Privacy Policy

Version: Australia & New Zealand · Last updated: 18 October 2026 · Effective from: 18 October 2026

This version applies to customers established in Australia, New Zealand and the Pacific, and to everyone else where no other version applies. Other versions of this policy exist for the other regions we serve; the one that applies to your organisation is chosen from the country it is registered in, and is shown in Organisation settings → Region.

---

1. Who we are

NethuneX ("we", "us") provides a software-as-a-service maritime operations platform for ship owners and operators. We are an Australian business registered in Queensland. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

• Contact: support@nethunex.com
• Privacy officer: NethuneX, at the contact address above
• ABN: 56 137 797 320

2. What this policy covers

This policy explains:

• What personal information we collect.
• Why we collect it, and on what legal basis.
• How we use, store, and share it.
• Your rights under the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).
• How to contact us about your privacy.

3. What we collect

From visitors to our website:

• Pages you view (no individual identification unless you sign in).
• Browser type and approximate location (timezone-derived, not GPS).
• Cookies — see Section 8 and our cookie banner.
• If you ask for a demo or send us a message through the website: your name, work email, company, country, telephone number and the message you send us (and, for a demo, your position).

From customers and their users:

• Account information — name, work email, organisation name, role.
• Operational data you enter — vessels, crew, voyages, incidents, maintenance, payroll and so on. This often includes personal information about your crew: names, certificates, passport and visa details, medical fitness records, contracts and pay.
• Authentication data — a hash of your password (we never see the plaintext), session tokens, and two-factor authentication secrets if you enable 2FA.
• Activity logs — when you sign in and what records you change, for audit trails and security.
• Payment information — processed by our payment processor; we store the last four digits of a card, never the full number.
• Email you connect — if your organisation connects a mailbox to the email module, we store the messages it receives and sends, and encrypt the mailbox credentials at rest.
• Communications with us — emails, support tickets, feedback you send from inside the app.

Automatic technical data:

• IP address, for rate limiting and abuse prevention.
• Browser, operating system and device type.
• Error reports sent to our error-monitoring service, with personal identifiers removed before sending (see Section 7).

4. Why we collect it

• To provide the service — a fleet-management system cannot run without the fleet's data.
• To bill you — account and payment information to charge subscriptions.
• To support you — contact information to answer your questions.
• To improve the service — aggregate, de-identified usage tells us what to build next.
• For security and audit — to detect fraud, debug problems and keep audit trails.
• To comply with the law — tax records, and the records maritime regulation requires operators to keep.

We do not sell your personal information. We never have, and will not.

5. Sensitive information

Some NethuneX modules deal with sensitive information (APP 3):

• Crew medical records — fitness for duty, restrictions, blood type. Access is gated by a separate crew_medical.read permission, so only users your administrator authorises can view them.
• Crew identity documents — passports, visas, licences.
• Payroll — salary and payment details.

We treat this information with a higher level of care: stricter access control, encryption at rest, and no sharing with third parties beyond the infrastructure providers in Section 7. We do not send crew medical records to any AI provider.

6. Your rights

APP	Right	How to exercise it
APP 1	We have an open and transparent privacy policy.	This document.
APP 5	We tell you when we collect personal information.	At sign-up, through this policy, and the cookie banner.
APP 6	We use information only for the purpose we collected it.	If we ever want to use your data for a new purpose, we will ask.
APP 8	Cross-border disclosure — we host in Australia.	See Section 9.
APP 11	We protect personal information.	See Section 12.
APP 12	You can access the information we hold about you.	Use Export my data in Settings → Profile, or email support@nethunex.com. We respond within 30 days.
APP 13	You can correct your information.	Edit it in the app, or email us. We respond within 30 days.

