Legal

Privacy Policy

How GMTS handles onboard data, cloud hosting in New Zealand, and third-party services. Terms of Service Cookie policy

Global Marine Technology Services Ltd (“GMTS”, “we”, “us”) operates VesselNow Cloud at vesselnow.io and provides VesselNow vessel software. This Privacy Policy explains what we collect, where it is stored, how onboard processing differs from cloud hosting, and your choices.

Key points

  • Onboard first: sensor data, guest content, and logs normally stay on your vessel unless you turn on cloud sync.
  • Cloud in New Zealand: account, licence, and optional cloud sync data is stored in NZ, in a private data centre environment under GMTS control.
  • Minimal telemetry: cloud sync uploads only what your vessel is configured to send (e.g. position, heading, speed, selected alarms, and nearby AIS targets).
  • No sale of personal data for advertising or unrelated marketing.
  • Third-party weather/maps may receive requests directly from your browser or vessel when you enable those features — see their policies.
  • Your rights under the New Zealand Privacy Act 2020 and, where applicable, other laws.

1. Who we are

Global Marine Technology Services Ltd (GMTS), Auckland, New Zealand, is responsible for your personal information under the Privacy Act 2020, and acts as data controller where GDPR applies. For privacy requests contact info@gmts.io.

2. Scope

This policy covers:

  • The vesselnow.io website, customer portal, and FleetView cloud APIs.
  • License validation, trial registration, billing, and support interactions with GMTS.
  • Optional data your vessel pushes to VesselNow Cloud when cloud features are enabled.

It does not govern third-party websites (Windy, PredictWind, chart providers, etc.) that you access through VesselNow — those services process data under their own policies.

3. Data handled onboard your vessel

When you run VesselNow Hub aboard a vessel or on-premises server, the following typically remains local to that installation unless you enable cloud upload:

  • Sensor & instrument data — GPS, AIS, wind, depth, tanks, batteries, engine parameters, PLC/CZone/Mastervolt points, and derived alarms.
  • Operational configuration — data-source settings, display layouts, alarm rules, geofences, and engineering history (history replay snapshots where enabled).
  • Guest & crew content — programmes, menus, Wi‑Fi guest info, crew lists, and guest preferences stored in the onboard database/files.
  • Logs & diagnostics — application logs, unknown NMEA capture (if enabled), and local debug artefacts.

License checks contact VesselNow Cloud over HTTPS with license key, vessel identifier, and hardware fingerprint needed to validate entitlement — not your full sensor history.

You control onboard retention, backups, and deletion by managing the vessel server and storage. GMTS does not have routine access to onboard disks unless you grant remote support access.

Remote into Vessel

Remote into Vessel is off by default. If the vessel turns it on, people you authorise can open the onboard screens through vesselnow.io in signed sessions of up to one hour. They must confirm before changing anything that affects live equipment, and cameras need a separate confirmation. Each session and change is logged on the vessel and at vesselnow.io with the user, time and action.

4. Data we store in VesselNow Cloud (New Zealand)

Cloud-hosted data is stored in New Zealand within a private data centre environment (dedicated or segregated infrastructure under contract — not on shared consumer cloud accounts without isolation). Categories include:

  • Account & identity — name, email, company, phone, billing address, portal login, and role assignments.
  • License & vessel records — license keys, vessel names, MMSI or identifiers you provide, activation timestamps, trial status, and FleetView tokens.
  • Cloud sync telemetry — position, course, speed, and related fields your vessel uploads at the interval you configure; alarm events you route to the cloud; optional sensor summaries for fleet dashboards.
  • Shared AIS — with cloud sync on, the vessel uploads up to 200 nearby AIS targets each minute (MMSI, name, position, course, speed, heading, ship type and status). AIS is broadcast publicly over VHF; we use these targets to show logged-in customers the traffic around their own vessels. Turn it off in VesselNow Settings (Share AIS).
  • Remote session records — Remote into Vessel audit entries (user, vessel, time and confirmed actions).
  • Synced guest & operational content — crew, schedules, menus, tenders, welcome copy, and similar items when you use portal edit or vessel→cloud sync.
  • Website & support — IP address, browser type, pages visited, cookies (see below), and support tickets or emails.

