Privacy Policy

GMTS Group (“GMTS”, “we”, “us”) operates VesselNow Cloud at vesselnow.io and provides VesselNow vessel software. This Privacy Policy explains what we collect, where it is stored, how onboard processing differs from cloud hosting, and your choices.

1. Who we are

Data controller for VesselNow Cloud services: GMTS Group. For privacy requests contact info@gmts.io.

2. Scope

This policy covers:

• The vesselnow.io website, customer portal, and FleetView cloud APIs.
• License validation, trial registration, billing, and support interactions with GMTS.
• Optional data your vessel pushes to VesselNow Cloud when cloud features are enabled.

It does not govern third-party websites (Windy, PredictWind, chart providers, etc.) that you access through VesselNow — those services process data under their own policies.

3. Data handled onboard your vessel

When you run VN-Core aboard a vessel or on-premises server, the following typically remains local to that installation unless you enable cloud upload:

• Sensor & instrument data — GPS, AIS, wind, depth, tanks, batteries, engine parameters, PLC/CZone/Mastervolt points, and derived alarms.
• Operational configuration — data-source settings, display layouts, alarm rules, geofences, and engineering history (“Time Machine” snapshots where enabled).
• Guest & crew content — programmes, menus, Wi‑Fi guest info, crew lists, and guest preferences stored in the onboard database/files.
• Logs & diagnostics — application logs, unknown NMEA capture (if enabled), and local debug artefacts.

License checks contact VesselNow Cloud over HTTPS with license key, vessel identifier, and hardware fingerprint needed to validate entitlement — not your full sensor history.

You control onboard retention, backups, and deletion by managing the vessel server and storage. GMTS does not have routine access to onboard disks unless you grant remote support access.

4. Data we store in VesselNow Cloud (New Zealand)

Cloud-hosted data is stored in New Zealand within a private data centre environment (dedicated or segregated infrastructure under contract — not on shared consumer cloud accounts without isolation). Categories include:

• Account & identity — name, email, company, phone, billing address, portal login, and role assignments.
• License & vessel records — license keys, vessel names, MMSI or identifiers you provide, activation timestamps, trial status, and FleetView tokens.
• FleetView telemetry — position, course, speed, and related fields your vessel uploads at the interval you configure; alarm events you route to the cloud; optional sensor summaries for fleet dashboards.
• Synced guest & operational content — crew, schedules, menus, tenders, welcome copy, and similar items when you use portal edit or vessel→cloud sync.
• Website & support — IP address, browser type, pages visited, cookies (see below), and support tickets or emails.

We use this data to provide the Service, authenticate users, operate FleetView, improve reliability, meet legal obligations, and communicate about your account — not to build unrelated advertising profiles.

5. How we use personal information

• Provision and administration of licenses, trials, and subscriptions.
• Validation of onboard installations and FleetView ingest.
• Customer portal, guest-services cloud sync, and alerting you configure.
• Transactional email (license delivery, password reset, security notices).
• Aggregated, de-identified analytics to improve product quality.
• Legal compliance, fraud prevention, and enforcement of our Terms.

6. Legal bases (where applicable)

Depending on jurisdiction we rely on: performance of a contract (providing the Service you requested), legitimate interests (security, product improvement, fleet operations you initiate), consent (marketing emails, optional cookies), and legal obligation.

7. Sharing and processors

We do not sell your personal information. We may share data with:

• Infrastructure providers — NZ data centre, hosting, and backup vendors under confidentiality and data-processing terms.
• Email & payment providers — for transactional messages and billing you initiate.
• Professional advisers — lawyers or accountants when required, under duty of confidence.
• Authorities — when required by law or to protect rights and safety.

Sub-processors are permitted only to process data on our instructions and with appropriate safeguards.

8. Third-party weather, maps, and integrations

When you enable weather or map layers, your browser or vessel may contact third parties directly. Examples:

• Windy, PredictWind, Ventusky, OpenWeatherMap, Open-Meteo, Yr.no, PassageWeather — forecast and imagery per their terms.
• Map tile providers (e.g. OpenStreetMap contributors) — map display.
• Equipment vendors — data remains on your network unless you configure external APIs.

GMTS is not responsible for third-party privacy practices. Review each provider’s policy before supplying API keys or enabling embeds. We do not represent or endorse these companies.

9. Cookies and similar technologies

Our website and portal use cookies and local storage for:

• Authentication and session security.
• Portal preferences (e.g. selected vessel).
• Load balancing and abuse prevention.

You can control cookies in your browser; disabling essential cookies may prevent login.

10. Retention

• Account & license data — while your relationship is active, then as needed for tax, legal, and dispute resolution (typically up to seven years for financial records where required).
• FleetView history — according to your plan and purge settings; you may request deletion of vessel history subject to verification.
• Support tickets — typically up to 24 months unless longer retention is needed.
• Onboard data — controlled by you on the vessel; not retained by GMTS unless synced to cloud.

11. Security

We apply reasonable technical and organisational measures, including:

• HTTPS for cloud APIs and website traffic.
• Access controls and role-based permissions on portal and ops tools.
• Token-based vessel authentication for FleetView ingest.
• Infrastructure in a private NZ data centre with physical and network controls operated by our hosting partner.

No system is perfectly secure. You must protect onboard networks, Wi‑Fi passwords shown to guests, API keys, and admin credentials.

12. International transfers

Primary storage is in New Zealand. If you access the Service from abroad, data may be viewed in your country. If we ever transfer data outside NZ, we will ensure appropriate safeguards consistent with applicable law.

13. Your rights

Under the Privacy Act 2020 (New Zealand) and, where applicable, GDPR or similar laws, you may have the right to:

• Access personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion where we have no lawful reason to retain it.
• Object to or restrict certain processing.
• Withdraw consent for marketing (see Unsubscribe).
• Complain to the Office of the Privacy Commissioner (NZ) or your local authority.

Contact info@gmts.io to exercise these rights. We may need to verify your identity.

14. Children

The Service is directed at vessel operators and professionals, not children under 16. We do not knowingly collect children’s personal data.

15. Changes

We may update this policy. The “Last updated” date below will change. Material updates may be notified by email or site notice.

16. Contact

• Website: https://vesselnow.io/
• Privacy enquiries: info@gmts.io

Last updated: June 24, 2026