Privacy policy

1. Data controller

CURSORIO, a French société par actions simplifiée à associé unique (SASU) with share capital of €1,000, registered with the RCS of Cannes under number 913 138 640 (SIREN), with registered office at 21 rue des Muriers, 06110 Le Cannet, France.

Legal representative: the President.
General contact: contact@cursorio.info
Data protection contact: jean.pousthomis@cursorio.com

2. Data collected and purposes

When you fill in a contact or beta access form, we collect the information you voluntarily provide:

• —Identity (first name, last name)
• —Contact details (email, phone)
• —Professional information (company, vessel, role)
• —Content of your message

This information is used exclusively to process your request, respond to it and, where applicable, send you a commercial proposal. It is never sold or shared with third parties without your explicit consent.

Providing the data marked as mandatory in the form is necessary to process your request. Failing this, we will not be able to respond.

2 bis. Recipients and sub-processors

Data collected via the forms is accessible only to authorised Cursorio personnel.

To operate the site and process your request, we rely on the following sub-processors:

• — Cloudflare, Inc. (United States) — hosting (Cloudflare Pages), anti-bot protection (Cloudflare Turnstile), content delivery network. See §7 on transfers.
• — Google LLC / Google Ireland Limited (EU / United States) — Google Workspace, Cursorio's professional email. Receives form submissions. Transfers governed by Standard Contractual Clauses and EU-U.S. Data Privacy Framework certification.

Cursorio does not sell or commercially transfer your data to any third party.

2 ter. Crew area (seafarer profiles)

If you create a seafarer profile in our crew area, we collect the data you voluntarily enter: identity (including date of birth and nationalities; sex and photo are optional), contact details, availability status and job-search preferences, professional sea service history, certificates and tickets, self-assessed skills, spoken languages, optional details (interests, visible tattoos, smoker status, salary expectations) and your CV.

Purpose: building a candidate pool and matching crew to the vessels managed or supported by Cursorio. Legal basis: your consent (Article 6.1.a GDPR), given when you create your profile and withdrawable at any time.

Recipients: your profile, CV and photo can be accessed by authorised Cursorio staff and by holders of a Premium account in the crew area, namely Cursorio employees and partner recruiters authorised by Cursorio. Your profile is not public and is not shared with any other third party without your agreement.

Retention: your data is kept for as long as your profile is active. You can amend it at any time from your account, and permanently delete your account (profile, CV and photo included) in one click from the “Account” section — or by writing to contact@cursorio.info.

AI-assisted processing: so that Cursorio can find a profile from a job description, a numerical representation (vector) of your professional data — positions sought, experience, sea service, certificates, skills, languages, cruising areas; never your name, contact details, photo or CV — is computed each time you save and stored with your profile. The analysis of your CV to pre-fill your profile only happens when you request it from your account: its result is suggested to you, nothing is saved without your confirmation, and it is not retained. This processing runs on Cloudflare Workers AI (models hosted by Cloudflare, with no reuse of your data for training) and involves no automated decision within the meaning of Article 22 GDPR: every match is decided by an authorised person.

Specific sub-processors: profile data and files are hosted on Cloudflare infrastructure (D1 database and R2 storage, located in the European Union); account emails (confirmation, sign-in, reset) are delivered by Resend, Inc. (United States), which only receives your email address for that purpose, under the safeguards of Article 46 GDPR.

2 quater. Onboard tools (risk assessment, procedures, permits to work)

The tools in the “Tools” section are free and require a Cursorio account. When you create the account from a tool, we collect your email address and your vessel's name; afterwards, the documents you save to the register (risk assessments, shipboard procedures, permits to work) and the vessel details you enter (IMO, flag, type). The draft you are working on stays on your device until you save it.

Purpose: letting you find your documents again from one device to the next, and offering, if you ask for it, a review by a Cursorio Master Mariner. Legal basis: your consent (article 6.1.a GDPR), collected when the account is created and withdrawable at any time. Cursorio only reads your documents to handle a review request; they are neither public nor shared with third parties. An account created from a tool does not create a seafarer profile: you can create one later, with its own consent.

Retention: your data is kept as long as your account exists. You can export every document as JSON at any time, and permanently delete your account (vessel and documents included) in one click from the crew area — or simply by writing to contact@cursorio.info.

