1. About this notice
1.1 This notice sets out the practices of the office in respect of personal information processed in connection with our services and this site. It is written with reference to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK General Data Protection Regulation as it forms part of domestic law in the United Kingdom by virtue of the European Union (Withdrawal) Act 2018 ("UK GDPR"), the Data Protection Act 2018, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA/CPRA") to the extent applicable to residents of California, and other applicable privacy and data protection laws of the jurisdictions in which we operate.
1.2 The terms used in this notice carry the meanings given to them in the GDPR and the UK GDPR. "Personal information" includes "personal data" within the meaning of those instruments and "personal information" within the meaning of the CCPA/CPRA.
1.3 We may provide more specific information at the point we collect particular information from you (sometimes called a "just-in-time" notice). Where there is any conflict between this general notice and a just-in-time notice issued in respect of a specific collection, the just-in-time notice prevails.
2. Who we are
2.1 The office is the controller in respect of the personal information described in this notice. Correspondence on data protection matters may be addressed to:
- Email: office@acmarine.co
- Subject line: "Data Protection"
2.2 Where the office is required by Applicable Law to appoint a representative in the European Union or the United Kingdom, that representative's details will be made available on request.
2.3 In certain engagements we may act as a processor on behalf of a principal who is the controller (for example, where the office administers crew payroll on the principal's instructions). The data-processing arrangements for those engagements are governed by the relevant engagement letter and any required data-processing agreement.
3. Personal information we collect
3.1 We collect personal information that is reasonably necessary to deliver our services, satisfy our regulatory and professional obligations, manage our relationships with you, and operate this site. The categories of information we collect include the following:
3.2 Identity and contact information. Full legal name, preferred name, title, date of birth, nationality, passport or identity-document number and copy, residential and correspondence addresses, telephone numbers, email addresses, and (in respect of corporate principals) the equivalent details of directors, officers, beneficial owners, settlors, trustees and authorised signatories.
3.3 Onboarding and due-diligence information. Proof of address documents, source-of-funds and source-of-wealth declarations and supporting evidence, ownership structure documentation, tax-residence information, politically-exposed-person screening outcomes, sanctions screening outcomes, and adverse-media screening outcomes.
3.4 Vessel and operational information. Vessel name, hull and IMO numbers, MMSI, flag, registry data, classification status, photographs, technical specifications, maintenance history, insurance details, certificates and surveys, log entries, port-call records, fuel and provisioning records, and information relating to charters undertaken.
3.5 Crew information. In relation to crew candidates and crew engaged on a principal's vessel under our management, we may process curricula vitae, certifications (including STCW, GMDSS, AEC and other competency certificates), seafarer's medical fitness certificate (ENG1 or equivalent), references, prior service records, photographs, passport copies, visas and immigration documentation, training records, employment contracts, payroll information, performance and disciplinary records, and emergency contact details.
3.6 Financial information. Bank account details, escrow instructions, transaction records, retainer payment history, deposit records, advance provisioning allowance accounts, and similar.
3.7 Correspondence and engagement records. Letters, emails, meeting notes, telephone-call summaries, instructions, advice given, deliverables produced, and the records required by Applicable Law and professional standards to demonstrate the work undertaken.
3.8 Site information. When you visit this site, our infrastructure providers automatically record limited technical information about your visit, including your internet protocol (IP) address (in truncated form where feasible), user-agent string, request method and path, response status, referrer and request time. This information is used to detect abuse, maintain security and produce aggregated traffic statistics, and is retained for short periods only.
3.9 Inquiry-form submissions. When you submit an inquiry through this site, we receive the name, email address and message you provide, together with the slug of any vessel listing you are inquiring about. We do not collect any further information through the site itself.
4. How we collect it
4.1 We collect personal information from the following sources:
(a) Directly from you, when you contact us, complete the inquiry form, attend a meeting, enter into a letter of appointment, provide identity documents and supporting materials, or otherwise communicate with us.
(b) From referrers, including existing principals, captains, lawyers, accountants and brokers who introduce you to the office in confidence.
(c) From public sources, including registers of companies, registers of vessels, classification-society records, court and insolvency records, news media and licensed databases.
(d) From specialist screening providers, who supply us with sanctions, politically-exposed-person and adverse-media data drawn from public, official and proprietary sources, for the purposes of anti-money laundering and compliance.
(e) From counter-parties and authorities involved in a transaction or operation (for example, opposing brokers, yards, surveyors, classification societies, flag administrations, port authorities, customs, marinas, insurers and underwriters), where they share information that is necessary for the conduct of the engagement.
