Last updated: October 7, 2026
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Navalapp platform — including our websites, applications, courses, memberships, community features, and related services (collectively, the “Services”). It applies to members, visitors, and organizations who access or interact with the Services.
Short version:
- We process personal data to provide, secure, and improve the platform.
- We do not sell personal information as that term is commonly understood. Some limited data sharing for analytics or advertising may be deemed “sale” or “sharing” under certain laws — you can opt out.
- You control optional cookies and certain uses via Cookie Settings and applicable regional rights.
- Closing your Navalapp account ends your account access and entitlements, but does not automatically erase all historical personal information. Privacy and erasure rights can be exercised separately as described in this Policy.
Scope & Relationship to Other Terms
This Privacy Policy applies to the processing of personal information in connection with the Navalapp platform — including our websites, applications, courses, memberships, community features, and related services (collectively, the “Services”). It explains how Navalapp collects, uses, and protects personal information about members, visitors, and organizations who access or interact with the Services.
Member and organization content. Materials that members or organizations upload, submit, create, or store through the Services — such as assignments, projects, messages, designs, course files, images, documents, or other learning and community content — may contain personal information. Navalapp may process and, where reasonably necessary, access such information to provide, administer, support, secure, and maintain the Services, including to operate courses and classrooms, review or assess submitted work, provide instructor feedback, respond to support requests, moderate community features, investigate misuse or security issues, comply with legal obligations, and maintain appropriate educational and business records.
We do not use such content for unrelated marketing, advertising, or other purposes unless that use has been clearly described in the applicable terms or notice, or you have otherwise provided any authorization or consent required by law. Where member materials are used for marketing, promotional, or educational purposes, we will remove or anonymize personal information where appropriate unless you have expressly agreed to be identified.
Retention of member content and learning records. Closing a Navalapp account does not automatically delete all learning records, messages, submissions, assignments, uploaded materials, or other information associated with that account. Navalapp may retain such information for as long as reasonably necessary for purposes such as course administration, assessment integrity, completion or certificate evidence, support, dispute resolution, security, fraud or abuse prevention, legal compliance, and legitimate record-keeping. When personal information is no longer reasonably needed for those purposes, it may be deleted or anonymized in accordance with our retention procedures and applicable law.
Public and community areas. The platform may include optional public or community features where members can choose to share information visible to others. You should avoid posting personal or confidential information in public areas. Public posts are governed by our Platform Terms and Acceptable Use Policy in addition to this Privacy Policy. Historical community contributions and conversations may remain where necessary to preserve discussions and other users’ records. Where reasonably practicable, Navalapp may suppress or replace the visible profile identity of a former member without deleting the underlying historical record.
Account closure and privacy rights. Closing your Navalapp account is an account-access action and does not by itself constitute a request to erase all personal information. Certain historical information may continue to be retained as described in this Privacy Policy and as permitted or required by applicable law. You may separately exercise applicable privacy rights, including a right to request deletion where available, as described under Your Rights & Choices.
Third-party products and content. Our Services may include or link to third-party products, services, or content that operate under their own privacy policies (including third-party sellers used for fulfilment when you initiate a request). Navalapp is not responsible for the privacy practices of such independent third parties, and we encourage you to review their privacy notices before providing personal information.
If you do not agree with this Privacy Policy, please do not access or use the Services.
Who We Are (Controller Information)
Controller:
Blueheading Oy (doing business as “Navalapp”)
Address: Svinhufvudintie 2 D 30, 00570 Helsinki, Finland
Email: privacy@navalapp.com
Supervisory Authority (EU):
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, Finland; tel. +358 29 566 6700; email: tietosuoja@om.fi.
If you interact with the Services on behalf of an organization, your personal information may also be subject to that organization’s privacy practices.
Organizational or Sponsored Accounts
Organizations (for example, maritime companies, training institutions, or other entities) may sponsor or manage access to the platform. Each participant typically creates an individual account and agrees to this Privacy Policy.
- Navalapp as controller: We are the controller for personal information processed within the platform (e.g., account data, participation records, communications).
- Organization as independent controller: The sponsoring organization may process personal information for its own purposes (e.g., eligibility, HR records, compliance) as an independent controller.
- Navalapp as processor (limited cases): Where an organization provides personal information to set up or assign accounts, we process that data on the organization’s documented instructions under a separate data processing agreement, where applicable.