Specific processors: the same as for the crew area — hosting on Cloudflare's infrastructure (D1 database, European Union) and account emails via Resend, Inc. (United States), which only receives your email address for that purpose.

2 quinquies. Household staff recruitment (villas)

If you create a file in the Villa area of our recruitment area, for a household staff job in a private property, we collect the data you voluntarily enter: identity (first name, last name; date of birth and nationalities if you provide them), contact details (phone, WhatsApp, city), job search (positions sought, accommodation, contract types, areas, availability, salary expectations, driving licence, couple position), experience in private properties and personal summary, spoken languages and your CV. Your photo, certificates and self-assessed skills are optional.

Employer references: if you list former employers or supervisors (name, relationship to you, phone, email), you are giving us data about those people. Let them know before you list them: Cursorio may contact them to check your references and will then tell them where their details came from. They have the rights described in §6.

Purpose: building a candidate pool and presenting your file to an owner-employer. Cursorio asks for your agreement, by phone or by email, before each presentation. Legal basis: your consent (Article 6.1.a GDPR), given when you create your file and withdrawable at any time.

Recipients: your file can only be accessed by authorised Cursorio staff in charge of recruitment. An owner-employer only receives a presentation of it with your agreement; that presentation is limited to your professional profile, without your contact details, references or salary expectations. Your file is never accessible to Premium accounts of the seafarer crew area, is not public and is not shared with any other third party without your agreement.

Retention: as for a seafarer profile, your data is kept for as long as your file is active. You can amend it at any time from your account, and permanently delete your account (file, CV and photo included) in one click from the “Account” section — or by writing to contact@cursorio.info. Changing area: an account holds only one file at a time. If you move from the Villa area to the seafarer area, or the other way round, the file of the area you leave is erased, CV and photo included.

AI-assisted processing: so that Cursorio can find a file from a job description, a numerical representation (vector) of your professional profile — positions sought, experience, preferred accommodation and contracts, areas, certificates, skills, languages, introduction, driving licence, couple position — is computed each time you save and stored with your file. It never includes your name, contact details, photo, CV, references, salary expectations or the property name given in your experience; free-text fields (introduction, location of an experience, areas) are included as you write them, without emails, links, phone numbers or surname. The analysis of your CV to pre-fill your file only happens when you request it from your account: its result is suggested to you, nothing is saved without your confirmation, and it is not retained. This processing runs on Cloudflare Workers AI, under the same conditions as for seafarer profiles, and involves no automated decision within the meaning of Article 22 GDPR: every presentation to an owner is decided by a person at Cursorio, with your agreement.

Specific sub-processors: the same as for seafarer profiles — file data and documents hosted on Cloudflare infrastructure (D1 database and R2 storage, European Union) and account emails delivered by Resend, Inc. (United States), which only receives your email address for that purpose.

2 sexies. Service providers and tradespeople (businesses)

If you open the Business area of our recruitment area to offer your business's services to villa owners (as a tradesperson, service provider or services company), your listing describes a business, but it contains personal data: that of the contact person and, for a sole trader (sole proprietorship, micro-enterprise), that of the entrepreneur themselves, who remains a natural person within the meaning of the GDPR. This section therefore applies to every business listing, whatever the business's legal form.

Data: we collect the data you voluntarily enter: business (company name, legal form, SIRET number, VAT number, description); contact (first name, last name, phone, business email, city); trades and service area; insurance (insurer, policy number, expiry date); certifications and qualifications (name, number, expiry date); the PDF documents you upload (Kbis company registration extract, professional liability and ten-year warranty insurance certificates, URSSAF compliance certificate, other documents); and the availability status you indicate.

Purpose: building a directory of service providers and putting your business in touch with villa owners looking for a service provider. Cursorio asks for your agreement, by phone or by email, before each presentation of your business to an owner. Legal basis: your consent (Article 6.1.a GDPR), given through a dedicated checkbox when you choose the Business area (on the area choice screen or when you switch to it from another area) and withdrawable at any time.

Documents and expiry dates: uploaded documents are kept for as long as your listing is active; you can delete them one by one from your account. Cursorio sends no automatic expiry reminder: a badge, in your account and in the Cursorio console, flags insurance that expires soon or has expired, and expired professional liability insurance makes the listing incomplete until it is updated.

