Privacy Policy

This privacy notice outlines the standards you can expect from us when we request or hold your personal information. It also details what we ask of you to help us keep your information accurate and up-to-date

The Merchant Navy Association (MNA) is a charity that represents all seafarers in the UK and has the additional benefit of branches in local communities.

Our Registered Address: 8 Cumberland Place, Southampton SO15 2BH

Our Registered Charity Number is 1135661

This privacy notice explains how the MNA complies with data protection laws, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Personal data refers to any information related to an identified or identifiable living individual, also known as a ‘data subject’.

A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity.

These types of identifying information are known as ‘personal data’.

Data protection law applies to the processing of personal data, including its collection, use and storage.

We understand the importance of protecting your privacy and complying with data protection laws.

If we need to collect, store, or use your personal information, we will:

• have a legal basis for doing so, and only ask for what we need
• do so in a fair and transparent way, letting you know why we need your information and how we will use it
• use it in the way we said we would and not in a way you wouldn’t expect without letting you know
• ensure that we don’t keep more than we need, for longer than we need
• make sure it is accurate and up-to-date
• make sure nobody has access to it who shouldn’t
• ensure that it is kept safe and secure

We will also keep detailed records of how such data is handled.

You can help us by making sure that the information you give us is accurate and let us know if it changes.

For example, if you change telephone numbers, name or move to a new home, let us know.

To process personal data, we need to meet one of the following conditions or legal bases:

• you have freely given your consent – it will be clear to you what you are consenting to and how you can withdraw your consent
• it is necessary for a contract you have entered into with us, or a contract that you intend to enter into
• it is necessary to meet a legal obligation
• it is necessary to protect someone’s ‘vital interests’ (a matter of life or death)
• it is necessary to perform a public task or to exercise powers set out in law
• it is necessary for our legitimate interests or that of a third party (a condition used where personal data is going to be used in ways that are reasonably expected and are not intrusive, or where there are compelling reasons for the processing)

There are further requirements for processing more sensitive, or ‘special category’, personal data.

The lawful basis that we rely on to process your personal data will determine which of the following rights are available to you.

Much of the processing we do will be necessary to meet our legal obligations or to perform a public task.

If we hold personal data about you for different purposes, then the legal basis we rely on in each case may be different.

The GDPR grants individuals several rights over their personal data, including the ability to request copies of their data or, in certain circumstances, to have it deleted or modified.

These rights are explained fully on the Information Commissioner’s Office website.

The MNA will ensure that we uphold your rights to the extent that they apply to the way in which we process your personal data.

Below we have explained those rights that are most likely to be relevant to the ways in which the MNA processes personal data.

The right to be informed is a key part of the transparency requirements of data protection law.

It includes various categories of information which would normally be provided in a ‘privacy information notice’.

Where you give us your data directly, you will see a privacy notice from us which will tell you, or provide you with a link to information on:

• which part of the MNA as data controller is processing your personal information, and how to contact our Data Protection Officer
• the purpose and legal basis for processing (including details of the legitimate interests where that is the basis)
• where relevant, the categories of recipients with whom the data has been or will be shared, including information about transfers to a third country and the protective safeguards in place where that happens
• how long it will be kept for or the criteria used to determine the retention period
• the rights to which you are entitled and the right to withdraw consent where that is the legal basis for processing
• how to complain
• whether providing personal data is a contractual or statutory requirement, and if so the possible consequences of not providing it
• whether automated decisions which might significantly affect you will take place, and if so information about the logic involved and how it might affect you

Where your personal data was sent to us by a third party, we will aim to provide you with the above information, where relevant, within one month.

We will also aim to inform you of the source that the personal data originated from and the types of your personal data that will be used by us.

If we intend to share your data onward with another organisation, we will let you know before we do so.

See also ‘When we share information’.

You can request copies of the personal data that we hold about you at any time by making what is known as a ‘subject access request’. Before we can act on your request, you will need to supply proof of your identity. Please be as specific as you can about the information you want and, if it isn’t obvious, explain why you expect us to hold your personal data.

We will usually respond to subject access requests within one month of receipt but may take up to 2 months in the case of complex and/or numerous requests. We will let you know when you can expect to receive a response, or if we will be unable to provide you with one.

There is no fee for making a subject access request, but charges may be made where someone asks for further copies of information which they have already received, or in exceptional circumstances, such as where a request is clearly unfounded, excessive or repetitive. In such cases, we may also refuse to answer the request. We will advise you of your right to complain to the Information Commissioner or to seek a judicial remedy.

If you would like to make a subject access request, please address it to governance@mna.org.uk

You have the right to object to us processing your personal data in any of the following circumstances:

• where the processing is based on either the legitimate interests or public task condition
• direct marketing (including profiling)
• for scientific and/or historical research and statistics purposes

Where you object to us processing your personal data based on the legitimate interests or public task condition or scientific and / or historical research and statistical purposes, we will stop processing that information unless we can demonstrate that there are overriding reasons to do so, including where processing is necessary for the conduct of legal claims.

We may also rely on legitimate interests to process and share your personal data for the purposes of the investigation, detection or prevention of fraud or other criminal activity.

Other rights you may have are: a right to rectification if your personal data is inaccurate, a right to erasure, a right to restrict processing, a right to data portability, and rights in relation to automated decision making.

Whilst these rights are unlikely to apply to the kind of processing that the MNA routinely carries out, if you think they may apply and want to know more, please refer to the Information Commissioner’s Office website.

Any request you make to us to exercise these rights will receive appropriate consideration, within the timescales required by data protection law.

