Legal — Data subject rights

Data subject rights.

Last updated: 2026-07-29.

1. Controller and processor

Provenship is processor for customer-uploaded operational data (voyages, BDNs); for those records DSAR fulfillment is coordinated via the customer-controller under the DPA. Provenship is controller for its own tenant-relationship data (billing contacts, DSAR audit log).

2. Your rights

Under GDPR Articles 15 to 22 you may request access, rectification, erasure (Art. 17), restriction of processing, portability (Art. 20), and object to processing. Provenship responds to verified requests within one month per Art. 12(3) (extendable by two further months for complex requests, with notice).

3. How to request a data export (Art. 20)

Email privacy [at] provenship.com from the address associated with your account. We return a structured, machine-readable JSON bundle containing the categories of personal data we hold. JSON is the default format; CSV is available on request as a defensive alternative content-type.

4. How to request erasure (Art. 17)

Email privacy [at] provenship.com from the address associated with your account. Confirmed erasure runs against tenant-relationship data we control. The following categories are subject to Art. 17(3) retention overrides: audit logs (7 years per ADR-022), verifier signed PDFs (7 years per ADR-021), customer contracts (7 years per our master services agreement), and our LLM call provenance log (operational retention, subject to forthcoming ADR amendment).

5. Retention schedule (summary)

Audit logs, verifier statements, and contracts: 7 years. User activity logs: thirty days. Vessel and voyage operational data: tenancy lifetime plus a thirty-day post-offboarding export window before Art. 17 deletion.

6. Data residency and transfers

EU customer tenant data is pinned to eu-west-1; North-American tenant data is pinned to us-east-1 per our two-region topology. Tenant operational data does not cross regions. Regulator-facing signed PDFs are replicated cross-region (encrypted, retention-locked) for audit redundancy. No Bedrock cross-region inference profiles are used.

7. Data Protection Officer

Email the DPO at dpo [at] provenship.com. Complaints may also be filed with your national supervisory authority.