Last Updated: July 11, 2026

At CrewPayScan (“we,” “us,” or “our”), we are committed to protecting the privacy and security of personal data. This document outlines our current data protection approach for website visitors and private-preview requests while CrewPayScan is still an early workflow exploration.

1. Overview

CrewPayScan is exploring a workflow for maritime teams to screen crew payment beneficiaries and banks before payroll release. During the validation/private-preview phase, we collect private-preview request data such as work email, name, company, role, approximate fleet or crew size, current screening process, and discovery-call preference.

The public preview is intended for sample or anonymized data only. Real crew or payment data should only be used in a private pilot with explicit agreement, limited fields, defined retention/deletion handling, and appropriate privacy review.

This document supplements our Privacy Policy and Terms of Service, which provide additional details on data handling and usage terms.

2. Our Role Under GDPR

2.1 Data Controller (Private Preview Request Phase)

During the validation/private-preview phase, CrewPayScan acts as a data controller for the personal data you provide through the website and private-preview request form. We determine the purposes and means of processing this data, such as managing requests, conducting discovery follow-up, and sending updates if you opt in.

2.2 Future Processor Role

If CrewPayScan later handles real customer crew or payment data in a private pilot or production service, the controller/processor roles, data processing agreement, retention rules, and security commitments will be defined before that data is handled.

3. Our Current Data Protection Measures

We currently use the following principles and measures:

3.1 Lawful Basis for Processing

• Private Preview Request Data: We process request data based on your consent and/or our legitimate interest in managing discovery, validating the workflow, and improving future product decisions.
• Real Crew Or Payment Data: Real customer data is not intended for the public preview and should only be used under a separate private-pilot agreement.

3.2 Data Security

• Access Controls: We limit access to submitted information to authorized personnel only.
• Bot Protection: We use Cloudflare Turnstile and related protections to prevent malicious bots from submitting fake private-preview requests.
• Production Planning: Production hosting, encryption, retention, audit logging, and DPA details will be defined before real customer data is handled.

3.3 Data Minimization

We collect only the data necessary for the intended purpose:

• Private preview: Work email (required), with optional fields such as name, company, role, approximate fleet or crew size, current screening process, and discovery-call preference.
• Future private pilot: Any real data fields would be limited to what is explicitly agreed for that pilot.

3.4 Data Subject Rights

We support your ability to exercise applicable data protection rights:

• Access, Rectification, Erasure, etc.: You can request access, correction, or deletion of your request data by emailing info@crewpayscan.com. We will respond within a reasonable period and in line with applicable law.
• Future Customer Support for Rights: If a private pilot or production service handles real crew data, support for data subject requests will be defined in the relevant agreement.

3.5 Data Retention

• Private Preview Request Data: Retained while it is useful for validation, discovery follow-up, or related communications, unless you request deletion earlier and we are not required to retain it.
• Future Pilot Data: Retention would be defined before any real customer data is handled.
• We delete data securely when no longer needed.

3.6 Data Protection Impact Assessments (DPIAs)

We expect to assess higher-risk processing before any real crew or payment data is handled in a private pilot or production service.

3.7 Data Processing Agreements (DPAs)

Data Processing Agreement terms are not currently offered as a public production service guarantee. If CrewPayScan later handles real customer data as a processor, DPA terms will be defined before that data is handled.

3.8 International Data Transfers

Website and form data may be processed by service providers in different locations. Production data-residency choices for any future real customer data will be defined before such data is handled.

4. Our Responsibilities

For the website and private-preview request process, we are responsible for:

• Implementing reasonable technical and organizational measures to protect submitted information.
• Responding to applicable data subject requests.
• Handling any personal data breach notifications in line with applicable law.
• Reviewing third-party providers used for website, form, and bot-protection purposes.

5. Customer Responsibilities

As a visitor or private-preview requester, you are responsible for:

• Sample Data Boundary: Avoiding submission of real crew or payment data through the public preview unless a private pilot has been explicitly agreed.
• Accuracy: Providing accurate contact and company information in the private-preview request form.
• Compliance with Laws: Ensuring any information you share with us complies with applicable laws and internal obligations.

6. Data Breach Notification

In the event of a personal data breach, we will assess the incident and provide notifications required by applicable law. Processor notification commitments for any future real-data pilot would be defined in the relevant agreement.

7. Third-Party Processors

We may use third-party providers for:

• Bot Protection and Website Security: Cloudflare Turnstile and related protections.
• Website Hosting and Form Handling: Providers used to operate the public website and receive private-preview requests.
• Analytics: We do not currently enable website analytics. If privacy-conscious analytics are enabled later, this section will be updated before use.

Production subprocessors for any future real customer data would be defined before that data is handled.

8. Contact Us

For privacy or data protection inquiries, or to exercise applicable data protection rights, contact us at:

Email: info@crewpayscan.com
Website: crewpayscan.com

Contact for GDPR Compliance:
CrewPayScan is in the validation/private-preview phase. For privacy or data protection inquiries, please reach out to:
Email: info@crewpayscan.com
Company and service details will be updated as they are finalized.

Data Protection Officer:
CrewPayScan is currently in the validation/private-preview phase. For any privacy or data protection inquiries, please contact us at:
Email: info@crewpayscan.com
We will update this section as company and service details are finalized.

We will respond to requests within a reasonable period and in line with applicable law.

9. Changes to This GDPR Compliance Statement

We may update this document to reflect changes in our practices or legal requirements. We will notify you of significant changes via email (if provided) or by posting a notice on our website. The “Last Updated” date at the top will reflect the latest revision.

Note: This data protection statement applies to CrewPayScan’s current website and private-preview request process. Additional terms may apply if CrewPayScan later offers private pilots or production services.