Privacy Policy

Effective date: 6 October 2026 Last updated: 6 October 2026 Version: 2.0 (previous version: 1.0 — 1 September 2026)

Language notice: This is an English translation provided for your convenience. The Turkish version is the binding text; in the event of any discrepancy between the two, the Turkish version prevails. See Gizlilik Politikası.

This policy explains how personal data is processed on the Pelastra platform (pelastra.com and api.pelastra.com, including the web and mobile interfaces). It has been prepared under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the European Union General Data Protection Regulation (GDPR). For a short summary, see the Personal Data Processing Notice.

1. Who we are and what this policy covers

1.1 Data controller

We have no representative established in the European Union. If we begin systematically offering services to users established in the EU, a representative will be appointed under GDPR Art. 27.

1.2 We have two different roles

Pelastra is both a platform that seafarers use with their own accounts and software with which maritime companies manage their fleets and personnel. For this reason, we may be in two different positions with respect to your data:

The relationship between us and companies is governed by a separate data processing agreement (Data Processing Agreement).

2. Data we process as data controller

The data processed varies depending on the type of user (seafarer / company user) and which features they use. A significant portion of the fields below is optional. You can use your account without filling them in; only the related feature will not work.

2.1 Account and authentication

When you sign in with Google, Google sends us your name, your e-mail address and the fact that the e-mail has been verified by Google. Your Google password never reaches us. The single-use code we use to protect sign-in against replay attacks is stored only as a hash and for 5 minutes.

2.2 Seafarer profile (optional)

Date of birth, gender, nationality, country / province / district of residence, marital status, military service status, height, weight, shoe size, coverall / clothing size, profile photo, "about me" text, current rank.

Body and size information is requested in the industry for the supply of work clothing and safety equipment. You are not obliged to enter it.

2.3 Identity information (optional, on a separate screen)

This information is entered on a separate screen from the rest of the profile and is never, under any circumstances, placed in share links:

• Turkish national identity number (not entered for foreign nationals)
• Place of birth, father's name, mother's name, second nationality
• Full address, postal code
• Your nearest airport (for travel planning)

Why it is requested: the crew list (FAL Form 5), visa, ticket and insurance procedures of the company you work for require this information. If you do not enter it, the company will request it from you separately for those procedures.

2.4 Professional information and documents (optional)

• Sea service / experience: company name, vessel name, IMO, vessel type, tonnage, rank, trading area, service dates, duties performed
• Education: school, department, graduation details
• Passport: number, name and surname as printed in the passport, issuing country, place and date of issue, validity, colour
• Seaman's book: book number, issuing country, place and dates of issue; if verified against the official register, the verification status and time
• Certificate of competency (CoC): certificate number, rank, qualification, trading area, STCW section, GMDSS, issuing country, dates
• Flag state endorsements, visas, STCW certificates and other certificates: document numbers, issuing authority, country, dates
• Document files you upload: scanned copies of the documents above and the document packages you create
• Foreign languages, skills and job preferences (desired rank, vessel type, contract type, region)

2.5 Bank account (optional)

Account holder's name, bank name and country, IBAN, account number, SWIFT code, currency, primary account flag. At most five accounts.

Why it is requested: so that the company you work for can pay your wages. Your bank information is not placed in share links; it can be seen only by the authorised users of the company whose personnel you are (§5.1), and every viewing is logged.

2.6 Special category personal data — health

The following data is special category / sensitive data within the meaning of KVKK Art. 6 and GDPR Art. 9 and is processed solely on the basis of your explicit consent:

• Health document records: document type (e.g. seafarer medical certificate, ENG1, flag state medical certificate, pre-employment medical examination, drug and alcohol test, yellow fever vaccination), document name, number, issuing institution, dates of issue and validity

Only information about the document itself is kept. No medical content is processed, such as a "fit / unfit" result, a restriction, an illness, a diagnosis, treatment or a test result. Do not write medical information in the document name field. ⚠️ This limit applies to the records you enter into your own profile. A copy of a medical report uploaded by a company that employs you and the injury records kept by the company are a different flow (§3).