Recipients: your listing and documents can only be accessed by authorised Cursorio staff in charge of matching. An owner only receives a presentation of your business with its agreement. Your listing is never accessible to Premium accounts of the seafarer crew area, is not public and is not shared with any other third party without your agreement.

Retention: your data is kept for as long as your listing is active. You can amend it at any time from your account, and permanently delete your account (listing and documents included) in one click from the “Account” section — or by writing to contact@cursorio.info. Changing area: an account belongs to only one area at a time. If you move from the Business area to another area, your business listing is erased, documents included; likewise, moving from another area to the Business area erases the file of the area you leave.

AI-assisted processing: none. Unlike candidate files, your listing is not turned into a numerical representation (vector) and is not analysed by artificial intelligence, and your documents are not analysed automatically. Cursorio finds a listing by plain text search. No automated decision within the meaning of Article 22 GDPR is taken: every presentation to an owner is decided by a person at Cursorio, with your agreement.

Specific sub-processors: the same as for the other areas — listing data and documents hosted on Cloudflare infrastructure (D1 database and R2 storage, European Union) and account emails delivered by Resend, Inc. (United States), which only receives your email address for that purpose.

3. Legal basis

Processing of your data via the contact and beta access forms is based on Article 6(1)(b) GDPR: performance of pre-contractual measures taken at your request.

When you contact us for a non-commercial reason (a question about a published insight, a spontaneous application), we rely on our legitimate interest in replying (Article 6(1)(f) GDPR).

4. Retention period

Your data is kept for the time needed to process your request, and for a maximum of 3 years from our last interaction, unless our commercial relationship leads to a management mandate (in which case the legal retention periods applicable to the maritime and accounting sectors apply).

5. Cookies and trackers

In compliance with article 82 of the French Data Protection Act and EU ePrivacy directive, cursorio.com does not set any consent-based cookie without your explicit agreement, collected via the dedicated banner. The following strictly necessary or functional cookies are set in all cases:

• — Cookie lang-preference: stores your language choice (FR / EN / IT / ES) if you manually select a language via the switcher. Duration: 1 year. Purpose: avoid re-triggering auto-detection on every visit. User preference cookie, exempt from consent.
• — Cloudflare cookies (notably __cf_bm and cf_clearance): automatically placed by our host Cloudflare for security purposes (anti-bot, anti-DDoS). Short duration, strictly necessary. Exempt from consent.
• — Cloudflare Turnstile: anti-spam protection used on our forms. Does not set any cookie and does not collect any personal identifying data.
• — Google Analytics 4 (audience measurement and advertising performance): set only if you accept via the consent banner (_ga cookies, maximum duration 13 months). Purposes: measuring site audience and the effectiveness of our campaigns. Your choice, acceptance or refusal, is stored for 6 months and can be changed at any time via the "Cookie settings" link in the footer. Data processed by Google Ireland Ltd; transfers outside the EU covered by the Data Privacy Framework.

Apart from Google Analytics audience measurement, which is subject to your explicit consent, no advertising cookies and no third-party tracking cookies are placed. Declining the banner has no impact on your browsing.

6. Your rights

Under the GDPR, you have the following rights over your data:

• —Right of access, rectification and erasure
• —Right to restriction of processing
• —Right to object
• —Right to portability
• —Right to withdraw consent at any time

To exercise these rights, contact jean.pousthomis@cursorio.com. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

No fully automated decision-making, including profiling, producing legal effects or similarly significantly affecting individuals, is carried out on this site.

7. Hosting and security

The site is hosted by Cloudflare Pages. Data transits through the Cloudflare network, primarily via its European points of presence. All communications are encrypted over HTTPS (TLS 1.3). Form data is forwarded to our Cursorio email addresses and is not stored on the site itself.

Cloudflare, Inc. is a U.S. company (San Francisco, California). Transfers of personal data to Cloudflare are governed by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021) incorporated into Cloudflare's Data Processing Addendum. Cloudflare, Inc. is also certified under the EU-U.S. Data Privacy Framework (dataprivacyframework.gov). A copy of the applicable safeguards can be obtained on request from jean.pousthomis@cursorio.com.