PRIVACY POLICY

OF THE NAVLITE MOBILE APPLICATION
Application published by GLOBAL SAR HUB
Simplified joint-stock company (SAS) with share capital of EUR 100
Registered office: 60 rue François 1er, 75008 Paris, France
Paris Trade and Companies Register No. 928 618 776
Version 1.0
Effective date: 1 July 2026
Date of last update: 1 July 2026

ARTICLE 1 – PREAMBLE

The purpose of this Privacy Policy (hereinafter the “Policy”) is to inform the user of the NAVLITE mobile application (hereinafter the “User” and the “Application”), in a clear, complete and transparent manner, in accordance with Articles 12 to 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “GDPR”) and French Act No. 78-17 of 6 January 1978, as amended, on data processing, files and individual liberties, of the conditions under which their personal data is processed by GLOBAL SAR HUB.

NAVLITE is a mobile application providing navigation assistance for coastal recreational boating, available on the iOS and Android operating systems. The Application is offered free of charge, its funding being ensured by the display of advertising, and offers paid ad-free options. The Application constitutes a mere navigation aid and does not replace regulatory navigation means.

This Policy forms an integral part of the Terms of Use and Sale of the Application and is expressly appended thereto by reference. Any term not defined in this Policy retains the meaning given to it in the Terms of Use and Sale.

ARTICLE 2 – IDENTITY OF THE DATA CONTROLLER

The controller of the personal data collected and processed within the framework of the Application is:

Corporate name: GLOBAL SAR HUB.

Form: simplified joint-stock company (société par actions simplifiée) with share capital of EUR 100.

Registered office: 60 rue François 1er, 75008 Paris, France.

Registration: Paris Trade and Companies Register No. 928 618 776 – SIRET No. 928 618 776 00019.

Legal representative: Ms Sarah LE COQ ZARANTONELLO, President.

Dedicated contact address: contact@globalsarhub.com.

GLOBAL SAR HUB is not required, in light of the criteria laid down in Article 37 of the GDPR, to appoint a data protection officer. Any request or complaint relating to the protection of personal data may be addressed to the dedicated contact point referred to above.

ARTICLE 3 – GUIDING PRINCIPLES

The processing of personal data carried out within the framework of the Application is based on the following guiding principles:

3.1. Minimisation. Only the data strictly necessary to provide the features is processed, in accordance with Article 5(1)(c) of the GDPR.

3.2. Local processing and non-retention by the Publisher. The Publisher has made the architectural choice not to retain, in its own databases, either the User’s navigation data or their geographical position. The bulk of the data processed by the Application remains stored exclusively and locally on the User’s device. The data necessary for support functions (advertising, subscription management, audience measurement) is, depending on the feature concerned, processed by specifically identified third parties without retention by the Publisher in its databases.

3.3. No account creation. In its current version, use of the Application does not require the creation of any user account with the Publisher. Any identification of the User for the purpose of managing the Paid Plans is carried out exclusively by the Stores and their technical service provider by means of pseudonymous identifiers.

3.4. Transparency. The User is informed, in clear and accessible terms, of the nature, purpose and arrangements of each processing operation.

3.5. Security. The Publisher implements appropriate technical and organisational measures to ensure the security of processing.

ARTICLE 4 – DATA PROCESSED, PURPOSES AND ARRANGEMENTS

The Publisher sets out below, by category of processing, the nature of the data processed, the purpose pursued, the place of storage and the treatment of the data.

4.1 Geolocation data (GNSS)

Subject to the prior authorisation granted by the User by means of their device’s system dialog box, the Application accesses the geolocation data provided by the GNSS chip (GPS, GALILEO, GLONASS or equivalent) integrated into the device.

This data is processed locally on the device for the sole purposes of:

(i) displaying in real time the position of the vessel on the chart;

(ii) calculating heading, speed and the course vector, and powering the tracking mode;

(iii) ensuring the operation of the anchor alarm, including in the background and with the phone locked;

(iv) ensuring the operation of the Man Overboard Mode, by locally recording a position at the time of its activation;

(v) allowing the User to share their position at their sole initiative.

Geolocation data is processed exclusively and locally on the User’s device. It is at no time transmitted to the Publisher, to its servers or to any third party, subject to the sharing voluntarily carried out by the User under the conditions of Article 4.8. Background location is used only when an anchor alarm is active. The User may revoke at any time, from their device settings, the geolocation access authorisation, it being specified that such revocation will render certain features inoperative.

