Privacy notice
Version 1.0, 2 October 2026. On this site "the yard" means Fjordane Yard AS.
Who we are
DSCSS is operated by West Maritime AS, org. no. 976 197 895, Rådhusgata 18, 6090 Fosnavåg, Norway. Contact: support@west-maritime.no.
Two roles
For the tender data in DSCSS (specifications, requirements, answers, documents, messages, rulings) the yard that invited you decides what is collected and why. The yard is the controller and West Maritime processes the data on the yard's behalf, under a written agreement. For your user account itself (name, work email, sign in records) West Maritime is the controller.
What we store about you
- Name, work email, your role and organisation, as entered by the person who invited you.
- A hash of your password (never the password itself) and the time it was set.
- Sign in records: time, IP address, browser type, and failed attempts.
- What you do in DSCSS: an audit log with your name, the action and the time. This is part of the tender record and cannot be edited.
- What you write and upload: messages, comments, answers, documents.
- Emails we send you: invitation, sign in and password links, and notifications about the tenders you are part of. We log that a mail was sent, not its content beyond the subject.
Why
To run the tender you were invited to, to keep a complete and unchangeable record of it, to keep the system secure, and to meet legal duties. The legal basis is the agreement with the yard and our legitimate interest in security and record keeping (GDPR article 6(1)(b) and (f)). We do not use your data for marketing and we do not sell it.
Where
The application and its data run on Railway in Amsterdam, Netherlands. Backups are stored with Railway in the Netherlands. Emails are sent through Resend from Ireland. Everything stays in the EU/EEA. We do not transfer your data outside the EU/EEA.
Who sees it
The people the yard invited to the same tender, according to their role. Suppliers see only the tenders they answer and never each other's data. West Maritime's operator sees the administration pages, system health and mail logs, and can open tender data only for support when the yard asks; every such access is written to the audit log with the operator's name.
How long
Tender data: as long as the yard keeps the project in DSCSS; the yard decides when it is archived or deleted. Backups: 30 days, then deleted automatically. Sign in records: 12 months. Audit log: with the tender record. When your account is retired, your name stays in the record of what you did, because that record is the point of the system; the rest of your account data is removed within 30 days.
Cookies
One cookie, for your session. It is required for the site to work and holds no tracking. No analytics, no advertising, no third party cookies, so no cookie banner.
Your rights
You can ask to see the data we hold about you, to correct it, to delete it where the law allows, to restrict or object to processing, and to receive your data in a usable format. Write to support@west-maritime.no. For tender data the request goes to the yard, which decides; we help them answer. You can complain to Datatilsynet (the Norwegian Data Protection Authority), datatilsynet.no.
Security
Encrypted connections, passwords stored with scrypt, sessions that end after 8 hours without activity, rate limits and lockout on sign in, nightly backups, access by invitation only. If a breach affects your data we tell the yard within 72 hours and you as the law requires.
Changes
The version and date stand at the top. When this notice changes you see it once at your next sign in.