1. Overview
1. 1 This privacy policy covers the use of your personal data by Harding Brothers Retail Operations Limited (“Harding”) through our Crew Portal (and other means of communication) once you have progressed beyond our initial recruitment stage in respect of your recruitment and any subsequent onboarding.
1.2 Any references in this privacy policy to “we” or “us” are to Harding. “Personal data” means any information relating to an identified or identifiable individual.
1.3 This privacy policy sets out:
1.3.1 What personal data we might collect about you;
1.3.2 How we might use that personal data;
1.3.3 What personal data we might share with others; and
1.3.4 Your rights relating to the personal data we process.
2. What personal data do we collect?
2.1 Once you have passed our initial recruitment stage, the personal data that we collect, store and process may include:
2.2 Information you have provided: This might be personal data you have provided voluntarily through our Crew Portal or inputted at the initial stage of recruitment into our careers website and which will be transferred into this portal if you have progressed to a further stage of the recruitment process. Such personal data includes (but is not limited to):
2.2.1 Personal information supplied such as your name, email address & phone number;
2.2.2 Proof of travel documents (driving licence, passport, national identity card etc);
2.2.3 Professional certificates;
2.2.4 Medical/vaccination certification;
2.2.5 References;
2.2.6 Next of kin details;
2.2.7 Personal data included in your CV;
2.2.8 Personal data contained in cover letters;
2.2.9 Any personal data you enter into any application form linked to the Crew Portal or the Talos site;
2.3 Information from third parties: As part of progressing your application for employment, we may request and receive personal data about you from third parties. Examples include:
2.3.1 Professional and personal references from your previous employers or other referees you have provided; and
2.3.2 Pre-employment checks undertaken by third party providers.
2.4 Sensitive (or ‘special category’) personal data: We only process sensitive personal data about you in cases in which it is necessary. Sensitive personal data processed by us may include (but is not limited to):
2.4.1 Personal data relating to your health: We may require you to undergo health screening as part of your pre-employment checks. While we would not receive detailed information, we would process personal data indicating if your health status was sufficient to accept a role. We may also require you to be tested for the use of drugs and other substances where these are illegal or prohibited by company policy. We will also process health data that you voluntarily provide to us, such as a vaccination certificate or indication of vaccine status. In addition, we provide occupational health services and, where relevant, may request information about treatment or support required.
2.4.2 Biometric data for the purposes of identifying individuals: Photographs of crew members are used for identification purposes to maintain security and safety whilst crew members are on board our cruise line partners’ ships, and so your photograph may be required to be provided as part of the onboarding process.
2.5 Personal data relating to criminal convictions and offences: We may from time to time process personal data relating to criminal convictions and offences. This may be provided, for example, by means of disclosures made as part of the recruitment process or as a condition of specific roles, or if screening checks reveal information relating to such convictions or offences.
2.6 Anonymised Data: We may completely anonymise personal data so that you are no longer identifiable from such data and continue to use any such anonymised data. We will use data outside the scope of this privacy policy only when it is fully anonymised, for example, in order to undertake statistical analysis and to review, develop and improve the employment services we offer. We may also process anonymised data in order to conduct research to provide longer-term insight into the effectiveness of our candidate/employee services, and to support our service planning and delivery.
General note: Please note that if you do not provide all the personal data we request, it may not be possible for us to finalise your recruitment process.
3. Legal basis
3.1 We use your personal data through reliance on the lawful basis of legitimate interests in order to:
3.1 .1 Communicate with you about your offer of employment;
3.1.2 Communicate with you regarding ship placements;
3.1.3 Process personal data about you for the purpose of pre-boarding activities;
3.1.4 Provide training and improve the employment services we offer;
3.1.5 Maintain health, safety (including by producing accident/incident reports), security, and discipline, and prevent fraud;
3.1.6 Monitor and improve the effectiveness of our pre-boarding, onboarding, and debarking processes; and
3.1.7 Analyse and improve the training and career development provision for shipboard employees.
3.2 We may also need to request and process your personal data if it is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract. This may include: conducting background checks to ensure your suitability for the role; processing your employment contract; providing training specifically referred to in the employment contract; the payment of salary and provision of benefits set out in the contract; and undertaking end-of-contract evaluations.
3.3 If we require your consent to process any personal data then we will inform you of this consent requirement, and request such consent, at the point of data entry. For example, if you have consented to receive careers marketing communications from us and related processing to track the response to our careers marketing communications.
3.4 If we wish to use your personal data for any purpose unrelated to recruitment or employment, we will first request your consent.
3.5 In some limited cases, we may be subject to a legal obligation in respect of which it is necessary to process your personal data. If this happens, we will only process the personal data necessary pursuant to the relevant requirements.
3.6 In the case of processing special category data, in addition to reliance on a lawful basis, we only process such data in cases in which we satisfy a relevant condition, for example: we have obtained your explicit consent; or such processing is in order to give effect to our rights or obligations in the field of employment; or it is necessary to protect your vital interests and you are not able to provide consent.
3.7 In the case of processing personal data relating to criminal convictions or offences, in addition to reliance on a lawful basis, we only process such data in cases in which we satisfy a relevant condition, for example, consent or regulatory requirements relating to unlawful acts and dishonesty.
4. Sharing data
4.1 The personal data that you submit to the Crew Portal may be processed by Harding as the controller and also by our processor, Adonis AS, which will collect and store your personal data on our behalf.
4.2 Where personal data about you is disclosed to third parties in connection with your application/employment or as otherwise required by law, it will be restricted to only those details that are necessary for the purpose of the processing.
