PRIVACY POLICY
Last Revised: 4th June 2026
1. Who Are We?
EU & UK
Mariforce Ltd is a specialist marine and offshore workforce recruitment agency operating globally. We connect maritime professionals, including seafarers, offshore engineers, marine officers, and support personnel, with employers across the global marine and offshore industries.
This Privacy Statement applies to all individuals and organisations who interact with Mariforce Ltd through our website mariforce.com, our recruitment platform, or any related services we provide.
- Entity: Mariforce Crewing Ltd.
- Company Number: 15472395
- Registered Office: 66 Paul Street, London, England, EC2A 4NA
- Indian Office: Landmark Cyber Park, Gurgaon, Gurugram, Haryana 122101, India
- Phone: +44 2039 515998
- Email: mail@mariforce.com
INDIA- ADDITIONAL PROVISION
For users, candidates, and clients based in India or whose data is processed in India, Mariforce Ltd maintains an India operations presence at the following address:
3rd Floor, Space Creattors Heights, Landmark Cyber Park, Sector 67, Gurugram, Haryana – 122002, India
This Privacy Policy, as applicable to Indian residents, is governed by and construed in accordance with:
- Information Technology Act, 2000
- Information Technology (Amendment) Act, 2008
- IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
- Digital Personal Data Protection Act, 2023 (DPDPA)
2. What Is This Privacy Statement About?
EU & UK
To provide our recruitment and workforce placement services, we need to collect and process certain information about you — some of which may be personal or sensitive in nature. For example, we may need details such as your name, contact information, professional certifications, seafarer documentation, employment history, and next of kin details.
This statement explains what information we collect, why we collect it, how we use it, who we may share it with, and how we keep it safe. It also sets out your rights under UK data protection law.
INDIA- ADDITIONAL PROVISION
Under the Digital Personal Data Protection Act, 2023 (DPDPA) and the IT (SPDI) Rules, 2011, Mariforce Ltd is considered a “Data Fiduciary” when processing personal data of Indian residents.
This Privacy Statement also serves as a disclosure under Rule 4 of the SPDI Rules, 2011, informing Indian data principals of the purpose of collection, intended recipients, and the name and address of the agency collecting and retaining such information.
Indian users have the right to withdraw consent at any time. Such withdrawal will not affect the lawfulness of any processing carried out prior to the withdrawal.
3. What Information Do We Collect About You?
EU & UK
The information we collect varies depending on whether you are a candidate, a client employer, or a general website visitor. Typically, we may collect:
For Candidates & Maritime Professionals
- Full name, address, date of birth, and nationality
- Contact details including email address, phone number, and emergency contact / next of kin information
- Seafarer documentation such as STCW certificates, Flag State certificates, Merchant Mariner credentials, and OPITO/GWO safety training records
- Employment history, vessel experience, rank, and professional references
- Passport, VISA status, and travel document details (required for international placements)
- Medical fitness certificates (e.g. ENG1 / Flag State medical) where required by the role
- Bank account details for payroll processing where applicable
- Any other information relevant to assessing your suitability for a specific marine or offshore role
For Client Companies & Employers
- Company name, registered address, and company registration number
- Contact details of key personnel such as HR managers, fleet managers, and crewing officers
- Details of vessels, fleet composition, or offshore installations as relevant to resourcing requirements
- Billing and payment information
We collect only the information we genuinely need to deliver our services. We respect your privacy and take a minimal-collection approach at all times.
INDIA- ADDITIONAL PROVISION
Under the SPDI Rules, 2011, the following categories of information collected from Indian residents constitute Sensitive Personal Data or Information (SPDI) and are afforded enhanced protection:
- Passwords and security credentials
- Financial information (bank account, debit/credit card details)
- Physical, physiological, and mental health conditions (including ENG1/medical certificates)
- Biometric information (where applicable)
- Any detail relating to the above as provided to a body corporate for providing service
We will obtain written consent from Indian residents before collecting SPDI. Collection of such data is done only for a lawful purpose connected with a function or activity of Mariforce Ltd, and the collection is considered necessary for that purpose.
