Privacy Policy

1. Who we are

Hullbot Pty Ltd (ACN 608 638 642) of (“Hullbot”, “we”, “us”) provides autonomous hull-cleaning and inspection as a managed service to vessel operators worldwide. We are responsible for the personal information described in this policy and are the “controller” of it for the purposes of the EU and UK GDPR.

This policy explains what personal information we collect, why, who we share it with, how long we keep it and the rights you have. It applies to:

• visitors to hullbot.com and our other online channels
• people who contact us, attend our events or receive our communications
• representatives of our customers, prospects, suppliers and partners
• job applicants
• people who may be incidentally recorded during our hull-cleaning and inspection operations

Where we process personal information on a customer’s behalf under a contract (for example, crew details in vessel data a customer shares with us), the customer’s own privacy notice applies and we act on their instructions.

Questions about this policy can go to our privacy contact at privacy@hullbot.com

2. Information we collect

We collect only what we need for the purposes in section 3. We do not intend to collect sensitive information (such as health, biometric or political data) and ask you not to send it to us.

About operational data. Our robots record imagery of underwater hull surfaces. This is mostly not personal information. Occasionally footage or photos may incidentally capture identifiable people, such as crew, divers or port workers. We do not use this footage to identify or monitor individuals, and we limit access to it. Vessel performance data is about the ship, but may become personal information if it is linked to named crew; where that happens, we handle it under this policy or under our customer’s instructions.

If you do not provide information we reasonably ask for, we may not be able to respond to your enquiry, deliver our services or progress your job application. You can browse our website without telling us who you are.

3. How we use your information

We use personal information only for the purposes below, or for related purposes you would reasonably expect. The legal basis column applies where the EU or UK GDPR (or a similar law) requires one.

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details, and you can object (section 9).

Marketing. Every marketing email has an unsubscribe link. You can also opt out at any time by contacting us. We will still send service and contract messages.

Automated decisions and AI. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Our robots use automated systems to clean and inspect hulls, and we may use AI tools to help analyse imagery and vessel data; these concern vessels, not individuals. If this changes, we will update this policy before we start.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

4. Cookies and analytics

Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working and secure, and are always on. Analytics and marketing cookies are optional: where the law requires it (including in the EU and UK), we set them only after you accept them in our cookie banner.

You can change your choices at any time through the “Cookie settings” link in the website footer, or by adjusting your browser settings. Blocking some cookies may affect how the site works. We honour Global Privacy Control signals where the law requires it.

5. Who we share it with

We share personal information only as needed for the purposes in section 3:

• Service providers that act on our instructions, such as cloud hosting, CRM, email, video-conferencing, payroll, recruitment and IT security providers. They must protect the information and may not use it for their own purposes.
• Our customers and their agents, such as ship managers, charterers or class societies, when we share cleaning and inspection reports for the vessels they operate.
• Operational partners, such as port agents, local service partners and logistics providers, where needed to deploy our equipment.
• Professional advisers, such as lawyers, auditors and insurers.
• Regulators, port and biosecurity authorities, courts and law enforcement, where the law requires it or to protect rights, safety or property.
• Event co-hosts or partners, only where you register for a jointly run event or give consent.
• A buyer or investor, if we are involved in a merger, acquisition, financing or sale of assets, under confidentiality terms.

6. International transfers

Hullbot is headquartered in Sydney, operates internationally and may use service providers or engage business partners located in countries other than the country where personal information was collected.

As a result, personal information may be transferred to, accessed from or stored in other jurisdictions, depending on our business activities, service arrangements and technology providers.

Where applicable law imposes requirements on international transfers, we will take steps to meet those requirements. Depending on the circumstances, these may include:

• Relying on an applicable adequacy decision or recognised transfer mechanism.
• Entering into standard contractual clauses or other approved contractual safeguards.
• Implementing supplementary technical or organisational measures where required.
• Obtaining consent or relying on another permitted transfer exception where legally appropriate.

For transfers subject to Australian privacy law, we will take the steps required by the Australian Privacy Principles and other applicable provisions governing overseas disclosures.

The countries in which personal information may be processed depend on the locations of our actual service providers, infrastructure and business partners.

7. How long we keep it

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, customer relationship management, legal compliance, dispute resolution and the establishment or defence of legal claims.

