Privacy Policy

This Privacy Policy explains how personal data is handled on Tideward, the maritime crewing platform, its portals and this website. It tells you who is responsible for your data in each situation Tideward creates, what data is involved, why it is used, who receives it, how long it is kept and what rights you have.

Tideward puts seafarers and the companies that work with them on one shared platform. The same person has one record, and several companies can work with that one record. Because of that design, the answer to "who is responsible for my data?" depends on how your record came to be on Tideward and who you are dealing with. Section 3 goes through each situation in turn.

1. Who we are

1.1 The company

Tideward is a product of Rogue Star Marine Software Ltd, trading as RSM Software, a company registered in the Republic of Cyprus under number HE496769, with its registered office at Pavlou Aggelinide 21, 3110 Limassol, Cyprus. In this policy RSM Software, we, us and our mean that company, and Tideward means the platform, its portals, the sign-in service at auth.tideward.net and this website. Our full company information is on the Legal page.

1.2 How to reach us about personal data

For anything about personal data, including a request to exercise your rights, write to dpo@rsm-software.com, or by post to Data Protection, Rogue Star Marine Software Ltd, Pavlou Aggelinide 21, 3110 Limassol, Cyprus.

1.3 Words we use

• GDPR means the EU General Data Protection Regulation (Regulation (EU) 2016/679), together with the Cyprus law that supplements it (Law 125(I)/2018).
• A controller decides why and how personal data is used. A processor uses personal data on a controller's behalf and only on its instructions.
• A Tenant is an account space on Tideward. Every seafarer, every company and every vessel on Tideward is a Tenant. A Seafarer Tenant belongs to one seafarer. A Company Tenant belongs to a manning agency, a maritime operator, a port agent or a fleet owner, each of which we call a Company.
• A User is a person with a Tideward login. Every User belongs to a Tenant: a seafarer's login belongs to their own Seafarer Tenant, and a Company's staff belong to its Company Tenant.
• An Unclaimed Tenant is a Seafarer Tenant or Company Tenant that a Company entered on Tideward and that the person or company it represents has not yet taken over. The Company that entered it and looks after it is its Steward. Taking it over is called a Claim.
• A Pool is a Company's register of the Tenants it works with, such as its seafarers, vessels and partner companies. Being in a Pool is a membership: your record is not copied into the Company's Tenant.
• A Shared Record is a record that concerns more than one Tenant and that each of them can read, such as a crewing contract or a sea-service record shared between a seafarer and the Company they served with.
• Your Profile Card is a small card about you as a seafarer, and your Profile Share Link is the private link that opens it.
• A Sourced Advert is a job advert that Tideward collects from a third-party job board, and a Recruiter is the person an advert names for applications.

2. Tideward is a mediator, not an employer

Tideward is software that connects seafarers with manning agencies, maritime operators, port agents and fleet owners, and helps them work together. We never employ seafarers, and we do not decide who is recruited, assigned or employed: people at the Companies make those decisions. Every User accepts our Mediator & employment notice inside the product and is asked to accept it again every 24 months.

This matters for your privacy. The Company that employs or places you is responsible for the personal data it needs to do so, and it will have its own privacy notice.

3. Who is responsible for your data

3.1 In short

3.2 You signed up as a seafarer yourself

When you sign up as a seafarer, we create your own Seafarer Tenant and your login. We are the controller of your account and of what you keep in your Seafarer Tenant: your profile, your documents, your listing in the Tideward pool if you choose to be listed, your Profile Card and Profile Share Link, your job interests and your decisions. You decide what you share with Companies and with anyone else, as sections 3.5 to 3.7 explain.

3.3 A Company entered you before you joined Tideward

A manning agency or maritime operator can enter a seafarer on Tideward, for example when it already employs you or is considering you for a position. Doing so creates an Unclaimed Tenant for you, which the Company stewards: it can see and edit your record until you claim it.

