Custhelper Privacy Policy
1. Who we are
This policy explains how personal data is handled when you use Custhelper, the web service and API at custhelper.com ("Custhelper" or "the Service").
Data controller. Custhelper is operated on behalf of A.P. Møller - Mærsk A/S ("Maersk", "we", "us"), [registered address, Copenhagen, Denmark], CVR [number]. Maersk decides why and how personal data in the Service is processed and is the controller under the EU General Data Protection Regulation (GDPR).
Developer and data processor. Burbas Consulting AB, [registered address], Sweden, org. no. [number], develops, hosts and maintains the Service for Maersk. Burbas Consulting AB processes personal data only on Maersk's documented instructions under a data processing agreement (GDPR Article 28).
By using the Service, you acknowledge this policy. It applies to custhelper.com, its API and any related support channels.
2. Personal data we collect
We collect only the data needed to run the Service. Depending on how you use it, this may include:
| Category | Examples | Source |
|---|---|---|
| Account and identity data | Name, work email, username, employer, role | You or your employer |
| Authentication data | Hashed passwords, API keys and tokens, login timestamps | You and the Service |
| Customer-service content | Cases, messages, notes and attachments you submit | You |
| Technical and log data | IP address, browser and device type, request URLs, API calls, error logs | Collected automatically |
| Usage data | Features used, pages visited, time and frequency of use | Collected automatically |
| Support correspondence | Emails and messages sent to our support team | You |
We do not intentionally collect special categories of personal data (for example health, religion or ethnicity). Please do not enter such data into free-text fields unless it is strictly necessary for your case.
3. Why we process your data and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide the Service, create and manage accounts | Account, authentication, customer-service content | Contract (6(1)(b)) or Maersk's legitimate interest in providing tools to its staff and partners (6(1)(f)) |
| Handle customer-service cases | Customer-service content, account data | Contract (6(1)(b)) or legitimate interest (6(1)(f)) |
| Keep the Service secure, prevent misuse, investigate incidents | Technical and log data, authentication data | Legitimate interest (6(1)(f)) |
| Maintain, troubleshoot and improve the Service | Technical, log and usage data | Legitimate interest (6(1)(f)) |
| Answer support requests | Support correspondence, account data | Legitimate interest (6(1)(f)) |
| Meet legal obligations, such as bookkeeping or authority requests | Relevant data as required | Legal obligation (6(1)(c)) |
Where we rely on legitimate interest, we have balanced our interests against your rights. You can object to this processing at any time (see section 8). We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
6. How long we keep your data
We keep personal data only as long as needed for the purposes above, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Account and authentication data | While the account is active, plus [90 days] after closure |
| Customer-service cases and content | [24 months] after the case is closed, unless Maersk needs it longer for a legal claim |
| Technical and security logs | [90 days] |
| Support correspondence | [12 months] after the request is resolved |
| Data subject to legal retention (e.g. accounting) | As required by law |
Backups are overwritten on a rolling basis within [30 days].
7. How we protect your data
We use appropriate technical and organisational measures to protect personal data, including:
- Encryption in transit (TLS/HTTPS) for all traffic to the website and API
- Passwords stored only as salted hashes; API keys and secrets kept separate from application configuration
- Role-based access control and least-privilege access for staff and systems
- Isolated, containerised hosting with regular security updates
- Logging and monitoring to detect and respond to unauthorised access
- Regular backups and tested recovery procedures
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the supervisory authority as required by the GDPR.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy
- Rectification of inaccurate or incomplete data
- Erasure of your data, where there is no longer a valid reason to keep it
- Restriction of processing in certain situations
- Data portability, receiving data you provided in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time, where processing is based on consent
To use these rights, contact us using the details in section 10. We will reply within one month. We may ask you to verify your identity first. Requests sent to Burbas Consulting AB will be forwarded to Maersk.
9. Children
The Service is intended for business use and is not directed at children under 16. We do not knowingly collect their data.
10. Changes, contact and complaints
Changes. We may update this policy. The date at the top shows the latest version. We will notify users of material changes through the Service or by email.
Contact the controller (Maersk). Data protection questions and rights requests: [privacy contact email at Maersk]. Maersk's Data Protection Officer: [DPO email].
Contact the developer (Burbas Consulting AB). Technical questions about the Service: [support email for Custhelper].
Complaints. You can lodge a complaint with a data protection supervisory authority. Maersk's lead authority is the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk). You may also complain in the EU country where you live or work, for example the Swedish Authority for Privacy Protection (IMY, imy.se). We encourage you to contact us first so we can try to resolve your concern.