Version 1.0 · Effective 20 February 2026
This schedule supplements the Data Processing Addendum, the Terms and Conditions and the Privacy Policy.
The 30-day export window is not a retention period. It is the period after termination during which the customer may retrieve its data. Some classes of data are deleted sooner than the export window would suggest, and some are lawfully retained for longer where a legal obligation, limitation period or legal hold applies. Customers remain responsible for identifying and meeting their own statutory retention obligations, including under MLC 2006, STCW and flag State requirements, and for exporting anything they are required to keep.
| Data class | While the account is active | After termination | Rationale |
|---|---|---|---|
| Hours of rest records, breach records, justifications and acknowledgements | Retained for the life of the account | Available for export for 30 days, then deleted or anonymised within 12 months unless a legal hold applies | MLC 2006 record-keeping support; limitation periods for employment and compliance claims |
| Watch schedules, rotations, leave and travel-day records | Life of the account | 30-day export window, then deleted or anonymised within 12 months | Operational record; supports hours-of-rest evidence |
| Seafarer employment agreements, offers, contract terms and signature records | Life of the account | 30-day export window, then deleted or anonymised within 12 months | Employment record; contractual limitation periods |
| Crew identity data (passport, visa, immigration records and extracted biographical data) | Life of the account, or until removed by the customer | 30-day export window, then deleted within 90 days | Data minimisation; high-risk identity data is deleted early |
| Medical certificate records, crew medical declarations, allergy and dietary information | Life of the account, or until removed by the customer | 30-day export window, then deleted within 90 days | Special category data; minimum necessary retention |
| Certificates, qualifications and uploaded certificate files | Life of the account | 30-day export window, then deleted within 12 months | STCW/flag State evidence support |
| Sea service records | Life of the account | 30-day export window, then deleted or anonymised within 12 months | Career record evidence; customer is responsible for issuing testimonials to crew |
| Payroll, expenses, reimbursements, boat cash and payslip data | Life of the account | 30-day export window, then retained up to 7 years where required for financial or tax record purposes, otherwise deleted within 12 months | Financial and tax record-keeping |
| Crew movements, flights and transport bookings | Life of the account | 30-day export window, then deleted within 12 months | Operational record |
| Guest records, trips, cabin allocations and luggage details | Life of the account, or until removed by the customer | 30-day export window, then deleted within 90 days | Confidentiality; minimum necessary retention |
| Muster, safety and emergency records | Life of the account | 30-day export window, then deleted within 12 months | Safety evidence |
| Sign-on / sign-off checklists and signatures | Life of the account | 30-day export window, then deleted within 12 months | Handover and employment evidence |
| Compliance and integrity audit trails (certificate review, HOR amendments, calendar locks, permission audits) | Life of the account | Retained up to 24 months after termination | Integrity of compliance records; defence of claims |
| Access-role change and administrative security logs | 24 months | Retained to end of the 24-month rolling period | Security and accountability |
| Crew sign-in / sign-out logs and general activity logs | Purged automatically after 30 days | Not retained | Data minimisation (automated purge) |
| Error, diagnostic, capacity and system health telemetry | 90 days | Not retained | Service reliability and security monitoring |
| Document processing diagnostics (upload, OCR and extraction traces) | 90 days | Not retained | Support and troubleshooting |
| Account, authentication and user profile data | Life of the account | Deleted within 30 days of account deletion, subject to billing records below | Account administration |
| Billing, subscription and payment records | Life of the account | Retained up to 7 years | Statutory financial and tax record-keeping (processed by us as controller) |
| Support correspondence and legal/compliance correspondence | Life of the account | Retained up to 6 years | Limitation period for contractual claims |
| Backups | Rolling backups overwritten in the ordinary course | Deleted data may persist until the relevant backup expires; backups are not selectively edited | Business continuity |
Customers may delete most records at any time from within the Platform, before the periods above expire. Deletion of compliance records that are locked, signed or acknowledged may be restricted in order to preserve the integrity of the compliance record; those records can be amended with an audit trail rather than silently removed.
Where data is subject to a legal hold, a regulatory request, or is necessary to establish, exercise or defend legal claims, retention is extended for the duration of that requirement. Processing during that period is restricted to the purpose of the hold.
© 2026 Yacht Watchkeeper. All rights reserved.