Last updated: 19 October 2026

 

Purpose and scope

This policy sets out the data-protection standards for Boreas Maritime B.V. and the personnel and service providers acting on its behalf. It concerns the handling of personal data, rather than general employee conduct. It is an internal company policy and is not presented as an approved sector code under Article 40 GDPR. It must be read together with our Privacy Statement and Cookie Policy.

 

1. Applicable rules and responsibility

Personal data must be handled in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act and other applicable legislation. Boreas must identify the controller for each activity, document responsibilities and ensure that staff know whom to contact about privacy matters.

 

2. Lawfulness and transparency

Every processing activity must have a specified purpose and an appropriate legal basis. Depending on the activity, this may be necessary steps requested before a contract, performance of a contract, a legal obligation, a documented legitimate interest or valid consent. Consent must be freely given, specific, informed and withdrawable. A list of business purposes is not, by itself, a legal basis. Individuals must receive clear information about how their data is used, including when information is obtained from another source.

 

3. Necessary and accurate information

Only information relevant and necessary for the stated purpose may be collected or shared. Staff must take reasonable steps to keep records accurate and correct errors. Candidate screening must be relevant to the role and proportionate. Publicly accessible information is not automatically free to collect or reuse.

 

4. Sensitive information and identification

Health information and other special-category data require both a lawful basis and an applicable exception under Article 9 GDPR. Criminal-record information is subject to Article 10 and applicable national law. A general consent form or the fact that information is public does not remove all legal restrictions. National identification numbers and identity-document copies must only be processed where legally permitted and necessary. Medical details must not be requested in general recruitment messages; any necessary fitness-to-work information must be handled through the appropriate authorised process.

 

5. Systems, access and confidentiality

Boreas uses Wix for its website, Outlook for communication and Invu for candidate and personnel administration. Access must be restricted to authorised people who need the information for their work. Staff must preserve confidentiality, use approved systems and apply appropriate technical and organisational security measures. Access must be reviewed and removed when it is no longer needed.

 

6. Sharing and international transfers

Personal data may only be shared for a specified, lawful purpose with the information limited to what the recipient needs. Boreas shares relevant data with its offices in Croatia, Bulgaria and Indonesia and has agreements with these offices. Transfers involving Indonesia must also satisfy the GDPR rules for transfers outside the European Economic Area. A general cooperation agreement alone is not sufficient: the applicable transfer mechanism, any necessary assessment and supplementary safeguards must be verified and documented. Service providers processing data on Boreas’ instructions must have an appropriate data-processing agreement.

 

7. Retention and deletion

The stated retention period for personnel files is five years after the end of employment, subject to a documented assessment of which records are necessary for that period. Information that is no longer needed must be deleted earlier; records subject to a different statutory period must follow that period. A specific legal claim may justify limited further retention, which must be documented. The five-year period is not a blanket retention rule for unsuccessful applicants or all website data.

 

For an unsuccessful application, the default is deletion within four weeks after the procedure ends, unless a separate lawful reason requires limited retention. With the candidate’s permission, information may be retained for future opportunities for up to one year, with renewal or deletion at the end of that period. Active crewing or recruitment relationships must have their own documented purpose and retention assessment. Deletion must cover relevant systems and be managed appropriately for backups.

 

8. Individual rights

Individuals may request access, correction, erasure, restriction, portability where applicable, and object to processing. Consent can be withdrawn without affecting the lawfulness of earlier processing. Requests are handled without undue delay and normally within one month. Where the GDPR permits an extension of up to two additional months, the person must be informed within the first month and given the reasons. Requests are normally free; any refusal or fee must meet the limited legal conditions and be explained. Identity verification must be proportionate.

 

9. Incidents and accountability

Staff must promptly report a suspected data loss, unauthorised access or disclosure to the Operations team. Boreas must assess and document incidents and fulfil any applicable notification duties, including notification to the supervisory authority within 72 hours of awareness where required. High-risk breaches must also be communicated to affected individuals where required. Processing records, processor agreements, access controls and retention arrangements must be reviewed regularly.

 

10. Questions and complaints

Contact team@boreasmaritime.com for privacy questions or requests. Individuals may also complain to the Dutch Autoriteit Persoonsgegevens at www.autoriteitpersoonsgegevens.nl, or another competent supervisory authority.

 

Contact

Boreas Maritime B.V.
Kolk 42, 4241 TJ Arkel, The Netherlands
Email: team@boreasmaritime.com
Telephone: +31 (0)183 820 320