This General Privacy Notice explains what we do with your personal data in relation to this website only. Each entity included on this website has its own website and Privacy Notice. Columbia Shipmanagement Limited (CSM Limited) does not exercise control over the content of these websites.

It applies to any Prospective Customers, Customers, Business Partners, Prospective Vendors, Vendors, Prospective Employees (Office Staff), Unsuccessful Candidates (Office Staff), Prospective Seafarers, Seafarers, Seafarer Allottee (Beneficiary), Employees (Office Staff), Office Staff and Seafarer Children, Adopt a ship Children, Family Members of Employees (Office Staff), Group Company Employees, Group Company Shareholders/Directors, Group Company UBO/Board Owner, Supervisors/Trainers, Local Authority Inspectors, Port Agents, Vesel Flag Inspectors, Prospective Experts, Third Party (Claims Handling), Non-Fare paying passengers, Office Visitors and any Company Website Visitors of whom we process personal data.

It describes how we collect, handle, and process your personal data.

This notice is layered. So, if you wish, you can easily select any processing activity to see what to expect us to do with your personal data.

Columbia Shipmanagement Limited (CSM Limited) is the controller for the personal data that is processed through this website. You can contact CSM Limited in a number of ways, which are set out below:

Columbia Shipmanagement Limited
Address: 21 Spyrou Kyprianou, Columbia House, Germasogeia 4042, Limassol, Cyprus
Phone: +357 25843100
Email: [email protected]

If you wish to contact the Data Protection Officer of CSM Limited in relation to the processing of your personal data by CSM Limited, you can do so in a number of ways, which are set out below:

Mr Andreas Andreou
Address: 21 Spyrou Kyprianou, Columbia House, Germasogeia 4042, Limassol, Cyprus
Phone: +357 25843100
Email: [email protected]

Communication

Data Subject

This section applies to the personal data of Customers, Prospective Customers, Vendors, Prospective Vendors, Local Authority Inspectors, Port Agents, Vessel Flag Inspectors, and Business Partners.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for communication purposes only.

Categories of personal data

This includes your personal identification details, contact information and employment information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is the direct marketing of our services.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required direct marketing and approach new business opportunities.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for ten (10) years following the termination of our collaboration.

Data Subject

This section applies to the personal data of Vendors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for communication purposes only.

Categories of personal data

This includes your personal identification details and contact information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us to enable communication with vendors.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required vendor management and communicate with vendors.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for six (6) months following the conclusion of our business relationship with the vendor.

Data Subject

This section applies to the personal data of Vendors and Local Authority Inspectors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for operational purposes only.

Categories of personal data

This includes your personal identification details.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required vessel operation management, we shall not be able to fulfil our contract with you or contract with you.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for fifteen (15) years from the date of collection of your personal data.

Data Subject

This section applies to the personal data of Vendors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for flag requirement purposes only.

Categories of personal data

This includes your personal identification details.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(c). This allows us to process personal data when it is necessary for compliance with a legal obligation to which the controller is subject.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to comply with the port authority requirements, we shall not be able to comply with our legal obligation.

Recipients

The only recipients shall be:

• our Agencies;
• our Manning Agents;
• Port Agents;
• our Vessel Operators;
• our Vessels.

They shall be assisting with the necessary formalities for this matter. They are located globally.

Where they are based outside the EEA, these include, but are not limited to:

• United Kingdom; and

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where they are based in the United Kingdom, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for a period of one (1) month from the date of receipt of the documents, or earlier in case the assignment is completed.

Claims Handling

Data Subject

This section applies to the personal data of Seafarers, Port Agents, Prospective Experts and Third Party (Claims Handling).

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for claims handling purposes only.

Categories of personal data

This includes your personal identification details, contact information, financial information, education and skills, and various incidents reports.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is to protect the Company’s interests, such as monetary losses and reputation.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required claims handling and protect the Company’s interests.

Recipients

The only recipients shall be:

• our Customers (Shipowners);
• our Insurers;
• Judicial Bodies;
• our External Lawyers;
• our P&I Clubs;
• our Vessel Operators.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years after claims are barred/settled.

People Claims Handling

Data Subject

This section applies to the personal data of Seafarers and Third Party (People Claims Handling).

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for people claims handling purposes only.