4.2 Local navigation data

The Application allows the User to create and save routes, waypoints, tracks, points of interest (POIs), to download offline map areas and to save their settings and display language. This data is stored exclusively and locally on the User’s device, within an embedded database (Hive technology). It is at no time transmitted to the Publisher, to its servers or to any third party.

Deletion of the Application results in the definitive and irreversible erasure of this data. The User acknowledges that they will not be able to claim its restoration.

4.3 Advertising data (Google AdMob)

In the free version, the Application displays advertising banners and formats operated by the Google AdMob advertising network (Google LLC). On this basis, advertising identifiers (IDFA on iOS, Advertising ID on Android), device-related data and consent signals may be processed, under the conditions referred to in Articles 10 and 11.

Where the User resides in the European Economic Area or the United Kingdom, these trackers are only placed or read after their consent has been collected through the consent management platform (CMP) based on Google User Messaging Platform (UMP). On iOS devices, advertising tracking is further subject to the User’s prior authorisation by means of the App Tracking Transparency (ATT) framework. Depending on the consent and authorisations granted, the advertising displayed is personalised or non-personalised. The processing of advertising data is governed by Google’s privacy policy, accessible at https://policies.google.com/privacy.

Subscription to a Paid Plan results in the removal of advertising and, consequently, of the associated advertising trackers.

4.4 Subscription management data (RevenueCat)

The technical management of the status of the Paid Plans is ensured by the RevenueCat platform (RevenueCat, Inc.). For this purpose, a pseudonymous technical identifier (anonymous “app user ID”) generated by the Application, the subscription or purchase status, as well as the transaction identifiers issued by the Stores are processed. These identifiers do not enable the Publisher to directly identify the User.

The Publisher does not access any banking or payment data of the User, all payment operations being managed exclusively by Apple Inc. and Google LLC within the framework of their respective Stores.

4.5 Audience measurement and stability (Google Firebase Analytics and Crashlytics)

The Application uses the Google Firebase Analytics and Firebase Crashlytics tools (Google LLC) in order to produce aggregated usage statistics, record usage events, collect crash reports and ensure the diagnosis of the Application’s stability. For this purpose, technical identifiers, device-related data (model, operating system version, Application version) and usage events are processed.

Audience measurement is subject to the User’s consent. Stability diagnosis (crash reports) is based on the legitimate interest of the Publisher in ensuring the proper functioning of the Application, depending on the User’s settings and consent.

4.6 Push notifications

Where the User consents to receiving notifications, the Application processes a notification token (push token) issued by the Apple Push Notification Service (Apple Inc.) or by Firebase Cloud Messaging (Google LLC), for the sole purpose of routing notifications to the device.

4.7 Third-party base mapping and tile requests

The display of online base maps requires the loading of map tiles directly from third-party providers: the vector base map served by OpenFreeMap (from OpenStreetMap data), the OpenSeaMap maritime overlay and the Sentinel-2 cloudless satellite imagery served by EOX IT Services GmbH. The Publisher operates no map tile server; in offline mode, tiles are rendered from the device’s local cache. During these requests addressed to the third-party providers, technical logs (IP address, date and time, requests made) may be processed by those providers, in their capacity as autonomous data controllers, for the purposes of operation, security and prevention of abuse, in accordance with their respective privacy policies.

4.8 Position sharing

The Application allows the User, at their sole initiative, to share their position. Activation of this feature generates a map link transmitted by means of the operating system’s native share sheet. The Publisher does not receive the content of this share and retains no record of it. The recipient chosen by the User and the third-party application used for the sharing determine the subsequent treatment of the information transmitted.

4.9 Technical data and identifiers

The Application processes the following technical data:

(i) a technical installation identifier, generated locally, enabling the provision of the features;

(ii) information relating to the device (model, operating system version, language settings);

(iii) a push notification token (push token) issued by the Apple Push Notification Service (Apple Inc.) or Firebase Cloud Messaging (Google LLC) where the User consents to receiving notifications;

(iv) a pseudonymous identifier (“anonymous identifier”) generated by the RevenueCat platform for the purpose of managing subscription status, which does not enable the Publisher to directly identify the User.

ARTICLE 5 – LEGAL BASES FOR PROCESSING

In accordance with Article 6 of the GDPR, the legal bases on which each processing operation relies are as follows:

ARTICLE 6 – RECIPIENTS OF THE DATA

The recipients of the personal data processed within the framework of the Application are strictly the following:

6.1. The Publisher and its authorised personnel, within the limits of their respective duties and exclusively for operational, security and support purposes.

6.2. The Publisher’s technical processors, acting on its behalf and in accordance with Article 28 of the GDPR, under the conditions specified in Article 7 below.

