This Privacy Notice explains how the Zodiac Group (“We”, “Us”, “Our”) uses and stores your Personal Data that we collect from or about you, or that you give us, and sets out the basis on which we will process such Personal Data.

We are committed to protecting and respecting your privacy. We will limit the collection and processing of Personal Data to information necessary to achieve one or more legitimate purposes as identified in this Privacy Notice. Please read the Privacy Notice carefully in full to understand our views and practices regarding your Personal Data and how we will treat it.

This Privacy Notice (as we may update it from time to time) applies to, and is incorporated in, the terms of business for Zodiac Maritime Limited.

By accessing and using the Zodiac Maritime Limited website or other application of ours (or any mobile version thereof), applying for and/or accepting employment with us, or by continuing to use our Service, you are accepting and consenting to the practices described in this Privacy Notice.

If you are located in the EEA, please also read in our Privacy Notice Annex.

Definitions

For the purpose of this Privacy Notice:

“Affiliates” means subsidiaries, the ultimate holding company, its subsidiaries and other related entities from time to time.

“Key Third Parties” means our agents, business partners, consultants, representatives or sub-contractors or suppliers, who we engage to help us deliver the Service.

“Personal Data” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information).

“Service” means our interaction with you, whether as employer, agent for your employer or as other service provider.

“Zodiac Group” means Zodiac Maritime Limited together with its Affiliates.

Your Personal Data

You may give us, or we may collect from you or elsewhere, Personal Data about you at the start of, and for the duration of, your interaction with us including (but not limited to) the following:

• name and address (and, if relevant, additional places of residence), date of birth and contact details
• social security information (e.g. National Insurance Numbers or equivalent)
• financial information, including account details and related information
• information held within professional licenses, certificates, training records and qualifications that you may hold
• passport information, including nationality, and information relating to your permit to work and the visas you hold
• visual images of you and your personal appearance (such as copies of passports)
• information about your marital status, dependents, next of kin and family circumstances (and their contact details and financial information)
• education and employment information
• information relating to your performance that we collect during the process of recruitment and, if successful, during subsequent employment with us
• online profile and social media information and activity, based on your interaction with us and our websites and applications, including (for example) profile and login information, Internet Protocol (IP) address, smart device information, location coordinates, online and mobile security authentication, and mobile phone network information.

We may also process certain special categories of Personal Data for specific and limited purposes, such as detecting and preventing financial crime, to make our Service available, or providing you with urgent medical assistance and ongoing medical care when necessary (e.g. in case you become ill while employed on a vessel we operate or manage).

These special categories may include information about:

• gender racial or ethnic origin
• religious or philosophical beliefs
• trade union membership
• physical or psychological health details or medical conditions (including medications, allergens, as well as information contained within a copy of any Seafarer’s Medical Certificate)
• biometric information, relating to the physical, physiological or behavioural characteristics of a person (e.g. height, weight, shoe size)
• criminal convictions or offences and alleged offences for specific and limited activities and purposes, such as to perform checks to prevent and detect crime and to comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption, and international sanctions. These processing activities may involve investigating and gathering intelligence on suspected financial crimes, fraud and threats and sharing data with law enforcement and regulatory bodies.

We will only process special categories of Personal Data where we have obtained your explicit consent or are otherwise lawfully permitted to do so (and then only for the particular purposes and activities set out in this Privacy Notice).

Personal Data you give us

You may give us Personal Data:

• When you enter Personal Data for the Service
• When you interact with us
• When you otherwise provide Personal Data to us through Key Third Parties or elsewhere.

Collection of Personal Data

We may collect, whether directly or through third party suppliers, Personal Data regarding your use of our Service, such as:

• Your interaction with our website, applications and e-mails or any website that referred you to the Service
• Personal Data relating to any transactions carried out between you and us, including Personal Data relating to our business and services
• Personal Data you provide to us for the purpose of registering with us, or Key Third Parties or elsewhere, in connection with an application for a position with us or on board a vessel operated or managed by us
• Device IDs or unique identifiers, location data, connection data, statistics on page views, referral URLs, website and app navigation, IP address and standard web log Personal Data
• Personal Data collected via the use of cookies, web beacons and other technologies about how you use our Service
• Personal Data collected from publicly available sources.

