Privacy Policy

This Privacy Policy explains how HotDocks ("we", "us" or "our"), the operator of the HotDocks business-to-business maritime marketplace at hotdocks.com (the "Platform"), collects, uses, stores, shares and protects personal data.

It applies to company representatives who create an account, visitors who browse the Platform, and anyone who contacts us. HotDocks is a B2B marketplace that connects shipowners and managers with shipyards, workshops, repair contractors and parts suppliers. We act as the data controller for personal data processed to operate the Platform.

If you use the Platform on behalf of a company, you confirm that you are authorised to provide that company's and your own information to us.

We process personal data of individuals who act for companies: account holders, employees who message or publish on the Platform, and visitors. Company information (legal name, tax identifiers, public profile) may include personal data where a person is identifiable, for example a work email or a named contact.

This Policy covers data processed through the website, emails we send, in-platform messages, and related support. It does not cover other users' independent processing of data you share with them (for example a supplier you message off the Platform).

The categories below depend on how you use the Platform. We do not require more than is needed for the relevant feature.

• Account data: work email, password (stored as a one-way hash; we cannot read it), language, account role and status, and timestamps of registration and updates.
• Company profile: company name and types, phone numbers, country, city, address, map coordinates, about text, website, logo and cover images, specialities, operating areas, and contact-visibility settings you choose.
• Legal and tax data you add later in your profile: official company name, tax number (including Turkish VKN), tax office and related verification status. For Turkish companies we may check the VKN through GİB.
• Publications and marketplace activity: listings, requests for quotation (RFQs), quotes, news posts, portfolio/works, images, comments, likes, follows, favourites and reviews.
• Communications: in-platform messages, notification preferences, and emails we send (password reset, email-change confirmation, service notices).
• Usage and device data: IP address, browser user agent, pages and profiles viewed, search queries, approximate location derived from city or map pin, and diagnostic logs needed to keep the Platform secure.
• Billing data: subscription plan and, when paid plans are enabled, payment and invoicing details required to bill you.

We collect data in the following ways.

• Directly from you when you register, edit your profile, publish content, message other companies, contact support, or change email or password.
• Automatically when you use the Platform, including session tokens, language preference, visitor identifier, and analytics of profile and listing views.
• From other users, for example when they mention your company, send a quote, leave a review, or open your public profile.
• From third parties that you ask us to use: GİB for Turkish tax verification, mapping/geocoding to place your city on the map, and email delivery providers.

We use personal data only for specified, explicit purposes.

• To create and administer your account, authenticate you, and keep you signed in.
• To show public company profiles, listings, RFQs and other content you choose to publish, and to let other companies find and contact you according to your privacy settings.
• To enable quoting, messaging, follows, favourites, comments and reviews between companies.
• To send transactional emails (password reset, email-change confirmation, security notices) and in-platform notifications you have not turned off.
• To verify companies (including GİB checks for Turkish VKN), prevent fraud, spam and abuse, and moderate listings and posts (including automated review of content for off-topic, contact-spam or prohibited material).
• To provide search, recommendations of companies, and owner analytics (who viewed a profile or listing).
• To operate billing and subscriptions when paid plans are in force.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal claims.
• To improve reliability and security of the Platform (error diagnosis, rate limiting, session management).

Where the EU/UK GDPR applies, we rely on: performance of a contract with you (providing the account and marketplace features); our legitimate interests in operating, securing, moderating and improving a B2B marketplace, preventing abuse, and understanding how the Platform is used, balanced against your rights; consent, where we ask for it (including the registration checkbox and any optional marketing); and compliance with legal obligations.

Where Turkish law applies, we process personal data in accordance with Law No. 6698 on the Protection of Personal Data (KVKK), including processing that is necessary for the establishment or performance of a contract, for our legitimate interests provided they do not harm your fundamental rights, where you have given explicit consent, and where processing is required by law (for example tax and accounting records).

You may withdraw consent at any time without affecting processing that already took place, or processing that rests on another lawful basis. Withdrawing consent to use the Platform as a registered user means you should close the account if you no longer wish us to process account data on that basis.

We use a small set of cookies and similar storage that are needed to run the Platform. We do not currently use third-party advertising cookies. You can delete cookies and local storage in your browser; blocking them may sign you out or reset language and visitor analytics.

• Authentication: an access token stored in your browser's local storage so you stay signed in. Clearing it signs you out.
• Language: a first-party cookie (hotdocks_locale) remembers English, Turkish or Russian for up to one year.
• Visitor analytics: a first-party cookie (hd_vid) helps us count unique viewers of public profiles and listings, including for company owners' analytics. It is not used to advertise to you on other sites.
• Preferences and drafts: local or session storage may keep recently viewed items, chat drafts and similar UI state on your device only.

