Privacy Policy

Effective Date: 2 March 2026  |  Last Updated: 17 September 2026

Vinova Systems Ltd (Company No. 15969790), registered at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF ("Vinova Systems", "we", "us", or "our") is committed to protecting the privacy of individuals who use our products, services, and websites. This Privacy Policy explains how we collect, use, store, and share information when you use:

• NCoDE Mobile - our iOS and Android mobile application
• NCoDE Command - our unified vessel management and operating platform
• NCoDE Peplink - our network monitoring integration
• NCoDE Fleet - our fleet management platform
• NCoDE SeaTwin - our digital twin product
• AirTime and SeaLink - our connectivity and communication services
• Vinova Systems websites - including www.vinova.uk
• Any associated hardware, cloud services, or support services (collectively, the "Services")

1. Data Controller and Legal Framework

Vinova Systems Ltd (Company No. 15969790), registered at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF, is the data controller responsible for personal data processed under this Policy. You can contact us about data protection matters at info@vinova.uk.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we provide Services to customers established in the European Economic Area, we also process personal data in accordance with Regulation (EU) 2016/679 (EU GDPR).

Where we process vessel or operational data on behalf of a customer under a contract, we act as a processor and that customer is the controller. In those cases the customer's own privacy notice governs, and we process the data only on documented instructions.

1.1 Our Lawful Bases for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract (Art. 6(1)(b)) — to provide the Services, manage accounts, deliver support, and fulfil our obligations to you.
• Legitimate interests (Art. 6(1)(f)) — to secure and maintain our Services, prevent fraud and misuse, understand aggregate website usage, and communicate with business contacts about products they have enquired about. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to meet accounting, tax, regulatory, and lawful-request obligations.
• Consent (Art. 6(1)(a)) — where we ask for it, for example for optional marketing communications. You may withdraw consent at any time without affecting processing carried out beforehand.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, company name, and role when you create an account or request information via our contact forms.
• Configuration data: Vessel identifiers (MMSI, vessel name), connection settings (server addresses, port numbers), and dashboard layout preferences.
• Support communications: Messages, feedback, and correspondence you send to us.

2.2 Information Collected Automatically

• Vessel telemetry data: Engine parameters (RPM, temperature, oil pressure, fuel levels), navigation data (position, speed, heading, depth), environmental data (weather, sea state, temperature, humidity), and system status data collected from onboard sensors via NMEA 2000 and other marine protocols. This data is processed primarily on-vessel or on-device and is only transmitted to cloud services when remote access is configured by the vessel operator via the cloud proxy.
• Network data: WAN link status, signal strength, bandwidth usage, connected device information, and Starlink dish status (where available on the local network) when using NCoDE Peplink features. This data remains within the vessel's network unless remote access is configured via the cloud proxy.
• AIS data: Automatic Identification System vessel tracking data obtained from publicly available AIS services for fleet tracking and collision avoidance purposes.
• Device information: Device type, operating system version, app version, and screen dimensions for the purpose of delivering a responsive user experience. We do not collect device advertising identifiers.
• Usage data: Basic app usage patterns (screens visited, features used) to improve product quality. This data is anonymised and aggregated.
• Security and audit logs: Login events, configuration changes, and system alerts for compliance and security monitoring purposes.

2.3 Information We Do Not Collect

• We do not collect precise device location via GPS from your mobile device. Vessel position is obtained from the vessel's onboard navigation systems (NMEA data), not from your phone's GPS.
• We do not collect contacts, photos, calendar data, or other personal content from your device.
• We do not use advertising identifiers (IDFA/GAID).
• We do not use tracking pixels or third-party analytics SDKs that share data with advertisers.

3. How We Use Your Information

4. Data Storage and Security

4.1 Where Data Is Stored

• On-vessel: Telemetry data, audit logs, and configuration are stored locally on the vessel's NCoDE hardware and within the NCoDE Command application's local database. This data does not leave the vessel unless remote access is explicitly configured via the cloud proxy.
• On-device: NCoDE Mobile stores connection settings and cached telemetry data locally on your mobile device using encrypted device storage.
• Cloud services: When remote access is configured, vessel data is transmitted via encrypted connections (TLS 1.2+) to secure cloud infrastructure hosted in Microsoft Azure (UK West region). Contact form submissions and account data are stored in our secure cloud infrastructure.

