Privacy Policy

VAKE AS (“VAKE”, “We”, “Us”, “Our”) takes the privacy of our users (“User”, “You”) seriously. We have created this Privacy Statement (“Statement”) to explain how we collect, use, and disclose information when You use our websites, digital services, and applications (the “Service”). VAKE provides maritime surveillance, intelligence, and analytics solutions. To deliver these services, we process certain categories of information in a manner consistent with applicable laws, including the EU General Data Protection Regulation (GDPR)

1. VAKE’s role under data protection law

In most cases, VAKE acts as a data processor on behalf of its customers. This applies where VAKE processes personal data as part of delivering the Services based on customer-defined configurations, areas of interest, users, or operational parameters. In certain limited cases, VAKE acts as a data controller. This applies where VAKE independently determines the purpose and means of processing, such as when VAKE defines areas of interest or analytical datasets and generates insights that are shared across customers or made available as part of the Service. VAKE also acts as a data controller in relation to personal data processed for administration, operation, security, and improvement of the VAKE App and Services, including account management, authentication, access control, service monitoring, and support. Where VAKE acts as a data processor, processing is governed by a data processing agreement (DPA) entered into with the customer. Where VAKE acts as a data controller, this Privacy Statement applies.

2. Information We Collect

We may collect and process the following categories of information:

• Personal Data provided by You: such as name, email address, organization, login credentials, or other details You submit when registering for or using the Service.
• Usage and activity data: interactions with our platforms and features, reports viewed, feedback You provide (e.g., via surveys or forms), and behavioral patterns collected to improve the user experience and product performance.
• Device and technical data: such as browser type, operating system, IP address, and log files generated during Service use.
• Other data You choose to provide: when communicating with us (e.g. support inquiries, feedback).

We collect data primarily from You directly, or it is generated automatically when You interact with the Service.

3. Use of Your Information

We may use Your information to provide, maintain, and improve the Service, as well as to communicate with You. Where VAKE acts as a data controller, personal data is processed for the following purposes and on the following legal bases, in accordance with applicable data protection laws.

• Provision and operation of the VAKE App and Services, including account creation, authentication, access control, customer administration, service delivery, and user support. Legal basis: Performance of a contract (GDPR Article 6(1)(b))
• Security, monitoring, and prevention of misuse, including logging, audit trails, troubleshooting, and ensuring the integrity, availability, and confidentiality of the Services. Legal basis: Legitimate interests (GDPR Article 6(1)(f))
• Improvement and development of the Services, including analysis of usage patterns, system performance, and service reliability. Legal basis: Legitimate interests (GDPR Article 6(1)(f))
• Generation and distribution of VAKE-defined analytical insights, where VAKE independently determines the purpose and means of processing and makes such insights available as part of the Service. Legal basis: Legitimate interests (GDPR Article 6(1)(f))
• Compliance with legal obligations, including accounting requirements, regulatory compliance, and responding to lawful requests from public authorities. Legal basis: Legal obligation (GDPR Article 6(1)(c))

Where processing is based on legitimate interests, VAKE has assessed that such interests are not overridden by the fundamental rights and freedoms of the data subjects.

Where processing requires consent under applicable law, VAKE will obtain such consent prior to processing. Any consent given may be withdrawn at any time.

4. Sharing Your Information

We may share Your information with third parties, such as technical service providers, in order to provide and improve the Service. We may also share Your information with third parties as required by law. We do not sell or disclose personal data to third parties for marketing or other purposes unrelated to the Service.

We will restrict the amount of data given to service providers and only share information that is important to make the best service possible. When we give third parties access to personal data in this way, we make use of data processing agreements so that we ensure that the third parties comply with our high standards, requirements for the processing of personal data, and applicable legislation.

Disclosure of personal data may also take place in connection with a business transfer, merger, acquisition, amalgamation of, with or to another company.

Our main purpose is to keep the oceans safe. It is therefore conceivable that we will share information with collaboration partners and/or representatives from academia and research institutions for this purpose. In that case, we will inform you about who our partners are and what information we will share.