Social media

You may also interact with us via social media (e.g. Facebook or LinkedIn). If you choose to do so, you shall be subject to the Privacy Policy of such social media provider (and any other relevant policies governing your use thereof) and their right to use your Personal Data, as amended from time to time.

Uses made of the Personal Data in connection with the Service

We may use your Personal Data to do some or all of the following, in each case to the extent permitted by applicable data protection laws:

• provide the Service
• notify you about changes to, or contact you for another reason connected with, the Service or otherwise send information to you
• collect payments from, and make payments to, you
• provide Key Third Parties with your Personal Data
• provide third parties with statistical information - this Personal Data will first be pseudonymised or anonymised
• deal with enquiries and complaints.

Purposes of processing and disclosure of your Personal Data to third parties

We want to ensure that you fully understand how your information may be used.

We will only use and share your Personal Data where it is necessary for us to carry out our lawful business activities. For example (but without limitation), we may need your Personal Data in connection with analysis of the performance of our employees and the crew on vessels we operate or manage, or in order to provide information as may be required by our customers in order to fulfil our obligations under contracts (e.g. about your professional qualifications, licenses and training records, or disciplinary procedures you have been subject to).

Your Personal Data, although given by you to, or otherwise collected by, a particular member of the Zodiac Group, may be shared freely among any of our Affiliates who adhere to the same policy on data protection.

We may also share your Personal Data with, or disclose it to, Key Third Parties for the performance of any contract we enter into with you, or for other specific and limited purposes, including (but not limited to):

• where we have your consent to do so
• where we process the information for the purpose of protecting your vital interests, or of another natural person, and/or for the purposes of preventative or occupational medicine
• to protect our legitimate interests. For example (but without limitation), we may disclose your Personal Data to our legal, financial and other professional advisers in the event that your it is required in connection with them providing advice to us
• to comply with a legal obligation or regulatory requirement to which we are subject, or in order to enforce or apply our terms of business. For example (but without limitation), we may disclose your Personal Data to any person designated by a court, law-making or other public body, regulatory or other authority who has jurisdiction over us
• to prevent, detect and investigate potentially prohibited or illegal activities, including bribery, corruption, fraud, money laundering (or any other criminal activity in any county or territory to whose jurisdiction we are subject). We may also disclose your Personal Data to banks/ other financial institutions/ law enforcement agencies/ regulators/ other relevant third parties to help recover funds that have entered your account erroneously or that were meant to be paid to you but have been paid to another person as a result of a misdirected payment
• where you have nominated one or more third parties as authorised payees of money due to you in the course of your employment on vessels that we operate or manage
• where permitted by law and it is necessary for our legitimate interests or those of a third party, and it is not inconsistent with the purposes listed in this Privacy Notice
• to fulfil any other legitimate interest.

Security

We understand that the security of your Personal Data is important to you. When handling Personal Data, security is paramount to us and we seek to ensure that Personal Data is adequately protected with us and with Key Third Parties.

We use administrative, digital and physical controls, including password protection, to safeguard your Personal Data against loss, theft and unauthorised access, use or modification. However, some limited Personal Data provided to us is transmitted using unencrypted protocols.

Unfortunately, the transmission of Personal Data via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data.

Your Rights

We want to make sure you are aware of your rights in relation to the Personal Data we process about you. Your rights are set out below:

