Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how CraftIndex OÜ collects, uses, stores, shares and protects personal data in connection with YachtCraft Index.

It applies to personal data relating to:

• representatives and contact persons of companies applying for membership;
• representatives and contact persons of approved Member Companies;
• Builder Users;
• website visitors;
• newsletter subscribers;
• prospective business customers;
• persons receiving professional outreach communications;
• persons communicating with CraftIndex OÜ;
• persons appearing in uploaded profile content; and
• other individuals whose personal data is processed through YachtCraft Index.

YachtCraft Index is strictly a business-to-business platform. However, information relating to an identifiable employee, director, sole trader, consultant or other natural person may still constitute personal data.

2. Data controller

The controller responsible for the personal data described in this Privacy Policy is:

CraftIndex OÜ
Registry code: 17498820
Legal form: Osaühing, OÜ
Registered address: Pärnu mnt 139b, Kesklinna linnaosa, Tallinn 11317, Harju maakond, Estonia
Email: office@yachtcraftindex.com

Privacy requests and questions may be sent to:

office@yachtcraftindex.com

3. YachtCraft Index

YachtCraft Index is a private professional visibility and sourcing platform.

Approved Member Companies create structured profiles describing their products, materials, capabilities, production methods, project scope and delivery areas.

Approved professional Builder Users may access those profiles to identify and contact potentially relevant companies.

CraftIndex OÜ does not act as a broker, agent or party to agreements between Member Companies and Builder Users.

4. Categories of personal data

Depending on how a person interacts with YachtCraft Index, we may process the following categories of personal data.

4.1 Identity and professional information

This may include:

• full name;
• professional title;
• job role;
• department;
• employer or represented organisation;
• authority to represent an organisation;
• professional category;
• business biography; and
• professional experience.

4.2 Company and organisation information

This may include:

• company name;
• legal form;
• registry code;
• tax or VAT number;
• registered address;
• operating address;
• country;
• city or region;
• website;
• year established;
• company size;
• industry category;
• products and services;
• capabilities;
• materials;
• production methods;
• project scope;
• delivery area;
• certificates; and
• other business information.

Information relating solely to a legal entity may not itself be personal data. This Privacy Policy applies where that information identifies or relates to a natural person, including a sole trader or company representative.

4.3 Contact information

This may include:

• business email address;
• telephone number;
• postal address;
• preferred contact method;
• communication notes;
• newsletter preferences; and
• marketing subscription status.

4.4 Account and authentication information

This may include:

• account identifier;
• username;
• encrypted or hashed password information;
• login records;
• account status;
• access permissions;
• organisation association;
• authentication tokens;
• password-reset records;
• acceptance records; and
• security events.

We do not store passwords in readable form.

4.5 Profile and uploaded content

This may include:

• profile descriptions;
• company contact-person details;
• photographs;
• videos;
• logos;
• certificates;
• project descriptions;
• technical information;
• drawings;
• documents;
• captions;
• additional profile information; and
• information about identifiable persons appearing in uploaded material.

Member Companies must not upload personal data that is unnecessary, confidential, unlawful or provided without appropriate authority.

4.6 Builder User information

This may include:

• name;
• professional email address;
• organisation;
• job title;
• professional role;
• project role;
• account application information;
• reasons for requesting access;
• eligibility information;
• login activity;
• saved or shortlisted companies;
• profile access activity;
• reported misuse; and
• account-review records.

4.7 Payment and billing information

This may include:

• billing name;
• billing address;
• company identification;
• tax information;
• payment status;
• payment amount;
• currency;
• subscription status;
• payment dates;
• renewal dates;
• invoice details;
• refund information;
• failed-payment information;
• Stripe customer or transaction identifiers; and
• limited payment-method information such as card type and final digits.

Complete payment-card numbers are processed by Stripe and are not normally received or stored by CraftIndex OÜ.

4.8 Communications

This may include:

• emails;
• support and account requests;
• legal notices;
• complaints;
• cancellation requests;
• refund requests;
• profile-review correspondence;
• responses to outreach;
• newsletter activity;
• unsubscribe requests; and
• other communications with CraftIndex OÜ.

4.9 Website and technical data

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• language;
• time zone;
• referring website;
• pages visited;
• session information;
• login date and time;
• cookie identifiers;
• interaction data;
• security logs;
• error records;
• approximate geographic information derived from IP address; and
• other technical information generated through use of the website.