We do not sell personal data. We share it only as described below, and only as needed for that purpose.

• Other companies on the Platform: public profile fields, listings, RFQs and other content you publish; contacts you choose to show; messages and quotes you send.
• Service providers who process data on our instructions: hosting and storage, email delivery, mapping/geocoding, and AI moderation/search assistance (currently Google Gemini for taxonomy suggestions and spam/content review of listings and posts).
• Turkish Revenue Administration (GİB) when you ask us to verify a VKN.
• Professional advisers, payment providers (when billing is enabled), and authorities where required by law or to protect rights, safety and the integrity of the Platform.
• A buyer or successor if we transfer or reorganise the business, under this Policy or an equivalent one.

The Platform is used by companies in many countries. Your data may be stored or processed in the country where our servers or providers operate, which may be outside your own country, including outside the European Economic Area or Türkiye.

Where a transfer of personal data from the EEA/UK requires a safeguard, we use appropriate measures such as standard contractual clauses and provider terms. Where KVKK requires it, we transfer data abroad only in accordance with that law (adequate country, undertaking, or explicit consent as applicable).

We keep personal data only as long as needed for the purposes in this Policy, then delete or irreversibly anonymise it, unless a longer period is required by law.

• Account and company profile: for the life of the account. After you close the account we delete or anonymise personal data within a reasonable period, except records we must keep.
• Publications, messages, quotes and reviews: while the account is active and as needed to keep marketplace history coherent for other parties to a conversation or transaction; public content may remain in anonymised or company-only form after an individual user leaves.
• Security, login and abuse logs: typically up to 12 months, longer if an investigation is open.
• Transactional emails and password/email-change tokens: until used or expired (tokens expire in about one hour) and briefly thereafter in mail logs.
• Tax, billing and legal records: for the statutory retention period (often 5–10 years depending on the country).
• Analytics cookies: the visitor cookie lasts up to one year; you can clear cookies in your browser at any time.

We use technical and organisational measures appropriate to a marketplace that holds company and account data: hashed passwords, access-controlled servers, HTTPS, session controls, rate limits on sensitive endpoints, and staff access only as needed. No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for activity on your account. Tell us promptly if you suspect unauthorised use.

Depending on your location, you may have some or all of the following rights. We will not refuse a request that the law requires us to honour, and we may need to verify your identity first.

• Access: obtain confirmation of whether we process your personal data and a copy of it.
• Rectification: correct inaccurate or incomplete data. Much of this you can do in account and profile settings.
• Erasure: ask us to delete personal data where there is no longer a lawful basis to keep it.
• Restriction and objection: ask us to limit certain processing, or object to processing based on legitimate interests.
• Portability: receive account data you provided to us in a structured, commonly used format, where the law provides this right.
• Withdraw consent: where processing is based on consent.
• Complaint: lodge a complaint with a supervisory authority. In Türkiye this is the Personal Data Protection Authority (KVKK). In the EEA/UK you may contact your local data protection authority.

Use your account settings where the action is available (edit profile, contact visibility, notification preferences, password and email change). For access, deletion of the account, or any request you cannot complete in the product, email [email protected] or [email protected] from the address on the account and describe what you need.

We will respond within the period required by applicable law (generally 30 days under GDPR, and within the periods set by KVKK). If we cannot fulfil a request, we will explain why, unless the law prevents us from doing so.

Information you mark as public (company name, location you choose to show, listings, RFQs, posts, and contacts you have not hidden) can be seen by other users and visitors and may be indexed by search on the Platform. Do not publish personal data you are not entitled to share.

When you message or transact with another company, that company becomes an independent controller of the data you send them. Their use of it is governed by their own policies and the law, not by this Policy.

We use automated tools to suggest listing categories, rank search results, recommend companies, count profile views, and flag content that may be spam, off-topic or prohibited. These tools help us operate the marketplace. They do not produce legal effects or similarly significant decisions about you solely by automated means without human involvement. You may contact us to contest a moderation outcome that affects your account or content.

The Platform is for business use by adults. You must be at least 18 years old to register. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

We may update this Policy when the Platform, the law, or our practices change. The "Last updated" date at the top shows when it was last revised. For material changes we will make reasonable efforts to notify account holders through the Platform or by email.

The updated Policy applies from the date it is posted, unless a later date is stated. If you do not agree with the changes, you should stop using the Platform and request closure of your account.

For privacy questions or to exercise your rights, contact HotDocks at [email protected] or [email protected].

If a Data Protection Officer or an EU/UK representative is appointed, their details will be added to this section.