This Privacy Policy explains how Blue Stratum Ltd ("Blue Stratum", "we", "us", "our") collects, uses, stores, and shares your personal data when you use the Naviora platform and visit our website (collectively, the "Services"). It applies to all users including platform administrators, organization managers, and maritime training candidates.
We are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and where applicable the EU GDPR. Please read this policy carefully. By using our Services you acknowledge you have read it.
1. Who we are
Blue Stratum Ltd is the data controller for personal data processed through the Naviora platform.
Where an organization subscribes to Naviora and administers candidates under their account, that organization acts as an additional data controller (or processor, depending on the relationship) for data relating to their candidates. A separate Data Processing Agreement (DPA) is available upon request.
2. Data we collect
2.1 Data you provide directly
- Account data: name, work email address, job title, organization name.
- Contact / demo requests: name, work email, organization, role, message, and your GDPR consent timestamps.
- Candidate profiles: name, seafarer ID, nationality, qualifications, certificate numbers.
- Assessment records: session dates, scores, evaluator notes, competency ratings, simulator performance data.
- Certificates: digital certificate metadata including issue date, expiry, and issuing authority.
2.2 Data collected automatically
- Usage data: pages visited, features used, session duration, button clicks.
- Technical data: IP address, browser type and version, operating system, time zone, referring URL.
- Log data: server access logs, error logs, API request logs (retained for security and debugging).
2.3 Data from third parties
- Simulator performance data received via direct simulator integrations (Kongsberg, Wärtsilä/Transas, etc.) during assessment sessions.
- Single sign-on (SSO/SAML) identity data from your organization's identity provider where configured.
3. How we use your data
We only process your data for specific, documented purposes with a valid legal basis.
| Purpose | Legal Basis (GDPR Art. 6) | Retention |
|---|---|---|
| Respond to demo / contact requests | Art. 6(1)(a) — Consent | Until withdrawn or 2 years after last contact |
| Provide and maintain the platform | Art. 6(1)(b) — Contract performance | Duration of contract + 30 days |
| Conduct and record assessments | Art. 6(1)(b) — Contract performance | 7 years (regulatory compliance) |
| Issue and verify digital certificates | Art. 6(1)(c) — Legal obligation | 10 years |
| Platform security and fraud prevention | Art. 6(1)(f) — Legitimate interests | 90 days (logs) / ongoing (security data) |
| Product analytics and improvement | Art. 6(1)(f) — Legitimate interests | 25 months (anonymised after 90 days) |
| Marketing communications (with consent) | Art. 6(1)(a) — Consent | Until consent withdrawn |
| Legal compliance and regulatory reporting | Art. 6(1)(c) — Legal obligation | As required by applicable law |
We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
4. Who we share data with
We do not sell your personal data. We share it only in the following circumstances:
- Infrastructure providers: hosting, database, and storage services (currently Replit Inc., subject to a DPA) processing data on our behalf.
- Email service providers: transactional email delivery (e.g. for account notifications and certificate issuance), under a DPA.
- Your organization: where you are a candidate, your assessment results, competency records, and certificates are accessible to your organization's administrators within the platform.
- Flag state / regulatory authorities: where legally required and at the direction of the subscribing organization (e.g. certificate verification).
- Legal / law enforcement: where required by applicable law, court order, or to protect the rights and safety of our users.
- Business transfers: in connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to standard confidentiality obligations.
5. International transfers
Our primary data processing takes place within the UK and the European Economic Area (EEA). Where data is transferred outside the UK/EEA (for example, to infrastructure providers with US-based data centres), we rely on:
- UK adequacy regulations for transfers to countries with an adequacy decision.
- UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs) with appropriate supplementary measures.
A copy of the applicable transfer mechanism can be requested by emailing privacy@bluestratum.com.
6. Retention periods
We retain personal data for no longer than is necessary for the purposes for which it was collected. The specific periods are shown in the table in Section 3. Where legal obligations require us to retain data for a defined period (e.g. maritime certification records for 10 years), we apply that period. After expiry, data is securely deleted or anonymised.
If you withdraw consent for demo / marketing purposes, we will stop processing within 14 days and delete the relevant data within 30 days unless retention is required by law.
7. Your rights
Under UK/EU GDPR you have the following rights regarding your personal data:
To exercise any of these rights, email us at privacy@bluestratum.com with the subject line "Data Subject Request — [Your Name]". We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Cookies
We use cookies and similar tracking technologies on our website. The table below summarises the types in use:
| Purpose | Legal Basis (GDPR Art. 6) | Retention |
|---|---|---|
| Strictly necessary | Art. 6(1)(b) — Contract / legitimate interests | Session / 1 year |
| Functional (preferences) | Art. 6(1)(a) — Consent | 1 year |
| Analytics (anonymised) | Art. 6(1)(a) — Consent | 25 months |
| Marketing / targeting | Art. 6(1)(a) — Consent | As set by provider |
You can control cookie preferences via the cookie banner displayed on your first visit, and update your preferences at any time by clicking "Cookie Settings" in the footer. Withdrawing consent for non-essential cookies does not affect the functionality of the core platform.
9. Children
The Naviora platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data relating to a child under 18, please contact us immediately so we can delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our Services. We will notify registered users of material changes by email or prominent notice within the platform at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of the Services after the effective date of a change constitutes acceptance of the updated policy. If you do not agree to a change, you should discontinue use and contact us to exercise your data rights.
11. Contact & data protection enquiries
For any questions, subject access requests, or concerns about this policy or our data practices, please contact our data protection team:
We aim to respond to all requests within 5 business days.
Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk/concerns