4.10 Acceptance and audit records

This may include:

• the identity of the user and organisation;
• email address;
• the accepted legal documents;
• document version numbers;
• acceptance wording;
• acceptance date and time;
• IP address;
• browser or device information;
• acceptance method;
• event identifier;
• cancellation or withdrawal records; and
• renewed acceptance of updated documents.

4.11 Marketing and outreach information

This may include:

• business contact name;
• professional role;
• company;
• industry;
• country;
• professional email address;
• source of the contact information;
• outreach campaign;
• delivery status;
• opens or clicks where tracking is lawfully enabled;
• responses;
• interest status;
• unsubscribe status;
• objection records;
• suppression-list status; and
• information indicating whether further contact is appropriate.

5. Sources of personal data

We may obtain personal data from the following sources.

5.1 Directly from the individual

We receive data directly when a person:

• registers a Company;
• creates an account;
• applies for Builder User access;
• completes a profile;
• uploads content;
• purchases a membership or service;
• subscribes to a newsletter;
• responds to an email;
• submits a form;
• contacts us;
• makes a privacy request;
• submits a complaint; or
• otherwise communicates with us.

5.2 From the represented organisation

A company or organisation may provide personal data about its:

• employees;
• directors;
• owners;
• authorised representatives;
• profile contacts;
• billing contacts;
• project contacts; and
• account users.

The organisation providing the information must ensure that it has authority and an appropriate lawful basis to do so.

5.3 From public professional sources

For professional business outreach and eligibility checks, we may obtain business contact information from sources such as:

• company websites;
• public company registers;
• professional directories;
• trade-association directories;
• exhibition or conference directories;
• professional networking profiles;
• business publications;
• public procurement information;
• industry databases;
• public social-media business pages; and
• other publicly available professional sources.

5.4 From business-data providers

We may obtain professional contact information from third-party business-data or contact-discovery providers.

Where required, we will identify the relevant source or source category when contacting the person or responding to a privacy request.

5.5 From service providers

We may receive information from providers including:

• Stripe;
• Brevo;
• Smartlead;
• Google;
• Vercel;
• Supabase;
• Cloudflare; and
• other providers used to operate and secure the service.

5.6 From other platform users

A Member Company or Builder User may provide information concerning another person in connection with:

• an account;
• a project enquiry;
• an organisation;
• a complaint;
• suspected misuse;
• an intellectual-property issue;
• a privacy concern; or
• a security incident.

6. Purposes and legal bases

We process personal data only where we have an applicable lawful basis.

The legal basis depends on the purpose and circumstances of the processing.

7. Registration and pre-contractual steps

We process registration and contact information to:

• receive Company applications;
• create registration records;
• answer pre-contract questions;
• prepare checkout;
• verify business eligibility;
• communicate about registration; and
• take steps requested before entering into a membership agreement.

The legal basis is taking steps at the request of the individual or represented organisation before entering into a contract and our legitimate interest in operating a professional business platform.

8. Membership and contract administration

We process account, Company, contact, profile, payment and communication information to:

• activate accounts;
• provide profile access;
• review profiles;
• publish approved profiles;
• manage membership status;
• provide purchased services;
• send service communications;
• process renewals;
• manage cancellations;
• manage refunds;
• issue certificates;
• provide account functions; and
• enforce the contractual agreement.

The legal basis is performance of the contract and steps necessary to administer the business relationship.

Where the contract is with a legal entity rather than the individual, we rely additionally on our legitimate interests in communicating with the organisation’s authorised representatives and performing the agreement.

9. Profile review and publication

We process profile information and uploaded content to:

• assess eligibility;
• review relevance and quality;
• request corrections;
• classify capabilities;
• assign categories and tags;
• structure profile content;
• translate or summarise text;
• detect misleading or inappropriate material;
• approve or reject profiles;
• display approved profiles to authorised Builder Users; and
• maintain the quality and credibility of the index.

The legal bases are performance of the membership agreement and our legitimate interests in operating a useful, accurate, controlled and professional index.

Profile approval decisions are not intended to be based solely on automated processing. Automated tools may assist with classification, language, security or content review, but CraftIndex OÜ retains human oversight over approval and rejection.

