Privacy Policy
1. Who we are
This website, hullsnap.com (the "Website"), is operated by HULLSNAP LTD ("HullSnap", "we", "us", "our"), a company registered in England and Wales.
- Company name: HULLSNAP LTD
- Company number: 17300820
- Date of incorporation: 25 June 2026
- Registered office: 3 Windlass Court, Barquentine Place, Cardiff, Wales, CF10 4NG, United Kingdom
For the personal data described in this policy, HULLSNAP LTD is the data controller. We are responsible for deciding how and why your personal data is processed and for keeping it secure.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We have assessed that we are not currently required to appoint a statutory Data Protection Officer: we are not a public authority and our processing does not involve large-scale monitoring or large-scale processing of special-category data. We will keep this under review. You can raise any data-protection question using the contact details in Section 14.
2. Scope of this policy
This policy explains what personal data we collect through the Website, why we collect it, the legal basis on which we rely, how long we keep it, who we share it with, and the rights you have.
This policy covers the hullsnap.com Website only. It does not cover:
- the HullSnap product itself (any vessel or operational data processed inside the product is governed by the relevant customer/pilot agreement), or
- websites operated by our licensee Apeks Marine (apeks.tech), which are governed by their own notices.
3. What personal data we collect
We collect the information you actively provide, a small amount of technical information created automatically when you submit a request and — only if you agree in our cookie banner — analytics, campaign and advertising-measurement information described in (c) and (d) below.
a) Information you give us — the demo request form. If you use the "Request a private demo" form on the Website, we collect:
| Field | Type |
|---|---|
| Full name | Provided by you |
| Company | Provided by you |
| Work email address | Provided by you |
| Phone number | Provided by you (optional) |
| Role / position | Provided by you |
| Page language (English or Turkish form) | Recorded automatically |
We ask about your fleet, vessel types and priorities during the demo conversation itself rather than in the form.
b) Technical information collected automatically when you submit the form:
| Field | Type |
|---|---|
| Date and time of submission | Recorded automatically |
| Source IP address | Recorded automatically |
| Browser information (user agent) | Recorded automatically |
We collect this technical information for security and anti-abuse purposes (see Section 5) and to help us understand and respond to your request.
c) Only if you choose "Analytics only" or "Accept all" in the cookie banner:
| Information | Purpose |
|---|---|
| Google Analytics usage data (pages visited, device and browser type, approximate location from an anonymised IP address, and events such as a successful demo request, a WhatsApp-button click or playing the demo film) | Understanding, in aggregate, how the Website is used |
| Campaign tags of the advertising link you arrived through (source, medium, campaign, content and LinkedIn's click identifier) | Sent with your demo request and shown in the notification we receive, so we can see which campaign led to it |
d) Only if you choose "Accept all": the LinkedIn Insight Tag collects, on LinkedIn's systems, information about your visit (such as the page address, referrer, IP address, device and browser characteristics and a timestamp) and links it to your LinkedIn account if you have one. We use it to measure whether our LinkedIn ads led to a demo request or a WhatsApp click, and to show our LinkedIn ads again to people who visited the Website (retargeting). We receive aggregated reports only. We do not send LinkedIn your name, email address or any other form content, and LinkedIn's email-matching ("enhanced conversions") is not used.
What we do NOT collect. We do not ask for special category (sensitive) personal data, and we do not knowingly collect personal data from children. Please do not include sensitive information (for example health, identity-document or payment-card details) in any field.
The demo request form is the Website's only form. If we add another form or another analytics, advertising or third-party tool, we will update this policy before that feature goes live.
e) WhatsApp. If you use the "Message us on WhatsApp" button, WhatsApp opens with a pre-written message that you decide whether to send. The Website does not send anything to WhatsApp. If you do write to us, that conversation is handled through WhatsApp (WhatsApp Ireland Limited, part of Meta) under WhatsApp's own terms, and we treat what you send us like any other business enquiry (Sections 5 and 9).