Categories of personal data

This includes your personal identification details, contact information, employment information, financial information, health information, PEME invoices, professional experience and affiliations, and travel and expense.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The sensitive personal data derogation for processing we rely on to process your personal data is GDPR Article 9(2)(f). This allows us to process personal data when it is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required people claims handling, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Customers (Shipowners);
• our Instructed Experts;
• our Insurance Brokers;
• our Insurers;
• Judicial Bodies;
• our External Lawyers;
• our Manning Agents;
• our P&I Clubs;
• our P&I Correspondents;
• our Port Agents;
• our Vessel Operators.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years after claims are barred/settled.

Data Subject

This section applies to the personal data of Business Partners, Vendors, Prospective Vendors, Customers, Prospective Customers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for KYC/AML compliance purposes only.

Categories of personal data

This includes your personal identification details and AML checks.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is to comply with KYC/AML procedure of the Company.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required KYC/AML Compliance and comply with the KYC/AML procedure of the Company.

Recipients

The only recipients shall be:

• Our External Lawyers.

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for a period of ten (10) years from the date of receipt of the information and documents.

Data Subject

This section applies to the personal data of Seafarers and Non-Fare paying passengers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for insurance placing purposes only.

Categories of personal data

This includes your personal identification details and employment information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required insurance placing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Our Insurance Brokers.

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for one (1) year from the inception of the policy, until the next renewal is finalised.

Data Subject

This section applies to the personal data of Seafarers and Prospective Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for payment processing purposes only.

Categories of personal data

This includes your personal identification details, employment information and PEME invoices.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required PEME Invoice processing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Our P&I Clubs.

They shall be assisting with the necessary formalities for this matter. They are located globally.

Where they are based outside the EEA, these include, but are not limited to:

• United Kingdom.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where they are based in the United Kingdom, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for one (1) year from the inception of the policy, until the next renewal is finalised.

Data Subject

This section applies to the personal data of Employees (Office Staff), Group Company Employees, Group Company Shareholders/Directors, Group Company UBO/Board Owner and Vendors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for contract management purposes only.

Categories of personal data

This includes your personal identification details and contractual details.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required contract management, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Auditors;
• Banks;
• our Business Partners;
• Judicial Bodies;
• our External Lawyers;
• our Manning Agents;
• Notary Public;
• Registrar of Companies;
• Social Insurance Authorities;
• Tax Authorities;
• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Sanctions Management

Data Subject

This section applies to the personal data of Business Partners, Vendors, Prospective Vendors, Customers and Prospective Customers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for sanctions checks purposes only.

Categories of personal data

This includes your personal identification details and AML checks.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(c). This allows us to process personal data when it is necessary for compliance with a legal obligation to which the controller is subject.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required sanctions checks, we shall not be able to comply with our legal obligation.

Recipients

The only recipients shall be:

• our External Lawyers.

They shall be assisting with the necessary formalities for this matter. They are located globally.

Where they are based outside the EEA, these include, but are not limited to:

• United Kingdom; and
• United States.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where they are based in the United Kingdom, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Business Partners, Customers, Employees (Office Staff) and Group Company Employees.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for company events purposes only.

Categories of personal data

This includes your personal identification details and contact information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is to effectively plan and coordinate/organize Company events.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required events management and send digital invitations for our Company events.

Recipients

The only recipients shall be:

• our Business Partners;
• our Customers (Shipowners).

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for a period of one (1) year from the time the invitation has been sent.

Data Subject

This section applies to the personal data of Vendors, Customers, Employees (Office Staff), Group Company Employees, Office Visitors and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for communication purposes only.

Categories of personal data

This includes your personal identification details, social information and employment information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is maintaining our Company news archives.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required CEO newsletter management and communicate with you.

Recipients

The only recipients shall be:

• our Manning Agents.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Office Staff and Seafarer Children, and Adopt a ship Children.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for communication purposes only.

Categories of personal data

This includes your social information.

Legal Basis

The legal basis we rely on to process your personal data for non-necessary cookies is GDPR Article 6(1)(a). This allows us to process personal data when the data subject has given consent, subject to the applicable conditions, to the processing of his or her personal data for the specified purposes.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required internal/external publications management, we shall not be able to communicate with you.

Recipients

The only recipients shall be:

• our Manning Agents;
• our Customers (Shipowners);
• Shipping Associations.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Business Partners, Customers, Employees (Office Staff), Group Company Employees and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for marketing and social media engagement purposes only.

Categories of personal data

This includes your social information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is the marketing promotion and communication of our services.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required event/maritime photography and promote and communicate our services.

Recipients

The only recipients shall be:

• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for seven (7) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Business Partners, Customers, Employees (Office Staff), Family Members of Employees (Office Staff), Group Company Employees, Office Visitors and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for marketing and social engagement purposes only.