7. Service providers (sub-processors) and third parties

We use a small number of specialist providers to run the service. Each is bound by its own privacy terms and by a written data-protection agreement with us, sees only what its job needs, and may not use your data for anything else. By category:

Provider	What they see	Where they process it
A cloud database, authentication and file-storage provider	All operational data	Australia (Sydney)
A web-hosting and content-delivery provider	Compiled code and request data in transit	United States, with edge locations in many countries; the application is served from Australia
An error-monitoring service	Error reports and browser metadata; names, emails, IP addresses and tokens are removed before sending	United States
A payment processor	Billing contact and the last four digits of a card	United States; Ireland for customers in the EU
An email-delivery service	Recipient address and message content for invites, password resets and notifications	United States
A map-tile provider	Your browser's IP address when it loads a map tile	Switzerland
AI model providers, chosen by your organisation's region	The operational data a question or message refers to, for the duration of the request; never crew medical records; their terms exclude use of your data for model training	United States; France for EU organisations' email extraction
A live vessel-position (AIS) feed	Vessel identifiers only; no personal information	No personal information is processed

The named list — each provider, its purpose, location and status — is available to your organisation's administrators in the app under Settings → Organisation → Security & data → Sub-processors, and to any customer — or any individual whose data we hold, as part of an access request — on request at support@nethunex.com. It forms Annex III of our Data Processing Agreement. We give customers at least 30 days' notice before a new provider handles personal information, and a document-scanning (OCR) service in France will be added under that notice when certificate scanning is switched on.

8. Cookies

We use cookies for:

• Strictly necessary — sign-in sessions and security tokens. These cannot be disabled.
• Error monitoring — so we can fix problems you hit.
• Marketing — none. We will update this policy if that changes.

You see a notice when you first visit; you can manage cookies from the banner or by clearing your browser's cookies.

9. Cross-border data flows

Primary storage: Sydney, Australia (ap-southeast-2). Operational data does not leave Australia by default.

Error monitoring, email delivery and AI providers are in the United States and the EU, as set out by category in Section 7. The AI providers receive only the data a request refers to, and only while the request runs.

Transfer mechanism: APP 8: before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient handles it in line with the APPs, and we remain accountable for it.

10. How long we keep your data

Data type	Retention
Active customer data	While your subscription is active
Cancelled customer data	30 days after cancellation, then permanently deleted
Audit logs	7 years
Backups	Daily; retained according to our hosting plan (currently 7 days)
Error-monitoring data	90 days, then aggregates only
Website enquiries (demo requests and messages)	As long as we need them to answer and follow up, then deleted; ask us at any time to delete yours sooner
Billing records	7 years (Australian tax law)

11. Data breaches

If we suffer a breach of personal information that is likely to cause harm, we will notify the OAIC and affected individuals as required by the Notifiable Data Breaches scheme; our target is 72 hours from confirming an eligible breach. Our internal response runbook is operations/runbook-ndb.md.

12. Security measures

• Encryption at rest (managed by our hosting provider) and in transit (TLS 1.3).
• Row-level security in the database enforces separation between customers. No customer can read another customer's data, even if a bug existed in our application code.
• Role-based access control within each organisation: profiles, roles and permission sets configured by your administrator.
• Two-factor authentication, available to every user and visible to administrators in Members & Access.
• Audit logs of sensitive operations.
• Encrypted credentials for connected mailboxes (AES-256-GCM).
• Regular dependency audits and security reviews. Our public security page describes the current posture.

No system is perfectly secure. We follow industry practice and respond quickly when something goes wrong.

13. Children's data

NethuneX is a business-to-business product for shipping operators. We do not knowingly collect information from anyone under 18.

14. Automated decisions and AI

Our AI features draft, summarise and extract; a person decides. Nothing in NethuneX makes an automated decision with legal or similarly significant effect on a crew member or anyone else.

15. Complaints

If you have a privacy complaint, contact us first at support@nethunex.com. We will investigate and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), online at https://www.oaic.gov.au/privacy/privacy-complaints/, by phone on 1300 363 992, or by mail to GPO Box 5288, Sydney NSW 2001.

16. Changes to this policy

We may update this policy. Material changes are notified by email and an in-app banner at least 30 days before they take effect.

17. Contact

support@nethunex.com — Privacy Officer, NethuneX.