4. How the demo request is handled
When you submit the demo request form:
- The information is sent to us by email to our internal HullSnap team inbox(es). It is not stored in a website database.
- Your email address is set as the reply address so that a member of our team can respond to you directly.
- If the same email address sends a request again within 24 hours with identical details, it is not sent to us a second time. If the details have changed, the new details are sent to us marked as an update of your earlier request, so nothing you typed is lost. To do this, the server keeps a one-way fingerprint (a hash) of the request and of the email address — not the details themselves. A fingerprint is used for 24 hours and is then deleted at the next form submission after it is 25 hours old (Section 9).
- We may then keep your message and our reply within our normal business email and correspondence records.
5. Why we use your personal data, and our legal basis
| Purpose | Personal data used | Legal basis (UK GDPR) |
|---|---|---|
| Responding to your demo request and starting a business conversation you asked for, and keeping a proportionate record of that contact | Name, company, work email, phone (if given), role, message and the business details you selected | Legitimate interests — Article 6(1)(f): responding to and recording a business enquiry that you initiated |
| Protecting the Website and our systems from spam and abuse (rate limiting, recognising a request sent twice) | Source IP address, timestamp, one-way fingerprints of the request and email address | Legitimate interests — Article 6(1)(f): security and prevention of misuse |
| Website analytics and knowing which campaign led to a demo request | The information in Section 3(c) | Consent — Article 6(1)(a), given through the cookie banner (and, for the cookies themselves, PECR regulation 6) |
| Measuring and retargeting our LinkedIn ads | The information in Section 3(d) | Consent — Article 6(1)(a) via "Accept all" (and PECR regulation 6) |
Our legitimate interests are to respond to enquiries people choose to send us and to keep our Website secure. We have carried out a legitimate-interests assessment and consider that these interests are not overridden by your rights and freedoms, because the processing is limited to what you provided, is what you would expect when you ask to be contacted, and has minimal impact. You can object to this processing at any time (see Section 11).
Only where it genuinely applies — for example if you contact us as a sole trader seeking a service for yourself — we may also rely on Article 6(1)(b) (taking steps at your request before entering into a contract with you). Analytics and advertising measurement rely on your consent, which you can withdraw at any time through "Cookie settings" in the Website footer. We do not rely on consent for handling your enquiry itself, and we do not use your enquiry details for newsletters or unrelated marketing; we would only do that through a separate, clearly-explained process and, where the law requires it, with your consent.
6. Cookies
With your choice in the cookie banner, the Website uses Google Analytics ("Analytics only" or "Accept all") and the LinkedIn Insight Tag ("Accept all" only). Nothing non-essential runs if you decline. Please see our separate Cookie Policy for the cookies involved and how to change your choice.
7. Who we share your personal data with
We do not sell your personal data and we do not share it with third parties for their own marketing.
Your personal data may be handled by:
- Our own team, in order to respond to your request; and
- Hostinger, our website hosting and email provider, which processes your data on our behalf (under a data-processing arrangement) to host the Website and to deliver and store the email your enquiry generates;
- Google Ireland Limited (Google Analytics), as our processor, for the analytics described in Section 3(c) — only with your consent; and
- LinkedIn Ireland Unlimited Company, for the advertising measurement and retargeting described in Section 3(d) — only with your consent. Under the LinkedIn Ads Agreement (Section 5) and the LinkedIn Data Processing Agreement (which lists "Insight Tag Data" in Annex B), LinkedIn and we each act independently as data controllers — not as joint controllers. LinkedIn's own use of the data is described in the LinkedIn Privacy Policy; to exercise your rights over the data LinkedIn holds, you can contact LinkedIn directly, and we will help with any request you send to us.
Your demo-request details (name, company, email, phone, role) are not passed to Google or LinkedIn. We do not use a website database or a CRM for them. We may disclose personal data where we are required to do so by law, or to establish, exercise or defend legal claims.