Filling in these fields is entirely optional. You may withdraw your consent at any time; when you withdraw it, your health document records are deleted.

Separate consent in share links: If you wish to include the health section when sharing your profile via a link, the system asks for your separate and explicit approval and records the moment the approval was given. If you do not give approval, health fields are not generated at all in the shared content.

2.7 Data belonging to third parties

Two types of record you can add to your profile belong to another person who may not be a platform user:

⚠️ Your responsibility: Before adding a person as a reference or emergency contact, you must inform them and obtain their approval. A person who learns that they have been recorded may write to [email protected] to request the deletion of their record; we fulfil the request within 30 days.

2.8 Profile share links

You can show your profile to an employer or another person via a link.

• You choose which sections will be visible. A section you do not select is not generated at all in the response.
• At the moment the link is created, a copy of the sections you selected is taken; changing your profile afterwards does not change the shared content.
• A link is valid for at most 90 days; you can revoke it at any time.
• The profile header shows your name, photo, rank, nationality, location, date of birth, gender, marital status and military service status.
• Identity numbers are not shared in any section: Turkish national identity, passport, visa, seaman's book, endorsement and certificate of competency numbers, bank information and emergency contacts are not placed in the link.
• Each time the link is opened, the IP address and browser information of the person opening it are recorded; this allows us to show you when your profile was viewed (§9).

2.9 Communication and community

• Messaging: messages in direct and group chats, participants, read status, the "typing" indicator (not stored, transmitted in real time)
• Social: friend requests, friendships, users you have blocked
• Community: channel memberships, posts, comments, likes, bookmarks, images you upload. Your membership in the vessel and department channels of the company you work for is set up automatically according to your assignment on board
• Notifications and your notification preferences. Notifications and messages are delivered in real time while the application is open; the connection established for this purpose does not store content
• Activity feed: your visible actions on the platform (publishing a post, forming a friendship, etc.)

Your messages are not end-to-end encrypted. We do not routinely read their content; however, we may access them in the event of an abuse report, a legal obligation or a security investigation.

2.10 Subscription and payment

Subscription status, plan tier, period information and subscription events relating to paid plans are stored. Once payments begin to be collected, your card details will not reach our servers and will not be stored by us; payment is collected by the licensed payment institution iyzico — iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (Türkiye) on its own infrastructure.

As of this date, no online fees are collected on the platform.

2.11 Forms on our marketing site

Data of visitors who fill in the demo request and contact forms: first name, last name, e-mail, company, title, phone, fleet size, areas of interest, message, the page and the campaign link through which the form was submitted, the version of the privacy notice read, optional consent to commercial electronic messages (with the time of consent and IP address), and the sender's IP address to prevent abuse. The person filling in the form does not need to have an account on the platform.

The purpose is to respond to your request; if you have given consent, we may also send product announcements. The IP address is deleted after 90 days and the other personal information after 2 years; the record then retains only statistical information such as company name and fleet size. You may withdraw your consent to commercial messages at any time by writing to [email protected].

2.12 Technical data and logs

Passwords, session tokens, identity / passport / seaman's book / visa numbers and IBANs are masked (***) in audit records and application logs. This behaviour is enforced at code level.

3. Data that companies process on Pelastra

The data controller for the data in this section is the relevant company (§1.2). Pelastra stores and processes this data on the company's behalf. The description below is so that you know in advance which data may exist; as regards purpose, legal basis and retention period, the privacy notice the company will give you is what applies.

