Sail Platform Privacy Policy

Introduction

General

Applies to: SAIL Platform (the maritime ERP and operational SaaS provided by Safe Lanes Innovation Pte Ltd, including its web, vessel, and mobile components, hereafter the “Platform”).

This Privacy Policy describes how Safe Lanes Innovation Pte Ltd (trading as SAIL Software, hereafter “Safe Lanes”, “we”, “us”, or “our”) processes personal data within the SAIL Platform. It is intended for the personnel of our customers (shipping companies and ship managers) whose personal data is processed when they use, or are recorded within, the Platform.

Who we are

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, and the Singapore Personal Data Protection Act 2012 (“PDPA”), Safe Lanes ordinarily acts as a data processor on behalf of its customers, who are the data controllers of personal data processed within their tenant of the Platform. The roles are confirmed in writing in the applicable customer agreement and/or Data Processing Agreement.

Where Safe Lanes processes data for its own purposes (for example, account administration of the customer’s named platform users, security monitoring of the Platform, or compliance with its own legal obligations), Safe Lanes acts as a data controller for that limited processing.

Scope

This Policy applies to personal data processed within any module of the SAIL Platform, including but not limited to:

• Planned Maintenance System (PMS) / Technical
• Forms, Checklists and Inspections
• Audits and Findings
• Incident Reporting and Investigation
• Voyage and Operational Reporting
• Crew records (where the customer subscribes to the relevant module)
• Document Management, Safety Management System repositories and chat-based assistants integrated with the Platform

It does not apply to the public Safe Lanes website (safe-lanes.com), or to third-party services that the customer may integrate with the Platform under their own arrangements.

Categories of personal data processed

The categories of personal data processed within the Platform depend on the modules the customer has subscribed to and the data the customer chooses to enter. Typical categories include:

Safe Lanes does not require customers to upload special categories of personal data (Article 9 GDPR — health, biometric, racial or ethnic origin, religious belief, etc.). Where a customer chooses to upload such data in unstructured fields or attachments, the customer remains responsible for the lawful basis to do so.

Purposes and legal basis for processing

Safe Lanes processes personal data within the Platform strictly for the following purposes, and only on documented instructions from the customer (controller):

Safe Lanes does not use customer personal data to train artificial intelligence or machine learning models for the benefit of third parties and does not sell personal data.

Sources of personal data

Personal data is obtained from:

• The customer’s authorised administrators, who provision user accounts and configure the tenant
• The customer’s users, who enter data into the Platform in the course of their duties
• Vessels’ onboard systems that sync data to the shore tenant via the Platform’s sync engine
• Authentication and security systems (e.g. login attempts, MFA challenges)

Safe Lanes does not collect personal data from public sources or third-party data brokers for the purposes of the Platform.

Recipients of personal data

Personal data within a customer’s tenant is, by default, accessible only to:

• The customer’s own authorised users, in accordance with the customer’s role-based access control configuration
• A limited number of Safe Lanes technical and support personnel, on a strict need-to-know basis, bound by written confidentiality obligations, and only as required to deliver, secure, maintain or troubleshoot the Platform
• Sub-processors engaged by Safe Lanes (see Sub-processors section)
• Competent authorities, where Safe Lanes is legally compelled to disclose

Personal data is not shared with one customer’s tenant for the benefit of another customer.

Sub-processors

Safe Lanes engages a limited number of sub-processors to provide infrastructure, communications and supporting services. The current list is maintained by Safe Lanes and made available to customers on request and where a Data Processing Agreement is in place, in accordance with its terms.

Current principal sub-processors include:

Where required by the customer’s Data Processing Agreement, Safe Lanes will give prior written notice of intended changes to its sub-processor list and provide the customer a reasonable opportunity to object.

Safe Lanes imposes data protection obligations on each sub-processor that are no less protective than those it owes its customer and remains responsible to the customer for the acts and omissions of its sub-processors.

International transfers of personal data

The Platform’s primary hosting location is Singapore (AWS ap-southeast-1). Customer data is therefore transferred from the customer’s jurisdiction (which may include the European Economic Area, the United Kingdom, India, or elsewhere) to Singapore.