10. Builder User access

We process Builder User data to:

• review access applications;
• verify professional eligibility;
• create accounts;
• control access to the private index;
• associate users with organisations;
• prevent shared or unauthorised accounts;
• provide search and shortlist functions;
• maintain audit and security records;
• investigate misuse;
• communicate with Builder Users; and
• suspend or terminate access where necessary.

The legal bases are performance of the Builder User agreement and our legitimate interests in protecting Member Company information and maintaining a controlled professional sourcing environment.

11. Display of Company contact information

Approved profiles may include business contact information supplied by the Member Company.

This information may be displayed to authorised Builder Users so that they can contact the Company regarding genuine professional sourcing or project opportunities.

The legal bases are:

• performance of the membership agreement;
• steps requested by the Member Company;
• the legitimate interests of the Member Company in professional visibility;
• our legitimate interests in providing the index; and
• the legitimate interests of Builder Users in identifying and contacting relevant professional suppliers.

The Member Company is responsible for ensuring that any named contact person is authorised to be displayed.

12. Payments, accounting and taxation

We process billing, payment, subscription, invoice and refund information to:

• collect payments;
• administer subscriptions;
• process renewals;
• retry failed payments;
• issue invoices and receipts;
• provide refunds;
• investigate payment disputes;
• respond to chargebacks;
• maintain accounting records;
• prevent fraud; and
• comply with tax and accounting duties.

The legal bases are performance of the contract, compliance with legal obligations and our legitimate interests in securing and documenting payments.

13. Service communications

We may send communications necessary to operate an account or membership, including:

• double opt-in confirmation;
• account activation;
• password reset;
• payment confirmation;
• profile setup instructions;
• incomplete-profile reminders;
• review requests;
• revision requests;
• approval notices;
• renewal reminders;
• failed-payment notices;
• cancellation confirmations;
• security notices;
• legal updates; and
• other administrative communications.

These are service communications rather than optional marketing messages.

The legal bases are performance of the contract, compliance with legal obligations and our legitimate interests in account administration.

14. Newsletters and promotional communications

We may send newsletters, product updates, educational content and promotional communications where:

• the recipient has consented;
• the communication is otherwise permitted by applicable direct-marketing law; or
• we have another appropriate legal basis.

Every marketing email will provide an unsubscribe method.

Withdrawing marketing consent or unsubscribing from marketing does not prevent necessary service, billing, security or legal communications.

Where processing is based on consent, consent may be withdrawn at any time without affecting processing carried out before withdrawal.

15. Professional business outreach

CraftIndex OÜ may contact professional representatives of companies that appear relevant to YachtCraft Index.

Professional outreach may be based on contact information obtained from:

• public business sources;
• professional directories;
• company websites;
• professional networking platforms;
• business-data providers; or
• previous professional communications.

The purposes may include:

• introducing YachtCraft Index;
• explaining potential relevance to yacht projects;
• inviting a business to review the platform;
• inviting a business to apply for membership; and
• following up on a relevant professional communication.

Where permitted by applicable law, the legal basis is our legitimate interest in promoting a relevant business-to-business service to professional contacts.

We consider factors such as:

• the person’s professional role;
• the relationship between their company’s activities and YachtCraft Index;
• the limited and professional nature of the information used;
• the reasonable expectations of a business contact;
• the content and frequency of communications; and
• the person’s ability to object easily.

The rules governing electronic direct marketing may differ between countries. We will seek to apply the rules relevant to the recipient and the communication.

A person may object to professional marketing at any time. Once a valid objection or unsubscribe request is received, we will stop using the person’s data for further direct marketing.

We may retain a minimal suppression record to ensure that the person is not contacted again inadvertently.

16. Analytics

Subject to the visitor’s cookie choices, we may use Google Analytics to understand:

• how visitors reach the website;
• which pages are visited;
• how the website is used;
• general device and browser information;
• website performance;
• user journeys; and
• aggregate usage trends.

Where analytics cookies or similar identifiers require consent, Google Analytics will not be activated in the consent-requiring mode until the visitor has made the relevant choice.

The legal basis for non-essential analytics cookies and associated processing is consent.

Analytics information may also be aggregated or de-identified for statistical and service-improvement purposes.

Further information is provided in the Cookie Policy.

17. Security and fraud prevention

We process account, payment, technical, authentication and communication data to:

• protect accounts;
• prevent unauthorised access;
• detect bots and malicious activity;
• investigate suspicious payments;
• prevent fraud;
• detect scraping;
• enforce access restrictions;
• preserve logs;
• manage security incidents;
• protect platform infrastructure; and
• establish or defend legal claims.