While your record is unclaimed:

• the Company that entered you is the controller of your record. It decided to put your data on Tideward, and it is responsible for having a lawful basis, for telling you about it as Article 14 of the GDPR requires, and for answering your requests. We process your record for the Company as its processor under our Data Processing Addendum;
• we are the controller of two limited uses of your data that keep the platform accurate for everyone: duplicate checks and the Claim process, described below.

Duplicate checks. Tideward exists so that one person has one record. When any Company adds a seafarer, Tideward searches the existing records while the Company types and suggests possible matches, so that the Company can work with the existing record instead of creating a second one. A suggestion shows only what is needed to recognise the person: the name, the identifying detail the Company typed (such as a seafarer number or an email address), a short line of context such as rank and nationality, and whether the record has been claimed. It does not show which other Companies hold the record. Our platform staff also review possible duplicates that get through. We rely on our legitimate interest, and yours, in accurate records (Article 6(1)(f) GDPR).

The Claim process. If you later sign up yourself and your sign-up matches your record by a strong identifier (the email address on the record, or your name together with your date of birth and nationality), we do not create a second record. Instead we email a one-time link to the address on the record, or, where there is no address and our staff approve the match, to the address you signed up with. Following the link and setting your password proves that you control the record, and your login is attached to it. A weaker resemblance never claims a record: it goes to our staff for review while your sign-up continues as normal.

Where your data came from. For an Unclaimed Tenant, your data comes from the Company that entered you: typically your identity and contact details, your rank, your documents and certificates, and your history with that Company. Section 4 lists the kinds of data Tideward can hold. This section, together with the rest of this policy, is the information we give you about data we did not collect from you. A Claim starts from our sign-up form, which links to this policy.

3.4 When you claim your record

When you claim your record, your Seafarer Tenant becomes yours. From then on:

• we are the controller of your account and your Seafarer Tenant, as in section 3.2;
• the Company that entered you can no longer edit your profile directly. A Company that works with you can propose changes to your profile, and you accept or decline them;
• the Company remains the controller of the records it holds in its own Tenant about its work with you, such as contracts, assignments, payroll and appraisals, and it keeps its Pool membership with you subject to the consent Tideward asks of you (section 3.5).

A Shared Record, such as a crewing contract or a sea-service record, is held by you and the Company together. Each of you can read it, and each of you is the controller of your own side of it. A sea-service record becomes read-only for both of you once the contract it records has been completed.

3.5 Pools and your consent

A Company that wants you in its Pool asks for your consent, and you give or refuse it in your seafarer portal. We record your consent and its date. You can see every Pool you belong to and leave any of them at any time. Leaving ends the membership from then on, but it does not delete records the Company already holds and may have to keep, such as contracts and payroll records.

Separately, you can choose to be listed in the Tideward pool, where Companies searching for crew can see a listing about you. You decide whether to be listed, and you can remove your listing at any time.

While a Company stewards your Unclaimed Tenant, it holds you in its own Pool without your consent, because until you claim there is nobody to ask. The Company is responsible for that as controller.

When you are in a Company's Pool, the Company sees what Tideward lets that relationship see, and it is the controller of its own use of that data. Tideward does not show a Company which other Companies hold you in their Pools, although your sea-service history, where you share it, shows your previous employers.

3.6 Your Profile Card and Profile Share Link

When your seafarer record is created, Tideward prepares a Profile Share Link for you. Nobody else can see the link until it is passed on: you can copy it from the Share tab of your profile, and it is sent for you when you express interest in a job whose employer is not on Tideward (section 3.7).

Your Profile Card always shows your name. It can also show your rank, a short headline you write and your availability. These three are switched on when the link is first prepared, and you can switch any of them off. The card never shows your date of birth, nationality, identity or document numbers, contact details, documents, medical information, salary, next of kin, address or the companies you have worked with.