Personal Information We Collect
Information You Provide
For example, when you create or manage an account; purchase courses, memberships, or merchandise; register for events; participate in community features; communicate with us; or complete forms, questionnaires, or support tickets. Categories may include:
- Identifiers and contact details (e.g., name, email, postal address, phone number)
- Payment and billing information
- Organization or institution details
- Verification documents where needed (e.g., eligibility for offers and/or memberships)
- Communications, feedback, and support content
- Profile information (e.g., photo, display name) and optional media (e.g., event recordings)
- Learning and participation information (e.g., course enrolments, lesson and course progress, quiz and assessment results, assignments or project submissions, instructor feedback, grading records, completion information, certificates, learning activity, and classroom or group participation)
- Community and messaging information (e.g., posts, comments, group activity, private messages, notifications, and other interactions within community features)
- Tax/billing identifiers where required (e.g., VAT number)
Information Collected Automatically
When you use the platform, we may automatically collect information such as:
- IP address, device and browser information, operating system, language
- Usage, activity, and diagnostic data (e.g., pages viewed, features used, course or platform activity timestamps, login and security events, time and date, and error logs)
- Cookie identifiers and similar technologies
- Approximate location derived from IP address
Information from Other Sources
We may receive information from service providers and partners (e.g., payment processors, communications platforms, analytics/measurement providers), publicly available sources, social networks, or business partners, and combine it with information we collect directly to maintain accurate records and improve the platform.
Eligibility Verification
When you apply for eligibility-based programs, we process the information and supporting documents you provide to verify eligibility and administer the related benefit or program.
- Legal basis: Depending on the circumstances, processing may be based on performance of a contract or steps taken at your request, legitimate interests, compliance with legal obligations, and/or consent where required by applicable law.
- Retention: Supporting documents are retained only for as long as reasonably necessary to verify eligibility, resolve related questions or disputes, prevent abuse, and comply with applicable obligations. Where reasonably practicable, the supporting document itself is deleted when it is no longer needed. Navalapp may retain a limited record of the verification outcome, date, status, and related account reference for audit, fraud-prevention, support, and compliance purposes.
- Recipients: Verification service providers or other parties involved in administering the relevant eligibility program, where applicable.
How We Use Personal Information
- Provide and operate the platform, including account management, memberships, purchases, and support.
- Administer learning and educational activities, including course enrolments, progress tracking, assessments, assignments, grading, instructor feedback, course completion, certificates, classrooms, groups, and related learning records.
- Maintain, protect, and improve the platform, including diagnostics, security, and feature development.
- Personalize content, recommendations, and experiences (where permitted).
- Communicate with you (e.g., transactional messages, updates, responses to inquiries).
- Marketing with consent where required (e.g., newsletters, promotions); you can opt out at any time.
- Fraud prevention & security, and to protect the rights, property, and safety of members and the public.
- Maintain appropriate historical and administrative records, including information reasonably needed to document purchases, memberships, enrolments, course completion, certificates, support matters, disputes, account closure, and privacy requests.
- Compliance with legal, accounting, and tax obligations.
- Software licenses (Membership Benefit). If you request a software license (e.g., a Maxsurf Academic License), we use the details you provide to verify eligibility and to provision your access and entitlements through the relevant software provider’s licensing system.
- Book requests (Membership Benefit). If you request a member book purchase, we use the details you provide to process your request, generate a reference code, and facilitate fulfillment with the relevant book seller.
Future features and innovation. As the platform evolves, we may introduce new tools or features that involve processing personal information. Where required, we will update this Policy and/or request consent.
Legal Bases for Processing (GDPR)
We process personal information only where we have a lawful basis under applicable law, including:
- Contract: To create and administer your account and provide the Services you request, including courses, enrolments, memberships, purchases, assessments, certificates, support, and benefits or requests you initiate.
- Legitimate interests: Where appropriate, to maintain and secure the platform, prevent fraud or abuse, provide support, resolve disputes, maintain appropriate historical or educational records, improve the Services, and protect Navalapp, our members, and others — balanced against your rights and interests.
- Consent: For activities where consent is required, such as certain marketing communications, non-essential cookies, advertising personalization, or other optional processing. You may withdraw consent at any time.
- Legal obligations: To comply with applicable accounting, tax, regulatory, reporting, privacy, and other legal requirements.
International Data Transfers
We are based in Finland and may process or store personal information in countries where we or our providers operate, including within the EEA, the United Kingdom, and the United States. Where personal information is transferred internationally, we implement appropriate safeguards as required by law (e.g., adequacy decisions, Standard Contractual Clauses, or equivalent frameworks). Copies of these safeguards are available upon request where required.
How We Secure Information
We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption in transit and at rest where appropriate, monitoring, and staff training. We may request proof of identity before disclosing information. If a data breach occurs, we will notify affected individuals and authorities as required by law.