The legal bases are our legitimate interests in maintaining the security and integrity of the platform and compliance with legal obligations where applicable.

18. Legal compliance and claims

We may process and disclose personal data where necessary to:

• comply with law;
• respond to lawful requests;
• establish, exercise or defend legal claims;
• enforce agreements;
• investigate complaints;
• protect intellectual property;
• respond to privacy or content complaints;
• respond to court or regulatory proceedings;
• comply with sanctions;
• prevent unlawful conduct; or
• protect the rights and safety of CraftIndex OÜ, users or others.

The legal bases are compliance with legal obligations and our legitimate interests in protecting our legal rights and the platform.

19. Legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating YachtCraft Index;
• communicating with business representatives;
• reviewing applicants;
• displaying authorised professional contact details;
• providing a secure private index;
• preventing fraud and misuse;
• improving functionality;
• understanding service performance;
• conducting proportionate professional outreach;
• enforcing agreements;
• protecting intellectual property;
• maintaining records;
• defending claims; and
• developing the business.

We assess whether the processing is necessary and whether the individual’s rights and interests override our interests.

An individual may contact us for more information concerning a legitimate-interest assessment relevant to their personal data.

20. Consent

Where processing is based on consent, the person may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Withdrawal may affect our ability to provide an optional feature that depends on that consent.

Contract acceptance, essential service communications and marketing consent are handled separately.

21. Sensitive personal data

YachtCraft Index is not designed to collect special categories of personal data, such as information concerning:

• health;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic data;
• biometric identification;
• sex life; or
• sexual orientation.

Users must not upload sensitive personal data unless it is strictly necessary, lawful and expressly requested by CraftIndex OÜ.

We may delete sensitive information that is irrelevant to the platform.

22. Children

YachtCraft Index is a professional business service intended for adults.

Accounts may be created only by persons aged at least 18.

We do not knowingly request or collect personal data from children for platform membership or Builder User access.

A person who believes that a child’s personal data has been submitted should contact office@yachtcraftindex.com.

23. Sharing with authorised Builder Users

Information from an approved Company profile may be shared with authorised Builder Users.

This may include:

• company information;
• profile descriptions;
• capabilities;
• location and delivery area;
• photographs and videos;
• certificates;
• business contact details; and
• other information selected for the approved profile.

Builder Users are contractually restricted from:

• scraping;
• bulk extraction;
• resale;
• republishing;
• mass marketing;
• constructing competing databases;
• unauthorised external sharing; and
• other misuse.

However, CraftIndex OÜ cannot guarantee that every authorised user will comply with all restrictions.

Companies must not upload information that is unsuitable for disclosure to authorised professional Builder Users.

24. Sharing with Member Companies

Member Companies do not receive access to other Member Companies’ private profiles merely because they are listed.

A Member Company may receive information about a Builder User where that Builder User contacts the Company directly or where disclosure is necessary to investigate a complaint, security issue or other legitimate matter.

25. Service providers

We use service providers to operate YachtCraft Index.

These providers may process personal data according to their role, contractual terms and applicable law.

Current principal providers include:

25.1 Stripe

Stripe processes:

• payment information;
• billing information;
• subscriptions;
• payment authentication;
• payment status;
• fraud-prevention information;
• refunds; and
• chargebacks.

Stripe may act as a processor or an independent controller depending on the activity.

25.2 Supabase

Supabase provides services that may include:

• database infrastructure;
• account and authentication functions;
• file storage;
• backups;
• application data storage; and
• technical platform services.

25.3 Vercel

Vercel provides website and application hosting, deployment and related infrastructure.

25.4 Cloudflare

Cloudflare may provide:

• domain and DNS services;
• content delivery;
• website performance;
• traffic filtering;
• security;
• bot protection; and
• protection against malicious activity.

25.5 Brevo

Brevo is used for:

• transactional emails;
• onboarding sequences;
• account communications;
• newsletters;
• marketing communications;
• email-delivery records;
• unsubscribe management; and
• suppression records.

25.6 Smartlead

Smartlead may be used for:

• professional cold outreach;
• campaign delivery;
• email-sequence management;
• bounce handling;
• reply status;
• unsubscribe management; and
• outreach suppression records.

