GDPR & Compliance

GDPR Readiness Statement · Updated August 19, 2026 · Document Version: 1.1

PortFlow is a maritime operations platform for port agencies. Many of the agencies that use it work with shipping companies, vessel owners and crew who fall under European Union data protection rules, even when the agency itself operates entirely outside the EU.

This statement describes how personal data is actually handled inside the product today: who processes it, where it sits, what is encrypted, what can be exported and what cannot.

PortFlow is a data processor for the agencies that use it, and a data controller for its own account holders and waitlist contacts. It holds no GDPR certification and has not been independently audited. Nothing below is a forecast; anything not stated here has not been verified.

1. GDPR Compliance Overview

1.1 What is GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679) applies to:

· Any organisation processing personal data of people in the EU
· Organisations established outside the EU, when they offer goods or services to people in the EU or monitor their behaviour (Art. 3(2))
· Fines of up to €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 83(5))

1.2 Why Does This Matter for Maritime Agencies?

Maritime agencies routinely handle data about European shipping companies, EU citizen crew, EU based vessel owners and European counterparties. That data is covered by GDPR even when your agency sits entirely outside the EU. It does not follow that any particular software makes you compliant: the obligations stay with your agency, and no software vendor can take them over.

2. Data Controller vs. Data Processor

Your Role: Data Controller

· You decide what data to collect and why
· You hold the legal basis for the processing
· You answer requests from crew and client contacts
· You decide retention and when data is deleted
· You own your data

PortFlow's Role: Data Processor

· We process your data on your instructions, isolated per tenant and enforced in the database with row level security
· We apply the security measures described in this document. They are not configurable per customer.
· We support your GDPR obligations. We do not confer compliance on you.
· We delete data on request. Deletion is performed manually by our team; there is no self service account wipe.
· We are a controller, not a processor, for PortFlow account holders and waitlist contacts

3. Data Processing Agreement (DPA)

3.1 DPA Status

PortFlow has no signed or published Data Processing Agreement. The list below is the scope a DPA would need to cover. None of it is in force until one is executed:

·Definition of personal data and processing scope

·Security and confidentiality obligations

·Audit rights over PortFlow's security

·The sub-processor list and a change notification mechanism

·Breach notification procedure and timing

·Assistance with data subject requests

·Assistance with impact assessments (DPIA)

·Data return and deletion on termination

Status: in preparation

Nothing is signed. We will not send you a document that does not exist yet.

If your organisation needs a DPA, email support@portflow.tech with your organisation name, your data protection contact and the processing you intend, and we will work through the scope with you.

3.2 Sub-Processors

Sub-Processor	Function	Processing region
Neon Postgres	Application database	United States (default region)
Vercel	Hosting for the application and this site	Global edge network
Anthropic	Assistant on this site, and an internal review of new signups	United States
Resend	Transactional and waitlist email delivery	United States
Upstash Redis	Rate limiting and budget counters on this site	United States (default region)
Zoho Mail	Hosted mailboxes for support and general correspondence	United States
Vercel Analytics	Traffic measurement, this site only	Global edge network

The last two run only on the public marketing site, never inside the application. Regions reflect the current default configuration and are not contractual. This list is maintained on this page; a contractual right to be notified of changes and to object only exists once a DPA is signed.

4. Data Residency & International Transfers

Default Configuration

Application database: Neon Postgres in the United States. Application and marketing site: Vercel edge network. Crew identity fields are encrypted inside the application before they ever reach the database.

EU Data Residency

Not deployed

Neon and Vercel both offer EU regions, so an EU resident deployment is technically possible. PortFlow has not provisioned one, has not tested one, and no customer runs on one today. Treat it as a scoping conversation, not a product feature.

· Would require a separate Neon project in an EU region and EU function regions on Vercel
· Would require a signed Data Processing Agreement
· Sub-processors outside the EU, such as email delivery and the AI assistant, would still need their own transfer basis
· No timeline is committed until the scope is agreed

To scope it, contact info@portflow.tech

Legal Basis for Transfers

In the default configuration, personal data is processed in the United States. Those transfers currently rest on the Standard Contractual Clauses and data processing terms of each provider listed above. PortFlow has no SCCs of its own signed with customers, because no DPA has been executed yet. The technical measures actually in place are TLS in transit, provider encryption at rest, and application level AES-256-GCM on crew passport number, nationality, date of birth and gender marker before they are written to the database.

5. Data Subject Rights Under GDPR

Who to contact depends on the data. Personal data your agency loads into PortFlow, such as crew and client contacts, is yours as controller: a crew member exercises these rights against your agency, and PortFlow assists you in answering. Personal data PortFlow holds about its own account holders and waitlist contacts is ours as controller, and those requests come to us.

Art. 15

Right to Access

One month

A copy of the personal data held, the purposes of processing, the recipients and the criteria used to set retention.