3.1 When you work for a company

• Personnel record: category, rank, title, department, dates of hiring and leaving, employment periods, availability status and note
• Service history: vessel, rank, sign-on and sign-off, contract, reason for leaving, end-of- assignment appraisal
• Crew list and rotation plan: vessel, assignment dates, ports, the company's internal notes, the joining note shown to you
• Pre-joining preparation: checklist, declaration forms you fill in, ticket and travel information (flight, PNR, ticket number, fare)
• Leave records: annual leave, courses, unpaid leave and sick leave dates (no diagnosis is kept)
• Monthly appraisal, competency assessment, personnel record notes
• "Do not re-employ" record: the company may keep such a record together with its reasons. This record is not shown to you; only the company's authorised users see it, and it prevents the company from entering into a new working relationship with you
• Survey responses: identified or anonymous. In an anonymous response your identity is not linked to the response; results are shown in groups of at least 5 persons
• Safety records: your hours of work and rest and your monthly acknowledgement, watch schedule, form submissions, incident reports, injury records (body part, nature of the injury, severity, lost workdays, medical note — health data), non-conformity and audit records
• In maintenance, voyage report and procurement records, your identity and rank as the person who performed the operation
• Crew wages (earnings statements): wage agreement, monthly earnings statement, advances and expense items on board, employment agreement (SEA). A copy of the employment agreement is stored together with your identity and document numbers as they were at the time it was issued

3.2 If the company opened a record on your behalf

A company may open a record on behalf of an employee who does not use the application and track their documents through this record. This record cannot be used to sign in. If you have been notified that your record has been opened with your e-mail address, you can claim the record via the link and convert it into your own account; from then on only you can write to your profile, and the company can only read it. Information about which company opened the record is kept after the record is claimed as well.

3.3 Documents uploaded by the company

The company may upload employer records relating to you: employment agreement, training record, insurance document, medical report, document scans.

• Within the company, the medical report can be opened only by users with health data permission.
• The officers on the vessel you are assigned to (master, chief engineer, second and third officers, electro-technical officer) may view the documents of the crew on that same vessel for vessel operations and inspection readiness. In other words, a copy of your medical report is a record accessible not only to the shore office but also to the officers on the vessel you sail on.
• When an access link to one of these documents is obtained, who obtained it, when, with which rank and from which IP address is recorded (30 days). The record captures the moment the link was issued; we cannot see whether the file was actually opened.
• When the company uploads a document copy to link it to a record in your profile, the file also appears in your profile and you can delete it.

3.4 Querying the seaman's book against the official register

The company whose personnel you are may query your seaman's book against the seafarer register of the Ministry of Transport and Infrastructure (Ulaştırma ve Altyapı Bakanlığı). For this purpose your Turkish national identity number and your seaman's book number are sent to the Ministry's system. The query is made only when a company user requests it; there is no scheduled scan.

• Viewing: the register record (birth information, father's name, documents, passport-style photograph) is shown to the company user; nothing is saved.
• Updating: performed only on records that the company opened on your behalf and that have not yet been claimed. Date of birth, gender, place of birth, father's name, the dates and verification status of the seaman's book, and matching certificates are written to the record. If the record has no profile photo, the passport-style photograph from the register is saved as the profile photo.

3.5 Other persons recorded by companies

Companies may record the contact person details (name, e-mail, phone, address) of suppliers, agents, charterers, brokers and similar business partners, as well as shipper / consignee details appearing in cargo documents. Procurement and ticket requests may be sent to these persons by e-mail, and incoming reply e-mails may be stored on the platform. In ticket requests, passengers' first and last names are forwarded to the travel agency. The controller for this data is also the relevant company.

4. Purposes and legal bases

This table covers the processing for which we are the data controller (§2).

Legitimate interest assessment: We rely on legitimate interest for security records and notifications. Protecting the platform against abuse, preventing professional harm to a seafarer whose certificate is expiring, and enabling companies to carry out retrospective audits were weighed against your privacy expectations. Balancing measures: keeping access records that carry an IP address for 30 days and application logs for 14 days; masking identity numbers, IBANs and passwords in the audit record; allowing notification categories to be switched off individually. You may request the details of the assessment from [email protected].