5. Why we use it and our legal bases
5.1 We use personal information for the purposes set out below. Under the GDPR and the UK GDPR, each use is supported by one or more of the following legal bases: (i) performance of a contract or steps prior to entering into a contract; (ii) compliance with a legal obligation; (iii) our legitimate interests (or those of a third party), where these are not overridden by your interests, rights and freedoms; (iv) your consent, where required; and (v) the establishment, exercise or defence of legal claims.
5.2 To provide our services, including evaluating, accepting and operating engagements; communicating with principals; preparing reports, advice and deliverables; coordinating with third parties on a principal's behalf; and administering retainers and disbursements. (Legal bases: contract; legitimate interests in operating an effective professional practice.)
5.3 To comply with our legal and regulatory obligations, including customer due diligence, ongoing monitoring, sanctions screening, anti-bribery checks, tax reporting (such as the Foreign Account Tax Compliance Act and the Common Reporting Standard, to the extent applicable), responding to lawful requests by competent authorities and assisting investigations. (Legal bases: legal obligation; legitimate interests in compliance and risk management.)
5.4 To establish, exercise and defend legal claims, including managing disputes, claims, arbitrations, court proceedings and insurance matters. (Legal bases: legitimate interests; legal claims.)
5.5 To run our practice, including bookkeeping, audit, professional indemnity insurance, training, business continuity, conflicts management and quality assurance. (Legal bases: legitimate interests; legal obligation, where applicable.)
5.6 For crew placement, we use crew candidates' information to assess suitability for vessels, present candidates to principals (in identifiable form, with consent), verify certifications at source, arrange interviews, and (where placed) assist a principal in administering crew matters in accordance with applicable maritime employment regulations. (Legal bases: pre-contractual steps and contract; legitimate interests in operating a curated crew network; legal obligation in respect of certifications and right-to-work checks.)
5.7 For security and abuse prevention on this site and our infrastructure. (Legal basis: legitimate interests in operating a secure service.)
6. Special category data
6.1 The GDPR and the UK GDPR define certain types of personal information as "special category data" requiring additional protection. The office does not seek special category data save where directly relevant to a crew engagement (for example, a seafarer's medical fitness certificate, which evidences general fitness for sea service) or where a principal voluntarily provides such information in the course of a sensitive matter.
6.2 Where we process special category data, we do so on the basis of an exception in Article 9 of the GDPR (or the equivalent provision of the UK GDPR), most commonly the establishment, exercise or defence of legal claims, the protection of vital interests, employment, social-security and social-protection law obligations, or your explicit consent.
6.3 We do not seek or knowingly process personal information about a person's criminal convictions or offences other than via the regulated sanctions, politically-exposed-person and adverse-media screening described above, and in each case on the basis of legitimate interests and applicable derogations for anti-money laundering and fraud prevention.
7. Recipients of your information
7.1 We share personal information with the following categories of recipient on a need-to-know basis and with appropriate confidentiality protections:
- Members of the office bound by confidentiality obligations.
- Independent professional advisers (lawyers, accountants, tax advisers, naval architects, marine engineers, surveyors) instructed in connection with an engagement.
- Counter-parties and their advisers in transactions, charters or refits we coordinate.
- Banks, payment-service providers, escrow agents and insurance brokers and underwriters.
- Yards, marinas, port agents, customs agents and provisioners.
- Classification societies, flag administrations and port-state authorities.
- Specialist providers of sanctions, politically-exposed-person, adverse-media and identity-verification services, operating under our written instructions.
- Hosting, security and communications providers operating the digital and physical infrastructure of the office, operating under written agreements that restrict their use of personal information to the provision of those services and that include appropriate security and confidentiality undertakings.
- Acquirers or potential acquirers of all or part of the office's business or assets, in connection with a corporate transaction, restructuring or reorganisation, on customary confidentiality terms.
- Competent authorities (including tax, regulatory, law-enforcement and judicial authorities), where required by Applicable Law, court order, subpoena or analogous lawful request.
7.2 We do not sell, rent or barter personal information. We do not engage in cross-context behavioural advertising. We do not allow third parties to use personal information collected through this site for their own advertising or analytics purposes.
8. International transfers
8.1 The office operates internationally. Personal information may be transferred to, and processed in, jurisdictions outside the European Economic Area, the United Kingdom and Switzerland, including where principals, vessels, counter-parties, advisers or recipients listed at clause 7 are located outside those jurisdictions.
8.2 Where a transfer is made to a jurisdiction that does not benefit from an adequacy decision under the GDPR or the UK GDPR, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and supplementary measures where appropriate. Copies of the relevant clauses are available on written request, subject to redaction of commercially sensitive information.
8.3 In limited circumstances we may rely on a derogation under Article 49 of the GDPR (or the equivalent provision of the UK GDPR), such as where the transfer is necessary for the performance of a contract concluded in your interest, for the establishment, exercise or defence of legal claims, or where you have given explicit consent.
