Privacy Policy

1. Who we are

CharterDeck is operated by ORION MARINE GEMİ ELEKTRİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ (“Orion Marine”), Orhangazi Mah. Vatan Cad. No: 23/A, Pendik, Istanbul, Türkiye (“we”, “us”). For personal data we decide how to use — the website, chartering enquiries you send us, the waitlist and desk user accounts — we are the data controller. Questions and requests: info@orionnmar.com.

When an organisation uses CharterDeck to process its own business communications (for example by connecting its mailbox), that organisation decides why the data is processed and we process it on its behalf as a data processor (see section 6 of the Terms of Service).

2. What we collect

Chartering enquiries: when you send us a cargo, an open vessel position or another enquiry by email, by phone or with the short enquiry form on this website, we receive your name, contact details, company and the commercial information you choose to share. Enquiries sent with the form are stored in our CharterDeck desk, where a broker reviews them; the form has a hidden anti-spam field and limits how many enquiries one address can send in an hour. Emails to our chartering desk are imported into our CharterDeck desk, where the rules and AI described in section 4 read cargo and vessel details into records.

Waitlist (charterdeck.io): your work email, company, the profile you select (cargo owner, vessel owner, both, other), your consent, the page you signed up from and campaign parameters (UTM). We do not record your IP address with a sign-up.

Desk accounts (desk.charterdeck.io): name, email address, a one-way hash of your password (never the password itself), your role in the organisation and an activity/audit log of actions taken in the desk.

Connected mailboxes: when an organisation connects a mailbox, CharterDeck reads — with read-only access — messages that arrive after the connection: sender and recipient names and addresses, subject, text body and attachment metadata (file name, type, size). Attachment contents are not downloaded or stored at this stage. From these messages we derive business records such as cargoes, vessel positions, companies and contacts (name, email and phone number as they appear in the message).

How your visit started (charterdeck.io): the site notes in your browser's session storage how your visit began — the page you landed on, the website that referred you (its address only, never the full link), campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and, for a Google Ads click, the ad click identifier (gclid, gbraid or wbraid). It is not a cookie, contains nothing that identifies you and is deleted when you close the tab. If you accept analytics (section 11), the same note is kept in your browser's local storage for up to 90 days instead, so a later visit still knows how you first found us. It reaches us only if you submit the enquiry form, and is then stored with your enquiry so we can see which pages and campaigns lead to enquiries and fixtures.

Analytics (charterdeck.io), only if you accept it: Google Analytics records the pages you view, how you arrived, your approximate location, your device and browser, and that an enquiry was sent, with its type (cargo or vessel), its segment and the kind of page you first landed on. It never receives your name, company, email address, phone number or anything you write in an enquiry. Section 11 describes the cookies it uses and how to change your choice.

Technical data: our hosting provider processes connection data (such as IP address and browser type) to deliver and secure the service and keeps it for a limited period. The desk uses only strictly necessary cookies (sign-in session and security). We do not use advertising cookies. Analytics cookies are set only if you accept them (section 11).

3. Why we use it and on what legal basis

• To answer and work your chartering enquiry, including taking your cargo or vessel to market as you instruct — steps you ask for before a contract, performance of a contract, and our legitimate interest in running our brokerage.
• To provide the desk and its features to your organisation — performance of a contract.
• To contact you about early access and product updates after you join the waitlist — your consent, which you can withdraw at any time.
• To process business communications of an organisation that connected its mailbox — on that organisation's instructions; for the organisation's counterparts, the organisation's legitimate interest in running its chartering business.
• To learn which pages and campaigns bring enquiries and business, using the visit source stored with an enquiry — our legitimate interest in measuring our own marketing.
• To count visits to charterdeck.io with Google Analytics, and to remember between visits how you first found us — your consent, which you give or refuse in the cookie banner and can change at any time under “Cookie settings”.
• To keep the service secure, prevent abuse and keep audit records — our legitimate interest.
• To comply with legal obligations — legal obligation.

4. Automated processing and AI

CharterDeck combines deterministic rules with AI-assisted processing. Together they read cargo circulars, open-position lists, enquiries and attachments into structured cargo and vessel records, match vessels with cargoes on the details that decide a fixture, estimate voyage economics and rank the options with the reasons shown.

The system learns from the desk's own work. When brokers confirm, correct or reject a record or a match, and when a negotiation ends in a fixture or not, that feedback is used to improve extraction, matching and ranking. Learning uses business information (cargo, vessel, ports, dates and terms), not your personal contact details.

