Data Privacy Notice

Effective date: 17 October 2025
Last updated: 17 October 2025

1. Introduction

CSM Ukraine Manning Agency (“we”, “our”, “us”) is committed to protecting the privacy and security of personal data collected from seafarers, employees, partners, and website visitors. This Privacy Notice explains how we collect, use, disclose, and safeguard personal information in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Law of Ukraine “On Protection of Personal Data”. We act as a Data Controller when we determine the purposes and means of processing personal data.

2. Data We Collect

  • Identification data: name, date of birth, nationality, passport/ID details, seaman’s book number.
  • Contact details: address, phone number, email.
  • Employment & qualification data: rank, sea service record, certificates, appraisals, references.
  • Medical & training information: medical fitness certificates, vaccination records, training/safety certificates (where required by maritime law).
  • Website & technical data: IP address, browser type, operating system, cookies and similar technologies.

3. Purpose of Processing

  • Evaluate and manage seafarer applications and employment records.
  • Fulfil contractual and legal obligations to our Principals, vessel owners, and authorities.
  • Comply with international maritime, tax, and immigration regulations.
  • Communicate with candidates, employees, and partners.
  • Improve website functionality, recruitment processes, and related services.
  • Internal analytics, security monitoring, and record-keeping compliance.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases under GDPR Articles 6 and 9:

  • Performance of a contract or pre-contractual measures (Art. 6(1)(b)).
  • Compliance with legal obligations (Art. 6(1)(c)) under maritime, tax or employment law.
  • Legitimate interests of CSM Ukraine Manning Agency and the Columbia Shipmanagement Group (Art. 6(1)(f)), balanced against your rights and freedoms.
  • Consent of the data subject, where required (Art. 6(1)(a)).
  • Special categories (medical data) processed where necessary for employment, social security/occupational health obligations (Art. 9(2)(b), (h)).

If processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Data Sharing and International Transfers

We may share your personal data with:

  • Columbia Shipmanagement Ltd. (Cyprus) and affiliated EU/EEA entities.
  • Vessel owners and Principals for employment and contractual purposes.
  • Regulatory authorities, flag states, and port state control where required by law.
  • Medical centers, training institutions, and insurance providers for certification and safety compliance.
  • IT and cloud service providers under contractual confidentiality and data protection obligations.

International Transfers

Where personal data are transferred outside the EU/EEA (e.g., to Ukraine or third-country flag states), we implement appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs) (Art. 46 GDPR); and/or

• Adequacy decisions issued by the European Commission.

Copies or a description of the safeguards can be requested from our DPO (see Section 10).

6. Data Retention

We retain personal data only as long as necessary for the purposes outlined above, in line with applicable law and internal policies:

  • Employment & contractual data: up to 3 years after contract termination.
  • Medical & training records: up to 5 years or as required by maritime law.
  • Recruitment applications (unsuccessful): 12 months from submission.
  • Website logs/analytics: up to 6 months.

Longer retention may be necessary to comply with legal or regulatory obligations.

7. Your Rights

  • Access your personal data (Art. 15).
  • Rectify inaccurate or incomplete data (Art. 16).
  • Erase data where applicable (“right to be forgotten”, Art. 17).
  • Restrict processing under certain conditions (Art. 18).
  • Object to processing based on legitimate interests (Art. 21).
  • Data portability (Art. 20).
  • Withdraw consent at any time (Art. 7(3)).
  • Lodge a complaint with a supervisory authority.

Supervisory authorities: You may contact the Office of the Commissioner for Personal Data Protection of Cyprus (EU reference authority) or the Ukrainian Parliament Commissioner for Human Rights (Ombudsman).

8. Security of Personal Data

We implement appropriate technical and organizational measures—including encryption, role-based access control, secure authentication, regular audits, and staff confidentiality training—to protect data against unauthorized access, disclosure, alteration, or destruction.

If a personal data breach poses a risk to your rights and freedoms, we will notify the competent supervisory authority and affected individuals in accordance with GDPR Articles 33–34.

9. Cookies and Website Tracking

Our website uses cookies and similar technologies to enhance functionality and analyze usage. You can manage preferences via our Cookie Banner or your browser settings. For details, see our Cookie Policy.

10. Contact Information

Data Protection Officer (DPO)
CSM Ukraine Manning Agency Team Lead Developer: Moldovanov Oleksandr
Email: privacy@csm-ua.com
Address: Ukraine, Odesa, 3 Sabanskiy Lane, Office 11n

11. Updates to this Notice

This Privacy Notice may be updated periodically to reflect legal, technical, or operational changes. The latest version will always be available on our website. Please review it regularly.