6.3. Third parties acting as autonomous data controllers (in particular Apple, Google and the base mapping providers), for their own purposes, under the conditions specified in Article 7 below.

6.4. The recipient(s) chosen by the User when they implement, at their sole initiative, the position sharing feature.

6.5. The competent administrative or judicial authorities, by reason of a legal obligation, a court decision or a lawful requisition.

Personal data is neither sold, rented nor transferred to third parties for commercial prospecting purposes, in any form whatsoever.

ARTICLE 7 – PROCESSORS AND THIRD-PARTY DATA CONTROLLERS

The scope of intervention of technical third parties varies according to the operations concerned. In accordance with the doctrine of the European Data Protection Board (Guidelines 07/2020 on the concepts of controller and processor), a distinction must be drawn between processors acting on behalf of the Publisher on documented instructions, and third parties acting as autonomous data controllers for their own purposes.

7.1 Processors within the meaning of Article 28 of the GDPR

The following technical third parties act on behalf of the Publisher, on documented instructions and under an obligation of confidentiality and security:

7.2 Third parties acting as autonomous data controllers

The following technical third parties process personal data as autonomous data controllers for their own purposes, which are defined in their respective privacy policies. The Publisher exercises no control over this processing and does not assume the status of joint controller:

Each third party implements security measures consistent with the state of the art and publishes its own privacy policy, accessible from its respective website. The User is invited to consult them for the processing operations for which such third parties act as autonomous data controllers.

ARTICLE 8 – RETENTION PERIODS

The retention periods for personal data are set as follows:

8.1. Local navigation data (routes, waypoints, tracks, POIs, offline areas, settings, language) and any other data entered into the Application: stored exclusively on the User’s device, until uninstallation of the Application or reset at the User’s initiative.

8.2. Geolocation data: processed locally on the device, neither transmitted nor retained by the Publisher.

8.3. Advertising data processed by Google AdMob: in accordance with Google’s retention policy.

8.4. RevenueCat pseudonymous identifiers and subscription status: for the duration of the subscription cycle and in accordance with RevenueCat’s retention policy.

8.5. Audience measurement and stability data (Firebase): in accordance with Google’s retention policy, crash reports being retained for the period necessary for diagnosis.

8.6. Push notification tokens: for the duration of actual use of the Application and for as long as the User has not revoked their consent.

8.7. Technical request logs processed by the third-party map tile providers (OpenFreeMap, OpenSeaMap, EOX): in accordance with each such provider’s own retention policy, the Publisher operating no tile server and retaining no logs of this nature.

8.8. Data retained as evidence of consent to trackers: six (6) months from its collection, in accordance with the recommendation of the French Data Protection Authority (CNIL).

8.9. Data retained for the purpose of legal defence: duration of the applicable statutory limitation period.

ARTICLE 9 – TRANSFERS OUTSIDE THE EUROPEAN UNION

Certain processing operations involve a transfer of personal data outside the European Union and the European Economic Area, in particular to the United States of America as a result of the use of Apple Inc., Google LLC (AdMob, Firebase, FCM) and RevenueCat, Inc. As the map tile providers (OpenFreeMap, OpenSeaMap, EOX) are established in the European Union, the map data gives rise to no transfer outside the European Union.

These transfers are governed in accordance with Chapter V of the GDPR, by the cumulative or alternative implementation of the following safeguards:

(i) an adequacy decision of the European Commission (in particular the EU-United States adequacy decision of 10 July 2023 relating to the Data Privacy Framework), for adhering organisations and for as long as that decision remains in force;

(ii) the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021;

(iii) the implementation of appropriate supplementary technical and organisational measures.

The User may obtain, upon written request sent to contact@globalsarhub.com, further information on the safeguards in force as well as a copy of the applicable standard contractual clauses.

ARTICLE 10 – TRACKERS, COOKIES AND CONSENT MANAGEMENT

10.1. In accordance with Article 82 of French Act No. 78-17 of 6 January 1978, as amended, and the guidelines of the French Data Protection Authority (CNIL) of 17 September 2020, the Application presents to the User residing in the European Economic Area or the United Kingdom, upon first opening and upon any substantial modification, a consent management platform (CMP), based on Google User Messaging Platform (UMP), enabling the free, informed, specific and unambiguous collection of their consent to the placing and reading of advertising and, where applicable, audience measurement trackers.

10.2. The User may accept, refuse or customise their choices. Refusal is as simple and accessible as acceptance. The trackers strictly necessary for the operation of the Application are not subject to prior consent.