You can revoke the link at any time. A revoked link stops working for good; sharing again creates a new link. When someone signed in to a Company account opens your link, we record who opened it, for which Company and when, and we show you that list. What that person can see beyond the card depends only on what Tideward already lets their Company see.

We are the controller of your Profile Card and Profile Share Link.

3.7 Expressing interest in a job

In Job Hunt you can express interest in a Company's opening on Tideward or in a Sourced Advert. Before you can, your profile must show at least your name, rank and availability. If the Company behind the job does not already hold you in its Pool, you also confirm that your Profile Card may be sent to it, and we record that confirmation with its date and wording. Then:

• if the employer is a Company on Tideward, we tell it inside Tideward;
• if the employer is not on Tideward and the advert gives an email address for applications, we email the Recruiter. The email lists the seafarers who have shown interest, with each seafarer's name, rank and availability as their Profile Card shows them and a link to the card, and nothing else from their profiles. Interests are collected and sent together, and under our current settings an address receives at most one such email a day. If you revoke your Profile Share Link before the email is sent, it carries no working link to your card; an email that has already been sent cannot be recalled;
• if the advert gives no email address, you are offered a link to apply on the job board instead.

We send your Profile Card on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw your interest in Job Hunt at any time. Our Sourced job adverts notice gives the full details.

3.8 Recruiters named on Sourced Adverts

If you are a Recruiter, we hold the contact details that a Sourced Advert publishes for applications (your name, email address, telephone number and postal address) and a record of the emails we have sent you. We are the controller. We use your email address only to pass on seafarers' interest, as section 3.7 describes; we never show your contact details on Tideward's public pages; and every email carries a visible unsubscribe link and supports one-click unsubscribe. We rely on our legitimate interests in helping seafarers apply for the work you advertised and in inviting your company to Tideward (Article 6(1)(f) GDPR). You can object at any time and we will stop. The Sourced job adverts notice explains how adverts are collected, how long they are kept and how to ask for one to be taken down.

3.9 People who use a Company account

If you use Tideward as a member of a Company's staff, including as a crew member a Company has given access to its vessel desk, the Company is the controller of how its account is used: the roles and permissions it gives you, the records you work on and the activity recorded in its Tenant. We process that data for the Company under our Data Processing Addendum. We are the controller of your login and sign-in, the security and audit data we need to protect Tideward, your acceptance of our notices, the billing contact details of your Company and our messages to you about the service.

Some of what you do is visible outside your Company. If you open a seafarer's Profile Share Link while signed in, the seafarer sees your name, your Company and when you opened it. Where Tideward shows who did something to a record that another Tenant can see, such as a document's access list or a Shared Record, your name appears there too.

3.10 Visitors and people who contact us

We are the controller of the data we collect through this website: the enquiry form, the sign-up forms, and the technical data described in section 4.12 and in our Cookie Policy.

3.11 Other people whose data appears on Tideward

Tideward also holds data about people who are not Users: a seafarer's next of kin and emergency contacts, the beneficiaries a seafarer asks to be paid through an allotment, and people named in documents and cases. Where that data sits in a seafarer's own Tenant, we are the controller. Where it sits in a Company's Tenant, the Company is. Whoever enters data about another person should tell them. If you are one of these people, you can exercise your rights with us or with the Company (section 10).

3.12 Our own staff

Our platform staff can open a Tenant's data through operator tools that act on one Tenant at a time, to support customers, keep Tideward secure and check for duplicates. Operator tools open data read-only, and any change an operator makes is recorded in the audit trail under that operator's own identity. To diagnose a problem, our staff can also view Tideward as a particular User sees it; starting such a view is logged. Our staff are bound by confidentiality and see personal data only as far as their work needs.

4. The personal data involved

The categories below cover everything Tideward can hold. What we actually hold about you depends on who you are and how you use Tideward.