9. How long we keep it
9.1 We keep personal information only for as long as is necessary for the purposes for which it was collected, subject to retention obligations imposed by Applicable Law, the requirements of professional indemnity insurers, and our legitimate interests in establishing, exercising and defending legal claims.
9.2 Indicative retention periods are as follows. The periods stated start from the closing of the relevant engagement or other relevant trigger event.
- Engagement files, including correspondence, instructions and deliverables: typically seven (7) years, consistent with maritime professional convention and limitation periods.
- Anti-money-laundering records, including identification documentation and due-diligence outputs: typically five (5) years, or longer where Applicable Law so requires.
- Brokerage transaction files, including MOAs, sale documentation and commission records: typically seven (7) years.
- Crew placement files, including candidate cv, certifications and references: typically three (3) years from the last interaction with the candidate, longer where the candidate has been placed.
- Inquiry-form submissions: until the matter is closed, and then for a further two (2) years for legitimate-interest purposes, unless you ask for earlier deletion.
- Site technical logs: typically ninety (90) days, longer where retention is necessary to investigate a specific security incident.
- Bookkeeping records: as required by Applicable Law in the relevant jurisdiction (typically six (6) to ten (10) years).
9.3 At the end of the retention period, personal information is securely deleted or anonymised. Where we retain information for legal-claim or regulatory purposes after the standard retention period, access is restricted to those with a need to know.
10. How we protect it
10.1 The office maintains administrative, technical and physical safeguards designed to protect personal information against unauthorised or unlawful processing, accidental loss, alteration, disclosure or access. Measures include role-based access controls, multi-factor authentication for privileged systems, encryption of data in transit and at rest, vendor due diligence, written confidentiality undertakings from staff and providers, and a written incident-response procedure.
10.2 No system can be guaranteed to be impervious to compromise. Where a personal-data breach occurs that meets the threshold for regulatory notification under Applicable Law, the office will notify the competent supervisory authority within the period prescribed by law, and, where appropriate, the individuals affected.
10.3 We do not publish the technical details of our infrastructure on this site. Such information is made available to professional advisers, insurers and regulators on a confidential basis where they reasonably require it.
11. Your rights
11.1 Subject to Applicable Law, you have the following rights in relation to your personal information:
- Right of access to information we hold about you and a copy of it.
- Right to rectification of inaccurate or incomplete information.
- Right to erasure in certain circumstances (sometimes called the "right to be forgotten").
- Right to restrict processing in certain circumstances.
- Right to data portability in certain circumstances.
- Right to object to processing on the basis of our legitimate interests, and to object to direct marketing at any time.
- Right to withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing carried out before the withdrawal).
- Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you. The office does not currently make any such decisions.
- Right to lodge a complaint with a supervisory authority (see clause 16).
11.2 Certain rights may be limited or qualified by Applicable Law. For example, we may decline a request for erasure to the extent that we are required by law, professional convention or insurance to retain information.
11.3 Residents of California, Colorado, Connecticut, Virginia, Utah and other US states with comprehensive privacy laws may have additional or differently formulated rights, including the right to opt out of "sale" and "sharing" of personal information (we do not engage in either), the right to limit the use of sensitive personal information (we collect only what is necessary for the engagement), and the right to non-discrimination for exercising rights. To exercise any of those rights, please use the contact details at clause 16.
11.4 To exercise any right, please write to office@acmarine.co with the subject line "Data Protection". We may need to verify your identity before acting on a request. We will respond within one (1) month or, where the request is complex or numerous, within such longer period as Applicable Law permits, having notified you of the extension.
12. Marketing communications
12.1 The office does not conduct marketing campaigns and does not maintain a marketing mailing list. We may from time to time write to existing principals about matters relevant to their engagement, or to known referrers about industry matters where we have a legitimate interest in doing so. You may unsubscribe from such communications at any time by replying with the word "unsubscribe" or by writing to the office.
14. Children
14.1 Our services are intended for sophisticated adult clients and their professional advisers. The site is not directed at, and is not intended to be used by, children. We do not knowingly collect personal information about children. If you believe a child has provided personal information to us, please write to the office and we will take steps to delete it.
15. Changes to this notice
15.1 We may update this notice from time to time to reflect changes in our practices, our services, our infrastructure providers, or Applicable Law. The current version, and the effective date, are published on this page. Material changes will be brought to your attention where Applicable Law so requires.
16. Contact and complaints
16.1 Questions, requests and complaints about this notice or our processing of personal information may be addressed to office@acmarine.co with the subject line "Data Protection".
16.2 You have the right to lodge a complaint with a supervisory authority for data protection. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ico.org.uk). In the European Union, the relevant authority is the data protection authority of the member state in which you are habitually resident, in which you work, or in which the alleged infringement occurred. We would, however, appreciate the chance to address your concern before you approach the supervisory authority.