Privacy Policy

1Who We Are

1.1 Vestfold Marine Cargo Survey AS ("VMCS-AS", "we", "us", "our") is a Norwegian limited company providing independent marine, cargo, vessel, damage, and related survey and inspection services across Norway and internationally.

1.2 Our company details:

1.3 For the purposes of GDPR, VMCS-AS is the data controller — meaning we determine why and how your personal data is processed.

2What Personal Data We Collect

2.1 We collect personal data in the following situations:

(a) When you contact us via our website, email, or phone:

• Name and job title
• Company name
• Email address
• Phone number
• Country / location
• The content of your enquiry or message

(b) When you instruct us to perform an Assignment (survey, inspection, or related service):

• All of the above
• Billing address and VAT / tax registration details
• Bank account information for invoice settlement
• Names and contact details of vessel masters, crew, terminal operators, or other personnel relevant to the Assignment
• Vessel data (IMO number, flag, owner / charterer details, port of call)
• Cargo data (type, quantity, origin, destination)
• Photographic evidence taken during the Assignment, which may include identifiable individuals where unavoidable

(c) When you visit our website:

• Approximate location (country / city level, derived from IP address)
• Browser type, device type, and operating system
• Pages visited, time on page, and basic navigation patterns
• Referring website (the website you arrived from)

2.2 We do not knowingly collect personal data from individuals under 18 years of age. Our services are directed exclusively at commercial and professional clients.

3Why We Collect This Data and Our Lawful Basis

3.1 Under GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

4How We Use Your Data

4.1 We use your personal data only for the following purposes:

• To respond to enquiries and provide quotations
• To perform Assignments and produce Reports
• To communicate with you about ongoing or completed work
• To issue invoices and process payments
• To maintain our business records as required by Norwegian law
• To comply with regulatory obligations (Sjøfartsdirektoratet, MARPOL Annex II reporting, etc.)
• To defend or pursue legal claims, where necessary
• To improve our website and services through aggregated, non-identifying analytics

4.2 We do not use your personal data for:

• Selling or renting to third parties
• Automated decision-making or profiling that produces legal effects on you
• Marketing communications without your consent
• Any purpose unrelated to our professional services

5Who We Share Your Data With

5.1 We share personal data only when necessary, and only with the following categories of recipients:

(a) Service providers (data processors) acting on our behalf:

(b) Other parties only when required:

• Subcontractors or laboratories engaged for specific Assignments (with the Client's awareness)
• Norwegian authorities (Sjøfartsdirektoratet, Skatteetaten, Datatilsynet, courts) where required by law
• Insurers, P&I Clubs, or law firms when the Report is used in claims or legal proceedings
• Professional advisers (lawyers, auditors) when necessary for our business or legal defence

5.2 We do not sell, rent, or trade your personal data to any third party for marketing or commercial gain.

6International Data Transfers

6.1 Some of our service providers (such as Durable, Formspree, and certain cloud platforms) are based outside Norway and the European Economic Area (EEA), including the United States.

6.2 When personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Provider participation in the EU–US Data Privacy Framework where applicable

6.3 You may request a copy of the safeguards in place by contacting us at [email protected].

7How Long We Keep Your Data

7.1 We retain personal data only for as long as necessary for the purposes for which it was collected, and to comply with Norwegian legal obligations.

7.2 When the retention period ends, we securely delete or anonymise the data, unless we are required to retain it longer for legal or regulatory reasons.

8Your Rights Under GDPR

8.1 As a data subject, you have the following rights:

8.2 To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

8.3 If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

9Cookies and Website Tracking

9.1 Our website (www.vmcs-as.com) uses a small number of cookies and similar technologies to function correctly and to understand how visitors use the site.

9.2 We use the following types:

• Strictly necessary cookies — required for the website to function (e.g., remembering your cookie preference). These do not require consent.
• Analytics cookies — provided by our website platform (Durable) for basic visitor statistics. No personally identifying information is shared with third-party advertisers.

9.3 We do not use advertising cookies, social media tracking pixels, or behavioural advertising trackers.

9.4 You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

10Data Security

10.1 We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it from unauthorised access, alteration, disclosure, or destruction.

10.2 Our security measures include:

• Encrypted email communication where possible
• Strong, unique passwords on all systems and accounts
• Two-factor authentication (2FA) on critical accounts
• Encrypted cloud storage for survey reports and supporting evidence
• Restricted access to data on a need-to-know basis
• Regular software updates and security patches
• Backup procedures to prevent data loss

10.3 Despite these measures, no system can be guaranteed 100% secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the Norwegian Data Protection Authority within the timeframes required by GDPR.

11Children's Privacy

11.1 Our services are directed exclusively at commercial and professional clients. We do not knowingly collect personal data from individuals under the age of 18.

11.2 If we become aware that we have inadvertently collected data from a minor, we will delete it immediately.

12Changes to This Privacy Policy

12.1 We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

12.2 The current version is always published at www.vmcs-as.com/privacy-policy. The "Effective from" date at the top of the policy indicates when the most recent version came into effect.

12.3 Material changes will be communicated to existing clients by email where reasonably practicable.