Two of our service providers is located outside the EU/EEA (SendGrid by Twilio and CloudFlare). Where personal data is transferred to such third countries, VAKE ensures that appropriate safeguards are in place in accordance with applicable data protection laws, including the use of standard contractual clauses approved by the European Commission.

Key service providers and partners who provide hosting, infrastructure, analytics, or support services:

• Google Cloud Services (Europe)
• Hotjar (Europe)
• Nemme (Norway)
• SendGrid by Twilio (USA)
• CloudFlare (USA)

5. Data Retention

VAKE retains personal data only for as long as necessary to fulfil the purposes for which the data is processed and in accordance with applicable data protection laws. Retention periods vary depending on the nature of the data, the purpose of the processing, and legal or regulatory requirements. VAKE has established internal data retention policies that define how long different categories of personal data are retained and when such data is deleted, anonymised, or pseudonymized. Such categories may include, for example, account and user administration data, system and security logs, and analytical or usage data. Personal data is deleted or anonymised when it is no longer required for the relevant purpose, unless retention is required to comply with legal obligations or to establish, exercise, or defend legal claims.

6. Data Security

VAKE implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with applicable data protection laws, including GDPR Article 32.

Such measures are designed to protect personal data against unauthorised access, disclosure, alteration, or destruction, and include, where appropriate: Access controls and authentication mechanisms to ensure that personal data is only accessible to authorised users.

• Role-based access and the principle of least privilege.
• Logging and monitoring of system activity for security and operational purposes.
• Measures to ensure the confidentiality, integrity, availability, and resilience of systems and services.
• Procedures for handling security incidents and responding to data protection breaches.

Security measures are reviewed and updated on an ongoing basis, taking into account the nature of the data, the risks associated with the processing, and technological developments.

Access to the Service requires users to authenticate using personal credentials. Users are responsible for keeping login information and access credentials confidential.

7. Your Rights

You have the right to access, correct, and delete Your Personal Data, as well as the right to object to the processing of Your Personal Data. You also have the right to request that Your Personal Data be transferred to another controller.

You have several rights related to our processing of your personal information. Here you get information about which these are and how you can exercise these rights to us. If you want to exercise some of your rights, this can be done by contacting us. You are entitled to an answer from us without undue delay, and no later than one month.

• Access: You have the right to know what information we have registered about you (with the restrictions provided by current legislation).
• Correction: You may require incorrect, deficient or outdated personal information to be corrected.
• Protesting: You have the right to protest our processing of your personal information if we process information about you on the basis of a balance of interest.
• Withdraw your consent: You can withdraw consents you have given us to process your personal information, at any time.
• Deletion: If you protest the processing of your personal information, or you withdraw your consent, information that we have stored about you will be deleted on the condition that we have no other basis for retaining them.
• Data portability: If we process information about you that you have provided us with the basis of consent or agreement, you can ask us to transfer information about you to you or to another processing officer, as long as this is technically possible.
• The right to complain to a supervisory authority: If you believe our processing of your personal data should be in violation of the Privacy Regulations, we would like to hear from you. You also have the opportunity to complain about this to the Data Inspectorate. Complaints can be submitted on the Data Inspectorate's website; www.datatilsynet.no.

8. Contact Us

If You have questions about this Statement, or if You wish to exercise Your rights, please contact us at [email protected]. You can also use the following contact details: VAKE AS Universitetsgata 2 0164 Oslo Norway

9. Jurisdiction

This Statement shall be governed by the laws of Norway.

10. Changes to this Statement

We may update this Statement from time to time. We will inform You of any changes by posting the new Statement on the Service. You are advised to review this Statement periodically for any changes. If we make significant changes to the Privacy Policy, You will receive notification directly through available channels such as e-mail. When we make changes to this privacy policy, we will change the revision date at the top of this page, and a modified privacy policy will take effect from the revision date. This privacy statement is intended to provide you with information on how we collect, use and disclose information that we may collect from you in connection with your use of the VAKE services.