Privacy Policy

1. Data Controller

Nordic Crew Worldwide, S.L. ("NCW") is the data controller for all personal data collected through Maritime Delivery. Contact: hello@nordiccrewworldwide.com

NCW has assessed its DPO obligation under Article 37 GDPR. As NCW does not fall within a mandatory DPO sector under Spanish law, a formal DPO has not been appointed. Our designated privacy contact will respond to all rights requests and supervisory authority enquiries.

2. What Data We Collect and Why

2.1 Crew Members

• Identity data: full name, date of birth, nationality, passport or national ID number, photo ID document
• Contact data: email address, phone number, country of residence
• Professional data: certifications, STCW endorsements, sea service records, qualifications, crew level, years of experience
• Platform activity: applications, assignment history, messages, login events
• Technical data: IP address, browser type, session data, device identifiers

2.2 Clients

• Identity data: name, company name, company registration number
• Contact data: email, phone, country
• Vessel data: vessel name, type, flag state, registration documents
• Financial data: invoice records, payment history
• Career tools (verified crew): a sea-time logbook you maintain (vessel, role, dates, miles) and a CV generated from your profile — used only to provide these features (contract, Art. 6(1)(b)).
• Crew search: verified boat owners, recruitment agencies and commercial fleets can find Crew Members whose photo ID and/or at least one certificate we have verified. They see your position, years of experience, country of residence, regions, vessel types, availability, verified certificates, the skills you rate yourself on, logbook roles and dates, rating and a heavily blurred photo — never your name, contact details, nationality, identity documents or vessel names. If a Client asks to contact you, we ask you before sharing anything. Legal basis: our legitimate interest in matching crew with work on the platform you joined for that purpose (Art. 6(1)(f)). You can switch this off at any time under Skills & crew search; you can also object (Art. 21).
• Crew community: posts and replies you write on the crew community board are shown to other crew members with your first name and last initial. New posts are checked by our team before they are published, and we record that you accepted the community rules. Reports about posts are seen only by our team, and the reporter is never shown to the member reported. You can delete your own posts at any time; posts are deleted with your account. If you sign up for a networking event or expert session (Crew Premium), or tell us you would like to attend, speak or share your expertise, we store your sign-up, topics and message so we can organise it and contact you. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• Sea calendar (optional): the dates you mark as open, maybe or busy, and private notes. Verified Clients see only your open and maybe dates in crew search, never busy periods or notes. Legal basis: your consent / our contract with you (Art. 6(1)(a)/(b)). You can delete periods at any time.
• Job alerts (optional): your alert preferences (type of work, positions, vessel types, regions, minimum pay) and which alerts we sent you, used to email you matching assignments. You can switch alerts off or unsubscribe from notification emails at any time.
• Assignment workspace: when an assignment is agreed, we store the version of the terms each party accepted (name and time), the voyage log (notes, positions, issues and photos you add), boat handover reports at pickup and delivery (vessel condition, damage, engine hours, fuel, equipment, documents, photos) and the drawn signatures and names of the people who sign them. This is used to perform the contract between client and crew and to resolve claims and disputes. Only the client, the crew members confirmed on that assignment and NCW staff can open these files; on assignments with several crew members, each crew member sees the names of the others and whether they have accepted or signed. Your own log entries and uploads are deleted with your account; signed handover reports and accepted terms are kept as the other party's contract record for the retention period in section 4.
• Crew network and messages (crew only): approved crew members can find each other by name, add each other and send direct messages once both have accepted. Other crew see your first name, last initial, crew level and whether you are verified — never your contact details — and you can switch off being found by name, remove or block anyone. We store connections and messages to provide the service; our team does not read messages unless one is reported to us. Messages and connections are deleted with your account. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• Anonymous community posts: when you post or reply anonymously, other members see “Anonymous crew member”, but we still know and store who wrote it, so our team can review posts before they go live and act on reports.