Under the DPDPA 2023, Indian residents providing personal data are called “Data Principals” and have the right to know what personal data is being processed and for what purpose, prior to giving consent.
4. How Do We Collect Information About You?
EU & UK
We collect information primarily directly from you — through application forms on our website, email correspondence, telephone conversations, registration on our recruitment platform (mariforce.zohorecruit.in), or during the onboarding process.
In certain circumstances, we may also receive information from third parties such as:
- Professional referees or previous employers you have nominated
- Manning agents or crew management partners acting on your behalf
- Flag State administrations or certification bodies verifying credentials
- Third-party background check providers (where required by a client or regulatory body)
INDIA- ADDITIONAL PROVISION
In accordance with the SPDI Rules, 2011, Mariforce Ltd shall, prior to the collection of SPDI from Indian residents:
- Inform the individual of the fact that the information is being collected, the purpose for which it is being collected, the intended recipients, and the name and address of the agency collecting and retaining the information
- Obtain prior written consent from the individual, by letter, fax, or email
Under the DPDPA 2023, consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. We shall not collect personal data through any automated or coercive means without explicit consent.
Where data is collected from third parties (such as manning agents in India), we ensure such parties have obtained appropriate consent from the individual before sharing data with us.
5. What Do We Do With the Information We Collect?
EU & UK
We use your information to:
- Match you with suitable marine or offshore roles, or source appropriate candidates for client employers
- Verify professional qualifications, certifications, and seafarer documentation required for specific positions
- Provide and manage our recruitment and workforce placement services
- Communicate with you about vacancies, opportunities, or your application status
- Process payroll or contractor payments where we act as the intermediary employer
- Conduct background checks, reference verification, or pre-employment screening as required
- Comply with legal and regulatory obligations, including those set by the Maritime and Coastguard Agency (MCA), Flag States, and offshore industry regulators
- Prevent fraud, money laundering, or any other form of financial crime
- Maintain accurate and up-to-date records for our operations and audit trail
- Inform you of services we believe may be relevant to your career or workforce needs, where you have consented to such communications
INDIA- ADDITIONAL PROVISION
Under Indian law, we process personal data only for a lawful purpose for which the individual has given consent or which is required by law. In addition to the above:
- Legitimate Use (DPDPA 2023, Section 7): Processing may also be undertaken without consent for purposes such as compliance with any law or judgment of court in India, or processing by State instrumentalities for provision of benefits, or for employment purposes.
- Purpose Limitation: We shall not use personal data for any purpose other than the specified purpose for which it was collected, unless consent is obtained for such additional use.
- Data Minimisation: We collect and process only such personal data as is necessary for the specified purpose.
We do not sell, rent, or otherwise disclose personal data of Indian residents to any third party for commercial gain without explicit consent.
6. Who Do We Share Your Information With?
EU & UK
We appreciate the trust you place in us when sharing your information. We only share it where we are permitted or required to by law, or where you have given us consent to do so. We may share your information with:
- Prospective employers or client companies, for the purpose of evaluating your suitability for a specific vacancy
- Manning agents, crewing managers, or vessel operators involved in the placement process
- Flag State administrations, port authorities, or maritime regulatory bodies where required by law or necessary to verify your documentation
- Third-party background screening, occupational health, or drug and alcohol testing providers
- Our employees and recruitment consultants who are directly involved in managing your application or placement
- IT systems providers, payroll processors, or other carefully selected service providers who help us deliver our services under strict data processing agreements
- Any regulator, court, or government authority where disclosure is required by law, legal duty, or statutory obligation
International transfers: Given the global nature of the maritime industry, we may need to transfer your information to organisations outside the UK, including those based outside the European Economic Area (EEA). We will only do so where we are legally permitted to, and we take all reasonable steps to ensure that your data remains protected in accordance with UK GDPR standards.