10.3. The User may change their choices at any time from the Application’s settings menu.

10.4. The trackers liable to be placed for advertising purposes mainly emanate from the Google AdMob advertising network (Google LLC). The details of the categories, purposes and lifespans are set out in the CMP interface and in Google’s privacy policy.

ARTICLE 11 – APPLE APP TRACKING TRANSPARENCY (iOS)

On devices running the iOS operating system, the Application implements, in accordance with Apple Inc.’s requirements, the App Tracking Transparency framework. A system dialog box is presented to the User asking them to authorise or refuse tracking by the Application by means of the IDFA advertising identifier.

The User’s refusal affects neither access to the Application nor access to the free features. Its sole consequence is to prevent the IDFA identifier from being made available to the advertising network, which may then display non-personalised advertising.

ARTICLE 12 – RIGHTS OF THE DATA SUBJECT

In accordance with Articles 12 to 22 of the GDPR, the User has, at any time, the following rights over their personal data:

12.1. Right of access (Article 15 GDPR): to obtain confirmation that data concerning them is being processed and, where applicable, a copy of such data.

12.2. Right to rectification (Article 16 GDPR): to obtain the rectification of inaccurate or incomplete data.

12.3. Right to erasure (Article 17 GDPR): to obtain the erasure of data in the cases provided for by the GDPR.

12.4. Right to restriction of processing (Article 18 GDPR): to obtain the restriction of processing in the cases provided for by the GDPR.

12.5. Right to portability (Article 20 GDPR): to receive the data provided in a structured, commonly used and machine-readable format.

12.6. Right to object (Article 21 GDPR): to object, on grounds relating to their particular situation, to processing based on the legitimate interest of the Publisher.

12.7. Right to withdraw consent (Article 7(3) GDPR): to withdraw their consent at any time, without such withdrawal affecting the lawfulness of prior processing.

12.8. Right to define post-mortem directives (Article 85 of the Act of 6 January 1978, as amended): to organise the fate of data after death.

The User may exercise most of their rights directly by means of the tools made available to them: for geolocation and notifications, their device settings; for advertising and audience measurement, the consent management platform (CMP) and, on iOS, the App Tracking Transparency setting; for local navigation data, deletion from within the Application or its uninstallation. They may further exercise their rights electronically at the address contact@globalsarhub.com or by post to the address of the Publisher’s registered office. The Publisher undertakes to provide a response within a period of one (1) month from receipt of the request, which may be extended by two (2) months in the event of complexity or a large number of requests.

The User is informed that, as a result of the principle of local processing and non-retention, certain rights may become devoid of purpose vis-à-vis the Publisher. The rights relating to the data retained by the Stores, by RevenueCat, by the advertising network, by the audience measurement tools or by the base mapping providers must be exercised directly with the entities concerned.

The User further has the right to lodge a complaint with a supervisory authority, and in particular, for French residents, with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris cedex 07, website www.cnil.fr.

ARTICLE 13 – SECURITY OF PROCESSING

13.1. The Publisher implements appropriate technical and organisational measures, having regard to the nature, scope, context and purposes of the processing, to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.

13.2. These measures include in particular: the encryption of application flows (TLS), the design of the system around a principle of local processing and non-retention of navigation and position data by the Publisher, the restriction of access to authorised personnel, the traceability of sensitive operations, and the application of security updates published by the editors of third-party components.

13.3. In the event of a personal data breach likely to give rise to a risk to the rights and freedoms of natural persons, the Publisher notifies the competent supervisory authority within a period of seventy-two (72) hours and, where the risk is high, informs the data subjects, in accordance with Articles 33 and 34 of the GDPR.

ARTICLE 14 – AUTOMATED DECISION-MAKING AND PROFILING

In accordance with the information obligation provided for in Article 13(2)(f) of the GDPR and Article 22 of the same Regulation, the Publisher informs the User that the provision of the Application does not involve any decision based solely on automated processing, including profiling, producing legal effects concerning them or similarly significantly affecting them.

The processing operations carried out by the Application are based on deterministic rules (in particular position display, heading and speed calculation, anchor alarm, Man Overboard Mode) that do not carry out any evaluation of the User’s personal characteristics, any behavioural prediction or any segmentation for decision-making purposes.

The advertising processing operations carried out by third-party networks (in particular Google AdMob) may, where the User consents, involve advertising targeting. Such targeting does not produce legal effects or similarly significantly affect the User within the meaning of Article 22 of the GDPR. The User may object to it at any time via the consent management platform described in Article 10.

ARTICLE 15 – MINORS

15.1. The Application is rated for general audiences and does not specifically target minors; its content does not encourage any risky behaviour.