AI model providers act as our sub-processors under a data processing agreement. They process data in the European Union, receive message text with signatures and contact details removed wherever the task allows, and may not use the data to train their own general-purpose models.

People make the commercial decisions: offers, negotiations and fixtures are not concluded automatically, and no automated output is a decision with legal or similarly significant effects on you.

5. Who we share it with

We do not sell personal data. We use these service providers (sub-processors), each bound by a data processing agreement:

• Vercel Inc. — hosting; application functions run in Frankfurt (EU), content is delivered through a global edge network.
• Neon Inc. — database hosting in Frankfurt (EU).
• Google LLC — Gmail API for mailboxes an organisation connects; Google Workspace (Apps Script and Sheets) to record waitlist sign-ups; Google Analytics for website statistics, only for visitors who accept analytics.
• AI model providers — AI-assisted extraction, matching and ranking (section 4), processing in the European Union.

We may also disclose data where the law requires it, or to protect our rights and the security of the service.

6. International transfers

We store service data in the European Union (Frankfurt). Some of our providers are established outside the EU and Türkiye. Where personal data leaves the EU/EEA it is protected by the European Commission's Standard Contractual Clauses or an adequacy framework such as the EU–US Data Privacy Framework. Where Turkish law applies, transfers abroad follow Article 9 of the KVKK.

7. How long we keep it

• Chartering enquiries and brokerage correspondence, including the visit source stored with a web enquiry: for as long as needed to handle the business, then for the period commercial, tax and accounting law requires.
• Waitlist: until you ask us to remove you, and in any case no longer than 24 months after our last contact.
• Desk accounts and business records: for as long as the organisation uses CharterDeck, then deleted within 90 days unless the law requires us to keep them longer.
• Connected mailboxes: disconnecting a mailbox immediately deletes the stored access credential. Messages already imported remain part of the organisation's records until the organisation deletes or redacts them.
• Analytics choice and cookies: your accept or reject choice is remembered in your browser for 12 months, then we ask again. After an accept, the note of how you first found us is kept in your browser for up to 90 days and the Google Analytics cookies for up to two years; all of them are removed when you change your choice to reject. Google deletes visitor-level analytics data after the retention period set in our Google Analytics account.
• Security logs: for a limited period set by our hosting provider.

8. How we protect it

Data is encrypted in transit. Mailbox access credentials are encrypted at rest (AES-256-GCM) and mailboxes are connected with read-only permission unless the organisation explicitly enables sending. Access is limited by role, sensitive actions are audited, and attachments are never processed without malware scanning.

9. Your rights

Depending on the law that applies to you, you can ask to access, correct, delete or export your personal data, restrict or object to its processing, and withdraw consent at any time. Email us at the address below; we reply within 30 days. If your data was processed on behalf of an organisation (for example a message you sent to one of our customers), we will pass your request to that organisation.

You can also complain to a data protection authority — in the EU the authority of your country, in Türkiye the Personal Data Protection Authority (KVKK).

10. Children

CharterDeck is a business service and is not intended for anyone under 18.

11. Cookies and analytics

charterdeck.io sets no cookies until you make a choice. The first time you visit, a banner asks whether you accept or reject analytics; both answers are equally easy to give, and the site works the same either way.

• If you reject, or make no choice: Google Analytics is not loaded, no analytics cookie or identifier is created and nothing is sent to Google. How your visit started is kept in session storage only and is deleted when you close the tab.
• If you accept: Google Analytics is loaded and sets its cookies (_ga and _ga_ followed by our property id), which hold a random identifier for your browser. We use it for visit statistics only: advertising features, Google signals and ad personalisation are switched off, and no advertising cookie is set. How you first found us is then kept in local storage for up to 90 days.
• Your choice itself is remembered in your browser's local storage for 12 months. It is not a cookie and is never sent to us.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page. Changing an accept to a reject stops Google Analytics straight away, deletes its cookies from your browser and stops remembering how you first found us.

The desk at desk.charterdeck.io uses only the strictly necessary sign-in and security cookies and no analytics.

12. Changes and contact

We will update this page when our processing changes and show the date of the last update at the top; material changes are announced to desk users.

Contact: ORION MARINE GEMİ ELEKTRİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Orhangazi Mah. Vatan Cad. No: 23/A, Pendik, Istanbul, Türkiye — info@orionnmar.com.

