Data Privacy Policy

Effective date: 31 October 2026 · Last updated: 31 October 2026

1. Scope and Indian legal framework

This policy covers information provided through our website, seafarer portal, application documents and recruitment communications. Magellan is responsible for deciding how information is used for its own recruitment and business purposes. Shipowners, charterers and other organisations receiving information may have separate responsibilities and privacy notices.

Our handling of information is subject to the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable. The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 have phased commencement dates. Provisions are applied as they come into force; this policy does not represent that every DPDP provision is already operational. Applicable maritime, employment, recordkeeping and cybersecurity requirements also remain relevant.

2. Information we collect

• Identity and contact information: name, email, telephone/WhatsApp number, nationality, date of birth, photograph and details supplied in an enquiry or application.
• Professional and sea-service information: CV, rank, experience, employers, vessel and contract history, joining availability, education and qualifications.
• Certificates and supporting documents: passport or seafarer identity details where required, COC/licences, GMDSS, watchkeeping and STCW certificates, and other documents supplied for eligibility and deployment checks.
• Health-related information: medical fitness documents and relevant vaccination records, including COVID-19 and yellow fever documents, when supplied and necessary for the particular recruitment or joining requirement. These require heightened confidentiality.
• Recruitment administration: application references, status, interview notes, recruiter remarks, call-log entries, follow-up details and communications. A call-log entry is not a statement that calls are audio-recorded.
• Technical and account information: email verification and sign-in records, session identifiers, IP addresses and security logs generated by the services used to operate the website and portal, and locally saved application drafts.

We collect information from you and, where authorised or otherwise lawful, from referees, previous employers, training or certification bodies and parties involved in recruitment. Provide only information relevant to the application. Do not send passwords, sign-in codes or unnecessary identity or medical documents by email. If you provide another person’s information, ensure you are authorised to do so.

3. Why we use information

We use relevant information to respond to enquiries; create and maintain a seafarer profile; verify qualifications and sea service; assess suitability for a role; coordinate interviews and owner/charterer requirements; arrange joining and crew changes; communicate application updates; and meet applicable obligations. We also use necessary technical information to authenticate users, prevent duplicate profiles, protect the service and investigate misuse.

Your profile may be considered for future suitable opportunities while the recruitment purpose remains active. Sensitive health information is to be used only for relevant fitness, safety, travel or deployment requirements, with the consent or other authority required by law. Reading this policy or browsing the website does not by itself amount to consent to every use of your information.

4. Consent and your choice to provide information

Where consent is required, it must relate to the stated purpose and the information needed for that purpose. You may decline to supply optional information or contact us to withdraw consent. If essential information is withheld or consent for a necessary check is withdrawn, we may be unable to continue that application or service. We will explain the relevant consequence. Withdrawal does not invalidate earlier lawful processing or override a legal duty to retain a record.

Requesting a sign-in code or submitting/updating an application results in service emails. Application acknowledgements and updates may be copied to the company recruitment mailbox. Returning seafarers should use their existing verified email to update their profile.

5. Who may receive information

Access and disclosure must be limited to the relevant purpose and authorised recipients. Depending on the assignment, these may include:

• Authorised Magellan recruitment and management staff.
• Prospective shipowners, ship managers, charterers or their authorised representatives assessing a candidate or arranging deployment.
• Authorised verification, medical, training, travel, visa or joining-service providers, where needed for the assignment.
• Technology providers supporting hosting, data storage, website operation and email delivery. The portal uses hosted application/document storage and Resend for service emails.
• Regulators, maritime authorities, courts, law-enforcement agencies or professional advisers where disclosure is legally required or otherwise lawfully necessary.

Required consent or another lawful permission must be in place before sensitive information is disclosed. Recipients should receive only the information relevant to their role and be subject to appropriate confidentiality and security obligations. Candidate information is not made public through the recruitment portal. Magellan’s policy is not to sell personal information.

6. International operations and transfers

Marine recruitment can involve overseas shipowners, vessels, service providers and operations, including in the UAE, Saudi Arabia and other deployment locations. Hosting or communication services may also process information outside India. Any transfer must meet applicable Indian requirements, including relevant protections for sensitive information and any government restrictions in force. We do not represent that all information is stored exclusively in India. Contact us for information about a proposed disclosure connected with your application.