8. Where your personal data is processed (international transfers)
Our registered office is in the United Kingdom and our website and email are hosted with Hostinger. However, our team is partly based in Türkiye, and the enquiry inbox may be read and responded to by our authorised personnel in Türkiye. This means your personal data may be accessed from outside the United Kingdom.
Google and LinkedIn may process the analytics and advertising information described in Section 3(c)–(d) outside the UK, including in the United States, under the safeguards set out in their own terms (such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses).
Türkiye is not currently covered by a UK "adequacy" decision. Where your personal data is accessed from outside the UK, we limit that access to our own authorised personnel, who are bound by confidentiality, and we take steps to ensure your data continues to receive a level of protection consistent with UK data-protection law. If you would like more detail about the specific safeguards that apply, please contact us using the details in Section 14.
9. How long we keep your personal data
We keep your personal data only for as long as necessary for the purposes set out above.
- Enquiries that do not progress: if a demo enquiry does not lead to an ongoing conversation, we delete it within 12 months of our last contact with you.
- Active discussions: if we are in an active business discussion, we keep the correspondence for the duration of that discussion and for up to 12 months after our last contact, unless it becomes a contractual relationship.
- Contractual records: if you or your organisation becomes a customer, related records are kept for the duration of the contract and for up to 6 years afterwards, to align with the period during which contractual claims may be brought.
- Security / rate-limit records (a one-way hash of your IP address and submission times): used only within a 10-minute protection window, and deleted when they have not been updated for 24 hours. Deletion runs when the form is used (at most once an hour), so a record can remain on the server until the next submission after that point.
- Duplicate-request fingerprints: used for 24 hours to recognise a repeated request, then deleted at the first form submission after they are 25 hours old. As above, deletion happens when the form is next used, not on a fixed clock.
- Google Analytics cookies on your device (
_ga,_ga_<id>): up to 2 years by Google's default, unless you delete them earlier. - Google Analytics: event data is kept for the retention period set in our Google Analytics account (Google offers 2 or 14 months), then deleted.
- LinkedIn Insight Tag: held by LinkedIn, not by us. LinkedIn states that it removes the member's direct identifiers within 7 days and deletes the remaining pseudonymous data within 180 days (LinkedIn Insight Tag FAQs).
Once your personal data is no longer needed, we will delete it or make it anonymous. Copies held in routine system backups age out as those backups are cycled.
10. Automated decision-making and profiling
We do not make any decisions about you based solely on automated processing, and we do not carry out profiling that produces legal or similarly significant effects for you.
11. Your rights
Under UK data-protection law you have the right to:
- be informed about how we use your personal data (this policy);
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your personal data ("right to be forgotten"), where applicable;
- restrict or object to our processing, including where we rely on legitimate interests;
- data portability, where applicable; and
- withdraw consent at any time, where we rely on consent — without affecting processing carried out before withdrawal.
You will not usually have to pay to exercise these rights, and we will respond within the time limits set by law.
12. How to make a request or complaint
To exercise any of the rights above, please contact us using the details in Section 14.
If you are not satisfied with how we have handled your personal data, you have the right to complain to the UK supervisory authority:
- Information Commissioner's Office (ICO) — ico.org.uk · Helpline 0303 123 1113
We would, however, appreciate the chance to address your concerns before you approach the ICO.
13. Security and changes to this policy
We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.
We may update this policy from time to time, for example if we change how the Website works or add new features. The date at the top of this policy shows when it was last updated. Material changes will be reflected on this page before they take effect.
14. How to contact us
You can contact us about this policy or about your personal data:
- Post: HULLSNAP LTD, 3 Windlass Court, Barquentine Place, Cardiff, Wales, CF10 4NG, United Kingdom
- Phone: +90 546 504 78 18
- Email: info@hullsnap.com
- Online: using the contact form on hullsnap.com