the Service (art. 6(1)(b) GDPR).
2. Showing Skippers' qualifications and checking them for the safety of trips (art. 6(1)(b) and (f) GDPR).
3. Replying to messages and handling complaints (art. 6(1)(b), (c) and (f) GDPR).
4. Handling illegal content notices and moderation decisions under the Digital Services Act (art. 6(1)(c) GDPR).
5. Keeping the Service secure and preventing abuse, including limiting login attempts (art. 6(1)(f) GDPR).
6. Establishing, exercising or defending legal claims (art. 6(1)(f) GDPR).

Our legitimate interest is running the Service securely and reliably, communicating with Users and protecting ourselves against claims.

Providing data is voluntary but necessary to create an Account. A Skipper must give a licence number and SRC status to create a Skipper Account. Data in the contact form is necessary for us to reply.

1. Cloudflare, Inc. (hosting, database, content delivery network) as a processor acting on our behalf.
2. Unsplash: photos in the Service are loaded from images.unsplash.com, so your browser sends that server your IP address and basic technical information.
3. Other Users, for data published in a profile or Listing.
4. Public authorities, where the law requires us to disclose data.

Cloudflare, Inc. may process data in the United States. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which Cloudflare participates, and additionally on standard contractual clauses. You can obtain a copy of the safeguards by contacting us.

1. Account data: until the Account is deleted. Database backups are overwritten within 30 days.
2. Login sessions: up to 30 days or until you log out.
3. Private trips: until the Skipper deletes them or their Account; access gained with a code expires after 12 hours.
4. Log of login and sign-up attempts (IP address): up to 24 hours.
5. Messages, notices and complaints: up to 12 months after the matter is closed and, where necessary, until claims become time-barred.

1. Right of access and to a copy of your data (you can download your data under “My account”).
2. Right to rectification.
3. Right to erasure (you can delete your Account yourself under “My account”).
4. Right to restriction of processing.
5. Right to data portability.
6. Right to object to processing based on legitimate interest.
7. Right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or the supervisory authority in your country.

Your data is not used for automated decision-making or profiling.

The Service uses only what is strictly necessary for it to work. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent.

1. col_session: login session cookie (HttpOnly, Secure), valid for up to 30 days or until you log out. Logging in is not possible without it.
2. col_t_…: cookie that lets you view a private trip after entering the correct code (HttpOnly, Secure), valid for 12 hours.
3. col-intro (browser sessionStorage): remembers that the welcome animation has already been shown. Deleted when you close the tab.

You can delete or block cookies in your browser settings; blocking the session cookie prevents logging in.

Connections to the Service are encrypted (HTTPS). Passwords are stored as PBKDF2 hashes with a random salt and session identifiers as SHA-256 hashes. Only the Service's administrators can access User data.

This policy may be updated. The current version is always available at https://cruiseoflive.com/. We will inform Users with an Account about significant changes.