25.7 Google Workspace

Google Workspace is used for:

• business email;
• internal communications;
• document collaboration;
• administrative records; and
• related business functions.

25.8 Google Analytics

Google Analytics may process website and device information after the relevant analytics consent choice, as described in this Policy and the Cookie Policy.

26. Other recipients

Personal data may also be disclosed to:

• accountants;
• auditors;
• legal advisers;
• insurers;
• professional consultants;
• developers and technical contractors;
• security specialists;
• public authorities;
• courts;
• regulators;
• law-enforcement bodies;
• a purchaser or successor to the YachtCraft Index business; and
• other recipients where required by law or reasonably necessary for the purposes described in this Policy.

Professional advisers and contractors receive information only to the extent reasonably necessary for their work.

27. International transfers

Some service providers, group companies, subprocessors or technical systems may process personal data outside Estonia or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we seek to use an appropriate transfer mechanism, which may include:

• a European Commission adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• supplementary contractual or technical measures;
• another legally recognised transfer mechanism; or
• a limited derogation permitted by applicable law.

Information about available transfer safeguards may be requested by emailing office@yachtcraftindex.com.

Certain confidential commercial details may be redacted from copies of contractual safeguards.

28. Data retention principles

We retain personal data only for as long as reasonably necessary for:

• the purpose for which it was collected;
• performance of the agreement;
• maintenance of the account;
• security;
• dispute handling;
• fraud prevention;
• accounting;
• taxation;
• regulatory obligations; and
• legal claims.

Retention periods may differ depending on the type of information and relevant legal obligations.

29. Active accounts

While a Company or Builder User account is active, we retain account, profile, communication and technical information as necessary to provide and secure the service.

There is no automatic deletion merely because active-account information is old.

Users should update inaccurate or outdated information.

30. Cancelled Company memberships

Where a Company cancels automatic renewal:

• the membership remains active until the end of the paid annual term;
• the profile may remain visible until that date; and
• relevant account and profile data remain stored during the paid term.

31. End of Company membership

After a Company membership ends:

1. the Company profile is hidden from Builder Users;
2. inactive profile information and uploaded content are normally retained for 90 days;
3. after 90 days, profile content may be deleted or anonymised;
4. backup copies may remain for a further maximum of 90 days while normal backup cycles are completed; and
5. information needed for accounting, legal, security or dispute purposes may be retained for longer.

32. Builder User accounts

Builder User account information is retained while the account remains active.

A Builder User account may be treated as inactive after 24 months without login.

We may then:

• request reconfirmation of the person’s organisation and role;
• suspend access;
• delete or anonymise information that is no longer required; or
• retain limited records where necessary for security, misuse prevention or legal purposes.

33. Accounting and contractual records

Invoices, payment information, refunds, subscription records, contractual acceptance evidence and relevant accounting documents may be retained for seven years or for another period required by applicable law.

These records are not kept publicly visible within the platform.

34. Marketing and suppression records

Marketing data is retained while:

• consent remains valid;
• professional marketing remains appropriate;
• a legitimate business relationship continues; or
• the relevant outreach campaign remains active.

When a person unsubscribes or objects:

• active marketing stops;
• the person’s contact details may be placed on a suppression list; and
• a minimal record may be retained for as long as reasonably necessary to prevent accidental re-contact.

35. Communications and disputes

Communications may be retained for as long as needed to:

• manage the account;
• respond to the request;
• document decisions;
• resolve disputes;
• enforce agreements;
• establish or defend legal claims; or
• comply with legal obligations.

36. Analytics retention

Google Analytics information is retained according to the settings applied to the YachtCraft Index Analytics account and is periodically reviewed.

We seek to use retention settings proportionate to the purpose of understanding website use.

Aggregate or de-identified statistical information may be retained for longer where it no longer identifies an individual.

37. Security

We use reasonable technical and organisational measures intended to protect personal data against:

• unauthorised access;
• unlawful use;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure; and
• other security risks.

Measures may include:

• authentication controls;
• access restrictions;
• encryption in transit;
• encryption at rest where supported;
• secure hosting;
• logging;
• backups;
• role-based access;
• password protection;
• security monitoring;
• vendor due diligence;
• data-processing agreements; and
• incident-response procedures.

No online system is completely secure. Users are responsible for keeping their account credentials confidential and notifying us of suspected unauthorised access.