15.2. In accordance with Article 8 of the GDPR and Article 7-1 of French Act No. 78-17 of 6 January 1978, as amended, where processing is based on the consent of the data subject and that person is resident in France, such consent may validly be given as from the age of fifteen (15). Below this age, consent is given jointly by the minor and by the holder(s) of parental authority. In other Member States of the European Union, the age from which a minor may validly consent alone is that set by the national legislation, up to a maximum of sixteen (16).

15.3. The Publisher does not knowingly collect any personal data relating to a minor under the age of fifteen (15) without the prior consent of the holder(s) of parental authority. Subscription to a Paid Plan is subject to the prior authorisation of the legal representative for any User who has not reached the age of majority in their country of residence.

15.4. The holder(s) of parental authority of a minor who has used the Application may request, under the conditions of Article 12, the exercise of any GDPR right on behalf of that minor.

15.5. If the Publisher becomes aware that personal data relating to a minor has been processed in breach of these provisions, it will erase it without delay and take the appropriate technical and organisational measures to prevent the situation from recurring.

ARTICLE 16 – SPECIFIC PROVISIONS FOR RESIDENTS OF CERTAIN JURISDICTIONS

16.1. California residents (CCPA / CPRA). In accordance with the California Consumer Privacy Act as amended by the California Privacy Rights Act, Users residing in California have, subject to the conditions and exceptions provided for by law, the following rights: the right to know which categories of personal information are collected and their purposes; the right to access this information; the right to correct inaccurate information; the right to delete; the right to opt out of the “sale” or “sharing” of personal information; the right to limit the use of sensitive information; the right to non-discrimination when exercising these rights.

16.2. The Publisher does not sell personal information within the meaning of the CCPA for monetary consideration. Certain targeted advertising operations implemented by third-party networks may, however, constitute a “sharing” or a “sale” in the broad sense of the California regulations. A User residing in California may exercise their right to opt out (“Do Not Sell or Share My Personal Information”) by means of the advertising consent settings of the Application and of their device.

16.3. A User residing in California may exercise their rights or designate an authorised agent by writing to contact@globalsarhub.com. The Publisher shall not discriminate against a User who has exercised their rights.

16.4. Other jurisdictions. Users residing in other territories with data protection legislation may benefit from equivalent rights and exercise them with the Publisher or with the relevant third-party data controllers, under the conditions provided for by the law applicable to them.

ARTICLE 17 – MODIFICATIONS TO THIS POLICY

17.1. The Publisher reserves the right to modify this Policy at any time, in particular to take account of legislative, regulatory, case-law, technical or operational developments.

17.2. Any substantial modification is brought to the User’s attention by in-app notification and, where applicable, by the collection of a new consent where such collection is required.

17.3. The date of last update appearing at the head of this Policy evidences the applicable version. Earlier versions are retained by the Publisher for evidentiary purposes only.

ARTICLE 18 – CONTACT AND COMPLAINT

For any question relating to this Policy or to exercise the rights referred to in Article 12, the User may contact the Publisher:

By email: contact@globalsarhub.com.

By post: GLOBAL SAR HUB – NAVLITE Personal Data Compliance – 60 rue François 1er, 75008 Paris, France.

Failing a satisfactory response, the User may lodge a complaint with the competent supervisory authority, in particular the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris cedex 07, www.cnil.fr.

ARTICLE 19 – LEGAL NOTICE

In accordance with Article 6-III of French Act No. 2004-575 of 21 June 2004 on confidence in the digital economy:

Publisher: GLOBAL SAR HUB, SAS with share capital of EUR 100, Paris Trade and Companies Register No. 928 618 776, SIRET No. 928 618 776 00019, APE Code 6201Z, intra-Community VAT number FR 44 928 618 776, registered office 60 rue François 1er, 75008 Paris, France.

Publication director: Ms Sarah LE COQ ZARANTONELLO.

Contact: contact@globalsarhub.com.

Hosting of the Publisher’s website: LIGNE WEB SERVICES (LWS), SAS with share capital of EUR 500,000, Paris Trade and Companies Register No. B 851 993 683, SIRET No. 851 993 683 00024, APE Code 6311Z, intra-Community VAT FR 21 851 993 683, Paris establishment 10 rue Penthièvre, 75008 Paris, France.

Distribution: Apple Inc. (App Store) and Google LLC (Google Play).

© 2026 GLOBAL SAR HUB – All rights reserved.

NAVLITE is a trademark of GLOBAL SAR HUB.

Terms of Use and Sale  ·  Version française