Data Retention
General principle. We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or subsequently processed, including to provide the Services, maintain appropriate records, protect the security and integrity of Navalapp, resolve disputes, and comply with applicable legal, accounting, tax, regulatory, and reporting obligations. Retention periods vary depending on the type of information, the purpose for which it is processed, and applicable requirements. When personal information is no longer reasonably needed for those purposes, we take reasonable steps to delete or anonymize it in accordance with our retention procedures and applicable law.
Closed accounts. Closing a Navalapp account permanently ends access to that account and its account-linked entitlements, but it does not automatically erase all personal information associated with the account. Credentials and account access are invalidated as part of the closure process, while certain historical records may continue to be retained for the purposes described in this Policy. Account closure is separate from exercising a privacy right to erasure.
Financial, accounting, and transaction records. We may retain orders, invoices, payment and subscription records, VAT or tax information, billing information, refund or chargeback records, and related transaction information for as long as required or reasonably necessary for accounting, tax, regulatory, fraud-prevention, dispute-resolution, transaction-reconciliation, and legal purposes. These records may continue to contain identifying information after an account has been closed. Retaining them does not preserve or restore account access, memberships, purchases, or other entitlements.
Learning, completion, and certificate records. We may retain historical information relating to course enrolment, completion, relevant final results, certificates, membership or entitlement history, and related educational records where reasonably necessary for course administration, assessment integrity, certificate or completion evidence, support, dispute resolution, security, fraud or abuse prevention, or legitimate record-keeping. Closing an account ends the former member’s access to those records through Navalapp but does not automatically delete them.
More detailed learning information — such as lesson progress, quiz attempts and answers, assignments, projects, resubmissions, instructor feedback, grading information, and activity history — may also be retained for a reasonable period where needed for educational administration, assessment, support, disputes, security, or record-keeping. Such information may be deleted or anonymized when it is no longer reasonably needed for those purposes.
Community content and messages. Historical community contributions, discussions, and messages may remain after account closure where necessary to preserve conversations, community records, or the records and experience of other participants. Where reasonably practicable, Navalapp may suppress or replace the visible profile identity of a former member without deleting the underlying historical record. Closing an account does not necessarily remove copies of messages or content available to other participants.
Eligibility and verification records. Supporting documents used to establish eligibility for student or other restricted programs are retained only for as long as reasonably necessary to verify eligibility, resolve related questions or disputes, prevent abuse, and comply with applicable obligations. Where reasonably practicable, supporting documents are deleted when no longer needed. Navalapp may retain limited records of the verification outcome, date, status, and related account reference for audit, fraud-prevention, support, and compliance purposes.
Support, feedback, and service requests. Support correspondence, feedback, software-license requests, book requests, and similar service communications may be retained for as long as reasonably necessary to administer the request or service, provide support, resolve disputes, prevent fraud or abuse, maintain appropriate audit records, and comply with applicable obligations. Detailed information such as delivery addresses or telephone numbers is retained only for as long as reasonably necessary for the relevant purpose, subject to applicable legal or operational retention requirements.
Marketing preferences and communications. When an account is closed, Navalapp will stop account-related marketing communications under its control. We may retain limited records of consent, unsubscribe requests, suppression status, or communication preferences where reasonably necessary to respect your choices and demonstrate compliance. Account closure does not itself constitute a request to erase all historical analytics or advertising records held by Navalapp or independent providers.
Security, diagnostic, and audit records. Technical, security, diagnostic, audit, and fraud-prevention information may be retained for a limited period where reasonably necessary to protect Navalapp and our members, investigate incidents, prevent abuse, troubleshoot technical problems, maintain system integrity, or comply with applicable obligations.
Backups and archived copies. Personal information may remain temporarily in protected backups, archives, cloud-storage versions, or disaster-recovery systems until those copies are overwritten, expire, or are deleted according to our normal retention procedures. Such copies are protected and are not intended to be restored to ordinary active use except where necessary for legitimate backup or disaster-recovery purposes. Where data is restored, we take reasonable steps to preserve or reapply relevant account-closure, suppression, deletion, or privacy-request outcomes.
Dormant accounts. As described in our Platform Terms, Navalapp may close accounts that have remained inactive for an extended period where no material commercial, educational, community, or other ongoing relationship remains. Inactivity alone does not mean that all historical records associated with the account are automatically deleted. Information associated with a dormant account remains subject to the retention principles described in this Policy.