4.1 Account and sign-in

• your name, email address and the Tenant and type of account you belong to;
• your password, which our identity service stores only in a one-way scrambled (hashed) form;
• whether multi-factor authentication is switched on, and what it needs to work;
• your roles and permissions;
• your sessions: when you signed in, and the device, browser and IP address used;
• if you sign in with Google, Facebook or X where we offer it: your name, your email address and the identifier the provider uses for you. We do not keep the provider's access tokens;
• your acceptance of our notices and consents, including each decision about your health-data consent (given, not given or withdrawn), with the version, the date and, for the Mediator & employment notice, the text as it read when you accepted it;
• your preferences, such as your time zone and display settings.

4.2 Seafarer profile

• identity: given and family names, date of birth, nationality, photograph and seafarer number;
• contact: email address, phone numbers, messaging and social profiles you add, postal address and home airport;
• professional: rank, availability and the date you are available from, sea service, training and certificates, and appraisals;
• work equipment: height, weight, and boiler suit and boot sizes;
• health details you can add to your profile: blood type, vision aid, colour vision, hearing aid, allergies and dietary requirements (see 4.6).

4.3 Documents and certificates

Passports, seafarer's books, visas, certificates of competency and proficiency, medical certificates and other documents: the files and their details, such as numbers, issue and expiry dates and the issuing authority. Such documents often contain the machine-readable zone of an identity document, your date and place of birth and the outcome of a medical fitness examination. Each document also keeps an access list showing who viewed, downloaded or shared it.

When a document is uploaded, Tideward can read its text to fill in its details for you. By default this happens inside Tideward, using the text the file already contains. Where it has been switched on, the file can instead be read by Amazon Textract or Microsoft Azure AI Document Intelligence (section 7.4). Corrections made to the text read from a document are kept within the Tenant that made them and are never shared with other Tenants.

4.4 Employment and crewing records

Mostly held by Companies: assignments and crew changes, including travel and flights; contracts; sea service; rest hours; appraisals; training approvals; complaints; P&I and welfare cases, which may include injury or illness; port calls, expenses and invoices handled by port agents; and the messages and decisions exchanged with you, such as assignment confirmations and salary offers.

4.5 Financial data

• bank details for wages and allotments: account holder, IBAN or account number, BIC or SWIFT code and bank;
• beneficiaries and the allotment instructions to pay them;
• payroll records such as wages and payslips;
• for Seafarer PRO, the bids you place on positions.

4.6 Health data

Health data is a special category of personal data under Article 9 of the GDPR. On Tideward it means:

• medical fitness certificates, such as those the Maritime Labour Convention, 2006 requires every seafarer to hold (Regulation 1.2), their outcomes, and vaccination records;
• the health details on a seafarer's profile: blood type, vision aid, colour vision, hearing aid, allergies and dietary requirements;
• injury and illness information in P&I and welfare cases.

Tideward stores these as evidence for crew operations. It does not diagnose, treat or certify anyone's medical fitness. We do not process biometric data: photographs are displayed, never used to recognise people automatically.

4.7 Next of kin and beneficiaries

The name, relationship, phone number, email address and address of a seafarer's next of kin and emergency contacts, and the name and bank details of the beneficiaries of an allotment.

4.8 Job Hunt, listing and sharing

Your job interests and the confirmations you gave, your listing in the Tideward pool, your job preferences, your Pool memberships and consents, the settings of your Profile Share Link and the list of who opened it, and, for Seafarer PRO, bids and offers.

4.9 People who use a Company account

Name, work email address, phone number if given, job title or position, the Company Tenants you belong to, your roles and permissions, the audit trail of the changes you make, and your messages and support requests.

4.10 Billing and payment

The plan and subscription of your Tenant and its history, the billing name and email address, invoices, and the payment status Stripe reports to us. You enter your card details on Stripe's own pages; we never receive or store your full card number. At checkout Stripe also collects your billing address and, if you buy as a business, its VAT identification number, uses them to calculate the tax on the payment and shows them on the invoices it issues; we do not copy them into Tideward's own records.