INDIA- ADDITIONAL PROVISION
Under the SPDI Rules, 2011 (Rule 6), Mariforce Ltd shall not share SPDI collected from Indian residents with any third party without prior written permission from the individual, unless such sharing is necessary for performance of the lawful contract between us or is required by law.
Where personal data of Indian residents is transferred outside India, we shall ensure:
- The recipient country or organisation affords a level of data protection at least equivalent to the standards required under Indian law
- Such transfer is for a lawful purpose, necessary for contract performance, or done with explicit consent
- Compliance with any restrictions notified by the Central Government under the DPDPA 2023 on cross-border transfer of personal data
Third parties and service providers processing Indian residents’ data on our behalf are contractually obligated to maintain appropriate data security safeguards as prescribed under the IT (Reasonable Security Practices) Rules, 2011.
7. How Do We Look After and Secure Your Information?
We do not retain your personal data for longer than is necessary for the purpose for which it was collected. Unsuccessful CVs and applications are held for up to 12 months, after which they are securely deleted unless you ask us to keep your profile active. Active candidate records are retained for the duration of our working relationship and for up to 2 years following your last contact with us. Seafarer certificates and maritime documentation are kept for the valid life of the certificate plus 2 years to meet MCA and MLC 2006 compliance requirements.
Records relating to completed placements and employment are retained for 6 years in accordance with the Limitation Act 1980, as are all payroll, invoicing, and financial records in line with HMRC requirements. Medical certificates and health-related data, being special category information, are held only for as long as strictly necessary and for no longer than 6 years after your last placement with us.
Background screening results are deleted within 6 months of the decision being made. Next of kin and emergency contact details are held only for the duration of an active placement and deleted promptly once that placement concludes. Client company contact details and contractual records are kept for the duration of the business relationship and for 6 years thereafter.
Website enquiry data is retained for up to 12 months, and website analytics data for no longer than 13 months in line with ICO guidance. Upon expiry of any retention period, data is deleted or anonymised in a secure manner that prevents reconstruction or recovery.
7. Cookies
EU & UK
Our website uses cookies, small data files stored on your device by your browser, to support essential functionality such as secure sessions and improve your experience on the site.
Third-party tools embedded on our site (such as analytics or job board widgets) may also set their own cookies. Mariforce recommends reviewing the privacy policies of any third parties whose services you access through our website, as we are not responsible for how they collect or use your data.
You can usually adjust your browser settings to refuse cookies, though doing so may limit certain features of our website. Where required by law, we will seek your consent before placing non-essential cookies.
INDIA- ADDITIONAL PROVISION
Under the Information Technology Act, 2000 and applicable rules, Indian residents are informed that our website may use cookies and other tracking technologies to collect technical data such as IP addresses, browser types, and usage patterns.
In accordance with the DPDPA 2023, where cookies involve the processing of personal data of Indian residents, we will:
- Provide clear notice of the use of such cookies and the data collected through them
- Obtain prior consent from Indian residents for any non-essential cookies before placing them
- Provide a clear and accessible mechanism to withdraw cookie consent at any time
Indian residents may opt out of cookie-based tracking by adjusting their browser settings without any adverse effect on access to our core services.
8. Website Security & External Links
EU & UK
Sensitive areas of our website use SSL (Secure Socket Layer) encryption, which ensures that any data you submit is protected during transmission over the internet. However, no internet transmission can be guaranteed to be entirely secure, and you should be aware of this when using our online services.
Our website may contain links to third-party websites, including flag state portals, industry bodies, or job boards. These sites have their own terms and privacy policies, and Mariforce accepts no responsibility for their content or practices.
INDIA- ADDITIONAL PROVISION
In compliance with Rule 8 of the SPDI Rules, 2011, Mariforce Ltd has implemented a comprehensive information security programme including:
- ISO/IEC 27001-aligned security practices for protection of personal data
- SSL/TLS encryption for all data transmitted through our website
- Regular security audits and vulnerability assessments of systems handling personal data
- Access control measures to restrict unauthorised access to personal data
In the event of a personal data breach involving the data of Indian residents, Mariforce Ltd shall notify affected individuals and the relevant regulatory authority, as required by the DPDPA 2023, within the prescribed timelines.
