Privacy notice
DE-UK-privacy-2026-10-v3-en ยท DE
Working draft: The responsible operator's identity, address and country of establishment, and any required representatives, still need to be supplied. This is not yet a complete privacy notice.
Controller and contact
Not yet supplied Not yet supplied Not yet supplied privacy@maritimhub.com
Scope
This UK version covers MaritimHub under the UK GDPR and Data Protection Act 2018, as amended, including the Data (Use and Access) Act 2025. We provide a marketplace for new and used boats and parts, surveys and residual-value assessments. A user's country is not the operator's place of establishment or a choice of law. The EU GDPR also applies wherever its territorial conditions are met, including offering services to people in the EU or monitoring them. Selecting English does not remove those protections.
Data and sources
You supply identity, contact details, country, account type, credentials, seller evidence, listings, images, bids and boat, condition and location data. Sessions, IP/device data and security/change logs arise from use. Transaction partners, appointed surveyors and payment, verification or escrow services you actually use may supply payment references and verification results. Where information comes from elsewhere, we identify its specific source, categories and purpose in the relevant additional notice. Redact unnecessary details and avoid uploading unnecessary third-party data.
Purposes and lawful bases
Accounts, sign-in, listings, bidding, introductions and ordered surveys: UK GDPR Article 6(1)(b), contract or pre-contract steps. Actual legal accounting, retention or disclosure duties: Article 6(1)(c). Access protection, fraud prevention, technical logs and legal claims: Article 6(1)(f), legitimate interests in a secure marketplace, preventing abuse and protecting claims, balanced against your rights. Optional marketing, non-essential tracking and separately identified optional purposes: Article 6(1)(a), separate prior consent. Reading this notice is not blanket consent. Special-category information requires an additional Article 9 condition and any applicable DPA 2018 requirements.
Recipients and publication
Listing information and images intended for publication are public. Necessary transaction contacts are shared with the relevant buyer or seller. Assigned surveyors receive data needed for ordered expert or onsite services. Authorised staff access information according to their roles. Other categories include Hostinger VPS hosting, email delivery, private storage and activated verification, payment or escrow providers. Authorities receive information only on a lawful basis. External AI receives search/input text only when its integration is active and after information about the provider, data and transfers. Identity documents and private survey records are not public listings.
International transfers
The operator's country and the actual storage/access countries of providers must still be specified before this notice is completed. European hosting does not rule out overseas access. Restricted UK transfers require the applicable UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with the required transfer assessment and supplementary protection. Applicable EU transfers separately require EU GDPR Chapter V safeguards. Exceptional derogations are not a blanket basis for routine transfers. Ask the privacy contact for transfer details and a copy of relevant safeguards.
Retention
Account information is kept during active use and afterwards only for necessary outstanding administration. Listings, bids, contract and survey evidence are retained for fulfilment and, where necessary, applicable claim/evidence periods. Financial records follow the operator's actual statutory duties; no German period is assumed. Security logs are deleted or anonymised when their security purpose ends. After account deletion, legally necessary records are restricted to that purpose and backups removed in the normal backup cycle. Specific periods and backup cycles still need to be completed against the operator's duties and technical deletion schedule.
Your rights
Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, and the applicable safeguards for significant automated decisions. Contact us using the privacy contact; identity checks must be proportionate. Requests are normally handled within one month, subject to lawful extensions or clarifications; we explain any applicable extension. Requests are generally free. You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/. Where EU GDPR applies, you may also complain to the appropriate EU supervisory authority, particularly where you live, work or where the alleged infringement occurred.
Objection and withdrawal
RIGHT TO OBJECT: You may object on grounds relating to your particular situation to processing based on legitimate interests. Objection to direct marketing, including related profiling, is unconditional and available at any time. Withdraw consent as easily as you gave it or through the privacy contact, for future processing, without affecting prior lawfulness. Withdrawal from an optional purpose does not prevent use of independent core functions.
Automated processing
Automatic bids follow your chosen maximum and the auction rules. Survey models use completeness, declared condition and available comparables under documented rules. A self-created report is generated from owner declarations without expert approval; completeness is not a guarantee of valuation accuracy. Expert reports require professional review. Security rules may temporarily block actions. Any solely automated decision with legal or similarly significant effects must meet the applicable UK statutory requirements and safeguards, including relevant information, representations, human intervention and contesting the decision. Applicable EU Article 22 protections remain available to EU-covered processing. Specific information must be provided before such a procedure is used.
Required and optional data
Fields required for accounts and contracts are marked. Without contact/sign-in data we cannot create an account; missing required seller evidence can prevent selling approval; missing mandatory survey information or evidence makes a report impossible or limited. Additional equipment, documents and optional services are voluntary unless expressly required for the particular order. Do not send full card numbers or security codes in free text or uploads.
Cookies and security
Necessary session functions support sign-in and account security. Your language choice is stored locally in the browser. Non-essential analytics, advertising or other storage/access technology requires separate prior permission where required by PECR and applicable law; accepting terms does not replace that permission. Encrypted connections, restricted access, separate data areas and protected private uploads do not replace a lawful basis.
Updates and complaints
Updated: 2 October 2026. Material changes to purposes, recipients or lawful bases are explained before use; any required new consent is collected separately. Previously acknowledged versions remain linked to their evidence. Send internal privacy complaints to the privacy contact. Under the UK complaints procedure, receipt is acknowledged within 30 days, complaints are investigated without undue delay, you are kept informed of progress and the outcome is communicated without undue delay. Your right to complain to the ICO remains unaffected.