Privacy & Data Policy

Last updated: 09/11/2026
Version: 2.1

1. Introduction

This Privacy Policy (the “Policy”) describes how SYNDICO SAS (“everyblu”, “we”) collects, uses, shares and protects the personal data and business data of Users within the everyblu ecosystem.

It applies to all Users, whatever their role (Owners and Captains, Marinas, Suppliers, Technicians, Guests), as well as, where applicable, to the Payer, the shipowner, the yacht-owning or yacht management company (yacht manager) and crew members, and to visitors interacting with our websites (everyblu.com, mymarina.everyblu.com, supplier.everyblu.com, myboat.everyblu.com) and our mobile applications (everyblu Yachting app and everyblu Connect app, available on Google Play and the Apple App Store).

This Policy complies with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”), amended French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and other applicable data protection regulations. It forms an integral part of the everyblu Terms of Use.

2. Data Controller

The data controller is: SYNDICO SAS, a simplified joint-stock company registered with the Nice Trade and Companies Register under number 984 871 095, whose registered office is located at 38B Boulevard Victor Hugo, 06000 Nice, France.
Contact email: info@everyblu.com

Depending on the processing concerned, everyblu acts as data controller for its own purposes (provision of the Services, security, fraud prevention, legal obligations). For certain processing carried out on behalf of a Service Provider (for example, processing a customer list imported by a Marina or a Supplier, or activating a customer data platform), everyblu may act as data processor, the Service Provider then being the data controller and responsible for the lawfulness of the data it provides.

With regard to payment services, Lemonway, a payment institution authorised by the ACPR (number 16568), is the data controller for know-your-customer (KYC/KYB) and anti-money laundering and counter-terrorist financing (AML/CFT) checks, which it carries out under its own terms.

The list of everyblu’s processors is available on request at info@everyblu.com.

3. Categories of Data Collected

3.1. Data provided by the User

• Identity and contact details: first and last name, email address, telephone number, postal address;
• Login credentials (Account), including one-time codes and, where enabled, two-factor authentication;
• Professional details: company name, company address, company email, VAT number and company registration number;
• Information about the boat and its equipment;
• Business contact details (Marinas, Suppliers, Technicians);
• Payout bank details (IBAN and account holder name), for Users who receive payments through the Platform;
• Uploaded media and documents (photos, videos, PDF and other files);
• Content exchanged through the in-app chat: text messages, photos, videos, documents and voice messages;
• Events and reminders created in the in-app calendar;
• Marketplace listings, requests, claims, job offers and other content published by the User;
• Feedback, ratings and reviews.

3.2. Data collected automatically

• IP address, browser and device information (model, operating system, language);
• Usage logs and browsing paths, including screens viewed, features used and searches performed within the Platform;
• Language and region settings;
• Crash reports and error logs generated by our servers and web portals.

3.3. Data specific to the mobile applications

• Precise location (GPS), only with the User’s permission. It is used to show nearby marinas, suppliers and job offers on the map, to attach a location to marketplace listings, events and fuel requests, and to suggest the app language based on the User’s country (this last step is performed on the device; the coordinates are not sent to us for this purpose);
• Approximate location derived from the IP address by our audience measurement tool;
• Device identifiers: the device identifier (Android ID or iOS identifier for vendor), the push notification token and the analytics app-instance identifier;
• Photos, videos, documents and voice recordings that the User chooses to upload or send. The camera is only used when the User takes a photo, and the microphone only while the User records a voice message;
• In-app interactions: screens viewed and actions performed in the app, linked to a pseudonymous internal user identifier (see section 6).

Biometric unlock (fingerprint or face recognition), where offered, relies entirely on the device’s operating system. everyblu never receives or stores biometric data. The apps do not access the User’s contacts, SMS, call logs or list of installed applications.

3.4. Crew, passenger and identity data

To make berth bookings, prepare port and marina formalities and manage crew, Owners and Captains may enter information about themselves, their crew members and guests, in particular: first and last name, date of birth, gender, nationality, country of birth, passport number with its issue and expiry dates, and copies of passports or other identity documents.

Where a Marina or port authority requires it, the User may also upload a crew member’s health insurance certificate. Such a document may reveal information about the person’s health, which is a special category of data under Article 9 GDPR. Providing it is optional; it is processed only with the explicit consent of the person concerned and is made available only to the Marina concerned by the booking.

A User who enters data relating to another person (for example a crew member or a guest) confirms that they have informed that person of this Policy and, where required, obtained their consent.

3.5. Data from third parties

• Payment service providers (Lemonway, Stripe): payment metadata, payment status and KYC/KYB check status;
• Google Play and the Apple App Store: confirmation and status of in-app subscriptions (we do not receive the User’s card details);
• Marinas, Suppliers or Technicians: information relating to bookings and contracts;
• Analytics and performance tools: pseudonymised usage data.

