This is the Privacy Policy of Cygnus Tankers Limited, registered in England with company registration number 13835207.
Cygnus Tankers Limited (referred to as “the Company”, “we”, “us” or “our” in this policy) is committed to protecting your privacy and the confidentiality of your personal information, and hope that you reciprocate. Our policy is not just an exercise in complying with the law, but a continuation of our respect for you and your personal information.
INTRODUCTION
This Privacy Policy aims to inform you about how we collect and process any information (also known as data) that we collect from you, or you give to us. It covers information that could identify you (referred to as “personal information” or “personal data”) and information that does not (referred to as “non-personal information”). In the context of the law and this policy, “process” means collect, store, transfer, use, or otherwise act on information.
Our policy complies with the Data Protection Act (DPA) 2018 and UK GDPR legislation. The law requires us to tell you about your rights and our obligations to you in regard to the processing and control of your personal data, which we do by requesting that you read the information provided at GDPR rights for individuals
TYPES OF DATA THAT WE PROCESS
Personal information
We may collect, use, store, and transfer various kinds of personal information about you. We have collated these into the following groups:
- Identification Information, such as your name, title, and any other identifiers provided by you.
- Contact Information, such as billing and delivery addresses, email addresses, and phone numbers.
- Financial Data, such as bank account details.
- Transactional Data, such as payment details and services purchased from the Company.
- Aggregated Anonymous Data, such as IP address’, information about your device, browser history, and geolocation data.
Aggregated anonymous data is derived from personal information but does not identify individuals and therefore not considered to be personal information under the law. However, if aggregated data is combined with personal information in a way that identifies individuals, it is treated as personal information and processed according to this privacy notice.
Special personal information
Special personal information is data about your race or ethnicity, religious or philosophical beliefs, sex life or sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.
We collect special personal information via the Company’s closed-circuit TV (CCTV) system. Please refer to our CCTV policy below.
Criminal offence information
Criminal offence information is data about your criminal record and criminal activity.
We process criminal offence data during our pre-employment process when we perform a Basic DBS check and may do via our CCTV system.
THE BASES ON WHICH WE PROCESS INFORMATION ABOUT YOU
The law requires us to determine under which of six defined bases that we process your personal information and to notify you of the basis for each category. We process data on six of these bases, namely: consent, contract, legal obligation, public task, and legitimate interests. We do this after considering:
- whether the same objective could be achieved through other means
- whether processing (or not processing) might cause you harm
- whether you would expect us to process your data and consider it reasonable to do so.
We may for example process your information on this basis for the purposes of:
- record-keeping for the proper and necessary administration of our business
- conducting KYC, AML, and sanction checks
- protecting and asserting the legal rights of any party
- insuring against or obtaining professional advice which is required to manage business risk
- protecting your interests where we believe we have a duty to do so
- employment
If a basis on which we process your personal information becomes irrelevant, we will stop processing your data.
INFORMATION WE PROCESS WITH YOUR CONSENT
We have a contractual obligation with you
When you request information of our services and agree to our terms and conditions, a contract is formed between you and us. To fulfil our contractual obligations, we must process the information you provide, which may include personal information. The Company will continue processing this information until the contract ends or is terminated by either party according to the contract terms (and if applicable) the retention period.
You are employed by us
If we employ you, we will collect personal information about you and your work during your employment. This information will be used only for purposes directly relevant to your employment. This includes the following: personal details (including birthday, gender, and age), identity documents and residency status (such as right to work in the UK or visa details), bank account details for renumeration purposes, tax details (NI number and as required by the HMRC), references from 3rd parties, DBS checks, and education details. This information will only be used for purposes related to your employment. After your employment ends, we will retain your file (containing all documents and details as listed above) for six years before deleting and destroying it.
You have submitted a job application to us
If you send us information in connection with a job application, we may keep it for up to twelve months in case we decide to contact you later.
We have a legal obligation
We must process your information to comply with a statutory obligation. This may include conducting KYC, AML, and sanction checks.
You browse our website and accept our cookies
If accepted, our cookies collect aggregated anonymous data to gauge interest on our website of the services we provide. Please refer to our Cookie Policy for more information.
You are in communications with us
When you contact us via telephone, e-mail, or post, we collect your personal information to track our communications with you.
When there is no contractual relationship
When you browse our website or request more information about our business (including our services and job opportunities), you give us consent to process your information (which may include personal information).
If we receive a complaint from you
We record all information you give us to resolve your complaint. If your complaint reasonably requires us to contact another organisation or person, we may decide to give them some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we give information, and if we do, what that information is.
Wherever possible, we aim to obtain your explicit consent to process your information, for example, by asking you to agree to our use of our cookies.
We will continue to process your information until you withdraw your consent by notifying the Company’s Data Protection Officer (DPO), or it can be reasonably assumed that your consent no longer exists.