38. Personal-data breaches

Where we become aware of a personal-data breach, we will assess:

• the nature of the incident;
• the personal data affected;
• the likely consequences;
• the persons affected;
• the measures already taken; and
• the measures required to reduce risk.

We will notify the competent supervisory authority and affected individuals where required by applicable data-protection law.

39. Individual rights

Subject to the conditions and limitations of applicable law, an individual may have the right to:

• receive information about processing;
• access personal data;
• receive a copy of personal data;
• correct inaccurate information;
• complete incomplete information;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• withdraw consent;
• receive certain data in a portable format;
• lodge a complaint with a supervisory authority; and
• challenge certain decisions based solely on automated processing.

These rights are personal to the individual and do not generally provide a person with access to confidential information concerning another person or company.

40. Right to object to direct marketing

An individual may object to the processing of their personal data for direct marketing at any time.

After receiving the objection, CraftIndex OÜ will stop processing the person’s data for further direct marketing.

An objection may be made by:

• selecting the unsubscribe link in a marketing email;
• replying to the outreach email;
• using another unsubscribe method provided; or
• emailing office@yachtcraftindex.com.

A minimal suppression record may remain stored to prevent future marketing.

41. Right to object to legitimate-interest processing

Where processing is based on legitimate interests, an individual may object on grounds relating to their particular situation.

We will stop the relevant processing unless:

• we demonstrate compelling legitimate grounds that override the individual’s interests, rights and freedoms; or
• processing is required to establish, exercise or defend legal claims.

The direct-marketing objection described above does not require the individual to provide particular grounds.

42. Exercising rights

A request may be sent to:

office@yachtcraftindex.com

The request should identify:

• the person making the request;
• the relevant email address;
• the relevant organisation or account;
• the right being exercised; and
• sufficient detail to locate the information.

We may request reasonable evidence of identity and authority before acting on a request.

Where a person acts for someone else, we may request evidence of that authority.

We will respond within the period required by applicable law.

Complex or multiple requests may require an extension where permitted by law. We will inform the requester where an extension applies.

43. Refusal or limitation of a request

A request may be refused or limited where permitted by law, including where:

• identity cannot be verified;
• the request affects the rights of another person;
• disclosure would reveal protected trade secrets;
• information must be retained by law;
• information is required for legal claims;
• the request is manifestly unfounded or excessive; or
• another legal exception applies.

Where required, we will explain the reason for refusal and available complaint options.

44. Supervisory authority

Individuals may lodge a complaint with the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon
Tatari 39
10134 Tallinn
Estonia
Email: info@aki.ee

An individual may also have the right to complain to the data-protection authority in the country where they live or work or where the alleged infringement occurred.

45. Automated processing

CraftIndex OÜ may use automated tools for:

• categorisation;
• translation;
• profile summarisation;
• duplicate detection;
• search tagging;
• security monitoring;
• analytics;
• email delivery;
• bounce handling; and
• fraud detection.

We do not intend to make decisions producing legal effects or similarly significant effects on individuals solely through automated processing.

Profile approval and Builder User eligibility remain subject to human oversight.

46. External links

YachtCraft Index may contain links to websites operated by Member Companies, Builder Users, service providers or other third parties.

CraftIndex OÜ is not responsible for the privacy practices of external websites.

Individuals should review the privacy information provided by the relevant third party.

47. Changes to service providers

We may replace or add service providers where reasonably necessary to:

• operate the platform;
• improve functionality;
• increase security;
• support growth;
• comply with law; or
• provide new services.

Where a material change affects the information in this Privacy Policy, we will update the Policy.

48. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes in law;
• changes in processing;
• new service providers;
• new platform functions;
• security requirements;
• changes to retention practices; or
• clarification of existing information.

The updated version will display a new version number and effective date.

Where a change materially affects individuals, we may provide additional notice through:

• email;
• the website;
• the account interface; or
• another appropriate method.

49. Language

This Privacy Policy is written in English.

Translations may be provided for convenience.

Where a translation conflicts with the English version, the English version prevails unless applicable law requires otherwise.

50. Contact

Privacy questions, objections and data-subject requests may be sent to:

CraftIndex OÜ
Registry code: 17498820
Pärnu mnt 139b
Kesklinna linnaosa
Tallinn 11317
Harju maakond
Estonia

Email: office@yachtcraftindex.com