9. Communicating With Us by Email & Phone
EU & UK
If you contact us by email or provide us with your email address, we may use that address to respond to your enquiry or to follow up in connection with your application or placement.
Please be aware that email communication, while convenient, carries inherent security risks. We recommend that you avoid sending sensitive documentation (such as certificates, passport copies, or medical certificates) from unsecured or public Wi-Fi networks.
If you have provided a phone number, we may use it to contact you regarding relevant vacancies, application updates, or service matters. Please notify us promptly if your contact details change so we can keep our records accurate.
INDIA- ADDITIONAL PROVISION
In compliance with the Telecom Commercial Communications Customer Preference Regulations (TCCCP), 2018, issued by the Telecom Regulatory Authority of India (TRAI), Mariforce Ltd shall:
- Not make unsolicited commercial communications to Indian mobile numbers registered under the National Do Not Call (NDNC) registry, unless express consent has been obtained
- Maintain a record of consent obtained from Indian residents for receiving marketing communications
- Honour all opt-out requests from Indian residents within the prescribed timelines
Indian residents who receive unsolicited commercial communications may register their complaints with TRAI by sending an SMS to 1909 or through the DND portal.
10. How Do We Look After and Secure Your Information?
EU & UK
We take the security and integrity of your personal data seriously. Our approach includes:
- Technical security measures including password protection, data encryption, and access controls on all systems holding personal data
- Restricting access to your information to only those employees and consultants who need it to perform their role
- Staff training on data protection responsibilities and handling of sensitive maritime documentation
- Robust contracts and data processing agreements with any third parties to whom we may need to disclose your information
- Retention policies to ensure we do not hold your information for longer than necessary, with secure and timely deletion thereafter
We treat our obligations towards your privacy with the utmost seriousness and aim to be fair, transparent, and lawful in everything we do with your data.
INDIA- ADDITIONAL PROVISION
In accordance with Rule 8 of the SPDI Rules, 2011, Mariforce Ltd has implemented and maintains reasonable security practices, including:
- A documented Information Security Policy covering all aspects of data handling and protection
- Periodic security audits conducted by an internal or external auditing authority
- Managerial, technical, operational, and physical security controls commensurate with the sensitivity of data held
Data Retention (India): Pursuant to the DPDPA 2023, we shall retain personal data of Indian residents only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Upon the purpose being achieved, we shall delete personal data in a manner that prevents its reconstruction.
Data Localisation: Where applicable, we comply with any data localisation requirements notified by the Government of India under the DPDPA 2023, ensuring that certain categories of personal data are stored within the territory of India.
11. Your Rights
EU & UK
The UK General Data Protection Regulation (UK GDPR) provides you with a number of important rights in relation to your personal data. We take all reasonable steps to uphold these rights.
Right of Access
You have the right to request a copy of the personal data we hold about you. To make a Subject Access Request (SAR), please contact us in writing. We will ask you to provide two forms of current identification to verify your identity before releasing any information. We will respond within one calendar month of receiving your request.
Right to Rectification
If any information we hold about you is inaccurate or out of date, please inform us as soon as possible. This is especially important in a maritime context where certification and documentation details must be current. We will correct our records promptly.
Right to Object
Unless we are processing your data based on your consent, a contractual obligation, or a legal duty, you have the right to object to us using your personal information in a way that causes you substantial and unwarranted damage or distress. Please write to us with your objection and we will respond within 21 days.
Right to Opt Out of Direct Marketing
We may, from time to time, contact you about relevant roles, industry news, or services that may be of interest to you based on your profile. You have the right to opt out of such communications at any time by contacting us using the details below. Every marketing communication we send will include a clear option to unsubscribe.
We will also respect any registration you may have with the Telephone Preference Service (TPS) or Mailing Preference Service (MPS).
