Terms of Service

1. The service

SailorNotebook lets seafarers record their professional documents, sea service and qualifications, generate a maritime CV, and share it with maritime companies. Companies can post vacancies, review candidates who applied or accepted an invitation, and manage their fleet information.

SailorNotebook is a software platform. We are not a crewing or manning agency, we do not employ seafarers, and we are not a party to any employment relationship formed between users.

2. Accounts

You must provide accurate information when registering and keep your credentials confidential. You are responsible for activity under your account. One person or company may hold one account of each type. We may suspend accounts that violate these terms or threaten the security of the service.

3. Your content

The records and documents you upload remain yours. You grant SailorNotebook a limited licence to store, process and display them solely to operate the service — including showing your CV to companies you choose to share it with.

You are responsible for the accuracy and authenticity of the documents and qualifications you record. Uploading falsified certificates or impersonating another person is prohibited and grounds for immediate termination.

4. Company accounts

Company users may use candidate data only to evaluate candidates for genuine maritime vacancies. Re-selling, scraping, bulk-exporting or otherwise misusing seafarer data is prohibited. Companies must keep candidate data confidential and delete it when it is no longer needed for recruitment.

5. Acceptable use

You may not use SailorNotebook to break the law, infringe others' rights, distribute malware, attempt to access other users' data, or interfere with the operation of the service.

6. Intellectual property

The SailorNotebook name, design and software are owned by SailorNotebook. These terms grant you no rights in them beyond ordinary use of the service.

7. Disclaimers

The service is provided "as is". We do not guarantee that using SailorNotebook will result in employment, that postings are accurate, or that the service will be uninterrupted or error-free. Document expiry reminders are an aid, not a substitute for your own obligation to keep your certificates valid.

8. Limitation of liability

To the maximum extent permitted by law, SailorNotebook is not liable for indirect or consequential damages, lost earnings or lost employment opportunities arising from use of the service. Nothing in these terms excludes liability that cannot be excluded by law.

9. Termination

You may close your account at any time. We may suspend or terminate accounts that breach these terms. Upon termination, the Privacy Policy's deletion rules apply to your data.

10. Changes and governing law

We may update these terms; material changes will be announced in the app or by email, and continued use after the effective date constitutes acceptance. These terms are governed by the laws of the jurisdiction in which SailorNotebook is established, without prejudice to mandatory consumer protections that apply to you.

11. Data processing terms (company accounts): scope and roles

This part (sections 11–22) applies to company accounts only and is accepted separately when a company account is created. Its version is 2026-09-13 and it is effective from 13 September 2026. The acceptance record — version, server timestamp and the id of the accepting account — is written to the company's record and shown to the company. Where this part and the rest of these terms conflict on a matter of personal data, this part prevails.

Roles. For the data the company gives to SailorNotebook or that SailorNotebook processes on the company's behalf — the email addresses of candidates it assigns exams to, assignment notes, exam answers, scores, answer sheets and sitting records — the company is the data controller and SailorNotebook is the data processor acting on the company's behalf and on its instructions. SailorNotebook's position with respect to the CV and documents a seafarer keeps in their own account is described in the Privacy Policy; this part does not change it. When a seafarer shares their CV with the company (an application, an accepted invitation, an employment bond) the company is an independent controller of the data it receives, and the 'Company accounts' section together with the confidentiality, retention and liability provisions of this part apply to it as well.

The company fulfils its own duty to inform candidates under KVKK art. 10, determines the lawful basis of the processing (KVKK art. 5) itself, and declares on every assignment that it obtained the email address lawfully in the course of a recruitment process. The privacy notice SailorNotebook shows the candidate on the exam screen supplements the company's notice; it does not replace it. The exam is unsupervised and involves no identity verification; the company agrees not to base a hiring decision on the result alone.

12. Data processing: purpose limitation and instructions

SailorNotebook processes the data it holds on the company's behalf only to provide the service — running the exam, marking it on the server, presenting the result and the completed answer sheet to the assigning company alone, delivering notifications — and in line with the instructions the company gives through these terms and its actions in the application. It does not use that data for its own purposes: it does not show it to other companies, does not use it for marketing, and does not keep it beyond the periods in the 'retention periods' section.

The company's actions in the application (assigning, resending and revoking an exam, opening an answer sheet) count as its documented instructions. If SailorNotebook considers an instruction unlawful it informs the company before carrying it out. The company ensures its instructions are lawful and that no special-category personal data (health, criminal convictions, religion, union membership and the like) is ever entered into free-text fields such as the assignment note.

13. Data processing: confidentiality

SailorNotebook and those working on its behalf do not disclose the data processed for the company to anyone else or use it for another purpose, as KVKK art. 12/4 requires; this obligation has no end date. Access to the data is limited to the people needed to provide the service. One company's exam data cannot be seen by another company; that separation is enforced at the level of the database's authorisation rules, not in the interface, and is verified by automated tests.

The company owes the same confidentiality: it uses the contents of an answer sheet (question texts, correct options, explanations) only to evaluate the candidate concerned, and does not pass them to third parties, publish them, use them as training or preparation material or distribute them. The question bank belongs to SailorNotebook and is not made available to the company as a whole. Every opening of an answer sheet is recorded on the exam record.

