Privacy Policy

DirectPort — a product of FraktionX BV · Last updated: 12 March 2026

1. Data Controller

FraktionX BV (“we”, “us”, “our”) is the data controller for all personal data processed through the DirectPort platform. We determine the purposes and means of processing your personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) and applicable Belgian data protection legislation.

2. Scope of This Policy

This privacy policy applies to all personal data processed through:

• DirectPort Web Application — our browser-based maritime logistics platform
• DirectPort Mobile Application — our iOS and Android application for on-the-ground maritime operations
• DirectPort Backend Services — our server-side infrastructure, APIs, and edge functions that support both applications

Both applications share a common backend and user account system. Data you provide through one application may be accessible through the other, subject to your role and permissions.

3. Data We Collect

3.1 Account & Profile Data All Platforms

Data type	Examples
Identity data	First name, last name, profile picture
Contact data	Email address, phone number, physical address
Authentication data	Hashed password, session tokens, SSO identifiers (Microsoft)
Preferences	Timezone, language, notification subscriptions, product-update opt-in

3.2 Operational & Maritime Data All Platforms

Data type	Examples
Vessel data	Vessel name, flag state, fuel type, MMSI number, tank configuration
Voyage data	Routes, stops, estimated/actual arrival and departure times, status
Cargo data	Product descriptions, quantities, bill-of-lading references
Terminal operations	Berth assignments, shift data, storage measurements
Bunker/fuel data	Fuel type, level readings, consumption and emission calculations

3.3 Financial & Business Data Web App

Data type	Examples
Party/company data	Company name, VAT number, enterprise number (KVK, RSIN), PEPPOL ID
Banking details	IBAN, BIC (for invoicing purposes)
Invoice & financial data	Invoice amounts, line items, credit notes, purchase orders, budget lines
Contracts	Transport and employment contract terms, signatories, versions
Staff records	Name, email, phone number, position, department

3.4 Location Data Mobile App

Data type	Details
Precise geolocation	Latitude, longitude, accuracy, speed, heading, timestamp
Collection frequency	Every 5 seconds when tracking is enabled (foreground and background)
Derived data	Whether the user is moving (speed > 0.5 m/s)

Location data collection is entirely opt-in. See Section 7 for full details.

3.5 Documents & Media All Platforms

• Documents uploaded to voyages (PDFs, images, Word, Excel, email files)
• Photos taken via device camera for document capture Mobile
• Company logos and vessel certificates
• Electronic signature records

3.6 Technical & Diagnostic Data All Platforms

Data type	Details
Error reports	Application crashes, error stack traces, page URLs (via Sentry)
App metadata	App version, platform (iOS/Android/Web), update identifiers
API logs	Request endpoints, response status codes, processing duration

We do not collect device advertising identifiers, and we do not use your data for advertising or cross-app tracking.

3.7 Email & Communication Data Web App

• Emails processed through the platform (sender, recipient, subject, content, attachments)
• In-app notification records and read/unread status

3.8 Form & Inspection Data Web App

• Responses to QHSE (Quality, Health, Safety, Environment) forms
• Terminal inspection and operation form data
• Custom attribute fields as configured by your organisation

4. How We Collect Data

• Directly from you — when you register an account, fill in forms, upload documents, or enable location tracking
• From your organisation — your employer or organisation administrator may create your account and assign roles
• From your device — with your permission, the mobile app collects location data and can access your camera and photo library
• From third-party data sources — vessel positions may be supplemented with data from AIS (Automatic Identification System) providers, EURIS (European River Information Services), and water level services (Hydrometeo)
• Automatically — technical diagnostics and error reports are generated automatically during normal use

5. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6(1) GDPR:

Legal basis	Processing activities
Performance of a contract (Art. 6(1)(b))	Account creation and management; providing the DirectPort platform services; processing voyages, cargo, and financial operations; document management; vessel tracking as part of the service
Consent (Art. 6(1)(a))	Background location tracking on the mobile app; camera and photo library access; product update communications; vessel owner consent for vessel tracking
Legitimate interest (Art. 6(1)(f))	Error monitoring and diagnostics (Sentry) to maintain service quality and security; feature-flag evaluation (GrowthBook) to improve the user experience; API logging for security and debugging; audit trails for data integrity
Legal obligation (Art. 6(1)(c))	Retention of financial records (invoices, credit notes) as required by Belgian and EU accounting and tax regulations; compliance with maritime reporting obligations