Categories of personal data

This includes your personal identification details, social information, employment information and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is the social engagement and marketing promotion of our services.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required company social media management and promote social engagement and our services.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for seven (7) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Adopt a ship Children, Business Partners, Customers, Employees (Office Staff), Office Staff and Seafarer Children, and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for marketing and social engagement purposes only.

Categories of personal data

This includes your personal identification details, social information, employment information and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is the social engagement.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required company magazine management and promote social engagement.

Recipients

The only recipients shall be:

• our Business Partners;
• our Customers (Shipowners);
• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Business Partners, Customers, Employees (Office Staff), Group Company Employees, Office Visitors and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for marketing purposes only.

Categories of personal data

This includes your personal identification details, social information and contact information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is the marketing promotion of our services.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required marketing management and promote our services.

Recipients

The only recipients shall be:

• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Business Partners, Customers and Employees (Office Staff).

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for communication, customer relationship management, statistics and marketing purposes only.

Categories of personal data

This includes your personal identification details and contact information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required customer relationship management, we shall not be able to fulfil our contract with you or contract with you.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for ten (10) years from last communication with client/prospective client. All employees’ data are deleted upon termination of employment.

Data Subject

This section applies to the personal data of Seafarers and Port Agents.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for budget analysis purposes only.

Categories of personal data

This includes your contact information, employment information, travel and expense, and workplace welfare.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required budget elements analysis, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Customers (Shipowners).

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Prospective Seafarers

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for online recruiting activities purposes only.

Categories of personal data

This includes your contact information, crew data sheet information, education and skills, employment information, personal identification details and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required crewing HR recruiment software management, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Customers (Shipowners);
• our Manning Agents.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store qualification and contact details for six (6) months in case the applicant is not hired, as for the identification details, we shall store them for up to two (2) years.

Data Subject

This section applies to the personal data of Prospective Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.

Categories of personal data

This includes your contact information, background checks, crew data sheet information, education and skills, employment information, PEME invoices, personal identification, and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required recruitment of non PAX seafarers, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

(a) our Customers (Shipowners);

• our Manning Agents.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the recruitment of non PAX seafarers.

Data Subject

This section applies to the personal data of Prospective Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.

Categories of personal data

This includes your contact information, background checks, education and skills, personal identification, and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required recruitment of PAX seafarers, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

(a) our Customers (Shipowners);

(b) our Manning Agents.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for two (2) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Prospective Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.

Categories of personal data

This includes your contact information, background checks, crew data sheet information, education and skills, employment information, government identifiers, PEME invoices, personal identification, and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required shorlisted PAX candidates’ recruitment, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Customers (Shipowners);
• Flag Authorities;
• P&I Clubs;
• P&I Correspondents;
• Airlines;
• our B2B Customers;
• our Business Partners;
• Immigration Authorities;
• our Manning Agents;
• our Port Agents.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for one (1) year from the collection of your personal data.

Data Subject

This section applies to the personal data of Employees (Office Staff), Group Company Employees and Supervisors/Trainers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for training management purposes only.

Categories of personal data

This includes your contact information, education and skills, employment information, personal identification, and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required training and development management, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Human Resource Development Authorities;
• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for two (2) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Prospective Employees (Office Staff) and Unsuccessful Candidates (Office Staff).

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.

Categories of personal data

This includes your contact information, background checks, education and skills, employment information, government identifiers, personal identification, and professional experience and affiliations.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required employee recruitment, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for one (1) year post interview/application for unsuccesful candidates and ten (10) years post employment for successful candidates.

Data Subject

This section applies to the personal data of Prospective Employees (Office Staff) and Unsuccessful Candidates (Office Staff).

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.

Categories of personal data

This includes your education and skills, employment information and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required employee recruitment outsourcing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• our Vendors.

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for one (1) year from the collection of your personal data.

Data Subject

This section applies to the personal data of Employees (Office Staff) and Supervisors/Trainers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for bank account administration, payment and accounting processing purposes only.

Categories of personal data

This includes your government identifiers, personal identification, contact information and financial information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required bank account administration, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Banks

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for one (1) year following the termination of employment, or service contract.

Data Subject

This section applies to the personal data of Seafarer Allottee (Beneficiary) and Seafarers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for bank investigations and payment and accounting processing purposes only.

Categories of personal data

This includes your contact information, financial information, government identifiers and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required crew accounts payment processing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Banks

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the crew accounts payment processing.

