everyblu
Book a demo

Privacy & Data Policy

PRIVACY & DATA POLICY

Last updated: 28/08/2026
Version: 2.0

1. Introduction

This Privacy Policy (the “Policy”) describes how SYNDICO SAS (“everyblu”, “we”) collects, uses, shares and protects the personal data and business data of Users within the everyblu ecosystem.

It applies to all Users, whatever their role (Owners and Captains, Marinas, Suppliers, Technicians, Guests), as well as, where applicable, to the Payer, the shipowner, the yacht-owning or yacht management company (yacht manager) and crew members, and to visitors interacting with our websites (everyblu.com, mymarina.everyblu.com, supplier.everyblu.com, myboat.everyblu.com) and our mobile applications (everyblu Yachting App, everyblu Connect App).

This Policy complies with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”), amended French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and other applicable data protection regulations. It forms an integral part of the everyblu Terms of Use.

2. Data Controller

The data controller is:

SYNDICO SAS, a simplified joint-stock company registered with the Nice Trade and Companies Register under number 984 871 095, whose registered office is located at 38B Boulevard Victor Hugo, 06000 Nice, France.

Contact email: info@everyblu.com

Depending on the processing concerned, everyblu acts as data controller for its own purposes (provision of the Services, security, fraud prevention, legal obligations). For certain processing carried out on behalf of a Service Provider (for example, processing a customer list imported by a Marina or a Supplier, or activating a customer data platform), everyblu may act as data processor, the Service Provider then being the data controller and responsible for the lawfulness of the data it provides.

With regard to payment services, Lemonway, a payment institution authorised by the ACPR (number 16568), is the data controller for know-your-customer (KYC/KYB) and anti-money laundering and counter-terrorist financing (AML/CFT) checks, which it carries out under its own terms. The list of everyblu’s processors is available on request at info@everyblu.com.

3. Categories of Data Collected

3.1. Data provided by the User

  • Name, email address, telephone number;
  • Login credentials (Account);
  • Information about the boat and its equipment;
  • Business contact details (Marinas, Suppliers, Technicians);
  • Uploaded media and documents;
  • Feedback, ratings and reviews.

3.2. Data collected automatically

  • IP address, browser and device information;
  • Usage logs, browsing paths;
  • Language and region settings;
  • Crash reports and error logs.

3.3. App-specific data

  • GPS geolocation data (subject to consent);
  • Device identifier;
  • Photo / media files (for uploads).

3.4. Data from third parties

  • Payment service provider (Lemonway): payment metadata and KYC/KYB check status;
  • Marinas, Suppliers or Technicians: information relating to bookings and contracts;
  • Analytics and performance tools: pseudonymised usage data.

3.5. Data relating to Services, payments and regulatory obligations

Depending on the Services and user journeys used, the following may also be processed:

  • data relating to the Payer, the shipowner, the owner and crew members;
  • documents relating to the yacht;
  • payment histories, messages exchanged via the Platform and delivery notes (in particular BDR/POR);
  • customer data platform (CDP) activation data and customer lists imported by Service Providers;
  • data used in connection with the Platinum and Diamond offers;
  • tax identification numbers and transactional data required for platform reporting obligations (Article 242 bis of the French General Tax Code, “DAC7” regime).

4. Purposes of Processing

Data are processed for the following purposes:

  • Providing and personalising the Platform Services;
  • Authenticating and securing Accounts;
  • Processing bookings, requests and payments;
  • Monitoring and optimising the use of the Platform;
  • Providing customer support and handling disputes;
  • Complying with legal and regulatory obligations;
  • Producing internal decision-support reports (business intelligence).
  • Managing bookings, quotes, deliveries and delivery notes (BDR/POR);
  • Preventing and handling non-payments, payment objections, chargebacks and fraud;
  • Meeting platform tax and reporting obligations (Article 242 bis of the French General Tax Code, “DAC7” regime);
  • Where applicable, carrying out direct marketing operations under the conditions set out in section 7.1.

5. Legal Bases (Article 6 GDPR)

Processing is based, as the case may be, on the following legal bases:

  • Performance of a contract: Account management, provision of the Services, completion of transactions;
  • Legal obligation: invoicing, accounting, audits, requests from authorities;
  • Legitimate interest: improvement of the Platform, fraud prevention, security;
  • Consent: non-essential cookies, marketing communications, sharing of geolocation.