5. To whom we transfer

5.1 At your direction

• The company whose personnel you are. When you accept a company's personnel invitation, that company's authorised users can see your profile, your documents, your health document records and your sea service analysis. Your identity information (§2.3), document numbers, bank accounts and emergency contacts are opened only to users who have been granted permission to see this data. These viewings are logged. Of the document files in your profile, the company sees only those it uploaded itself and those you have linked to a record. While using your own account, you can be personnel of only one company at a time; you can end your relationship with the company yourself.
• People to whom you give a share link: only the sections you select (§2.8).
• Other users: your community posts, the public part of your profile, the people you message.

5.2 Public institutions

• Ministry of Transport and Infrastructure: for the seaman's book query, when the company whose personnel you are requests it (§3.4).
• Competent authorities: to the extent legally required, upon a duly made request.

5.3 Our service providers (data processors)

We do not sell or rent data to any third party for advertising purposes. We do not use any analytics, advertising or error-tracking service; we keep our application logs on our own server.

Google: When you sign in with Google, data comes from Google to us; our servers do not send Google any data about you. Google is therefore not a recipient of a transfer but the source of the data (§2.1). The "Continue with Google" button on the sign-in screen, however, loads Google's own script into your browser; the information collected by that script is subject to Google's privacy policy (policies.google.com/privacy).

Other addresses your browser connects to directly: Airline logos shown in flight information are loaded from pics.avs.io; in doing so, your browser's IP address reaches that server. Apart from this, our pages do not load any third-party scripts, fonts or images.

5.4 About transfers abroad

Our servers and main database are located in Türkiye (İstanbul). Transfers abroad are limited to the service providers above and to the functions stated.

• Transfers that are necessary for the platform to operate (file storage, e-mail, network) are made by signing the standard contracts announced by the Personal Data Protection Board (KVKK Board) and notifying the contracts to the Board (KVKK Art. 9(4)). We do not ask for your consent for these transfers.
• The transfer for the optional artificial intelligence feature is made only when you choose to use that feature and with your explicit consent. These countries may not offer the same level of protection as the KVKK, and your data may be accessed by the public authorities of that country.

Document files are kept in storage that is closed to access and can be read only through short-lived signed links.

6. Use of artificial intelligence

Sent for the professional summary: your rank, your qualification, your total sea service time, the number and types of vessels, the position and vessel name in your last ten assignments, certificate names, skills, languages and levels, school names. Not sent: your name, your contact details, your identity and document numbers, your health data, your document files, your messages.

• The feature runs only when you request it; your data is not sent as long as you do not use it.
• The generated text is shown to you first; text you do not approve is not written to your profile.
• Artificial intelligence can make mistakes. Checking the accuracy of the generated summary is your responsibility.
• Anthropic undertakes not to use data sent via the API for model training (anthropic.com/legal — Commercial Terms and Data Processing Addendum).

The platform does not make an automated decision about you that produces legal effects or similarly significantly affects you (GDPR Art. 22). Hiring and assignment decisions are made by companies.

7. Retention periods

Deleting your account does not delete company records. Your personnel record, service history, leave records and identified survey responses are deleted. By contrast, crew list, rotation, ticket, safety, maintenance, voyage, crew wages and procurement records are the company's legal and operational records and remain with the company. In these records your name mostly appears as "Deleted User"; however, in personnel documents uploaded by the company, in the copy of the employment agreement and in the company's "do not re-employ" record, a copy of your name as it was at that time remains. For these records you must address your deletion request to the company.

Deletion is performed by automated scheduled jobs; it does not depend on manual intervention.

8. Your rights

Under KVKK Art. 11

To learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties to whom it is transferred domestically or abroad; to request rectification if it has been processed incompletely or incorrectly; to request erasure or destruction; to request that rectification and erasure be notified to the third parties to whom the data was transferred; to object to a result arising against you through analysis exclusively by automated systems; to claim compensation if you suffer damage due to unlawful processing.

Additional rights under the GDPR

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)), not to be subject to automated decision-making (Art. 22).