Data Subject

This section applies to the personal data of Group Company Shareholders/Directors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for credit report review purposes only.

Categories of personal data

This includes your government identifiers and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required directors KYC details updating, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

(a)         Credit Agencies.

They shall be assisting with the necessary formalities for this matter. They are located globally.

We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.

Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the directors KYC details updating.

Data Subject

This section applies to the personal data of Group Company Shareholders/Directors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for corporate administration purposes only.

Categories of personal data

This includes your financial information.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required group companies structure administration, we shall not be able to fulfil our contract with you or contract with you.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the group companies structure administration.

Data Subject

This section applies to the personal data of Group Company Shareholders/Directors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for accounting and payment processing purposes only.

Categories of personal data

This includes your contact information, financial information and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required other group companies’ administration, we shall not be able to fulfil our contract with you or contract with you.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the other group companies’ administration.

Data Subject

This section applies to the personal data of Supervisors/Trainers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for accounting and payment processing purposes only.

Categories of personal data

This includes your financial information and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required payment processing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

The only recipients shall be:

• Banks

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Group Company Shareholders/Directors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for payment processing purposes only.

Categories of personal data

This includes your financial information and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required shareholder payment processing, we shall not be able to fulfil our contract with you or contract with you.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We shall store such personal data for as long as it is necessary to facilitate the shareholder payment processing.

Data Subject

This section applies to the personal data of Employees (Office Staff), Seafarers and Supervisors/Trainers.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for accounting and payment processing purposes only.

Categories of personal data

This includes your employment information, financial information and personal identification.

Legal Basis

The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

If legitimate interest, it must be identified

The legitimate interest pursued by us is processing payment or subscriptions to fulfil financial commitment or contracts and preventing fraud.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, we shall not be able to conduct the required payment reconciliation and fulfill financial commitment or contracts and prevent fraud.

Recipients

The only recipients shall be:

• our Auditors;
• Banks;
• our Customers (Shipowners).

They shall be assisting with the necessary formalities for this matter. They are based in the EEA.

Retention Period

We shall store such personal data for ten (10) years from the collection of your personal data.

Data Subject

This section applies to the personal data of Company website visitors.

Purpose of Processing

Where you provide us or we are provided with your personal data, we shall process them for cookie management purposes only.

Categories of personal data

This includes your browsing information.

Legal Basis

The legal basis we rely on to process your personal data for necessary cookies is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

The legal basis we rely on to process your personal data for non-necessary cookies is GDPR Article 6(1)(a). This allows us to process personal data when the data subject has given consent, subject to the applicable conditions, to the processing of his or her personal data for the specified purposes.

If legitimate interest, it must be identified

The legitimate interest pursued by us is maintaining the integrity of our IT systems and the continuity of our business.

PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same

If necessary personal data is not provided, allowing us to conduct the required cookie management, we shall not be able to track visitor behaviour, maintain the integrity of our IT systems, maintain the continuity of our business and measure site performance.

Recipients

There are no recipients of your personal data for these purposes.

Retention Period

We will store such personal data for the periods below depending on the type of cookie as from the Cookies’ activation:

• Necessary cookies shall be stored for:
  • PHPSESSID limited to the duration of a session;
  • OptanonAlertBoxClosed for 1 year;
  • OptanonConsent for 1 year.
• Performance cookies shall be stored for:
  • __hssc for a few seconds;
  • __hssrc limited to the duration of a session;
  • __hstc for 5 months;
  • _ga for 2 years;
  • _ga_xxxxxxxxxx for 1 year;
  • __hstc for 5 months.
• Functional cookies shall be stored for:
  • Hubspotutk for 13 months;
  • __cf_bm for a few seconds;
  • ANONCHK for a few seconds;
  • CLID for 1 year;
  • hf_fh5_token_7438 for a few seconds;
  • MR for 6 days;
  • MUID for 1 year;
  • SM limited to the duration of a session;
  • route limited to the duration of a session.
• Targeting cookies shall be stored for:
  • _fbp fpr 2 months;
  • _cfuvid limited to the duration of a session;
  • Bcookie for 1 year;
  • li_gc for 5 months;
  • lidc for a few seconds;
  • __Secure-xxxxxxx for 5 months;
  • MR for 6 days;
  • MUID for 1 year;
  • SRM_B for 1 year;
  • VISITOR_INFO1_LIVE for 5 months;
  • VISITOR_PRIVACY_METADATA for 5 months;
  • YSC limited to the duration of a session.