Privacy
Privacy statement
Last updated: 4 October 2026
RiverBase is an app for river cruise companies: maintenance, safety, crew, certificates, hotel and HACCP, inventory, voyage planning and cruise reports. This statement explains which personal data we handle, why, where it is stored and what your rights are.
RiverBase, [legal name and legal form], [street and number], [postcode and town], the Netherlands. Chamber of Commerce (KvK) [number].
Questions about privacy: info@river-base.com
1. Two roles: processor and controller
Data in the app. The data a shipping company puts into RiverBase (crew, documents, rosters, reports, photos) belongs to that company. The company decides what goes in and why. For that data the company is the controller and RiverBase is the processor: we store and process it only on the company's instructions, under a data processing agreement. If you are a crew member and have a question about your data, please contact your employer first; we help them answer it.
Our own data. For the website, quote requests, the demo, user accounts and the login log, RiverBase itself is the controller.
2. What we process and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| User account: name, e-mail address, role, company, ships | To let you log in and show you the right ships and modules | Contract with your employer | As long as the account exists |
| Login log: time, e-mail, device type, browser, IP address and the approximate place derived from it | Security: spotting logins that are not yours, misuse and problems | Legitimate interest (security) | 12 months |
| Weekly e-mail and notifications: e-mail address, name, what is due on your ships | To remind you of overdue and upcoming work. You can switch the weekly e-mail off yourself (your name at the top > Weekly e-mail) | Contract with your employer | Not stored after sending, apart from the e-mail service's delivery logs |
| Quote or demo request: name, company, e-mail, phone, number of ships, message | To answer your request and follow up on it | Your request (steps before a contract) | 24 months after our last contact, unless you become a customer |
| Demo visits: an anonymous visit number, which demo role and pages were opened, device type, browser, country and the website you came from. No IP address, no name | To see how much the demo is used and improve it | Legitimate interest | 24 months |
| Data a company puts in the app (as processor), for example crew names, functions, nationality, phone numbers, rosters, working hours, crew documents and their expiry dates, and photos | On the company's instructions, to run the ship | Determined by the company (controller) | As long as the company uses RiverBase, then returned and deleted (see section 5) |
Sensitive documents. Companies can upload crew documents such as medical certificates of fitness. These can contain health data, a special category of personal data. Access is limited by role: a sailor or helmsman only sees their own documents, and only people with the right permission in that company see those of others. We advise companies to upload only what they need for their legal and safety obligations.
3. Where your data is stored and who helps us
| Service | What for | Where |
|---|---|---|
| Supabase | Database, file storage, logins | Data centre in London, United Kingdom (AWS eu-west-2). The EU has decided that the UK protects personal data adequately. |
| Cloudflare | Hosting the website and app, protection against attacks | Worldwide network. Cloudflare is certified under the EU-US Data Privacy Framework and uses the EU standard contractual clauses. |
| Brevo | Sending e-mails (invitations, password reset, notifications, weekly e-mail, request confirmations) | European Union (France) |
These services are our sub-processors. We have agreements with each of them. We do not sell personal data and we do not use it for advertising.
4. Cookies and tracking
RiverBase uses no tracking or advertising cookies and no third-party analytics. The app does store a few things in your browser that it needs to work: your login session, the data cached for offline use on board, and small preferences such as which lists you have folded in. Fonts are loaded from our own server.
5. Security, backups and deletion
- All traffic is encrypted (HTTPS). Passwords are never stored in plain text.
- Every company only sees its own data; this is enforced in the database itself, not only in the app.
- Files are stored privately and are only shown through short-lived links.
- Backups are made by our hosting provider and kept for a limited time.
- When a company stops using RiverBase, it can download all its data (Excel and files) and we delete it within 90 days; copies in backups disappear when those backups expire.
6. Your rights
You have the right to see, correct or delete your personal data, to restrict or object to its use, and to receive it in a usable format. For data a shipping company put into RiverBase, please ask that company; we help them. For everything else, mail info@river-base.com. We answer within one month.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in your own country.
7. Changes
When we change this statement, we update the date at the top. For important changes we inform customers by e-mail.