Third-party records. Information previously provided to independent payment processors, software providers, book sellers, fulfilment partners, communications providers, or other independent third parties may remain subject to their own privacy policies, legal obligations, and retention practices.
Software-license requests. We may retain limited records of software-license requests, such as the provider, request status, relevant timestamps, and other information reasonably needed for support, audit, dispute resolution, or compliance.
Book requests. We may retain limited records of book or fulfilment requests, such as reference codes, seller, items requested, relevant timestamps, and status, for support, dispute handling, fraud prevention, and legal or accounting purposes. Where reasonably practicable, detailed delivery address and telephone information is retained only for as long as needed for fulfilment and related support or compliance purposes.
Automated Decision-Making & Profiling
We do not make decisions with legal or similarly significant effects solely by automated means. We may use limited profiling (for example, recommendations or audience segmentation) to personalize experiences. You can object to profiling for direct marketing at any time.
Children’s Personal Information
The Services are not directed to children under the age of 18. If you are under 18, you may use our Services only with the involvement and consent of a parent or guardian. If we learn that we have collected personal information from a minor without appropriate consent, we will promptly delete or anonymize such information and, where applicable, disable the related account.
Your Rights & Choices
Depending on your location, you may have rights under applicable law, which can include:
- Accessing and obtaining a copy of your personal information
- Requesting correction or deletion
- Objecting to or restricting certain processing
- Data portability (receiving certain information in a structured, commonly used, machine-readable format)
- Withdrawing consent (where processing is based on consent)
- Opting out of targeted advertising or certain “sale/sharing” of personal information (where applicable)
- Managing cookies via Cookie Settings and supported browser signals
- Non-discrimination for exercising your rights
You can view, update, or delete certain information in your account. If you cannot access specific data or wish to exercise your rights, contact us at privacy@navalapp.com. We will not discriminate against you for exercising your rights.
Account closure and privacy requests. Closing your Navalapp account and exercising a privacy right to erasure are separate actions. Closing an account permanently ends account access and account-linked entitlements, but some personal information may continue to be retained where permitted or required by applicable law and for the purposes described in this Policy.
A former member may continue to exercise applicable privacy rights after account closure by contacting us at privacy@navalapp.com. Where necessary, Navalapp may use legitimately retained historical information, such as account, transaction, membership, or other records, to locate the relevant historical account and verify the requester’s identity. Retaining such information for this purpose does not make the closed account recoverable or restore any previous access or entitlements.
A request for deletion or erasure will be assessed in accordance with applicable law. Some information may need to be retained where an applicable legal obligation, legal claim, security requirement, or other lawful basis permits or requires continued processing.
Regional Disclosures
(a) European Economic Area / United Kingdom
Individuals in the EEA/UK have rights under GDPR/UK GDPR, including to lodge a complaint with a supervisory authority. Our lead EU authority is listed in Who We Are.
(b) United States (e.g., California, Colorado, Connecticut, Utah, Virginia)
Residents of certain U.S. states may have rights to access, delete, correct, opt out of targeted advertising or certain sharing, and to limit the use of sensitive personal information (where applicable). We do not sell personal information in the traditional sense. Some limited data sharing for analytics/advertising may be deemed a “sale” or “sharing” under specific state laws. You can opt out via Cookie Settings or by using a supported browser signal (e.g., Global Privacy Control) where required by law.
(c) Canada & Quebec (Law 25)
We comply with applicable Canadian privacy laws. We may transfer personal information outside Canada when necessary to provide the Services and will implement appropriate safeguards. Consent is obtained in a clear and understandable manner and can be withdrawn at any time.
Other Regional Privacy Laws
Navalapp complies with applicable data-protection laws in the regions where we operate or have users, including the United Kingdom (UK GDPR and PECR), Brazil (Lei Geral de Proteção de Dados – LGPD), Canada (PIPEDA and Quebec Law 25), and South Africa (POPIA). Residents of these regions may exercise their local privacy rights — such as access, correction, deletion, or withdrawal of consent — by contacting us at privacy@navalapp.com. Requests will be handled in accordance with applicable law.
Changes to This Policy
Our platform evolves, and we may update this Privacy Policy from time to time. We will not make material changes that reduce your rights without providing notice and, where required, obtaining your consent. The “Last updated” date at the top indicates the effective date of the current version.
Contact Us
If you have questions or concerns about privacy, please contact us:
- Email: privacy@navalapp.com
- Postal address: Navalapp, Svinhufvudintie 2 D 30, 00570 Helsinki, Finland
- Supervisory authority (EU): Office of the Data Protection Ombudsman, Helsinki – tietosuoja@om.fi