Art. 16

Right to Rectification

One month

Correction of inaccurate or incomplete records, including crew details and identity document data.

Art. 17

Right to Erasure

One month

Deletion of personal data. Two things survive: disbursement account evidence carrying a retention date or a legal hold set by your agency, and audit log entries, which are kept as a tamper evidence record of who did what.

Art. 18

Right to Restrict Processing

One month

Processing limited while accuracy is verified or a dispute is resolved.

Art. 20

Right to Data Portability

One month

Exports are per module, in CSV or XLSX: audit log, invoices, payments, quotations, vessels, port services, provisions, water supply and client account statements. There is no one click export of a whole account; a full extract is assembled by hand on request.

Art. 21

Right to Object

On receipt

An objection to direct marketing stops that processing on receipt. No third party analytics runs on the marketing site or in the application. Vercel Analytics runs on the marketing site only, first party, aggregated and cookieless, so there is no tracking profile to object to.

Art. 22

Automated Decision-Making

N/A

No automated decision grants, denies or restricts access to PortFlow. A Claude model does classify new signups for internal lead triage, using company name, email domain, approximate location from IP, phone and ports operated. It runs after the account already exists and cannot block or reverse a signup.

One month is the statutory deadline in Art. 12(3), extendable by two further months for complex requests with notice to the person. PortFlow does not publish a faster service level it has not measured. To exercise a right against PortFlow as controller, email support@portflow.tech; we will ask you to confirm your identity before acting.

6. Maritime-Specific Data Considerations

Crew Member Personal Data

What PortFlow stores about a crew member: name, identity document type and number, nationality, date of birth, gender marker, rank, vessel assignment, and STCW certificate types with their expiry dates, including the validity of a medical certificate. It does not store salary, medical records or next of kin details.

Passport number, nationality, date of birth and gender marker are encrypted with AES-256-GCM at the application layer, with a blind index so search still works without decrypting the column. That sits on top of the encryption at rest the database provider already applies.

Your agency controls this data. PortFlow stores and processes it. If the crew member is in the EU, their GDPR rights are exercised against your agency.

Vessel Owner & Company Data

A company name or registration number is not personal data. The name, email address and phone number of a person at that company is. Both live inside PortFlow client records, so treat a client record as containing personal data rather than assuming it is purely commercial.

FAL Documents & Port Authority Submissions

PortFlow generates the IMO FAL paperwork from the port call and tracks the pre-arrival submission deadline for you, in the port's own local time, so it stays correct across a daylight saving change. Which forms a given call needs is shown in the product.

Generated documents are stored against the port call, content, PDF and XML together, and stay for as long as that port call exists. Deleting the port call deletes them. There is no automatic purge after a fixed number of days.

PortFlow does not transmit anything to a port authority, to customs or to immigration. Preparing and submitting the declaration stays with your agency, through whatever channel the port requires.

7. Where This Actually Stands

In place todayVerified

· Per tenant isolation enforced in the database with row level security, multi-factor authentication, and an audit log
· AES-256-GCM encryption of crew identity fields at the application layer
· Vercel and Neon hold SOC 2 Type II reports. PortFlow holds none of its own and inherits none from them.

In preparationOngoing

· Data Processing Agreement being drafted, nothing signed or published
· Internal GDPR readiness self-assessment, not independently reviewed

Not committedNo date

· No independent GDPR audit has been commissioned and no date is set
· Certification under Art. 42 requires an accredited body and an approved scheme. PortFlow has not applied and does not claim one.
· No EU resident deployment exists

8. Data Breaches & Notifications

What We Do

· Notify you without undue delay once we become aware, and early enough for you to meet your own 72 hour deadline (Art. 33(2))
· Tell you what data was involved, when, and how many records are affected as far as we can establish
· Explain what we did to contain it
· Provide the detail your supervisory authority asks for

What You Must Do

· Notify your supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk (Art. 33(1))
· Inform the affected people without undue delay, but only where the breach is likely to result in a high risk to them (Art. 34)
· The duty to notify is yours as controller. We assist; we cannot file it for you.

What This Statement Does Not Claim

A compliance page is worth less than nothing if a buyer can knock a claim down. So here is the other half:

·PortFlow holds no GDPR certification and no independent audit

·The SOC 2 Type II reports belong to Vercel and Neon, not to PortFlow

·No Data Processing Agreement is signed or published yet

·No EU resident deployment exists today

·PortFlow can support your compliance work; it cannot confer compliance on you

·Anything not stated on this page has not been verified

Contact & Support

We acknowledge in writing and respond within one month, the statutory limit in Art. 12(3). Complex requests can be extended by two further months, and we tell you if that happens.

Privacy & data requests: support@portflow.tech

Security reports: security@portflow.tech

General: info@portflow.tech