14. Data processing: sub-processors

The company authorises SailorNotebook to use the following sub-processors to provide the service: Google Cloud / Firebase (database, authentication, file storage and hosting; the database is held in Google Cloud's eur3 multi-region location — Belgium and the Netherlands), Netlify (application hosting and server functions, including server-side marking), Resend (transactional email, e.g. the exam invitation) and Sentry (technical error monitoring; error records contain no raw personal data and no exam link). This list is the same as the one in the exam privacy notice shown to candidates. SailorNotebook uses each of these providers under that provider's own data processing agreement and is liable to the company for the acts of its sub-processors as for its own.

A change to the list of sub-processors is notified to the company's account email at least 30 days before it takes effect. The company may object on reasonable grounds; if no solution is found it may close its account, and the 'deletion and return' section applies.

15. Data processing: security

Under KVKK art. 12/1 SailorNotebook applies at least the following measures: TLS encryption in transit; encryption at rest at the infrastructure provider's level; default-deny database authorisation rules (the client has no write access to exam data); marking performed on the server, with any score sent by the client ignored; correct options and explanations absent from every packet sent to the candidate's side, verified by an automated scan on every release; a random 256-bit key for the exam link, of which only the hash is stored in the database; rate limits per IP and per assignment; automated secret scanning on code releases; no raw personal data in error-monitoring records.

The company is responsible for security on its own side: it keeps its account credentials confidential, limits access to printed or downloaded answer sheets to the people taking part in the hiring decision, and destroys them at the end of its own retention period.

16. Data processing: retention periods

Exam data — score, subject breakdown, exam date, answers, sitting records and the candidate's email address — is kept for 24 months from the exam date and then deleted. Technical data about the exam link (device summary, open count) is deleted after 30 days. These periods are the same as those in the exam privacy notice shown to candidates and are enforced by a scheduled deletion job. The company sets and applies its own retention period for any copies it downloads or prints.

17. Data processing: deletion and return

When the company account is closed or this part ends, the data processed on the company's behalf is deleted or anonymised unless the company asks in writing, from its account email and within 30 days, for it to be returned; if return is requested the data is provided in a machine-readable form and then deleted. Exams in progress are completed and are subject to the same rule. Records that must be kept by law are outside this rule; if any such record is kept, the company is told which one and on what ground.

18. Data processing: breach notification

When SailorNotebook becomes aware of a data breach affecting data processed on the company's behalf it informs the company at its account email within 24 hours at the latest. The notification covers the nature and time of the breach, the (estimated) number of data subjects and records affected, the likely consequences, the measures taken and planned, and a contact address. Notifying the Personal Data Protection Board (within 72 hours) and the data subjects is the company's duty as controller; SailorNotebook provides the information and documents needed for it.

19. Data processing: records, audit and data-subject requests

For every exam SailorNotebook records which version of the privacy notice was shown, the candidate's declarations, server-clock timestamps, and how many times and when the company last opened the answer sheet. To verify compliance the company may request information and documents at most once a year, with at least 15 days' written notice; SailorNotebook may offer security test results and its technical and organisational measures documentation in place of an on-site audit. An audit does not extend to other companies' data or to the question bank. After a data breach these limits do not apply.

If a candidate sends a request under KVKK art. 11 to SailorNotebook, SailorNotebook does not answer it itself: it forwards the request to the company within 3 working days at the latest and provides, free of charge, the technical support the company needs to meet the statutory 30-day deadline. A candidate's request to learn their own score and answer sheet is an ordinary request and cannot be refused.

20. Data processing: transfers outside Türkiye

The sub-processors above are established outside Türkiye; the data processed on the company's behalf is therefore transferred abroad. That transfer is governed by KVKK art. 9 as amended by Law no. 7499 and by the Regulation on Transfers Abroad. There is no adequacy decision from the Board covering these countries. Work to put in place the safeguard mechanism required by KVKK art. 9/4 for this transfer is ongoing; when it is complete this part will be updated and its version will change. The company accepts this knowingly and is responsible for keeping its own VERBİS registration (where it has one) and its notices to candidates consistent with this transfer.

21. Data processing: liability

The parties acknowledge that under KVKK art. 12/2 they are jointly responsible for data security measures. Between themselves, each party bears the consequences of breaches caused by its own fault: obtaining a candidate's email address from an unlawful source, choosing the wrong lawful basis, failing to inform candidates, entering special-category data into a free-text field and distributing the contents of an answer sheet are the company's fault; a breach of the authorisation rules, a leak between companies, a correct option or explanation reaching the candidate, disclosure of the exam link and a delayed breach notification are SailorNotebook's fault.

The service is provided free of charge during the pilot. SailorNotebook's liability under this part is limited to the fees the company paid for the service in the preceding 12 months; for free use that cap is zero. This limit does not affect liability that cannot be limited by law, nor who is liable for administrative fines, which the law determines. The 'Limitation of liability' section is unaffected.

22. Data processing: termination

These provisions apply for as long as the company account is open. The company may close its account at any time. SailorNotebook may end the company's ability to assign exams and to access candidate data immediately in the event of a material breach of these terms, and otherwise with 30 days' notice to the account email. On termination the 'deletion and return' section applies; the confidentiality, liability and records provisions survive termination.

When SailorNotebook updates this part, the new version is shown to the company account at its next session and the service cannot be continued until it is accepted. Closing the account is always open to a company that does not accept a version. This part takes the place of a separately signed agreement between controller and processor; a company that requires a signed agreement may write to sailornotebook@tutamail.com.