Data Protection & GDPR Compliance Policy

1. Our Data Protection Principles

In accordance with Article 5 of the UK GDPR, zevseraLTD ensures that all personal and commercial vessel data is:

• Processed lawfully, fairly, and in a transparent manner.
• Collected only for specified, explicit, and legitimate marine audit purposes.
• Adequate, relevant, and limited strictly to what is necessary for vessel provenance verification.
• Maintained with high accuracy and updated where required.
• Retained no longer than necessary for audit verification and statutory accounting obligations.
• Processed with appropriate technical security, including 256-bit encryption and strict access controls.

2. Maritime Asset Data vs. Personal Data

We maintain a clear legal distinction between vessel asset data and personal identifying data:

• Vessel Asset Data: Hull Identification Numbers (HIN), Craft Identification Numbers (CIN), builder specifications, shipyard years, BSS safety certificate numbers, and MCA registration entries are records relating to physical marine property.
• Customer Personal Data: Customer names, email addresses, and billing credentials provided during checkout are classified as personal data and safeguarded under the highest UK GDPR tier.

3. Security Architecture & Encryption

Our platform incorporates stringent technical safeguards to prevent unauthorized data access, loss, or alteration:

• Data in Transit: All web traffic and API integrations are encrypted via TLS 1.3 cryptographic protocols with High-Grade 256-Bit SSL certificates.
• Data at Rest: Database records and generated PDF audit archives are encrypted using AES-256 standard encryption on dedicated secure servers in the United Kingdom.
• Payment Protection: zevseraLTD does not store raw credit or debit card numbers. All payment processing is offloaded to Level 1 PCI-DSS certified gateway infrastructure.

4. Subject Access Requests (SAR) Procedure

Every individual whose personal data is processed by zevseraLTD possesses the right to request a complete copy of their data or request rectification or erasure. To initiate a Subject Access Request:

1. Send a request from your registered email to support@checkmyboat.co.uk.
2. Specify the nature of your request (Access, Rectification, or Erasure).
3. Our Data Protection Officer will acknowledge your request within 48 hours.
4. A verified response with your data records will be delivered within 30 calendar days at zero cost.

5. Data Breach Notification Protocol

In the unlikely event of a security incident affecting customer data, zevseraLTD maintains an incident response plan compliant with Articles 33 and 34 of the UK GDPR. The Information Commissioner's Office (ICO) and affected data subjects will be notified within 72 hours where required by law.