6. Cookies and Trackers

We use cookies and trackers on our web portals, as well as trackers and identifiers within our mobile applications, in order to: maintain secure sessions; remember User preferences; measure audience and performance (e.g. Google Analytics, Hotjar); and deliver marketing campaigns (e.g. Meta Pixel, LinkedIn Tag). The rules applicable to web portal cookies and mobile app trackers are set out in separate information notices adapted to each environment.

Cookies that are not strictly necessary are only placed after the User’s consent has been obtained, in accordance with CNIL requirements. The User may adjust their choices at any time via the preference manager available on everyblu.com.

7. Recipients and Disclosure of Data

We do not sell personal data. Data may be disclosed, to the extent necessary, to:

  • Our hosting and infrastructure partners;
  • Our authorised service providers and processors;
  • The payment service provider (Lemonway), which acts as data controller for KYC/KYB and AML/CFT checks;
  • The Marinas, Suppliers or Technicians concerned by a request or booking;
  • Legal or regulatory authorities where required by law.

All these partners are contractually bound to confidentiality and to compliance with GDPR requirements. Processors act on everyblu’s documented instructions under a contract compliant with Article 28 GDPR. Users who access another User’s data in the context of a Service (for example, a Marina, Supplier or Technician handling an Owner’s booking) undertake to keep such data secure and to use it solely for the purposes of that Service.

7.1. Direct marketing and customer data platform (CDP)

everyblu may carry out direct marketing operations and operate a customer data platform (CDP). The applicable rules differ depending on whether the target is a business or an individual: electronic marketing aimed at an individual in principle requires their prior consent, whereas business-to-business marketing may be based on legitimate interest, subject to information being provided and a right to object. In all cases, data subjects are informed and may object at any time to receiving solicitations.

When a Service Provider imports a customer list or activates the CDP, it warrants that it has a legal basis and has informed the data subjects; everyblu then acts, for this processing, on its instructions. everyblu does not directly contact a Service Provider’s customers for its own purposes, nor cross-reference such data with its own database, without an appropriate legal basis and without informing the data subjects.

8. International Data Transfers

Where data are processed outside the European Union or the European Economic Area, we only use providers offering a level of protection compliant with the GDPR and we govern such transfers by the European Commission’s standard contractual clauses (SCCs) or any other appropriate mechanism. Data centres are located in secure and regulated regions.

9. Retention Periods

Data are retained for the period strictly necessary for the purposes pursued:

  • Account data: for the duration of active use, then twelve (12) months after deletion of the Account;
  • Accounting and payment records: ten (10) years, in accordance with accounting and tax obligations;
  • Cookies and analytics: according to the consent obtained and browser settings;
  • Proof of consent (app permissions): stored securely with the timestamp of acceptance or withdrawal.
  • At the end of these periods, data are deleted or anonymised, subject to retention periods imposed by law or necessary for the establishment, exercise or defence of legal claims.

10. Data Subject Rights

In accordance with the GDPR and the French Data Protection Act, the User has the following rights:

  • Right of access to their data;
  • Right to rectification of inaccurate information;
  • Right to erasure (“right to be forgotten”);
  • Right to restriction of and right to object to processing;
  • Right to data portability;
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing;
  • Right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL) or the competent supervisory authority.

These rights may be exercised by writing to info@everyblu.com. We may need to verify the identity of the requester. A response is provided within the time limits laid down by the GDPR (in principle one (1) month, extendable by two (2) months depending on complexity). The User may also set out instructions regarding what happens to their data after their death.

11. Security Measures

We implement appropriate technical and organisational measures to protect data, including: encryption of data in transit (TLS/SSL); strong authentication and role-based access management; regular backups and secure server infrastructure; periodic penetration tests and code reviews. In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, everyblu makes the notifications required by Articles 33 and 34 GDPR.

12. Minors’ Data

Access to the Platform and use of the Services are reserved for persons aged at least eighteen (18) years, in accordance with the Terms of Use. In any event, we do not knowingly collect data relating to a minor without the verifiable consent of the holder of parental authority, the age of digital consent being set at fifteen (15) years in France. Any data collected by mistake will be deleted as soon as possible after being reported to info@everyblu.com.

13. Changes to this Policy

We may amend this Policy to reflect technical, regulatory or commercial developments. Material changes are brought to the User’s attention by notification on the Platform, by email or upon login. The “last updated” date is updated accordingly.

14. Contact

For any questions relating to this Policy or the exercise of your rights:

Email: info@everyblu.com

Address: SYNDICO SAS, 38B Boulevard Victor Hugo, 06000 Nice, France