Objection You have a right to object to the processing of your Personal Data.	You have a right to object to us processing, or to request us to restrict processing of, your Personal Data if: you believe that we no longer need to process your Personal Data for the purposes for which it was provided you believe that we are not using your Personal Data in a lawful manner we have requested your permission to process your Personal Data and you wish to withdraw your consent. Please note that if you object to us processing your Personal Data a) we may have to suspend the some or all of the Service we provide to you; b) this will not affect the legitimacy of prior processing; and c) we may still continue to process your Personal Data if we have a lawful basis for doing so which overrides your own interests.
Access; portability You have a right to get access to the Personal Data we hold about you.	You have a right to ask us for access to your Personal Data. You have a right to receive Personal Data you have provided to us in a portable format. Upon your request, but at our discretion and if technically feasible, we may also provide it directly to a third party. We will not accept responsibility for any such third party’s use of your account information, which will be governed by their agreement with you and any privacy statement they provide to you.
Erasure You have a right to ask us to delete your Personal Data.	You have a right to ask that we erase your Personal Data. Please note if you request us to delete your Personal Data a) we may have to suspend the some or all of the Service we provide to you; b) this will not affect the legitimacy of prior processing; and c) we may still continue to process your Personal Data if we have a lawful basis for doing so which overrides your own interests.
Correction / updating You have a right to ask us to correct or update your Personal Data.	If you believe that any of the Personal Data that we hold about you is inaccurate, you have a right to ask that we correct or update your Personal Data and/ or restrict processing any of the Personal Data that is inaccurate. Please note that if you request us to restrict processing your Personal Data, we may have to suspend some or all of the Service we provide to you. We will notify you if such action is necessary.
Withdraw consent You have a right to withdraw your consent.	Where we rely on your permission to process your Personal Data, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.
Lodge complaints You have a right to lodge a complaint with the regulator.	If you wish to raise a complaint on how we have handled your Personal Data, you can contact us at [email protected] and we will investigate the matter. We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO). For more information, visit www.ico.org.uk

If you wish to exercise any of these rights, if you have any queries about how we use your Personal Data that are not answered here, please contact us.

International Data Transfers

Personal Data that we collect may be stored and processed in, and transferred between, any of the countries in which we operate in order to enable us to use the Personal Data in accordance with our policy on data protection and/or this Privacy Notice.

Personal Data which you provide may be transferred to Key Third Parties located in countries which do not have data protection laws equivalent to those in force in the European Union or European Economic Area. Where that is the case, we will only do so where: a) the European Commission has decided that the country or the organisation we are sharing your information with will protect your information adequately; b) the transfer has been authorised by the relevant data protection authority; and/or c) we have entered into a contract with the organisation with which we share your information to ensure your information is adequately protected.

Contact

Questions, comments and requests regarding the Zodiac Group Privacy Policy are welcomed and should be addressed to [email protected]

Changes

We reserve the right to change the practices described in this Privacy Notice at any time. Please check here periodically.

This Privacy Notice is dated 24 May 2018.

ANNEX

ADDITIONAL INFORMATION FOR EEA AND SWISS INDIVIDUALS
In order to meet privacy regulations in the EEA and Switzerland, the Zodiac Group provides additional information to its EEA-based data subjects.

Who is responsible for your Personal Data?
If you use our Service, the Data Controller is:

Zodiac Maritime Limited is registered as a data controller with the Information Commissioner’s Office (registration number ZA389240).

What is the legal basis we rely on to process your Personal Data?
On some occasions, we process your Personal Data with your consent (for example, when you agree to the terms of use of our website).

On other occasions, we process your Personal Data when we need to do this in order to fulfil a contract with you (for example, to enable us to arrange to pay salaries or place appropriate insurances) or where we are required to do this by law (for example, where we have to fulfil anti-money laundering requirements).

We also process your Personal Data when it is in our legitimate interests to do this and when these interests are not overridden by your data protection rights. These rights may be limited in some situations - for example, where we can demonstrate that we have a legal requirement to process your Personal Data.

How long do we keep your Personal Data?
The Zodiac Group keeps your Personal Data for only as long as required to provide you with the Service, or as necessary for the purposes of processing set out in this policy in line with applicable legal and regulatory requirements worldwide.

We create records that contain your information, for example (without limitation) employment records and payment and tax records, and we hold these on a variety of media and formats (physical or electronic). Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.

Retention periods for records are determined based on various factors like the type of record, the nature of the Personal Data and the legal or regulatory requirements in the country in which the processing takes place. Retention periods may change from time to time based on business or legal and regulatory requirements.

We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies or our regulators.

Your rights
You may ask us for a copy of your Personal Data, to correct it, erase it or to transfer it to another organisation.

You also have rights to object to some processing and, where we have asked for your consent to process your Personal Data, to withdraw this consent. Where you withdraw your consent, please note a) this will not affect the legitimacy of prior processing conducted with your consent, and b) we may still continue to process your Personal Data if we have another lawful basis for doing so.

Where we process your Personal Data because we have a legitimate interest in doing so (as explained above), you also have a right to object to this.

We hope that we can satisfy queries you may have about the way we process your Personal Data. However, if you have unresolved concerns you also have the right to complain to appropriate data protection authorities (in the case of the UK, the Information Commissioner).