Where we need to collect personal information by law or under the terms of a contract, which you fail to provide when requested, we will not be able to perform that contract or provide a service to you, which we will notify you of this at that time.
DISCLOSURE AND SHARING OF YOUR INFORMATION
Information provided on the understanding that it will be shared with a third party
Occasionally, we must share personal information with third parties for the following reasons:
- Providing you with the services you have requested
- Record-keeping for the proper and necessary administration of our business
- Regulatory law (including for the period demanded by our tax authorities)
- Complying with other laws
- Employment
- Supporting a claim or defence in court
Information we obtain from third parties
Although we do not disclose your personal information to any third party (except as set out in this policy), we sometimes receive data that is indirectly made up from your personal information from third parties whose services we use.
Data processed outside the European Union
Our website is hosted in the UK.
We may use outsourced services in countries outside the European Union to fulfil our contractual obligations, or in other aspects of our business. Accordingly, data obtained within the UK, or any other country, could be processed outside the European Union.
INFORMATION PROVIDED BY AN AFFILIATE OR BUSINESS PARTNER
This is information given to us by you in your capacity as an affiliate or business partner of ours.
We undertake to preserve the confidentiality of the information and of the terms of our relationship. We expect any affiliate or business partner to agree to reciprocate this policy.
CONTROL OVER YOUR OWN INFORMATION
Your duty to inform us of changes to your information
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.
Request to delete your personal information
You have a legal right to request that we delete your personal data (also known as ‘right to erasure’), which you can do by submitting a verbal or written SAR to the Company. However, please note that there are some exemptions when we may not be able to comply with your request, for example, we have a legal obligation to retain the data, the data is for crime and tax-related purposes, the data is part of an investigation, etc., which will be communicated to you.
RETENTION PERIOD OF PERSONAL DATA
Except as otherwise mentioned in this privacy policy, we only keep your personal information for as long as required by us or as dictated by law.
CCTV POLICY
Purpose of CCTV System
Cygnus Tankers Limited uses Closed Circuit TV (“CCTV”) to monitor, prevent, detect, and identify criminal activities, which we do so in accordance with the Data Protection Act 2018 (UK GDPR) and as set by the ICO.
Access and disclosure
- We record footage (no audio recordings) for the purpose of monitoring, preventing, detecting, and identifying criminal activities only. This footage will not be disclosed or retained unless it is part of an incident/investigation.
- CCTV footage will be monitored to ensure that there has been no criminal activity or suspected incidents.
- Only the DPO has authorisation to view footage for the purpose of office security.
- The CCTV recording equipment is kept in a protected and secured area, which is only accessible to the DPO. However, this area might also be periodically accessed by third party maintenance contractors for necessary building servicing purposes. Contractors will not be able to view footage (as there is no monitor in this area). All third-party access will be supervised by the DPO.
- The Company’s staff have authorisation to accept SARs in the absence of the DPO.
Retention period
Footage is retained for 5 days only and is overwritten (deleted) thereafter. However, the footage may be kept for longer than 5 days (and possibly given to law enforcement) if it is part of an investigation.
Disclosure to law enforcement
- The Company’s CCTV footage will only be given to law enforcement if they submit a formal request to the Company.
- The DPO is allowed to view the requested footage before giving it to law enforcement.
- The DPO does not need to get authorisation from an individual (in the requested footage) when a request is made by law enforcement.
Processing and submitting a SAR
In accordance with GDPR law, a person can submit a SAR to view footage that the Company has (or may not have) of them. All requests received will be processed according to GDPR and regulations set by the ICO.
Should you wish to submit a SAR, please send sufficient information to enable the DPO to locate and process footage. You can send your request to any of the contact options below. We may in some cases request a form of ID (for the purpose of identifying the individual in the footage) and / or request further information if needed for processing.
Your request will be processed within the statutory one calendar month time frame. However, this might be extended to two months if we need further information or the request is complex, but you will be notified of this.
We may charge an administration fee for administrative time if the request is manifestly unfounded, or excessive.
In some cases, we may refuse a SAR if for example the footage is part of an on-going investigation, a third party is identifiable in the footage, the request is manifestly unfounded or excessive, the reason for refusal is on the ICO’s exemptions list, or the request is made by a third party who is not authorized to view another person’s footage. All reasons for a refusal will be communicated in writing.
Due to our short retention time, we may no longer have the footage, but you will be notified of this.
REVIEW OF THIS PRIVACY POLICY
We may update this Privacy Policy from time to time if necessary. The terms that apply to you are those posted here on our website, on the day you refer to our website.
CONTACT AND FURTHER INFORMATION:
Should you wish to submit a SAR, have a query recording our CCTV Policy, or make a complaint, please contact the Company or the Company’s DPO on the below:
Registered office: Cygnus Tankers Limited, The Gatekeeper’s House, The Old Pumping Station, Pump Alley, Brentford, TW8 0AP, UK
Tel: +44(0)203 815 9537
Email: [email protected]