4.11 Communications

The emails we send you, such as sign-in and verification emails, Claim links, notifications and, for Recruiters, the emails described in section 3.8; whether each email was delivered, bounced or marked as spam; our list of addresses that must not be emailed; and in-product notifications, messages and support requests.

4.12 Technical data

Your IP address, browser and device, the pages and data you request and when, and error and security logs. The cookies and browser storage Tideward uses are listed in our Cookie Policy.

4.13 Enquiries

When you use the enquiry form on this website: your name, work email address, company, message, any referral or partner code, the plan you asked about, and how you reached us (the page where your visit began and the page you sent the form from, the site that referred you and any campaign details in the page address).

5. Why we use personal data, and our lawful bases

5.1 Where we are the controller

5.2 Where a Company is the controller

For a Company, we process personal data to run its part of Tideward: its crew register and Pools, Unclaimed Tenants it stewards, contracts, assignments and crew changes, payroll and allotments, rest hours, documents, appraisals and training, P&I and welfare cases, port calls and disbursement accounts, and vessel records. The Company chooses the lawful basis for this. Companies commonly rely on the performance of an employment or service contract, on legal obligations under maritime, flag-state, employment and tax law, and on legitimate interests. Ask the Company for its privacy notice.

5.3 Health data

• Where you add health data to your own Seafarer Tenant, such as a medical certificate or vaccination record among your documents, or the blood type, vision, hearing, allergy and diet details on your profile, we process it on the basis of your explicit consent (Article 9(2)(a) GDPR). We ask for that consent when you create your seafarer account, whether you sign up, sign up with Google, Facebook or X, or claim a record a Company entered, in a box of its own, separate from accepting our terms. Registering does not depend on it. If you do not give it then, we ask again, in place, the first time you add health information, and you can give it at any time under Account & settings → More. We record each decision, given, not given or withdrawn, with the version of the wording and the date. Without the consent you cannot add health data to your account, and you cannot share a medical document you keep with anyone new in a grant or a verified pack. Nothing else in your account depends on it: the completeness of your profile, which Health & insurance, Pay, Planning and the Tideward pool depend on, counts your blood type and a medical certificate only while your consent is active, so declining or withdrawing it never locks anything. If you claim a record a Company entered and do not give the consent, the blood type, vision, hearing, allergy and diet details the Company entered are cleared from your profile when you claim it, exactly as a withdrawal clears them; medical documents stay, as the next paragraph explains.
• You can withdraw your consent at any time under Account & settings → More, as easily as you gave it. From that moment you cannot add new health data to your account, you cannot share the medical documents you keep with anyone new, in a grant or a verified pack, until you give the consent again, and the blood type, vision, hearing, allergy and diet details on your profile are cleared at once. Your profile never becomes incomplete because of it: the blood type and the medical certificate it counted while your consent was active are simply no longer asked for. The medical documents already among your documents stay until you ask for each one to be erased (section 9.2) or write to us to have it removed altogether (section 10). We do not erase them automatically, because a Company you work with may rely on the same document under its own legal basis, as the next paragraph explains. Erasing a document's file alone does not remove its recorded details, such as a fitness outcome, as section 9.2 explains. Withdrawing does not make what we did before it unlawful, and what you shared before stays with the Company you shared it with: a grant you gave earlier runs until it expires unless you revoke it under the document, and a verified pack's link runs until the pack expires. A Company that holds you in one of its Pools, including a Pool you join after withdrawing, continues to see the documents the Pool relation lets it see, medical documents included, because joining a Pool is your own act and the Company is the controller of its use of what it sees, as section 3.5 and the next paragraph explain.
• Where you share health data with a Company, or a Company records it in its own Tenant, the Company is the controller. Companies commonly rely on obligations under employment and social security law, such as the Maritime Labour Convention's requirement that seafarers hold a valid medical certificate (Article 9(2)(b)), and on the assessment of working capacity (Article 9(2)(h)). We process that data for the Company. This includes a medical update you send to a P&I case, which becomes part of that Company's case; a file you attach to it is kept among your own documents, on your consent, and linked to the case. Your consent does not govern the Company's records, and withdrawing it does not affect them.
• We may use health data where it is needed to establish, exercise or defend legal claims (Article 9(2)(f)).