3.6. Data relating to Services, payments and regulatory obligations

Depending on the Services and user journeys used, the following may also be processed: data relating to the Payer, the shipowner, the owner and crew members; documents relating to the yacht; payment and purchase histories (bookings, orders, invoices, subscriptions), messages exchanged via the Platform and delivery notes (in particular BDR/POR); customer data platform (CDP) activation data and customer lists imported by Service Providers; data used in connection with the Platinum and Diamond offers; tax identification numbers and transactional data required for platform reporting obligations (Article 242 bis of the French General Tax Code, “DAC7” regime).

3.7. Summary for the everyblu mobile applications

The table below summarises the data collected by our mobile applications, why it is collected and whether providing it is mandatory. All of this data is transmitted encrypted (HTTPS/TLS). We do not sell it and we do not share it with third parties for their own purposes; it is only disclosed to the recipients listed in section 7, acting on our behalf or at the User’s request.

4. Purposes of Processing

Data are processed for the following purposes:

• Providing and personalising the Platform Services;
• Creating, authenticating and securing Accounts;
• Managing bookings, quotes, deliveries and delivery notes (BDR/POR), requests and payments;
• Preparing berth bookings and port or marina formalities for the boat, its crew and guests;
• Enabling communication between Users (chat, voice messages, file sharing);
• Sending service communications (verification codes, booking and payment updates, push notifications);
• Measuring audience and optimising the use of the Platform (analytics);
• Providing customer support and handling disputes;
• Preventing and handling non-payments, payment objections, chargebacks and fraud;
• Complying with legal and regulatory obligations, including platform tax and reporting obligations (Article 242 bis of the French General Tax Code, “DAC7” regime);
• Producing internal decision-support reports (business intelligence);
• Where applicable, carrying out direct marketing operations under the conditions set out in section 7.1.

Data collected by the mobile applications is not used for advertising or to build advertising profiles.

5. Legal Bases (Articles 6 and 9 GDPR)

Processing is based, as the case may be, on the following legal bases:

• Performance of a contract: Account management, provision of the Services, completion of transactions, bookings and the related port and marina formalities, payouts;
• Legal obligation: invoicing, accounting, audits, DAC7 reporting, requests from authorities;
• Legitimate interest: improvement of the Platform, audience measurement, fraud prevention, security;
• Consent: non-essential cookies, marketing communications, access to precise location, camera and microphone, push notifications;
• Explicit consent (Article 9(2)(a) GDPR): health insurance certificates of crew members.

Consent may be withdrawn at any time, in particular through the device settings (location, camera, microphone, notifications), without affecting the lawfulness of processing carried out before its withdrawal.

6. Cookies, Trackers and Analytics

Web portals. We use cookies and trackers on our websites and web portals in order to maintain secure sessions, remember User preferences, measure audience and performance (e.g. Google Analytics, Hotjar) and, subject to consent, deliver marketing campaigns (e.g. Meta Pixel, LinkedIn Tag). Cookies that are not strictly necessary are only placed after the User’s consent has been obtained, in accordance with CNIL requirements. The User may adjust their choices at any time via the preference manager available on everyblu.com.

Mobile applications. Our mobile applications contain no advertising or marketing trackers. They use:

• Google Analytics for Firebase to measure audience and usage (screens viewed, features used, approximate location, device type). Events are linked to a pseudonymous internal identifier; names, email addresses and phone numbers are filtered out before sending. Advertising personalisation and Google Signals are disabled, and the data is not used for advertising;
• Firebase Cloud Messaging to deliver push notifications;
• Google Maps Platform to display maps and search for addresses and places.

7. Recipients and Disclosure of Data

We do not sell personal data and we do not share it with third parties for their own advertising or marketing purposes. Data may be disclosed, to the extent necessary, to:

• Our hosting and infrastructure partners;
• Our authorised service providers and processors, in particular Google (Firebase Analytics, Firebase Cloud Messaging, Google Maps Platform) for audience measurement, notifications and maps;
• The payment service providers: Lemonway, which acts as data controller for KYC/KYB and AML/CFT checks, and Stripe, for card payments. Card details are entered directly on the payment provider’s secure page; everyblu does not store full card numbers;
• Google Play and the Apple App Store, for in-app subscriptions;
• The Marinas, Suppliers or Technicians concerned by a request or booking. In particular, when a berth booking requires it, the Marina concerned receives the crew and passenger data described in section 3.4;
• Other Users, for content that the User chooses to publish or send to them (marketplace listings, ratings, chat messages);
• Legal or regulatory authorities where required by law.

All these partners are contractually bound to confidentiality and to compliance with GDPR requirements. Processors act on everyblu’s documented instructions under a contract compliant with Article 28 GDPR. Users who access another User’s data in the context of a Service (for example, a Marina, Supplier or Technician handling an Owner’s booking) undertake to keep such data secure and to use it solely for the purposes of that Service.