4.2 Security Measures

• All data transmitted between devices and cloud services uses TLS 1.2 or higher encryption.
• Cloud infrastructure is hosted within secure, professionally managed data centres.
• Access to vessel data is controlled by authentication (LDAP or local credentials).
• We implement role-based access controls within our products.
• Security monitoring and event logging is provided where configured.

4.3 Data Retention

• Telemetry data: Retained on-vessel for as long as storage permits, managed by the vessel operator. Cloud-synced data is retained for the duration of the service agreement.
• Audit logs: Retained for a minimum of 12 months for compliance purposes, then automatically purged.
• Account data: Retained for the duration of the business relationship and for 12 months thereafter, unless a longer period is required by law.
• Contact form data: Retained for 24 months or until the enquiry is resolved, whichever is longer.

5. Data Sharing

We do not sell, rent, or trade your personal data or vessel data to third parties.

We may share data only in the following limited circumstances:

• Service providers: We use Microsoft Azure for cloud hosting and data processing, Sentry (Functional Software, Inc.) for crash and error reporting, and Apple and Google for push notification delivery to mobile devices. These providers are bound by data processing agreements and process data only on our instructions.
• At your direction: When you configure data sharing with third-party systems or integrations (e.g., fleet management platforms).
• Legal obligations: Where required by law, regulation, court order, or governmental request. We will notify you where legally permitted to do so.
• Safety: Where necessary to protect the safety of persons or vessels in an emergency.

6. Your Rights

If you are located in the UK or European Economic Area, you have the following rights under the UK GDPR / EU GDPR:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@vinova.uk. We will respond within 30 days.

7. Mobile Application Specific Provisions

7.1 NCoDE Mobile (iOS and Android)

• Network access: The app requires network access to connect to your vessel's NCoDE system, either via local WiFi or a cloud proxy service. No data is transmitted to Vinova Systems unless remote access is explicitly configured by the vessel operator.
• Local network access (iOS): The app may request local network permission to discover and connect to NCoDE systems and CCTV cameras on the vessel's local network.
• Notifications: The app displays in-app alerts for vessel threshold breaches and system events. Where you grant notification permission, critical alerts are also delivered as push notifications via Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). A device push token is used solely to route alerts to your device and is not used to build a profile of you. Push delivery is performed by Apple and Google on a best-effort basis and is not guaranteed; an alert may be delayed or may not arrive. You can revoke notification permission at any time in your device settings.
• No background location: The app does not access your device's GPS or location services. Vessel position is obtained from the vessel's navigation instruments.
• Biometric authentication (iOS): The app may use Face ID or Touch ID to securely authenticate you. Biometric data is processed entirely on your device by iOS and is never transmitted to or accessed by Vinova Systems.
• Camera and microphone: The app displays live and recorded video from cameras installed on the vessel. It does not access your own device's camera or microphone, and does not request those permissions.
• Data stored on device: Connection settings (server URL, protocol preference) and cached telemetry data are stored locally on your device. This data is removed when you uninstall the app.
• Third-party SDKs: The app uses React Native (Meta Platforms) as its application framework, react-native-maps for map display, and the Sentry SDK for crash and error reporting. Crash reports contain diagnostic information such as the error and stack trace, app version, and device model; they are not linked to your account and are not used for tracking. No advertising or analytics SDKs are included.

7.2 Apple App Tracking Transparency

NCoDE Mobile does not track you across other companies' apps or websites. We do not use the AppTrackingTransparency framework because we do not engage in tracking as defined by Apple.

7.3 Apple Privacy Nutrition Labels

The following data types are collected by NCoDE Mobile:

8. Cookies and Website Tracking

Our website (www.vinova.uk) uses only essential cookies required for the website to function. We do not use advertising cookies, social media tracking pixels, or third-party analytics that share data with advertisers.

We use a self-hosted, cookie-free analytics tool (Umami) to collect anonymous usage statistics such as page views, referral sources, and browser type. No personal data, IP addresses, or cookies are stored. All analytics data is held on our own servers and is never shared with third parties.

9. Children's Privacy

Our Services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.

10. International Data Transfers

Our primary data processing takes place in the United Kingdom. Where data is processed outside the UK (for example, via cloud infrastructure), we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions as applicable.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this page and, where appropriate, via in-app notification or email. Your continued use of our Services after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.