INDIA- RIGHTS UNDER DPDPA 2023 & SPDI RULES
As an Indian resident (Data Principal), you have the following rights under the Digital Personal Data Protection Act, 2023:
- Right to Information (Section 11): The right to obtain a summary of personal data being processed and the processing activities undertaken by us
- Right to Correction and Erasure (Section 12): The right to correct inaccurate or misleading personal data, complete incomplete data, and erase personal data that is no longer necessary for the purpose for which it was collected
- Right of Grievance Redressal (Section 13): The right to have grievances addressed by our Grievance Officer within the prescribed timelines
- Right to Nominate (Section 14): The right to nominate any individual to exercise rights on your behalf in the event of death or incapacity
- Right to Withdraw Consent: The right to withdraw consent at any time, with the ease being comparable to how consent was given
Additionally, under the SPDI Rules, 2011 (Rule 5), you have the right to review the information provided by you and ensure that any personal information found to be inaccurate or deficient is corrected or amended as feasible.
To exercise any of the above rights, please contact us at info@mariforce.com. We will acknowledge your request within 24 hours and resolve it within the timelines prescribed under applicable Indian law.
12. Mariforce and Data Protection
EU & UK
Mariforce Ltd is registered with, and regulated by, the Information Commissioner’s Office (ICO) in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
For further information about data protection and your rights, you can contact the ICO directly:
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113
- Website: ico.org.uk
INDIA- REGULATORY FRAMEWORK
In respect of Indian operations, Mariforce Ltd complies with the following regulatory framework:
- Ministry of Electronics and Information Technology (MeitY): The nodal ministry overseeing implementation of the IT Act, 2000 and the DPDPA, 2023
- Data Protection Board of India (DPBI): The regulatory authority established under the DPDPA 2023 to adjudicate complaints regarding data protection violations
- Telecom Regulatory Authority of India (TRAI): For compliance with commercial communications regulations
Indian residents who believe their data protection rights have been violated may, after exhausting our internal grievance redressal mechanism, escalate their complaint to the Data Protection Board of India as constituted under the DPDPA 2023.
13. Grievance Redressal (India – DPDPA 2023)
EU & UK
For UK-based complaints or queries, please use the contact details in Section 14 below, or contact the ICO directly.
INDIA- GRIEVANCE OFFICER
In accordance with the Information Technology Act, 2000 (Section 46) and the DPDPA 2023, Mariforce Ltd has designated a Grievance Officer for India. All grievances from Indian residents should be directed to:
- Email: mail@mariforce.com
- Website: mariforce.com
- Address: 3rd Floor, Space Creattors Heights, Landmark Cyber Park, Sector 67, Gurugram, Haryana – 122002, India
All grievances will be acknowledged within 24 hours of receipt and resolved within timelines set by applicable Indian law. Where the grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India.
14. How to Contact Us
EU & UK
If you have any questions about this Privacy Statement, wish to exercise any of your data protection rights, or would like to opt out of marketing communications, please contact us:
- Email: mail@mariforce.com
- Website: mariforce.com
- Recruitment Platform: career.mariforce.com
INDIA- GRIEVANCE OFFICER
- 3rd Floor, Space Creattors Heights, Landmark Cyber Park, Sector 67, Gurugram, Haryana – 122002, India
- Email: info@mariforce.com
15. Changes to This Statement
EU & UK
We may update this Privacy Statement from time to time to reflect changes in the law, guidance from the ICO, updates to our services, or for other legitimate operational reasons. Any changes will be posted to this page on mariforce.com, and where appropriate we will notify you directly. We recommend checking this statement periodically to stay informed of the latest version.
The date at the top of this statement indicates when it was last revised.
INDIA- ADDITIONAL PROVISION
In accordance with the DPDPA 2023, any material changes to this Privacy Policy that affect Indian residents will be communicated to them in advance, including through prominent display on mariforce.com and by email where the changes are significant.
Continued use of our services after the effective date of any such changes shall constitute acceptance of the revised Privacy Policy. If you do not accept the revised terms, you should discontinue use of our services and contact us to request deletion of your personal data.