For transfers of personal data originating in the European Economic Area or the United Kingdom, Safe Lanes relies on the following safeguards:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission in Decision 2021/914, Module Two (Controller-to-Processor), incorporated by reference into the applicable Data Processing Agreement between the customer and Safe Lanes; and
• The UK International Data Transfer Addendum to the EU SCCs (or the UK IDTA) for transfers subject to the UK GDPR;
• Supplementary technical and organisational measures (encryption in transit and at rest, access controls, logging, and the measures described in the Security section) sufficient to address the risks of the transfer, as assessed in our Transfer Impact Assessment which is available to customers on request.

Singapore is recognised internationally as having a robust data protection regime under the PDPA, supervised by the Personal Data Protection Commission of Singapore.

Where Safe Lanes engages a sub-processor outside Singapore (e.g. OpenAI in the United States, only where the customer enables AI-features), equivalent transfer safeguards (SCCs and supplementary measures) are put in place with that sub-processor.

Security of personal data

Safe Lanes maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, in accordance with Article 32 GDPR. These measures include:

Safe Lanes is led on information security and data protection matters, by a Chief Information Security Officer holding CISM and CEH certifications.

A more detailed schedule of Technical and Organisational Measures is made available to customers under the applicable Data Processing Agreement.

Data retention

Personal data is retained for as long as the customer’s contract with Safe Lanes is in force, and as required for the customer’s documented retention obligations (for example, statutory record-keeping requirements for maritime inspections, audits and crew records).

On termination of the customer’s contract, Safe Lanes will, at the customer’s choice, return all personal data to the customer or delete it, within a reasonable period not exceeding ninety (90) days, save where applicable law requires longer retention. Backups containing personal data are overwritten in the ordinary course of the backup rotation cycle.

Audit logs are retained for a period appropriate to security and regulatory requirements, typically not less than one (1) year.

Rights of data subjects

Individuals whose personal data is processed within the Platform have, under the GDPR and other applicable laws, the following rights:

Because Safe Lanes ordinarily acts as a processor, requests by individuals to exercise their rights are most appropriately addressed to the customer (the controller) typically the individual’s employer or ship manager. Safe Lanes will, however:

• Forward any rights request received directly to the relevant customer without undue delay, and
• Assist the customer, at the customer’s instruction, in fulfilling the request, taking into account the nature of the processing.

Where Safe Lanes acts as controller for the limited purposes set out in the Who we are section, individuals may exercise their rights directly with us by writing to support@sl-sail.com. We will respond within one (1) month of receipt of a verified request, extendable by a further two months for complex or numerous requests.

Personal data breach notification

In the event of a personal data breach affecting customer data, Safe Lanes will notify the affected customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of the breach. The notification will, to the extent then known:

• Describe the nature of the breach, including the categories and approximate number of data subjects and records concerned
• Communicate the name and contact details of the person from whom further information can be obtained
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach and mitigate its effects

Safe Lanes will assist the customer in meeting the customer’s own notification obligations to supervisory authorities and data subjects under Articles 33 and 34 GDPR.

Cookies and similar technologies (Platform web interface)

The Platform’s web interface uses strictly necessary cookies and similar technologies to maintain user sessions, enforce security (e.g. CSRF protection) and remember user preferences. No third-party advertising or cross-site tracking cookies are used in the authenticated Platform interface.

Children

The Platform is a B2B SaaS used by maritime professionals and is not directed at children. We do not knowingly process the personal data of children.

Changes to this Policy

Safe Lanes may update this Policy from time to time to reflect changes in our processing, legal requirements or industry best practice. Material changes will be communicated to customers through the Platform or by email to the customer’s nominated administrators, with reasonable advance notice. The effective date and version number at the top of this Policy will be updated accordingly.

Contact

For any question or request concerning this Policy or the processing of personal data within the SAIL Platform:

Safe Lanes Innovation Pte Ltd
Email: support@sl-sail.com
Website: https://old.safe-lanes.com

Customers operating in the European Economic Area or the United Kingdom may, where required, request information on Safe Lanes’ arrangements under Article 27 GDPR.

Document approval

This version of the SAIL Platform Privacy Policy has been reviewed and approved by the persons named below. A signed master copy is retained as part of Safe Lanes’ internal records and is available to customers, regulators or auditors on request.

Approved by — For and on Behalf of Safe Lanes Innovation Pte Ltd

Owned by — Accountable Officer for Data Protection and Information Security

© Safe Lanes Innovation Pte Ltd. This document is intended as a public-facing privacy notice. It does not replace, and is supplemented by, the Data Processing Agreement and Technical and Organisational Measures schedule made available to customers as part of their contract with Safe Lanes.