Privacy, terms and security, in plain sentences.

Privacy

Quayside processes two kinds of data: operational data about vessels and port calls, which belongs to the terminal, and account data about the people who use the software.

Operational data

Vessel particulars, schedules, berth allocations, timeline events, documents and messages are processed on the terminal’s instructions as a processor under Article 28 GDPR. They are stored in the EU (Amsterdam) unless the contract names another region, encrypted at rest with AES-256 and in transit with TLS 1.3. Retention follows the contract; the default is seven years for documents and three for plans and messages.

Account data

Name, work email, terminal, role and sign-in records. We keep sign-in records for 18 months because an audit trail on who moved a plan is part of what we sell. We do not use account data for advertising, we do not sell it, and we do not enrich it with anything bought from a third party.

This website

No advertising or analytics cookies. A single functional cookie holds the sign-in session and only after you sign in. Server logs keep IP addresses for 14 days for abuse handling.

Sub-processors

Hosting (Amsterdam and Frankfurt), transactional email, error reporting and status paging. The current list, with the data each one sees, is in the contract annex and changes with 30 days’ notice.

Your rights

Access, rectification, erasure, restriction, portability and objection. Write to privacy@quayside.nl; we answer within 30 days. Where we act as a processor we will pass the request to the terminal and help them answer it. You may complain to the Autoriteit Persoonsgegevens.

Terms of service

Contracts are annual, billed monthly in euros, ex VAT, on 30-day payment terms. Either party may end the contract with 60 days’ notice before renewal. For cause — a missed uptime commitment in two consecutive months — the terminal may leave at any point with 60 days’ notice and we refund the unused months.

Metered port calls are counted as calls that reached the status alongside. Cancelled calls are not billed. Invoices show the count per terminal and per day.

Quayside is a planning tool. It does not replace the master’s judgement, the pilot’s judgement or the harbour master’s authority. Nothing in the software constitutes navigational advice, and the tide, depth and channel figures it shows come from third-party hydrographic sources that we pass on without warranty.

Liability is capped at the fees paid in the twelve months before the claim, except for damage caused by intent or gross negligence. Dutch law applies; the courts of Rotterdam have jurisdiction.

Security

ISO/IEC 27001 certified since 2023, audited annually by a Dutch accredited body; the certificate and the statement of applicability are available under NDA. Penetration testing twice a year by an external firm, with the summary shared with customers.

Encryption in transit (TLS 1.3) and at rest (AES-256). Access to production is by hardware key, least privilege, and every session is recorded. Backups every 15 minutes with a 30-day window; restores are tested quarterly and the last test took 41 minutes to a working system.

Vulnerability reports go to security@quayside.nl. We acknowledge within one working day, keep you informed, and will name you in the changelog if you want. We do not run a bug bounty and we will not threaten anyone who reports a problem in good faith.

Incidents affecting customer data are reported to the affected terminals within 24 hours of confirmation, with what we know and what we do not.