How to exercise your rights

Yourself, on the platform:

• You can edit and delete your profile, identity, document, bank and emergency contact information from your account.
• You can revoke your share links; revocation genuinely terminates access via the link. Files already downloaded cannot be recalled.
• You can see your open sessions and close them individually.
• You can switch off notification categories individually.
• You can withdraw your consents as easily as you gave them.
• You can end your relationship with the company whose personnel you are.
• You can delete your account yourself. Your account is immediately closed to access and your data is permanently deleted after 30 days. Within that period you can reverse your request using the link in the e-mail sent to you.
• You can download all of your personal data in a single file (machine-readable JSON). The file also contains, of the records that companies keep about you, those that belong to you (personnel record, assignment details, leave type and dates, earnings statements, hours of work and rest records, identified survey responses). The company's internal appraisals and notes are not included in this file; for those you must apply to the company.

By application: you can apply in writing to [email protected] (from the e-mail address registered in our system) or to the postal address in §1.1. We must be able to verify your identity. Your request is concluded free of charge within 30 days at the latest (KVKK Art. 13; under GDPR Art. 12 one month, extendable by two months for complex requests). If the operation additionally entails a cost, the fee in the tariff set by the KVKK Board may be charged.

For company data (§3): apply to the relevant company. If your application reaches us, we forward it to the company and inform you.

Right to complain:

• Türkiye: Personal Data Protection Authority — kvkk.gov.tr
• EU: the data protection authority in the country where you are located

9. Data security

• All traffic is encrypted with HTTPS/TLS.
• Passwords are irreversibly hashed with bcrypt.
• The session refresh token is kept in the browser in an HttpOnly cookie that page scripts cannot read, and is sent only to the authentication addresses.
• The tokens in verification, reset, invitation and share links are stored in the database as hashes, not in plain text.
• Document files are kept in non-public storage, and profile photos in an area of our server that is closed to access; both can be opened only via a short-lived signed link.
• Authorisation is permission-based. Company users' authority is limited by role and, where necessary, by vessel; identity, health, wage and appraisal data are protected by separate permissions. Platform administration and company permissions are isolated from each other.
• Company users' access to health, bank and identity document data is logged.
• Sensitive fields are automatically masked in audit records and logs.
• When you set up the application for offline use on board, vessel data, the documents you download and your records not yet sent are kept encrypted on your device. When you sign out, readable data is deleted from the device; records not yet sent, however, are kept so that they are not lost, but in a form that cannot be opened without a key specific to you and the device, obtained from our server. Do not leave your session open on a shared device.

No system is 100% secure. In the event of a breach affecting your personal data, we will notify the Personal Data Protection Board as soon as possible and within no more than 72 hours under the KVKK, the competent supervisory authority under GDPR Art. 33, and — where a high risk arises — you directly. We notify the relevant company without delay of a breach affecting company data.

10. Children's data

Pelastra is not directed at persons under the age of 18. Accounts of users we learn to be under 18 are closed and their data deleted. If you believe your child has provided us with data, write to [email protected].

11. Cookies

We use only one strictly necessary cookie to keep your session secure; we do not use advertising or analytics cookies. Details: Cookie Policy.

12. Changes to this policy

When we update the policy, we change the version number and the "last updated" date. For significant changes (a new processing purpose, a new recipient abroad, an extension of a retention period) we inform you in advance by e-mail or in-platform notification. If processing based on consent is being expanded, your consent is obtained again.

Previous versions are kept at pelastra.com/privacy/arsiv.

What changed in version 2.0: the distinction between our two roles (§1.2); identity, bank, emergency contact and document number fields (§2.3–§2.7); data processed by companies (§3); the official register query (§3.4); the move of the legal basis for transfers abroad to standard contracts (§5.4); the retention period of audit records becoming 5 years; the move of profile photos to an area closed to access.

13. Contact

For any question about this policy or your personal data: [email protected]