We use this data to provide the Service, authenticate users, operate FleetView, improve reliability, meet legal obligations, and communicate about your account — not to build unrelated advertising profiles.

5. How we use personal information

  • Provision and administration of licenses, trials, and subscriptions.
  • Validation of onboard installations and FleetView ingest.
  • Customer portal, guest-services cloud sync, and alerting you configure.
  • Transactional email (license delivery, password reset, security notices).
  • Aggregated, de-identified analytics to improve product quality.
  • Legal compliance, fraud prevention, and enforcement of our Terms.

6. Legal bases (where applicable)

Depending on jurisdiction we rely on: performance of a contract (providing the Service you requested), legitimate interests (security, product improvement, fleet operations you initiate), consent (marketing emails, optional cookies), and legal obligation.

7. Sharing and processors

We do not sell your personal information. We may share data with:

  • Infrastructure providers — NZ data centre, hosting, and backup vendors under confidentiality and data-processing terms.
  • Email & payment providers — for transactional messages and billing you initiate.
  • Professional advisers — lawyers or accountants when required, under duty of confidence.
  • Authorities — when required by law or to protect rights and safety.

Sub-processors are permitted only to process data on our instructions and with appropriate safeguards.

8. Third-party weather, maps, and integrations

When you enable weather or map layers, your browser or vessel may contact third parties directly. Examples:

  • Windy, PredictWind, Ventusky, OpenWeatherMap, Open-Meteo, Yr.no, PassageWeather — forecast and imagery per their terms.
  • Map tile providers (e.g. OpenStreetMap contributors) — map display.
  • Equipment vendors — data remains on your network unless you configure external APIs.

GMTS is not responsible for third-party privacy practices. Review each provider’s policy before supplying API keys or enabling embeds. We do not represent or endorse these companies.

9. Cookies and similar technologies

Our website and portal use cookies and local storage for:

  • Authentication and session security.
  • Portal preferences (e.g. selected vessel).
  • Load balancing and abuse prevention.

You can control cookies in your browser; disabling essential cookies may prevent login. See the Cookie policy.

10. Retention

  • Account & license data — while your relationship is active, then as needed for tax, legal, and dispute resolution (typically up to seven years for financial records where required).
  • FleetView history — according to your plan and purge settings; you may request deletion of vessel history subject to verification.
  • Support tickets — typically up to 24 months unless longer retention is needed.
  • Onboard data — controlled by you on the vessel; not retained by GMTS unless synced to cloud.

11. Security

We apply reasonable technical and organisational measures, including:

  • HTTPS for cloud APIs and website traffic.
  • Access controls and role-based permissions on portal and ops tools.
  • Token-based vessel authentication for FleetView ingest.
  • Infrastructure in a private NZ data centre with physical and network controls operated by our hosting partner.

No system is perfectly secure. You must protect onboard networks, Wi‑Fi passwords shown to guests, API keys, and admin credentials.

12. International transfers

Primary storage is in New Zealand. If you access the Service from abroad, data may be viewed in your country. If we ever transfer data outside NZ, we will ensure appropriate safeguards consistent with applicable law.

13. Your rights

Under the Privacy Act 2020 (New Zealand) and, where applicable, GDPR or similar laws, you may have the right to:

  • Access personal information we hold about you.
  • Request correction of inaccurate data.
  • Request deletion where we have no lawful reason to retain it.
  • Object to or restrict certain processing.
  • Withdraw consent for marketing (see Unsubscribe).
  • Complain to the Office of the Privacy Commissioner (NZ) or your local authority.

Contact info@gmts.io to exercise these rights. We may need to verify your identity.

14. Children

The Service is directed at vessel operators and professionals, not children under 16. We do not knowingly collect children’s personal data.

15. Changes

We may update this policy. The “Last updated” date below will change. Material updates may be notified by email or site notice.

16. Contact

Last updated: 7 October 2026