1.Data controller
Avatec Marine, Istanbul, Türkiye, acts as the data controller for personal data processed through Avatec Bridge. Inquiries should be directed to infotech@avatecmarine.com.
2.Categories of personal data
- Account data. Name, email address, telephone number and role assignments for each user of the hub.
- Sign-in data. IP address, browser user-agent string, timestamps, multi-factor challenges and outcomes. Retained in the audit log for the purposes of security and incident forensics.
- Operational data. Vessel telemetry, ISP usage counters and hotspot session metadata. This is not personal data with respect to shore staff but may identify crew members when paired with named voucher accounts.
- Communications. Emails dispatched by the platform (sign-in alerts, password resets, invitations) and the corresponding delivery metadata.
3.The camera service
Where a customer contracts the camera service, Avatec Bridge carries images from cameras installed on that customer’s vessels. The roles are the reverse of the rest of this notice and the difference matters: the customer — the shipowner, manager or operator — is the controller of that footage, and Avatec Marine acts only as their processor, under a written Data Processing Agreement concluded before any remote access is possible (GDPR Article 28, KVKK Article 8). The customer decides where cameras are placed, why they record, for how long and who may look. We follow documented instructions and nothing else.
What is processed
- Moving images of anyone in a camera’s field of view — crew, contractors, visitors, port and terminal staff — together with the vessel, camera and time they were taken.
- Audio, where the camera or recorder is configured to carry it. Sound is far more intrusive than pictures and is unlawful in several jurisdictions without a separate basis. The customer decides; Avatec recommends that audio be disabled on the recorder unless there is a specific, documented reason for it.
- Still frames taken on demand for the camera wall, and clips cut from the recorder when somebody with the right to do so asks for a specific span of footage.
- Access records. Every live view, still and clip is written to the vessel’s access log with the account that opened it, the camera, the time and the duration. Where the viewer is Avatec staff, the record also carries the reason given, the reference of the access grant and the account that approved it.
Speaking through a camera
Some cameras can play sound as well as capture it. Where a recorder offers it, the platform lets the people responsible for a vessel — the customer’s Company Owner and the Master of that ship — speak through a camera’s speaker, which anyone standing near it will hear. Nothing is recorded of what is said: the audio passes through the hub to the recorder and is kept nowhere. What is kept is that it happened — the vessel’s own feed and the audit log carry who opened the speaker, on which camera and when. The microphone closes by itself after a silence, and after two minutes in any case. Avatec staff need both the same access grant as the picture and a right of their own before they can use it, and a camera covering a rest area needs the customer’s approval like any other access to it.
Where footage lives
Recorded video stays on the recorder aboard the vessel, which is the customer’s own equipment. The hub does not record, archive or analyse continuous video, and runs no facial recognition, no behaviour analytics and no automated decision-making of any kind. A live view is relayed while somebody watches and kept nowhere afterwards. A still frame is held in memory for at most twenty seconds so that several viewers of one ship cost the recorder a single request. A clip is the one copy that leaves the vessel: it is produced only when requested, stored on the hub in Amsterdam, and deleted automatically fourteen days later.
Crew areas
Cameras must never cover cabins, sanitary facilities, changing areas, the ship’s hospital, or spaces given over to rest and recreation. Where a camera unavoidably overlooks a space used by crew off duty, the customer marks it in the platform as covering a rest area. The platform then shows no still image of it to anybody, including the customer’s own administrators; opening it live requires a named, time-limited approval; and the master of that vessel is emailed the moment it is opened by Avatec. Our placement and retention defaults are published to customers in full and follow EDPB Guidelines 3/2019 on video devices.
When Avatec can see a customer’s cameras
Never by default, and never silently. An Avatec account reaches a customer’s footage only with a grant that names a reason and expires by itself: eight hours to watch live, twenty-four hours to take a clip off the ship, and sixty minutes for a single camera covering a rest area. A clip export and any rest-area camera need the customer’s own approval before they open at all; a request nobody answers within a day expires unused. Every grant carries a reference, appears on the customer’s Vendor Access page whether they approved it or not, can be withdrawn by either side at any moment, and is summarised to the customer monthly. Access to the camera product is itself assigned to named Avatec employees rather than implied by seniority, and each of them signs a confidentiality undertaking before being given it.
Rights of the people filmed
A seafarer or visitor who wants to know what was filmed of them, to obtain a copy, to object, or to have footage erased should address the vessel’s owner or operator, who is the controller and holds the footage. Avatec assists that controller in answering — the access log tells them exactly what exists and who looked at it — and will not release footage to anyone else without the controller’s documented instruction or a legal obligation. If you are unsure who the controller is, write to us and we will put you in touch.
4.Legal basis
Account, sign-in and operational data are processed on the legal bases of contract performance (GDPR Article 6(1)(b) and KVKK Article 5(2)(c)) and legitimate interest (GDPR Article 6(1)(f) and KVKK Article 5(2)(f)). Without this processing the service contracted for cannot be delivered or kept secure.
5.Recipients and disclosures
Avatec Marine does not sell, rent or share personal data with third parties for marketing purposes, and never discloses camera footage for any purpose other than the one the customer instructed. Personal data may be disclosed to (i) competent authorities where required by law and (ii) the infrastructure sub-processors below, which are the only ones used for the platform and the camera service:
- DigitalOcean — hosting of the hub and of requested clips, in Amsterdam, the Netherlands.
- Amazon Web Services (SES) — delivery of transactional email, in Stockholm, Sweden.
Both are inside the European Economic Area, so no transfer of camera footage or account data outside the EEA takes place under the current architecture. Any change is notified to customers in advance and recorded in the Data Processing Agreement.
6.Retention
Account records are retained for the duration of your organisation’s Bridge subscription and for a short period thereafter to honour offboarding requests. The audit log is retained for the period configured by your fleet’s system_owner (default 365 days, configurable from the administration settings). The configured retention period is enforced by a daily background pruning task.
For the camera service: recorded video is kept on the vessel’s own recorder for as long as the customer has contracted and its disks allow, and is overwritten by the recorder thereafter — the platform reports what the recorder actually holds and warns the customer when it falls below the contracted figure. Clips produced on request are deleted from the hub fourteen days after they are cut. Still frames are never written to disk. Access log entries, which record who looked rather than what they saw, follow the audit-log retention configured by the customer.
7.Your rights
You have the right to request access to your personal data, to obtain rectification or erasure, to restrict or object to processing, and to receive an export in a portable format. Requests should be submitted to infotech@avatecmarine.com; identity verification may be required. You also have the right to lodge a complaint with the supervisory authority of your jurisdiction — in Türkiye, the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr); in the European Union, your national data protection authority.
9.Changes to this notice
We may amend this notice from time to time. The Effective date in the header always reflects the latest revision. Material amendments will be communicated to administrators by email.