Privacy Statement Swelb

Version 1.0 — [DATE]

Swelb attaches great importance to the protection of personal data of its users. In this privacy statement we explain which personal data we collect, why, how long we retain it and what rights you have.

This statement applies to all visitors, Boat Owners and Skippers using the Swelb platform.

1. Data controller

Swelb B.V. Registered office at [PLACE] Trade Register: [KVK-NUMBER] VAT number: [VAT-NUMBER]

Email: privacy@swelb.com Website: https://swelb.com

Swelb B.V. is the data controller within the meaning of the General Data Protection Regulation (GDPR).

2. Which personal data do we process?

We process various categories of personal data, depending on the role you fulfil on the platform.

2.1 Website visitors

When you visit our website without creating an account, we process limited data:

• IP address (anonymised where possible)
• Browser type and version
• Pages visited and interaction data
• Language preference and cookie settings

2.2 Boat Owners

When you place a Request or create an account, we process:

• Name, email address and phone number
• Address and billing details (where provided)
• Vessel information: make, type, length, year of construction, engine, photos
• Sailing route, dates and special considerations of the Request
• Communication with Skippers via the platform messaging system
• Content of intake conversations with our chatbot
• Vessel inspection reports (photos, technical condition)
• Reviews you post about Skippers
• Notification preferences and language settings

2.3 Skippers

When you register as a Skipper, we additionally process:

• Profile photo, biography and motivation
• Sailing licenses, certificates and qualification documents (uploaded scans)
• Sailing areas, experience, languages spoken and age
• Insurance declaration
• Rates and availability
• Reviews posted about you
• Response rate, completed requests and other performance data
• Any AI-generated assessment of your certificates

2.4 Both groups

For both Boat Owners and Skippers we process:

• Login credentials (email and encrypted password)
• Session and authentication data (cookies)
• Communication with Swelb support
• Invoices, transaction data and payment status

3. For what purposes do we use your data?

We process your data exclusively for the purposes set out below:

3.1 Performance of the agreement (article 6(1)(b) GDPR)

• Creating and managing your account
• Placing Requests and matching with Skippers
• Facilitating communication between Boat Owner and Skipper
• Processing inspection reports and reviews
• Invoicing and commission administration

3.2 Legal obligations (article 6(1)(c) GDPR)

• Tax administration (retain invoice and transaction data for 7 years)
• Complying with information requests from competent authorities

3.3 Legitimate interest (article 6(1)(f) GDPR)

• Platform security and prevention of fraud or misuse
• Improvement of the platform based on anonymised usage statistics
• Sending service notifications (e.g. changes to terms, outages)
• Verifying Skipper qualifications via AI-assisted review

3.4 Consent (article 6(1)(a) GDPR)

• Sending optional email notifications (e.g. for new Requests in your sailing area)
• Placing non-essential cookies and analytics
• Marketing communications, where applicable

You can withdraw your consent at any time without this affecting processing carried out on a different basis.

4. With whom do we share your data?

4.1 Other platform users

• Boat Owners share Request data (vessel, route, dates) with Skippers responding to or accepted for the Request;
• Skippers share profile information (name, experience, sailing license status, reviews) with Boat Owners placing a Request;
• Reviews are visible to other platform users, linked to the reviewer's first name and possibly last-name initial.

4.2 Processors (sub-processors)

We use external parties for the delivery and management of the platform. We have data processing agreements in place with all these parties in accordance with the GDPR.

For transfers to the United States we use the Standard Contractual Clauses of the European Commission or the EU-US Data Privacy Framework, where applicable.

4.3 Legal obligations

In exceptional cases we may share data with competent authorities if we are legally obliged to do so (e.g. tax authorities, police, judiciary).

4.4 We do not sell your data

Swelb does not sell personal data to third parties for marketing purposes.

5. Retention periods

We do not retain your data longer than necessary for the purpose for which it was collected or as required by law.

After expiry of the retention period, your data is deleted or anonymised.

6. Your rights

Under the GDPR you have the following rights with respect to your personal data:

• Right of access — you may request which data we process about you
• Right to rectification — you may have incorrect data corrected
• Right to erasure ("right to be forgotten") — you may request deletion of your data, insofar as we are not legally obliged to retain it
• Right to restriction of processing — you may request temporary cessation of certain processing
• Right to data portability — you may request your data in a structured, common format
• Right to object — you may object to processing based on legitimate interest
• Right to withdraw consent — for processing based on consent
• Right not to be subject to automated decision-making — for decisions made largely by AI, you have the right to human intervention (see also article 9 below)

You can exercise these rights by sending a request to privacy@swelb.com. We respond within one month. For complex requests we may extend this period by two months, of which we will inform you in good time.

If you suspect that we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl

7. Security

We take appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS / TLS)
• Encryption of passwords (bcrypt hashing)
• Access control with strong authentication (and two-factor authentication in the future)
• Logical separation between development, test and production environments
• Restricted access to personal data based on need-to-know
• Regular security updates and monitoring
• Data processing agreements with all our sub-processors

No security is 100% impenetrable. In the event of a data breach with risk to your rights and freedoms, we will inform the Dutch Data Protection Authority within 72 hours and you as soon as possible.

8. Cookies

Our website uses cookies. A detailed description can be found in our Cookie Statement.

9. Automated decision-making and AI

Swelb uses AI technology from Anthropic (Claude) for:

• Intake chatbot: step-by-step gathering of Request data from Boat Owners
• Certificate review: a first assessment of uploaded Skipper certificates for completeness and plausibility

These AI systems support our processes but do not make automated final decisions about admission, rejection or other significant matters. A Swelb staff member ultimately reviews Skipper applications.

You have the right at all times to request human intervention in decisions influenced by AI.

Conversation content with the chatbot is processed via the Anthropic API. Anthropic does not use this data to train its models, in accordance with the business terms under which Swelb uses Anthropic's services.

10. Transfers outside the EU

Some of our sub-processors are located in the United States (see article 4.2). For transfer of your data to countries outside the European Economic Area we use:

• the Standard Contractual Clauses (SCCs) of the European Commission; or
• for applicable parties, certification under the EU-US Data Privacy Framework.

We periodically assess whether the level of protection at these parties meets EU requirements.

11. Amendments to this privacy statement

We may amend this privacy statement from time to time, for example in case of changes to our services or to legislation. The current version is always available on the platform with a version date.

Important changes are announced at least 30 days in advance via email or platform notification.

12. Contact

Do you have questions about this privacy statement or about the processing of your personal data? Contact us via:

Email: privacy@swelb.com Post: Swelb B.V., [ADDRESS], [POSTAL CODE PLACE]

This privacy statement is drawn up in Dutch and English. In case of discrepancy, the Dutch text prevails.