5.4 Our legitimate interests

Where we rely on legitimate interests, they are: keeping one accurate record per person, company and vessel; keeping Tideward and its Users secure; passing a seafarer's interest to the person an advert names and inviting employers to Tideward; letting seafarers see who has opened their Profile Card; being able to show what each person agreed to and when; and running and improving our service. We have weighed these interests against your rights and limited what we do accordingly, as the relevant sections describe. You can object at any time (section 10).

5.5 Consent

Where we rely on consent, you can withdraw it at any time, and withdrawing does not make what we did before unlawful. You can withdraw it yourself in Tideward: withdraw your health-data consent under Account & settings → More (section 5.3), leave a Pool, remove your listing, revoke your Profile Share Link, withdraw a job interest, or change your analytics choice with the Cookie settings link in the footer of this website. For anything else, write to dpo@rsm-software.com.

5.6 Data you must give us

To open a seafarer account we need your name, email address, date of birth, nationality and rank. To register a Company we need its name and type and the name and email address of the person registering it. To express interest in a job, your profile must show your name, rank and availability. Without these we cannot provide the feature concerned. A Company may need other data from you to employ you, and it will tell you why.

5.7 Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Hiring decisions are made by people at the Companies, not by Tideward. Some things happen automatically by rules you can see: for example, a confirmation you have not answered by its deadline closes as declined with the reason "No response", a Sourced Advert expires on its closing date, and the modules of a paid plan are hidden after the date it is paid up to.

5.8 What we do not do

We do not sell personal data, we do not use it for advertising, and we do not use the content of your records to train artificial intelligence models.

6. Where personal data comes from

• from you, when you sign up, fill in your profile, upload documents and use Tideward;
• from the Company that entered you, or from Companies you work with, through Unclaimed Tenants, Shared Records, Pool records and proposed changes to your profile;
• from other Users, for example a Company User who opens your Profile Share Link, or a seafarer who names you as next of kin or as the beneficiary of an allotment;
• from Google, Facebook or X, if you choose to sign in with them;
• from Stripe, which tells us the status of payments and subscriptions and provides invoices;
• from job adverts published on third-party job boards, for Recruiters' contact details;
• from the text of documents you upload, when Tideward reads them;
• automatically from your device and browser, as technical data.

7. Who receives personal data

7.1 Companies you deal with

• Companies whose Pool you join, within what the relationship lets them see;
• the company behind a job you express interest in: a Company on Tideward sees your interest and your Profile Card, and a Recruiter receives the details section 3.7 describes;
• Companies with which a document's holder shares that document. The holder decides who else may open each document, can limit a share to a date, and can revoke it;
• a Company's client: a Company can show a proposed crew line-up to its client through a link that expires, in which each proposed seafarer appears by first name and surname initial only.

7.2 Anyone you give your Profile Share Link to

Anyone who has your link can see your Profile Card while the link is active.

7.3 Other Companies during duplicate checks

The recognition details described in section 3.3.

7.4 Our service providers

These providers process personal data for us. The full list, with the safeguards for each, is on our Sub-processors page.

7.5 Services you choose or your browser contacts

• Social sign-in. If you choose to sign in with Google, Facebook or X, you sign in with that provider directly under its own terms and privacy policy, and it shares your name and email address with us. Each provider is a separate controller.
• Stripe. You enter your card details on Stripe's own pages. Besides processing payments for us, Stripe acts as a controller for its own legal and fraud-prevention duties, under its own privacy policy.
• Google Fonts. Tideward's pages, including the portals, load fonts from Google's servers. Your browser's request gives Google your IP address and browser details.

Our Cookie Policy gives more detail.