4.3 Examples of the third parties with whom your personal data may be shared are (but are not limited to):
4.3.1 Providers of HR and payroll software and services: Where necessary, access to your personal data may be given to: HR software providers; payroll software providers and our payroll agent; and Learning Management System (LMS) software providers.
4.3.2 Our cruise line partners: Where required to do so, we will disclose personal data to our cruise line partners to enable the processing of your embarkation/debarkation.
4.3.3 Immigration and other public authorities: Where required and lawful, we will disclose the personal data necessary for compliance with the requirements of government, law enforcement agencies, and other public authorities, including customs and immigration authorities;
4.3.4 Tax, benefits, and corporate reporting: Where required and lawful, we will report to appropriate government agencies on your earnings and any tax deducted at source;
4.3.5 Law enforcement: Where required and lawful, we will disclose personal data to law enforcement authorities;
4.3.6 Maritime authorities: Where required and lawful, we will disclose personal data to maritime authorities.
4.4 We contract with other companies and individuals for them to perform certain activities on our behalf. Examples include (but are not limited to):
4.4.1 Pre-employment screening: We conduct pre-employment and employment background screening and may share personal data about you with recognised screening providers;
4.4.2 Drug screening: If you are required to undergo screening for illegal substances, these tests will be processed by third party providers;
4.4.3 Travel: If the company arranges travel for you, we may pass your personal data on to relevant suppliers of your travel such as travel agents, airlines, hotels, and transport companies;
4.4.4 Health: We may share personal data with our third-party healthcare and medical insurance providers;
4.4.5 Occupational Health: If you require occupational health support, you may be asked to provide personal data to an external occupational health provider contracted to act on our behalf.
4.5 We do not routinely share personal data with trade unions but may do so at your request and with your consent.
4.6 At your request and with your consent, information relating to your employment or earnings may be disclosed to other parties in connection with applications or requests you may have made to or through them.
5. International transfers
5.1 We may undertake international transfers of your personal data; for example, in respect of your onboarding to vessels and for administrative purposes linked to your recruitment and/or employment. Such international transfers may be undertaken from the UK and/or EEA to the following countries or territories: Guernsey (through reliance on adequacy regulations or an adequacy decision); the USA (through reliance either on the basis of standard contractual clauses accompanied by supplementary measures to the extent required or reliance on a derogation such as explicit consent to such a transfer). Copies of the safeguards relied upon may be requested from data.protection@hardingretail.com.
5.2 International transfers may also be undertaken from the UK to the EEA (through reliance on adequacy regulations), for example, to upload personal data to Adonis AS. In addition, transfers may also be undertaken from the EEA to the UK, for example, for Harding to access the personal data stored on Adonis AS (through reliance on an adequacy decision).
5. Data security
6.1 We take the security of candidate/employee personal data seriously, and use technical and organisational security measures to ensure a level of security appropriate to any risks posed by the processing, including policies, standards, technological solutions and ongoing training to safeguard the personal data we process from improper access, use, alteration, destruction and loss. Your personal data is only accessed by relevant and authorised personnel.
6.2 Where we share personal data with other companies, we require those companies to process personal data to an equivalent or higher level of security. We take care only to disclose your personal data where necessary to authorised persons and undertake checks prior to providing personal data in cases in which there is any doubt about the entitlement of a third party to be provided with your personal data.
6. Your data access rights
7.1 You have the following rights regarding your personal data:
7.1.1 Right to information: You have the right to be provided with clear, transparent and easily understandable information about what personal data is processed, why and by whom it is processed. This is why we are providing you with the information in this privacy policy.
7.1.2 Right to access: You have the right to obtain access to your personal data (if we are processing it), and certain other information (similar to that provided in this privacy policy).
7.1.3 Right to rectification: You are entitled to have your personal data corrected if it is inaccurate or incomplete. You are also able to amend some of your personal details directly through your self-service access to the Crew Portal.
7.1.4 Right to erasure: In certain circumstances you can request for your personal data to be erased from our records. This is not a general right to erasure; there are exceptions.
7.1.5 Right to restrict processing: You have rights to ‘block’ or suppress further use of your personal data. When processing is restricted, we can still store your personal data, but may not use it further.
7.1.6 Right to object to processing: You have the right to object to certain types of processing, in certain circumstances. In particular, you have the right to object to the processing of your personal data based on grounds of legitimate interest.
7.1.7 Right to object to and not be subject to automated individual decision-making: Subject to some limited exceptions, you also have the right to object to automated processing, including profiling; and not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
7.1.8 Right to data portability: You have the right to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
7.1.9 Right to withdraw consent: If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).
8. Contact information
8.1 To exercise your rights or to contact us with any questions about this privacy policy or about how we handle your information, please contact us using: data.protection@hardingretail.com.
8.2 You may also make a complaint to the relevant data protection supervisory authority. In the UK, this is the Information Commissioner and further information is available here: https://ico.org.uk/make-a-complaint/.
9. Length of data storage
9.1 We do not hold your personal data for longer than is necessary for the purposes of the processing.
9.2 It is sometimes necessary to retain employment data for specific periods to satisfy mandatory reporting requirements.
9.3 If you withdraw from the employment or onboarding processing, then your account will be deactivated and your personal data will be fully anonymised so that you can no longer be identified.
9.4 You can also request to withdraw your details and any application you have made at any time and thereafter your personal data will be fully anonymised so that you can no longer be identified.
10. Privacy policy changes
10.1 From time to time we may make changes to this privacy policy to ensure that it is accurate and up to date and to reflect any changes in the law. This policy was last updated on 12 July 2021.