PRIVACY POLICY

This Privacy Policy explains how Docky Holding LLC and the applicable affiliated operating entity, including DOCKY USA LLC and, where applicable, DOCKY FRANCE SASU, collect, use, disclose, retain and protect Personal Data in connection with Docky's websites, applications, berth workflows, Direct Listings, payments, communications and support. The responsible Docky entity may depend on the country, Service and contracting arrangement.

We may collect account and identity data; vessel and berth data; insurance and compliance documents; Booking and absence data; Direct Listing and provider-authority information; payment and transaction data; communications and user content; approximate or permission-based precise location; device, usage and diagnostic data; and legal, fraud and safety records. Full card numbers are generally processed by the payment provider rather than stored by Docky.

Data may come directly from you; Marina/Port Operators; Direct Listing providers; other users involved in a workflow; browsers, devices, cookies, SDKs and logs; payment processors, app stores, identity/fraud tools and other service providers; and public or legally available sources where reasonably necessary.

We use Personal Data to create and secure accounts; operate absence declarations, Direct Listings, search, matching, compatibility screening, Bookings, marina workflows and communications; transmit necessary information to operators/providers; process payments, refunds and transaction records; support users; prevent fraud and unsafe activity; improve the Service; send lawful communications; comply with law; and establish or defend legal claims.

We may disclose Personal Data as reasonably necessary to Marina/Port Operators, Direct Listing providers involved in the transaction, payment and financial-service providers, cloud/hosting/database/storage/CDN providers, email/push/communications/support providers, analytics/diagnostic/cybersecurity/identity/fraud providers, professional advisers, authorities, Docky affiliates and parties to a corporate transaction, subject to applicable law and safeguards.

A Marina/Port Operator or Direct Listing provider may independently process information it receives for access, safety, operations, billing, property administration, legal compliance or recordkeeping. For such independent purposes it may act as a separate controller/business and may have its own privacy notice and retention duties.

Docky may use Stripe and/or other payment providers for card payments, refunds, payouts where applicable to Direct Listings, fraud checks and related services. Depending on the activity, the provider may act as Docky's processor/service provider or as an independent controller/business.

Docky may use cookies, local storage, mobile SDKs, pixels and similar technologies for authentication, preferences, security, fraud prevention, analytics, diagnostics, performance and functionality. Where law requires consent or opt-out for non-essential technologies, Docky will provide appropriate controls. Device permissions such as location, camera, photos and notifications can generally be managed in device settings.

Where GDPR, UK GDPR or similar law applies, processing may rely on contract/performance steps, legitimate interests balanced against user rights, legal obligations and consent where required. For European operations, the responsible Docky entity may be DOCKY FRANCE SASU where the Service or contractual arrangement so provides; a separate Article 27 representative is not required merely because Docky also has U.S. entities when the relevant controller is established in the EEA.

Docky retains Personal Data only as long as reasonably necessary for service delivery, safety, fraud prevention, accounting, disputes, legal compliance and enforcement. Operational periods may vary by record type and jurisdiction. Booking/request records may be kept for approximately 24 months, technical logs for approximately 12 months, and active account data while the account remains active, with longer retention where tax, accounting, fraud, incident, legal-hold or other law requires it.

Docky uses reasonable administrative, technical and organizational safeguards, which may include encryption in transit, access controls, authentication, logging, secure cloud infrastructure, least-privilege practices, backups, monitoring and contractual safeguards. No system is absolutely secure.

Depending on where you live, you may have rights to access, correct, delete, port, restrict or object to processing, withdraw consent, opt out of certain processing, receive information about disclosures or appeal a privacy decision. Requests may be sent to contact@docky.com and may require identity verification.

Where applicable, residents of U.S. states with comprehensive privacy laws may have rights to access/know, correct, delete, obtain a portable copy, opt out of sale/sharing/targeted advertising or certain profiling, limit certain uses of sensitive data and appeal a denied request. Docky will not discriminate against a person for exercising a legally protected privacy right.

If the CCPA/CPRA applies to Docky and to you, categories collected may include identifiers, customer-record information, commercial/transaction data, internet/network activity, geolocation, audio/visual or user content, professional/marina-affiliation information and limited inferences for fraud, security, personalization or compatibility. Docky does not sell Personal Data for monetary consideration. If future practices constitute sale or sharing under California law, required notices and opt-out mechanisms will be provided.

Where applicable, you may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and rights concerning certain automated decisions. You may complain to the competent data-protection authority.

Personal Data may be processed outside the country where collected, including in the United States. Where law requires transfer safeguards, Docky will use a lawful mechanism such as an adequacy decision, approved standard contractual clauses, another recognized contractual mechanism or an applicable certified framework.

Transactional berth services are intended for adults who can legally contract. Docky does not knowingly collect Personal Data online from children under 13 in a manner subject to COPPA without valid authorization. Persons under the applicable age of majority may not independently enter transactions unless legally permitted and appropriately authorized.

Docky does not sell Personal Data for money. If Docky later introduces targeted advertising or another activity triggering statutory opt-out rights, it will provide legally required notice and controls and honor legally required preference signals where applicable.

You may request deletion through available account controls or by contacting Docky. Docky may retain records required for completed transactions, accounting, fraud prevention, safety, legal claims, regulatory obligations or other lawful exceptions.

Docky may update this Policy for changes in law, technology, vendors, features or data practices. Material changes will be communicated where required, and consent will be requested when legally required for a new use.

Privacy requests: contact@docky.com. General support: support@docky.com. WhatsApp: +1 (939) 999-0013. U.S.: Docky Holding LLC / DOCKY USA LLC (as applicable), 11 Broadway, Suite 1155, New York, NY 10004, United States. European operations may be handled by DOCKY FRANCE SASU where applicable.