Where we rely on consent, you may withdraw it at any time (see Section 12). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Purposes of Processing

We process your data for the following purposes:

1. Service delivery — operating the DirectPort platform, managing voyages, cargo logistics, terminal operations, and financial workflows
2. Account management — authenticating users, managing roles and permissions, supporting multi-tenant organisation structures
3. Maritime operations — tracking vessel positions, monitoring water levels, calculating emissions, and managing bunker/fuel data
4. Financial processing — generating and transmitting invoices (including via the PEPPOL e-invoicing network), managing purchase orders, credit notes, and recurring billing
5. Document management — storing, versioning, and sharing operational documents, contracts, and certificates
6. Communication — sending transactional emails related to your use of the platform, processing inbound emails for document management
7. Safety & compliance — managing QHSE inspection forms, terminal safety records, and incident reports
8. Service improvement — monitoring application errors, evaluating feature rollouts, and maintaining platform reliability
9. Security — API logging, audit trails, and access control to protect the integrity of the platform and your data
10. Data integration — synchronising operational data with authorised logistics partners through secure integrations

7. Location Tracking Mobile App

The DirectPort mobile app includes an optional location-tracking feature designed for maritime crew members. This section explains exactly how it works.

7.1 Opt-In Only

Location tracking is never enabled by default. Before tracking can begin:

1. You are shown a prominent disclosure explaining what data is collected and how it is used
2. You must explicitly accept the disclosure
3. Your device will prompt you for location permissions (including background location access)
4. You activate tracking via a clearly visible toggle in the app

7.2 What Is Collected

When tracking is enabled, the app collects your precise location (latitude, longitude, accuracy, speed, and heading) approximately every 5 seconds, including when the app is in the background or closed.

7.3 How Data Is Used

• Location data is associated with your user account and transmitted to our backend over an encrypted connection
• It is used to display your real-time position to authorised personnel within your organisation
• Location data is not sold, rented, or shared with third parties for advertising or analytics

7.4 How to Disable

You may disable location tracking at any time by:

• Turning off the tracking toggle in the app
• Revoking location permissions in your device settings (iOS: Settings > DirectPort > Location; Android: Settings > Apps > DirectPort > Permissions > Location)

7.5 Background Location Use

On Android, a persistent notification (“Location sharing enabled — Sharing your position in the background”) is displayed while background tracking is active, in compliance with Android platform requirements. On iOS, the system location indicator is shown when background location access is in use.

8. Third-Party Service Providers

We use the following categories of third-party service providers to operate DirectPort. These providers process personal data on our behalf under data processing agreements and are not permitted to use your data for their own purposes.

Provider	Purpose	Data shared	Location
Supabase	Backend infrastructure, database, authentication, file storage	All platform data (stored and processed as our primary infrastructure)	EU
Sentry	Error monitoring and crash reporting	Error stack traces, page URLs, app version, update identifiers	EU (Germany)
GrowthBook	Feature flag management	Tenant identifier (no personal data)	US/EU
Mapbox	Map rendering and vessel position visualisation	Map tile requests (no personal user data sent)	US
Resend	Transactional email delivery	Recipient email addresses, email content, attachments	US
Recommand (PEPPOL)	Electronic invoice transmission via the PEPPOL network	Invoice data: party names, addresses, VAT numbers, banking details, invoice amounts and line items	EU
Expo (EAS)	Mobile app over-the-air updates	App version metadata, update identifiers (no personal data)	US
Exchange Rate API	Currency conversion rates	No personal data (currency pair requests only)	US

8.1 Third-Party Data Sources

We may receive vessel position and waterway data from the following external sources to supplement our maritime services:

• AISHub — Global AIS (Automatic Identification System) vessel position data, queried by vessel MMSI number
• EURIS — European River Information Services for terminal and berth positioning
• Hydrometeo / Danube water level services — Water level forecasting and historical data for navigation

8.2 Authorised Logistics Partner Integrations

With your organisation’s authorisation, operational data (voyage references, party details, cargo and financial information) may be synchronised with authorised logistics partner systems through secure API integrations (e.g., Workato). These integrations are configured at the organisation level by your administrator.

9. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred to service providers located outside the EEA (such as providers in the United States), we ensure adequate protection through one or more of the following mechanisms:

• European Commission adequacy decisions (including the EU-US Data Privacy Framework where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules of the service provider

You may request information about the specific safeguards applied to transfers of your data by contacting us at privacy@fraktionx.com.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

Data category	Retention period
Account & profile data	Duration of your account, plus 30 days after deletion request to complete processing
Operational data (voyages, cargo, terminals)	Duration of your organisation’s subscription, plus any legally required retention period
Financial records (invoices, credit notes)	7 years from the end of the financial year in which the transaction occurred, in compliance with Belgian accounting law (Code de droit économique / Wetboek van economisch recht)
Location data	Duration of the relevant voyage, plus up to 12 months for operational review; thereafter anonymised or deleted
Error reports & diagnostics	90 days (Sentry default retention)
API logs	Up to 12 months for security and debugging purposes
Email records	Duration of your organisation’s subscription

When data is no longer required, it is securely deleted or anonymised. We use a “soft delete” mechanism for most records, marking data as deleted while retaining it for a limited period before permanent removal, to support audit requirements and accidental-deletion recovery.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit — All data transmitted between your device and our servers uses TLS/HTTPS encryption
• Encryption at rest — Database storage is encrypted at rest
• Authentication security — Passwords are cryptographically hashed; session tokens are managed securely with automatic refresh and expiry
• Multi-tenant isolation — Row-Level Security (RLS) policies enforce strict data separation between organisations at the database level
• Access control — Role-based permissions ensure users only access data relevant to their function
• API authentication — All API access requires valid authentication tokens; API tokens are stored as cryptographic hashes
• Audit logging — Changes to records are tracked with timestamps and user attribution

12. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You may request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — You may request deletion of your data where it is no longer necessary for the purpose it was collected, or where you withdraw consent
• Right to restriction (Art. 18) — You may request that we limit the processing of your data in certain circumstances
• Right to data portability (Art. 20) — You may request your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21) — You may object to processing based on legitimate interests, including for direct marketing purposes
• Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@fraktionx.com. We will respond within 30 days. If we require additional time (up to two further months for complex requests), we will inform you within the initial 30-day period.

13. Account Deletion

You may delete your DirectPort account at any time:

• Mobile app: Navigate to your profile settings and select “Delete Account”
• Email: Send a deletion request to privacy@fraktionx.com

Upon account deletion:

• Your profile data will be removed within 30 days
• Location tracking data associated with your account will be permanently deleted
• Data that we are legally required to retain (such as financial records in which you are referenced) will be retained for the mandatory period but will no longer be linked to an active account
• Documents and operational data belonging to your organisation will remain accessible to your organisation but will no longer be attributed to your personal account

14. Cookies & Local Storage

14.1 Web Application

The DirectPort web application uses the following browser storage mechanisms:

• Authentication tokens — Stored via Supabase Auth to maintain your logged-in session. These are strictly necessary for the service to function and do not require consent.
• SWR cache — Temporary in-memory cache for API responses to improve performance. No data is persisted to disk.

We do not use advertising cookies, social-media tracking pixels, or third-party analytics cookies. No cookie consent banner is required as we use only strictly necessary storage.

14.2 Mobile Application

The mobile app uses on-device storage (AsyncStorage) for:

• Authentication session tokens
• Location tracking preferences and queued location data (uploaded to the server periodically)
• Cached voyage data for offline access

This data remains on your device and is cleared when you log out or uninstall the app.

15. Children’s Privacy

DirectPort is a business-to-business maritime logistics platform and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us at privacy@fraktionx.com and we will promptly delete such data.

16. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on you. Feature flags and A/B testing are used solely to manage feature rollouts and improve the user experience, not to make decisions about individual users.

17. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will update the “Last updated” date at the top of this page
• For significant changes, we will notify you through the platform or by email

We encourage you to review this policy periodically.

18. Contact Us

19. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. For Belgium, the competent authority is:

You may also lodge a complaint with the supervisory authority in your country of residence or place of work.