• Crew Manager (company Clients): recruitment agencies and commercial fleets can keep crew lists, rotations, certificates and candidates in Crew Manager. For crew records they enter themselves, the company is the controller and we only store the data for them as processor (see Terms, section 21). If a company asks to add you, a crew member, to its crew list, you decide: if you accept, it sees your name, rank and the names and expiry dates of your certificates — never the documents, your ID or your contact details — and you can stop sharing at any time under “Companies on my record”. If you applied to a company’s listing, it can add you to its candidate list for that position, as it already sees your application. Legal basis: performance of our contracts (Art. 6(1)(b)) and, for linking, your consent (Art. 6(1)(a)).
• Live position during a delivery: crew on an assignment can share their position and ETA with the client. It is only shared when the crew member presses the button — never in the background — and only the client of that assignment sees it. Positions are deleted 30 days after the last update, or with the account. Legal basis: performance of the assignment contract (Art. 6(1)(b)).
• Availability requests and favourites: clients can mark crew they have worked with as favourites and ask whether they are free on certain dates; the crew member answers yes or no. Legal basis: Art. 6(1)(b).
• CV import (crew): if you upload your CV to fill in your profile, the file is read once to suggest a profile description and the certificates it lists. Nothing is saved until you confirm, and the CV file itself is not stored. Certificates added this way show “document missing” and are never verified until you upload the certificate and our team has checked it.
• Fleet import (company Clients): agencies and fleets can upload a fleet list to add vessels. The file is read once and not stored; only the vessels they choose are saved.
• Calendar sync: if you turn it on, your calendar app fetches your Maritime Delivery dates from a private link. Anyone with the link can see those dates, so keep it private; you can replace it at any time.
• Crew Manager details: in Crew Manager a company may also record sea service, training, wages for its payroll and internal evaluations of crew. The company is the controller of this data; you can ask the company for a copy under your GDPR rights.
• Video interviews: when a client requests an interview with an applicant, we store the request, the times the crew member proposes, the chosen time and the messages Maritime Delivery posts in the interview thread. Interviews are hosted by Maritime Delivery and recorded (audio and video) so that agreements cannot be moved off the platform and so that complaints and disputes can be resolved; both participants are told before the interview and confirm this. Recordings are kept for 90 days and then deleted, unless they are needed for an open dispute or legal claim. Legal basis: our legitimate interest in preventing circumvention and fraud and in resolving disputes (Art. 6(1)(f)); you may object, but then the interview cannot take place through the platform.
• Recommending a colleague: when a crew member recommends someone for an assignment, we store the recommender, the assignment, the email address entered and the optional note, and send that person one email (or a notification if they already have an account). The client sees the recommender's first name and initial next to the applicant. Addresses of people who do not join are deleted after 90 days. Legal basis: our legitimate interest in letting members refer colleagues (Art. 6(1)(f)); the recipient can ask us to delete their address at any time.
• Match score: we compare the requirements in a listing with your own profile, certificates and sea calendar to show a match percentage to you and to the client you apply to. It is a simple, explainable comparison — not an automated decision; the client always decides.
• Client dashboard & invites: clients see the boats from their own listings and the crew they have previously confirmed, and can invite that crew to apply for a new assignment. We record each invite to prevent repeat messages.
• Professional profile and shareable link (optional): languages and references you add (name, role and vessel type of the reference — please only add people who agreed; their contact details are never published). If you switch on your shareable profile link, anyone with the link can see your first name and last initial, verified certificates, logged sea time (without vessel names), reviews, languages, references and open dates — never your contact details, ID documents or nationality. You can switch the link off or replace it at any time.
• Reviews and track record: star ratings and comments from completed assignments, and the number of assignments completed, are shown on your profile to Clients and on your shareable link, without the reviewer’s name.
• Crew Premium data (optional subscription): profile banner, photos, video link, headline and availability you choose to add; anonymous counts of Clients who viewed your application (no names are shown to you); and, with your Premium subscription, your name, headline, level, rating and certificate count are shared by email with Clients whose assignment matches your verified certificates (contract, Art. 6(1)(b)).
• Tax reporting data (Crew Members): legal name, date of birth, tax identification number, address and IBAN — collected and reported to the Spanish Tax Agency (AEAT) because EU Directive 2021/514 (DAC7) and Royal Decree 117/2024 legally require it (Art. 6(1)(c) GDPR). Retained for 10 years as required by DAC7.