7.6 Others

• our professional advisers, such as lawyers, accountants and auditors, who owe us confidentiality;
• courts, regulators, law enforcement and other authorities, where the law requires it or where it is needed to establish, exercise or defend legal claims;
• a buyer of, or successor to, all or part of our business, who would be bound to protect your data as this policy does. We will tell you before your data becomes subject to a different privacy policy.

8. International transfers

We host Tideward in the European Union, in the Amazon Web Services Europe (Ireland) region.

Where one of our providers processes personal data outside the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the European Commission's standard contractual clauses (Article 46 GDPR). You can ask us for a copy of the safeguard at dpo@rsm-software.com.

Many maritime companies and recruiters are established outside the European Economic Area. When you ask us to share your data with one of them, by joining its Pool, expressing interest in its job or sharing a document with it, your data goes to that company in its own country. That country's law may not protect personal data to the standard of the GDPR, and you may find it harder to enforce your rights there. We make that disclosure because you ask us to, as part of the service you use (Article 49(1)(b) GDPR). A Company is responsible for the lawfulness of the disclosures it makes through Tideward.

9. How long we keep personal data

We keep personal data for as long as we need it for the purpose we hold it for, and longer only where the law requires or allows us to. This section describes how Tideward actually behaves today. Where a Company is the controller, the Company decides how long its records are kept, within these mechanisms.

9.1 Your account and deleting it

We keep your account while it exists. Where your portal offers it, the Delete account control in your account settings deactivates your login: your membership is marked as disabled and the browser you used is signed out. Deactivation does not erase your profile, your documents or the records Companies hold about you, and your login record stays. If you want your login closed at our sign-in service as well, or your data erased, write to us (section 10). We do not currently delete accounts or Tenant data automatically, whether after a period of inactivity or when a paid subscription ends.

9.2 Documents

Every document type has a retention period, which runs from the date a document of that type is archived:

A document's retention date is set when a User with the right permissions archives it, or when its holder asks for it to be erased. A document that is never archived, including one that has expired, has no retention date and is kept until one is set. Users with the right permissions can also set or change a document's retention date, and can place a document on legal hold, which stops it being deleted.

After a document's retention date has passed, a nightly process deletes its file and the text read from it, unless it is on legal hold, and keeps a short record that the file existed, with its size, a fingerprint of its content and the date it was deleted. The document's recorded details stay: its title, type, number, dates, issuer and place of issue, and the fields entered for it, which for a medical certificate include the fitness outcome and any restrictions. To have those removed as well, write to us (section 10). The holder of a document can ask for it to be erased sooner: the document is then archived and its file is deleted by the next nightly run, unless it is on legal hold.

Our file storage keeps a version history as protection against accidental loss. A deleted file can therefore remain in that history, where it is not visible in Tideward, cannot be opened by any User and is kept only so that we can recover from a failure.

9.3 Other records

10. Your rights

10.1 What your rights are

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased in certain circumstances (Article 17);
• restrict how we use your data in certain circumstances (Article 18);
• receive data you gave us in a structured, machine-readable form and have it transmitted to another controller, where we process it by consent or contract and by automated means (Article 20);
• object to our use of your data based on legitimate interests (Article 21);
• withdraw your consent at any time, where we rely on it (Article 7(3)); and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Article 22).

10.2 What you can do yourself

• correct your profile and your documents in your portal;
• download an account export, where your portal offers it. The export covers your account details (profile, memberships, preferences, whether multi-factor authentication is on, and active sessions). It is not a complete copy of every record about you; for that, write to us;
• deactivate your login with the Delete account control, where your portal offers it (section 9.1);
• give or withdraw your health-data consent under Account & settings → More (section 5.3);
• leave a Pool, remove your listing, revoke your Profile Share Link or withdraw a job interest;
• ask for the erasure of a document you hold (section 9.2);
• change your analytics choice with the Cookie settings link in the footer of this website.