Children have the same rights as adults over their personal data which they can exercise as long as they are competent to do so.

Where a child is not considered to be competent, an adult with parental responsibility may usually exercise the child’s data protection rights on their behalf.

If we need to process personal data belonging to children, we will provide children with the same information as we would give to adults in a clear, friendly and accessible way appropriate to the age group.

If the child is pre-literate the information will be provided in a way in which it will be readily understandable by the child’s parent/guardian/carer.

We use personal information for a wide range of purposes, to enable us to carry out our objectives as a membership organisation and charity. These include:

• maintaining our accounts and records
• consideration and investigation of complaints
• answering queries
• undertaking research
• the provision of education or training
• charity administration

We may share personal data within our organisation or with other bodies where we are permitted to do so by law.

In all cases, whether data is shared internally or externally, we will be governed by data protection law.

When you write to us, we will look after any personal information you disclose to us and use it only as necessary to provide you with an answer.

Where your correspondence relates to an area or issue for which another organisation or body has responsibility, it will in most cases be passed to them to respond to you. We will let you know when this happens. Except as explained here, your correspondence will not be shared without your consent.

In the case of requests for information, the MNA will use your personal data as necessary to comply with relevant legislations to the extent to which they apply to the MNA. As a charity, we are not subject to the Freedom of Information Act 2000.

Where an information request would be more appropriately directed to another organisation, our response will advise you where it should be sent, but the request will not be forwarded. When, in some circumstances, it is necessary to share information requests with third parties, any information that identifies you will not be shared.

A record of your correspondence will be held by us for at least 3 years and then, under normal circumstances, deleted. It will only be kept for longer where it is necessary to keep it for longer.

The MNA maintains a number of distribution lists to communicate with its stakeholders and interested parties.

In many cases this is to enable us to carry out our charitable objectives.

In some cases, where the use of a distribution list does not relate to the performance of our charitable objectives, we may use it as necessary for our legitimate interests.

In such cases, we have had regard to the rights and freedoms of those whose names are included on the list.

Each list will be used only for the purpose that the individuals on the list were informed about at the time their information was collected by us.

The MNA is a data controller under data protection law.

Our Data Protection Officer advise the MNA in how to comply with data protection law. They monitor and promote compliance, for example by providing advice on Data Protection Impact Assessments, and arranging audits and training. They act as your first point of contact, and lead on any communications with the Information Commissioner’s Office.

To contact the Data Protection Officer, please write to the following address:

Governance Officer
Merchant Navy Association
8 Cumberland Place,
Southampton
SO15 2BH

governance@mna.org.uk

Where we introduce new technologies, policies or processes, we will ensure that your privacy is considered from the outset, and where beneficial will carry out a Data Protection Impact Assessment (DPIA).

We will always carry out a DPIA where we use new technologies or consider there is a high risk to your rights and freedoms.

Where an assessment identifies risks that cannot be satisfactorily reduced or avoided, our Data Protection Officer or their team will seek advice from the Information Commissioner to help us find the best solution.

We take information security seriously and will protect your personal data from unauthorised access, accidental loss, destruction and damage.

We carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet the appropriate standards and industry good practice.

We will only transfer your personal data overseas where appropriate safeguards are in place to protect it.

Our officers are trained in the importance of protecting personal and other sensitive information. Those who routinely access personal data as part of their jobs are expected to undertake more in-depth training.

Individuals who have formal responsibilities for large datasets, for example as information asset owners, will also receive additional training so that they have a clear understanding of what they need to do to keep the data under their control safe and secure.

The MNA does everything it can to keep your personal data secure. But if, despite this, a breach occurs which creates a risk to your rights and freedoms (for example, financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), we will ensure that the Information Commissioner’s Office is informed without delay, and in any event within 72 hours after we have become aware of it.

Where we assess that there is a high risk to you, we will ensure that you are notified without undue delay.

Where it is not possible to contact you directly, we will attempt to make you aware through other means, such as a public announcement.

The information we will provide to you will include:

• the contact details of our Data Protection Officer
• the likely consequences of the breach
• details of the measures already taken or planned to address the breach including any steps taken to mitigate potential damaging effects

When you contact us either by telephone, through our website by e-mail or via social media, we collect the data you have given to us in order to reply with the information you need.

We record your request and our reply in order to meet the legal obligations of the MNA.

We keep personally identifiable information associated with your message, such as your name and email address so we can track our communications with you to provide a high quality service.

Requests by your web browser to our servers for web pages and other content on our website are recorded.

We record information such as your geographical location, your Internet service provider and your IP address. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.

We use this information in aggregate to assess the popularity of the webpages on our website and how we perform in providing content to you.

If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed in to our website.

When we receive any request to access, edit or delete personal identifiable information we shall first take reasonable steps to verify your identity before granting you access or otherwise taking any action. This is important to safeguard your information.

We may use Secure Sockets Layer (SSL) certificates to verify our identity to your browser and to encrypt any data you give us for certain parts of our website.

Whenever information is transferred between us, you can check whether it is done by using SSL by looking for a closed padlock symbol or other trust mark in your browser’s URL bar or toolbar.

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to our Data Protection Officer using the details below.

We aim to respond to written and email complaints within one month wherever possible.

If it is not possible to give you a full reply within this time (for example, if your complaint requires more detailed investigation), we will tell you what is being done and when you can expect a full response.

Governance Officer
Merchant Navy Association
8 Cumberland Place,
Southampton
SO15 2BH
governance@mna.org.uk

If you remain dissatisfied, or if you require independent advice about data protection, privacy and data sharing issues, contact:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk