Privacy Policy

1. Controller

Menzell Döhle GmbH & Co. KG, Hamburg, Germany ("we"). For all privacy questions and to exercise your rights, contact [email protected].

2. What data we store and why

• User accounts (name, email, password hash, role) — to authenticate and authorize you. Legal basis: contract (Art. 6(1)(b) GDPR).
• Two-factor authentication data (TOTP secret and recovery codes, stored encrypted) — to secure administrator accounts. Legal basis: legitimate interest (Art. 6(1)(f)).
• Port agent contact details (names, phone numbers, email addresses, role) — business contact directory for ship owners and operators. Legal basis: legitimate interest in B2B contact data published in a professional context (Art. 6(1)(f)).
• Port agency business contact data (address, email, phone) — agency directory. Legal basis: legitimate interest (Art. 6(1)(f)).
• Favorites (your saved agency links) — product feature. Legal basis: contract (Art. 6(1)(b)).
• Session data (IP address, browser user agent) — session management and security. Legal basis: legitimate interest (Art. 6(1)(f)).
• Security audit log (account changes, sign-in events including IP address) — security auditing and misuse forensics. Legal basis: legitimate interest (Art. 6(1)(f)).

3. How long we keep it

• User accounts: until you delete your account. Deletion takes effect immediately (sign-in blocked); after a 30-day grace window your personal data is permanently erased. You can cancel within the window via the link we email you.
• Security audit log: 365 days, then automatically deleted.
• Sessions: expire automatically (120 minutes) and on logout.
• Port agent data: while the agency relationship is active; removed when the agency or agent is deleted.
• Encrypted backups: at most 30 days.

4. Cookies and tracking

We use only strictly necessary cookies (session cookie and CSRF protection token). We do not use any analytics, advertising, or third-party tracking — therefore no cookie consent banner is required under the ePrivacy strictly-necessary exemption.

5. Your rights

• Access & portability (Art. 15/20): signed-in users can download a machine-readable (JSON) copy of their data at any time from Security Settings.
• Erasure (Art. 17): you can delete your account from Security Settings; see the retention rules above.
• Rectification (Art. 16): contact your administrator or us.
• Objection & restriction (Art. 18/21): contact [email protected].
• You also have the right to lodge a complaint with a supervisory authority (for Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

6. Recipients and processors

We do not sell or share personal data with third parties. Data is processed only by the service providers required to operate this platform: hosting, error monitoring (with personal data disabled), and email delivery of transactional messages (verification, password reset, account-deletion notices) via Resend (sending from the EU; a data processing agreement is in place). We never send marketing email.