10.3 How to make a request

Write to dpo@rsm-software.com, preferably from the email address on your account, and tell us what you are asking for. We may ask for information to confirm your identity before we act. We do not charge for a request, and we answer within one month. Where a request is complex, or you have made several, we may take up to two further months and will tell you so within the first month. If a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee, and we will explain why.

10.4 Where a Company is the controller

If your request concerns records a Company holds, such as your crew record at a manning agency or an Unclaimed Tenant a Company entered, send it to that Company. If you send it to us, we will pass it on to the Company without undue delay and, where we can, tell you which Company to contact. We help Companies answer requests as our Data Processing Addendum describes.

10.5 Limits to erasure

We cannot always erase everything. A Company may be required by maritime, flag-state, employment or tax law to keep records about your service, pay and certificates; a Shared Record also belongs to the other Tenant; the audit trail cannot be edited; and backups expire on their own cycle. Where we cannot erase data, we restrict its use to the purpose for which it has to be kept, and we tell you what we kept and why.

11. Complaints

If you are unhappy with how we handle your data, please tell us first at dpo@rsm-software.com so that we can try to put it right. You also have the right to complain to a supervisory authority at any time. Our lead authority is the Commissioner for Personal Data Protection of the Republic of Cyprus, Iasonos 1, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You can also complain to the data protection authority of the country where you live or work, or where you think the problem occurred.

12. Security

We protect personal data with measures suited to its sensitivity, including health data and bank details:

• Tideward runs on Amazon Web Services in Ireland, with its database in a private network that cannot be reached from the internet;
• all traffic to Tideward is encrypted in transit;
• the database, its backups and our file storage are encrypted at rest with keys held in AWS Key Management Service;
• every Tenant's data is separated by rules the database itself enforces, with matching checks in the application;
• stored files are kept under a storage path specific to their Tenant, in a file store that blocks all public access, and a document can be opened only by someone the platform has checked or through a share its holder issued;
• passwords are stored only in hashed form, repeated password guessing is blocked, and multi-factor authentication with one-time passcodes is available;
• changes to records are recorded in an audit trail naming the person who made them, including our own staff, and each document keeps a list of who viewed, downloaded or shared it;
• our staff reach a Tenant's data only through tools that act on one Tenant at a time and log what they do.

No system is completely secure, and RSM Software does not hold a security certification such as ISO/IEC 27001. If a personal data breach occurs, we notify the Commissioner within 72 hours where the GDPR requires it, and we tell you without undue delay where the breach is likely to put your rights at high risk. Where we act as a Company's processor, we notify the Company, which decides whom to tell.

You can help: use a strong password that you use nowhere else, switch on multi-factor authentication, sign out on shared devices, and share your Profile Share Link only with people you want to see your card.

13. Minimum age

You must be at least 16 years old to use Tideward, which is also the minimum age for work at sea under the Maritime Labour Convention, 2006. Seafarer sign-up checks your date of birth and does not accept anyone younger than 16, and a Company cannot enter a seafarer younger than 16. People who use a Company account do so for their employer; we do not ask their date of birth, and the Company is responsible for giving access only to people aged 16 or over. If you believe we hold data about someone under 16, write to dpo@rsm-software.com and we will look into it.

14. Changes to this policy

We may change this policy when Tideward or the law changes. The version and the date at the top show which text is current. Before a change that materially affects how we use your data takes effect, we will tell you by email or by a notice in Tideward. Where a change needs your consent, we will ask for it. Earlier versions are available on request from legal@rsm-software.com.

15. Contact

• Personal data and your rights: dpo@rsm-software.com
• Legal questions: legal@rsm-software.com
• By post: Rogue Star Marine Software Ltd, Pavlou Aggelinide 21, 3110 Limassol, Cyprus

Related documents: Terms of Service, Cookie Policy, Data Processing Addendum, Sub-processors, Sourced job adverts, Acceptable Use Policy and Mediator & employment notice.