Retention periods depend on the nature of the information, the purpose for which it is used, contractual requirements and applicable laws.

For example:

• Business contact and customer records may be retained while a relationship is active and for an appropriate period afterwards.
• Contracts, invoices and financial records may be retained for periods required by applicable laws.
• Service records and operational reports may be retained in accordance with customer agreements, legitimate operational requirements and applicable legal obligations.
• Recruitment information may be retained for the period reasonably necessary to complete recruitment and address related legal requirements.
• Website logs and analytics data may be retained according to operational needs, configured retention periods and applicable law.

When personal information is no longer required, we will take reasonable steps to delete it, destroy it or de-identify it, subject to legal, contractual and technical constraints.

Information contained in backups or archived records may remain for a limited period before being deleted or overwritten in accordance with our retention processes.

8. How we protect it

We use technical and organisational safeguards suited to the risk, including access controls and multi-factor authentication, encryption in transit and at rest where supported, staff confidentiality obligations, vetted service providers, and secure deletion.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected people and the relevant regulators as required by law, including under Australia’s Notifiable Data Breaches scheme and the GDPR’s 72-hour rule.

We use technical and organisational safeguards suited to the risk. Our controls have been independently audited against the Australian Government’s Essential Eight framework at Maturity Level 2. They include multi-factor authentication, restricted administrator access, managed and remotely wipeable devices, application control, regular patching and vulnerability scanning, encrypted connections to our robots, staff security training and regular incident-response drills. We limit access to personal information to people and providers who need it.

Deleted information may remain in backups for a limited time before it is overwritten.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected people and the relevant regulators as required by law, including under Australia’s Notifiable Data Breaches scheme and the GDPR’s 72-hour rule.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy
• correct information that is inaccurate, out of date or incomplete
• delete your information
• restrict or object to how we use it, including objecting at any time to direct marketing
• portability: receive information you gave us in a machine-readable format, or have it sent to another organisation
• withdraw consent where we rely on it, without affecting earlier processing
• not be subject to decisions based solely on automated processing that significantly affect you
• not be discriminated against for exercising your rights
• complain to a privacy regulator (section 10)

To use these rights, contact us using the details in section 13. We will verify your identity before acting, and you can use an authorised agent where the law allows. We respond within the time the law sets: generally within 30 days, and within one month in the EU and UK (extendable by up to two months for complex requests). Requests are free unless they are clearly unfounded or excessive. If we cannot meet a request, we will explain why.

10. Regional terms

Australia. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may deal with us anonymously or using a pseudonym where that is practicable. If you are unhappy with how we handled a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

European Economic Area, United Kingdom and Switzerland. Hullbot Pty Ltd is the controller. You can complain to the supervisory authority where you live or work, or where an alleged breach occurred, such as Sweden’s IMY or the UK’s Information Commissioner’s Office.

United States. If a US state privacy law applies to us (for example, the California Consumer Privacy Act as amended by the CPRA), residents of that state have the rights to know, access, correct and delete, to opt out of the sale or sharing of personal information and of targeted advertising, and to limit use of sensitive personal information. In the last 12 months we have collected the categories listed in section 2 for the purposes in section 3, and disclosed them for business purposes to the recipients in section 5. We do not sell personal information or share it for cross-context behavioural advertising, and we do not knowingly do so for anyone under 16.

Other countries. Residents of other countries, including Canada, New Zealand, Singapore, Japan, South Korea, Brazil and others where we operate, have the rights their local law provides. We will honour them, and you can complain to your local privacy regulator.

11. Children and third-party sites

Our services are for businesses and professionals. We do not knowingly collect personal information from anyone under 16. If you think a child has given us their information, contact us and we will delete it.

Our website links to other sites, such as LinkedIn. Their privacy practices are their own, so please read their policies.

12. Changes to this policy

We review this policy at least once a year and when our practices or the law change. The “last updated” date shows the latest version. If we make a significant change, we will highlight it on our website and, where appropriate, tell you directly before it takes effect.

13. Contact us and complaints

For questions, requests or complaints about privacy, contact our Privacy Officer:

• Email:privacy@hullbot.com

We aim to acknowledge complaints within 5 business days and resolve them within 30 days. If you are not satisfied with our response, you can contact the regulator listed for your region in section 10.