13. KVKK Aydınlatma Metni

Veri sorumlusu: ORION MARINE GEMİ ELEKTRİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Orhangazi Mah. Vatan Cad. No: 23/A, Pendik, Istanbul, Türkiye. İletişim: info@orionnmar.com.

İşlenen veriler ve amaçlar: bize e-posta, telefon veya web sitemizdeki kısa talep formu ile ilettiğiniz yük ya da açık gemi pozisyonu talepleri için ad, iletişim, şirket ve paylaştığınız ticari bilgiler (talebin yanıtlanması ve talimatınız doğrultusunda yürütülmesi); bekleme listesi için iş e-postası, şirket ve profil bilgisi (ürün güncellemeleri ve erken erişim iletişimi); masa kullanıcıları için ad, e-posta, rol ve işlem kayıtları (hizmetin sunulması ve güvenliği); bir kurumun bağladığı e-posta kutusundaki gelen iletilerin gönderen/alıcı bilgileri, konu, metin ve ek bilgileri (kurum adına navlun ve gemi kayıtlarının oluşturulması); kayıtların kurallar ve yapay zekâ desteğiyle okunması, yük ve gemilerin eşleştirilmesi ve sistemin broker geri bildirimleriyle iyileştirilmesi.

Ziyaret kaynağı: web formuyla gönderilen taleplerle birlikte, tarayıcınızın oturum belleğinde tutulan ziyaret başlangıcı bilgisi (giriş yaptığınız sayfa, sizi yönlendiren sitenin adresi, bağlantıdaki kampanya etiketleri ve Google Ads tıklama kimliği) de alınır; çerez değildir, sizi tanımlayan bir bilgi içermez ve sekme kapandığında silinir; analitiği kabul ederseniz aynı bilgi tarayıcınızın yerel belleğinde en fazla 90 gün tutulur. Hangi sayfa ve kampanyaların talep ve iş getirdiğinin ölçülmesi amacıyla meşru menfaate (KVKK m.5/2-f) dayanılarak talebinizle birlikte saklanır.

Analitik çerezler: charterdeck.io, yalnızca çerez bildiriminde analitiği kabul etmeniz hâlinde Google Analytics kullanır. Kabul etmediğiniz veya seçim yapmadığınız sürece Google Analytics yüklenmez, analitik çerezi ya da tanımlayıcısı oluşturulmaz ve Google'a veri gönderilmez. Kabul ederseniz görüntülediğiniz sayfalar, siteye nasıl ulaştığınız, yaklaşık konumunuz, cihaz ve tarayıcı bilginiz ile bir talep gönderildiği (türü, segmenti ve ilk giriş yaptığınız sayfanın türü) ziyaret istatistikleri amacıyla işlenir; adınız, şirketiniz, e-posta adresiniz, telefonunuz ve talebinizin içeriği Google Analytics'e gönderilmez. Bu işleme açık rızanıza (KVKK m.5/1) dayanır. Seçiminiz tarayıcınızda 12 ay hatırlanır; sayfaların altındaki “Cookie settings” bağlantısından dilediğiniz zaman değiştirebilirsiniz. Reddettiğinizde Google Analytics durdurulur ve çerezleri silinir.

Hukuki sebepler: KVKK m.5/2 (c) sözleşmenin ifası, (ç) hukuki yükümlülük, (f) meşru menfaat; bekleme listesi iletişimi, ticari elektronik iletiler ve analitik çerezler için açık rıza/onay.

Toplama yöntemi: e-posta, telefon, web formu, masa uygulaması ve kurumların salt okunur olarak bağladığı e-posta kutuları üzerinden.

Aktarım: veriler barındırma, veritabanı ve e-posta hizmeti aldığımız Vercel, Neon ve Google'a ve Avrupa Birliği'nde işleme yapan yapay zekâ hizmet sağlayıcılarına; Avrupa Birliği'ndeki (Frankfurt) sunuculara ve bu sağlayıcıların bulunduğu ülkelere KVKK m.9'a uygun olarak aktarılır. Kanunen yetkili kurumlara talep hâlinde aktarılabilir.

Haklarınız (KVKK m.11): verilerinizin işlenip işlenmediğini öğrenme, bilgi talep etme, amacını öğrenme, aktarıldığı kişileri bilme, düzeltilmesini veya silinmesini isteme, itiraz etme ve zararın giderilmesini talep etme. Başvurularınızı info@orionnmar.com adresine iletebilirsiniz; en geç 30 gün içinde yanıtlanır.