Controller: SM Caribbean B.V., trading as SM Caribbean. Contact: support@smcaribbean.com.
What information we handle
We handle contact details and enquiry text when you contact us; account, organization and authentication details when you register; vessel, port, timing, service and quote information when you request bunkering or waste removal; and limited Shopify order information when an order is linked to an authorized portal organization.
Customer document uploads are disabled until a malware-scanning process is approved. Do not send payment-card details, passwords or unnecessary identity documents through public forms.
Why we use it
- Respond to general enquiries and maintain the related CRM record.
- Verify accounts, control organization access and protect portal sessions.
- Review service requests, prepare quotes and keep an auditable request history.
- Show authorized customers purchase summaries linked from Shopify.
- Secure, operate and diagnose the website and portal.
- Load optional analytics or marketing technology only after the matching consent.
Systems and providers
- Vercel
- Hosts and delivers the website and application.
- Vercel Web Analytics
- Measures visits to public information and catalogue pages only after you allow this service. It receives a page address without query parameters or fragments, the time of the visit, referral information and browser/device information; Vercel derives approximate location. Catalogue addresses are grouped so individual product and collection slugs are not sent. Portal, staff, account, cart and service-request routes are excluded. We do not send form contents, customer details or custom events to this service. It does not use analytics cookies. You can withdraw consent through Privacy settings; this stops subsequent page views.
- Supabase
- Provides authentication, database and controlled portal storage.
- Shopify
- Provides the product catalogue, cart, checkout and authoritative order record.
- General enquiries
- Contact enquiries are saved in SM Caribbean’s own Supabase database for authorized staff to review. Resend notifies support@smcaribbean.com with your enquiry details. These enquiries are not sent to Zoho CRM.
- Resend
- Sends account verification and password-reset emails, service-request receipts, portal invitations, internal request notifications and, when enabled, client updates about requests, quotes, messages, service milestones and released or withdrawn documents. Portal updates go to the request’s authorized requester; access is checked again before sending. Private documents remain behind portal sign-in and are not attached to these emails. It receives the recipient email address and notification content, including the request reference, vessel, port, date and contact details needed for the message. Email open and click tracking are disabled. This transactional email service does not set cookies on this website. Replies go to support@smcaribbean.com.
- Cloudflare Turnstile
- Helps protect public and authentication forms from automated abuse.
- Usercentrics
- Stores privacy choices and controls optional services.
- Google Analytics and advertising measurement
- When enabled and you allow Google Analytics in Privacy settings, Google uses analytics cookies and browser and device information to measure public website activity. A newly accepted public service request can be measured using its service category and the form address without query parameters. This event does not include your contact details, vessel, port, requirements or request reference. Failed requests and recovered duplicates are not counted as new requests. Portal and staff activity is excluded. Advertising measurement uses our Google Ads tag and requires separate Google Ads consent; Meta consent does not grant it. Ad personalization remains disabled. You can withdraw either choice through Privacy settings to stop future events.
- Meta browser tracking
- When enabled, the Meta Pixel loads only after you opt in to Facebook Pixel in Privacy settings. It measures public page visits and newly accepted contact or service enquiries. Browser and device information and the public page address are received by Meta; private portal and staff activity and form contents are excluded. An event identifier shared with the Conversions API lets Meta recognize browser and server reports of the same enquiry. Facebook Pixel and Conversions API have separate choices. Enabling Google Analytics does not enable Meta browser tracking.
- Meta Conversions API
- When enabled, and only if you opt in to the dedicated Meta Conversions API marketing service in Privacy settings, an accepted public contact enquiry or bunkering or waste-removal request sends a Lead event to Meta. It includes a SHA-256 hash of your normalized email address, your browser user-agent (which describes your browser and operating system), an event identifier and time, and the public form address without query parameters. Meta can use the email hash to match an account and measure advertising; hashing does not make it anonymous. We do not send your name, phone number, IP address, cookies, message, vessel or service details through this integration. It does not track portal or staff activity or Shopify checkout and purchases. The checkbox allowing us to respond to your enquiry does not grant this marketing consent. You can withdraw consent through Privacy settings to stop future submission events.
Cookies and local storage
Essential cookies support authentication, security, cart and consent choices. Optional functionality, analytics and marketing technologies are off by default. If the built-in Analytics control is used, your allow/reject choice is stored locally for up to 180 days; it contains no customer identifier. Usercentrics manages choices when connected. You can change your choice through Privacy settings.
Sharing and transfers
Information is shared only with providers and authorized staff needed to operate the relevant workflow. Some providers may process information outside Sint Maarten. The applicable contractual and legal transfer safeguards require legal review before publication.
Security, retention and your choices
Access is restricted by account, organization and staff role. Security controls reduce risk but cannot guarantee absolute security. Specific retention periods are not stated in this draft because they have not yet been approved; information should be kept only as long as needed for the relevant operational, legal and security purpose.
You may ask to access, correct or delete information, object to or restrict certain use, or withdraw consent where consent is the basis. The exact statutory wording and complaint authority must be confirmed during legal review. Contact support@smcaribbean.com.