7. How long records are kept

Seafarer profiles may remain in company records for ongoing and future recruitment opportunities unless the seafarer requests removal, provided that retention remains necessary for that purpose and is permitted by law. This is not a commitment to retain every document indefinitely. Information that is no longer necessary should be deleted or anonymised even if no removal request has been made.

Retention is assessed according to the status of the profile, continuing recruitment needs, document relevance, employment or deployment history, and applicable statutory, regulatory or legal-claim requirements. Medical records and expired or superseded documents should not be kept merely because a profile remains open.

After a verified removal request, we will stop using information for future recruitment and delete information that is no longer required. Records that must be retained for legal obligations or a valid legal claim will be restricted to that purpose, with the reason explained where lawful. Backup copies may remain until their normal secure replacement cycle; they must not be used to restart recruitment processing after an accepted removal request. This policy does not introduce an automatic deletion feature in the portal.

8. Security and incident handling

The portal uses email verification, protected sessions and access restrictions for applicant and company accounts. Submitted documents are intended to be accessible only to the applicant and authorised company staff through the portal. Magellan’s security responsibilities include reasonable organisational and technical safeguards, limiting access to people who need it, and requiring service providers to protect information. No online service can guarantee absolute security.

Suspected loss, unauthorised access or disclosure should be reported promptly to the contact below. Incidents will be assessed and addressed, with notifications to affected individuals and authorities where required. Applicable CERT-In reporting and log-preservation requirements are separate from DPDP obligations and must be followed where relevant.

9. Cookies and information saved on your device

The website and portal may use necessary cookies or similar technology for sign-in, security and website functionality. The portal can keep unsubmitted form drafts and staged files in browser storage. Clearing cookies or site data can sign you out or remove those local drafts; it does not delete an application already submitted to the company. Use a trusted device, sign out after use and clear local drafts on shared computers.

Third-party content or links may have their own privacy practices. Non-essential tracking, if introduced, must be explained and any required choice or consent provided. This policy is not consent to undisclosed advertising or analytics tracking.

10. Access, correction, withdrawal and removal

You can ask us to review or correct information you supplied, withdraw consent, or request removal of your profile and documents. Use the same email as your application where possible and provide your name, application reference (if known) and the action requested. We may seek proportionate verification before releasing or changing a record. Do not send full identity-document copies unless a secure verification process is specifically arranged.

We will explain any lawful reason why a request cannot be fully completed. As the relevant DPDP provisions become effective and applicable, the statutory rights to access information about processing, correction/completion/updating, erasure, grievance redressal and nomination will be available in accordance with those provisions. A nomination request can be sent to the contact below; eligibility and verification requirements apply.

11. Applicants under 18 and representatives

Applicants under 18 should contact the company before submitting personal documents. Where processing a child’s information is lawful and necessary, the required parent or lawful-guardian authorisation and safeguards must be arranged. Where a lawful guardian acts for a person with a disability, the applicable authority and consent requirements must be respected. Do not upload another person’s records without appropriate authority.

12. Privacy enquiries and complaints

Please describe your concern and include enough information to locate your application. Complaints will be addressed expeditiously and within one month of receipt where the SPDI Rules, 2011 apply. Any shorter mandatory deadline will be followed. This contact route also handles correction, withdrawal and removal requests.

If a complaint remains unresolved, you may use the remedies available under the law then in force. Once the relevant DPDP complaint provisions are effective and applicable, a complaint may be taken to the Data Protection Board of India after the required opportunity for internal grievance resolution. Nothing in this policy limits a statutory right or remedy.

13. Policy updates

We may update this policy to reflect changes in our services, processing or applicable law. The latest version and update date will appear on this page. A policy update does not itself authorise a new use of information that requires fresh consent.

Official Indian legal references

• Digital Personal Data Protection Act, 2023, including notified commencement dates — India Code
• Digital Personal Data Protection Rules, 2025 — MeitY
• Government clarification on the SPDI Rules, 2011
• CERT-In directions under the Information Technology Act