7.1. Direct marketing and customer data platform (CDP)

everyblu may carry out direct marketing operations and operate a customer data platform (CDP). The applicable rules differ depending on whether the target is a business or an individual: electronic marketing aimed at an individual in principle requires their prior consent, whereas business-to-business marketing may be based on legitimate interest, subject to information being provided and a right to object. In all cases, data subjects are informed and may object at any time to receiving solicitations.

When a Service Provider imports a customer list or activates the CDP, it warrants that it has a legal basis and has informed the data subjects; everyblu then acts, for this processing, on its instructions. everyblu does not directly contact a Service Provider’s customers for its own purposes, nor cross-reference such data with its own database, without an appropriate legal basis and without informing the data subjects.

8. International Data Transfers

Where data are processed outside the European Union or the European Economic Area (for example by Google LLC in the United States), we only use providers offering a level of protection compliant with the GDPR and we govern such transfers by the EU–US Data Privacy Framework where the provider is certified, by the European Commission’s standard contractual clauses (SCCs) or by any other appropriate mechanism. Data centres are located in secure and regulated regions.

9. Retention Periods

Data are retained for the period strictly necessary for the purposes pursued:

• Account data: for the duration of active use, then twelve (12) months after deletion of the Account;
• Crew and passenger identity data, copies of identity documents and health insurance certificates: for as long as the person appears in the boat’s crew or guest list, then deleted or anonymised no later than twelve (12) months after their removal from the list or the deletion of the Account, unless a longer period is required by port or maritime regulations;
• Chat messages, voice messages and shared files: for the duration of the Account, then as for Account data;
• Accounting and payment records: ten (10) years, in accordance with accounting and tax obligations;
• Analytics data from the mobile applications: according to the retention period configured in Google Analytics (fourteen (14) months maximum);
• Cookies: according to the consent obtained and browser settings;
• Proof of consent (app permissions): stored securely with the timestamp of acceptance or withdrawal.

At the end of these periods, data are deleted or anonymised, subject to retention periods imposed by law or necessary for the establishment, exercise or defence of legal claims.

10. Data Subject Rights

In accordance with the GDPR and the French Data Protection Act, the User has the following rights:

• Right of access to their data;
• Right to rectification of inaccurate information;
• Right to erasure (“right to be forgotten”);
• Right to restriction of and right to object to processing;
• Right to data portability;
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• Right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL) or the competent supervisory authority.

These rights may be exercised by writing to info@everyblu.com. We may need to verify the identity of the requester. A response is provided within the time limits laid down by the GDPR (in principle one (1) month, extendable by two (2) months depending on complexity). The User may also set out instructions regarding what happens to their data after their death.

10.1. Deleting your account and your data

You can delete your everyblu account at any time:

• In the everyblu Yachting app: open Account settings, then tap Delete Account and confirm;
• On the web portal: when signing out, select the Delete account link;
• By email: write to info@everyblu.com from the email address linked to your account, with the subject “Account deletion”. You do not need the app installed to make this request.

Once the deletion is confirmed, your account is deactivated immediately and you can no longer sign in. Your personal data (profile, crew and passenger data, documents, messages, location data and device identifiers) is then deleted or anonymised within the periods set out in section 9. Some data is kept where the law requires it, in particular invoices and accounting records (ten (10) years), and data needed to handle an ongoing dispute or to prevent fraud.

You can also ask us to delete only some of your data (for example a document, a crew member’s details or your chat history) without deleting your account, by writing to info@everyblu.com.

11. Security Measures

We implement appropriate technical and organisational measures to protect data, including:

• encryption of all data in transit between the apps, the web portals and our servers (HTTPS/TLS);
• strong authentication (one-time codes, optional two-factor authentication) and role-based access management;
• restricted access to identity and health documents, limited to the persons who need them for the booking concerned;
• regular backups and secure server infrastructure;
• periodic penetration tests and code reviews.

In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, everyblu makes the notifications required by Articles 33 and 34 GDPR.

12. Minors’ Data

Access to the Platform and use of the Services are reserved for persons aged at least eighteen (18) years, in accordance with the Terms of Use. In any event, we do not knowingly collect data relating to a minor without the verifiable consent of the holder of parental authority, the age of digital consent being set at fifteen (15) years in France. Any data collected by mistake will be deleted as soon as possible after being reported to info@everyblu.com.

13. Changes to this Policy

We may amend this Policy to reflect technical, regulatory or commercial developments. Material changes are brought to the User’s attention by notification on the Platform, by email or upon login. The “last updated” date is updated accordingly.

14. Contact

For any questions relating to this Policy or the exercise of your rights:
Email: info@everyblu.com
Address: SYNDICO SAS, 38B Boulevard Victor Hugo, 06000 Nice, France