Privacy Policy

Depending on how you use Graftrz, we may collect the following types of information:

Account information

• Name, email address, phone number, profile photo, account role, and account status.

Profile information

• Crew users may provide work experience, skills, department preferences, certifications, availability, and other profile details.
• Vessel-side users may provide vessel name, home port, and role information needed to post and manage jobs.

Location information

• Graftrz uses location information to help users find relevant jobs or crew nearby. This may include a location you enter manually, an approximate location, or your device location where you have granted permission.
• Graftrz does not display your precise device location to other users. The app may instead display an approximate location, selected city or port, or distance-based result to support nearby discovery.
• You can manage location permissions at any time through your device settings. Some features may not work fully if location access is turned off.

Job and marketplace activity

• Job posts, applications, offers, accepted and completed jobs, notifications, and related marketplace activity.

Verification information

• Graftrz may collect information or documents to support account, identity, or vessel verification. Some verification checks may be handled by third-party providers.

Communications

• Messages, support requests, notifications, and related records when you interact with other users or with Graftrz.

Tax and regulatory information

• Where required by applicable law, we may collect information such as your address, country of tax residence, date of birth, Tax Identification Number and earnings or transaction information.

Technical and usage information

• Device information, app version, IP address, log data, crash reports, and usage information to operate, secure, and improve the app.

Some information is required to use Graftrz — without a name, email address, and location we cannot create your account or make you discoverable. Other information, such as a profile photo, is optional. We will always make clear at the point of collection whether something is required or not.

We use personal information to:

• Create and manage user accounts.
• Provide the Graftrz marketplace service.
• Display user, vessel, job, and profile information where relevant.
• Support job search, job posting, applications, offers, bookings, and completion flows.
• Support location-based discovery.
• Support verification, trust, safety, and platform integrity.
• Send service messages, notifications, and support communications.
• Prevent fraud, misuse, unauthorised access, and security incidents.
• Maintain, test, improve, and troubleshoot the app.
• Comply with legal, tax, regulatory, and platform obligations.
• Enforce our terms, policies, and user agreements.

Where we are based in the EU, we rely on the following legal grounds under GDPR: performance of a contract (to provide the service you signed up for); compliance with a legal obligation (to meet our regulatory and reporting requirements); and legitimate interests (to keep the platform secure and prevent fraud). We will ask for your consent before sending any optional marketing messages.

We do not currently use automated decision-making or profiling that produces legal or significant effects on you. No decision about your account or access to the platform is made by an algorithm alone.

We do not sell your personal information. We do not use your information for third-party advertising or tracking.

We may share personal information in the following circumstances:

With other Graftrz users

• Some information is shared with other users as part of the marketplace — for example, profile information visible to relevant users, job posts visible to potential applicants, and application or other information visible to the relevant parties.

With service providers

• We use trusted third-party providers to help operate the app, including providers for hosting, authentication, storage, notifications, analytics, verification, diagnostics and support. These providers may process personal information only as needed to provide their services to us.

For legal, safety, and business reasons

• We may disclose information where necessary to comply with law, respond to lawful requests, protect users, prevent fraud, investigate misuse, or enforce our terms. We may also disclose information in connection with a business transaction such as a merger, acquisition, restructuring, or sale of assets — we will notify you if this occurs and if a different privacy policy applies.

Graftrz may be used by users in different countries. Our service providers may process personal information in countries other than where you live, including the United States. Where required, we use appropriate safeguards for international transfers of personal information, such as Standard Contractual Clauses approved by the European Commission.

As a digital platform operating in the EU, we have legal obligations to keep records of transactions and, in some cases, to report earnings information to tax authorities. This applies to all EU digital platforms — it is not unique to Graftrz.

As an operator of a digital marketplace, Graftrz may be required under applicable tax transparency laws, including DAC7, to collect, verify, retain and report certain information about users who earn income through the platform. This may include identifying details, tax residence, Tax Identification Number and transaction or earnings information. We will inform affected users when information is required and the legal reason for collecting it.

We keep personal information for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, and maintain security and transaction records.

We retain each category of personal information only for as long as needed for the purpose for which it was collected, including operating the platform, resolving disputes, preventing fraud and meeting legal, tax and accounting obligations. Retention periods vary according to the nature of the information and applicable law.

Some information may be retained after account closure where we are legally required or have a legitimate reason to do so.

We use appropriate technical and organisational measures designed to protect personal information. These include encrypted network connections where appropriate, access controls, secure cloud services and operational security measures.

No system is completely secure. Users are responsible for keeping their login details safe and notifying us of any suspected unauthorised account access. In the event of a data breach that puts your information at risk, we will notify you and the relevant authority as required by law.

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or request a copy of your personal information. You may also be able to update certain information directly in the app.

• Access — ask us what information we hold about you.
• Correction — ask us to fix anything that is wrong or incomplete.
• Deletion — ask us to delete your account and personal information, subject to any legal retention obligations.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Portability — receive a copy of your information in a standard, machine-readable format.
• Object — object to processing based on our legitimate interests.
• Withdraw consent — where we have asked for your consent, you can withdraw it at any time.

To make a privacy request, contact us at privacy@graftrz.com. We may need to verify your identity before responding. We will respond within 30 days.

If you are based in the EU and are not happy with how we have handled your information, you can complain to the Malta Information and Data Protection Commissioner at idpc.org.mt, or to the data protection authority in your own country.

Graftrz may request access to location services and notifications to provide core features such as nearby job and crew discovery, account updates, application updates, job updates, and other service-related notices. You can manage these permissions at any time through your mobile device settings. Some features may not work fully if permissions are disabled.

Graftrz is not intended for children. Users must be old enough to lawfully use the service and enter into agreements in their country. We do not knowingly collect personal information from children. If we become aware that a child has created an account, we will close it and delete their information promptly.

Graftrz does not sell personal information. We do not use personal information for third-party advertising tracking unless disclosed and permitted in accordance with applicable law and platform rules.

If we send marketing communications in future, you will be able to opt out of non-essential messages at any time.

Graftrz uses third-party services to operate the platform, including providers for hosting, authentication, data storage, notifications, analytics, verification, diagnostics, and support. Those third-party services have their own privacy policies and terms. We encourage you to review them where relevant.

Our website may use cookies and similar technologies for essential functionality, preferences and, where enabled, analytics. Further details are provided in our Cookie Policy. The mobile app may use local storage, device identifiers or similar technologies where required to provide and secure the service.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you — for example by email or in-app notification — before the changes take effect. The latest version will always be available at graftrz.com/privacy. The version number and date at the top of this document show the current version.

For questions about this Privacy Policy or how Graftrz handles personal information, contact us at:

Graftrz Ltd. The Core, Triq Il-Wied Ta' L-Imsida, Msida, MSD 9021, Malta Email: privacy@graftrz.com Web: graftrz.com/privacy