2.3 Automatically collected

IP addresses, browser type, pages visited, session duration — processed under legitimate interests (Art. 6(1)(f) GDPR) for security and fraud prevention. LIA available on request.

3. Legal Bases for Processing

• Contract performance (Art. 6(1)(b)): Account creation, matching profiles with listings, payment processing via Stripe.
• Legitimate interests (Art. 6(1)(f)): Identity verification, fraud prevention, crime prevention (including vessel theft), platform security. For identity documents: protection of Clients and third parties from unverified individuals accessing high-value maritime assets. LIA available on request.
• Legal obligation (Art. 6(1)(c)): Compliance with maritime, tax, employment law, and law enforcement cooperation obligations including Spanish tax law (Ley 58/2003).
• Consent (Art. 6(1)(a)): Where explicitly consented, including for special category data.

3.1 Special category data (Article 9 GDPR)

Passports and national ID documents contain nationality data constituting special category data under Art. 9(1) GDPR. NCW processes all such documents on the basis of your explicit consent under Art. 9(2)(a) GDPR — separate from and independent of acceptance of the Terms. This consent can be withdrawn at any time; withdrawal results in account suspension. NCW does not use automated biometric recognition.

4. Data Retention

• Active account data: retained for the duration of your account.
• Identity documents — standard retention: 30 days after verification, then permanently deleted. A verification record (document type, issuing country, date, outcome) is retained for 24 months. Where a Crew Member is confirmed for an assignment before the 30-day period expires, the active assignment retention period applies automatically from the date of confirmation.
• Identity documents — active assignment: Retained for the duration of the assignment and 90 days after confirmed completion, to enable resolution of any claims or incidents. Consistent with standard practice in vehicle rental and maritime crewing.
• Identity documents — extended (fraud / crime / vessel theft): Retained for as long as necessary for: (a) prevention, detection, investigation or prosecution; (b) establishment, exercise or defence of legal claims; or (c) law enforcement cooperation. Based on Art. 6(1)(f) and Art. 17(3)(e) GDPR, applied case-by-case with internal documentation. Documents not retained beyond conclusion of proceedings.
• Post-activity data: 24 months after last meaningful activity. Reminders sent 30 days and 7 days before expiry.
• Financial records: 7 years (Spanish tax law — Ley 58/2003).
• Consent records (standard): 12 months from date given or last renewed.
• Consent records (special category data, Art. 9): 3 years from date given, renewed, or withdrawn.
• Security and fraud-prevention logs: 12 months, or longer for active investigations.

Anonymisation is performed by irreversible removal of all direct and indirect identifiers. Pseudonymised data (which could be re-identified) is not treated as anonymised under this Policy.

5. Data Security (Article 32 GDPR)

NCW implements: TLS/HTTPS encryption on all connections; encryption of data at rest (Vercel and Neon); access controls on a need-to-know basis; periodic security reviews; staff data protection training; documented incident response procedure; regular backup and recovery testing; and secure deletion procedures. Absolute security cannot be guaranteed.

6. Automated Decision-Making (Article 22 GDPR)

Certification gating: Automatically restricts listings a Crew Member can apply for based on verified certifications. You have the right to request human review if incorrectly assessed.

Account suspension triggers: Automated checks may flag accounts for review — all flags are subject to human review before a permanent decision is made. You have the right to contest any automated decision.

No other automated decision-making that produces legal or similarly significant effects is used.

7. Data Processors, International Transfers and Client Controllers

All processors have Data Processing Agreements (Art. 28 GDPR). Transfers outside the EEA are made under SCCs. Transfer Impact Assessments (TIAs) have been conducted for all US processors — summaries available on request.

We do not sell personal data. We do not share data with advertising networks.

NCW does not use your personal data to train AI or machine learning models.

8. Personal Data Breaches and Law Enforcement Sharing

NCW will notify the AEPD within 72 hours where required (Art. 33 GDPR), and notify affected individuals directly for high-risk breaches (Art. 34 GDPR). All breaches are recorded in our internal breach register.

Report security incidents at hello@nordiccrewworldwide.com.

9. Your Rights Under GDPR

• Right of access (Art. 15): Request a copy of all data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate data via your profile or by contacting us.
• Right to erasure (Art. 17): Request deletion, subject to legal retention. Where NCW declines under Art. 17(3) GDPR, we will notify you in writing within one month, specifying: (a) the legal basis; (b) anticipated duration of retention; and (c) your right to complain to the AEPD.
• Right to restriction (Art. 18): Request restricted processing in certain circumstances.
• Right to data portability (Art. 20): Request your data in JSON or CSV format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.
• Rights in relation to automated decisions (Art. 22): Request human review of any automated decision.

Contact: hello@nordiccrewworldwide.com. We respond within one calendar month. Identity verification may be requested before processing a rights request.

10. Cookies

We use: strictly necessary cookies (session authentication — no consent required); and functional cookies (consent preferences). Our only non-essential cookie is an optional partner-referral cookie that is set only with your consent (Marketing category). We do not use analytics or advertising cookies. Where we introduce analytics in future, this policy will be updated and explicit consent obtained. Managed by Cookiebot (Cybot A/S, Denmark). Update via "Cookie Settings" in the footer.

11. Complaints

Agencia Española de Protección de Datos (AEPD) · C/Jorge Juan, 6 — 28001 Madrid, Spain · Tel: +34 900 293 183 · www.aepd.es

We encourage you to contact us first at hello@nordiccrewworldwide.com. We respond within one calendar month.

13. Policy Governance

This Policy is owned by the designated privacy contact at Nordic Crew Worldwide, S.L. and is reviewed at least annually or whenever a material change in processing activities occurs. The current version and version history are maintained in NCW's internal data governance records. Prior versions are available on request. A Records of Processing Activities (ROPA) is maintained in accordance with Article 30 GDPR and is available to supervisory authorities upon request.

12. Changes to this Policy

We will notify you of material changes at least 14 days before they take effect. Where a material change affects processing based on your consent — including special category data under Section 3.1 — NCW will request explicit renewed consent before the change takes effect and will not rely on continued use as consent for such processing.