Malmo Marine Limited (“Malmo Marine”, “we”, “us”, “our”) operates a maritime credentialing and seafarer profile platform (the “Platform”) connecting seafarers with recruiters and employers. This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, and the rights individuals have over their information.
We are committed to a seafarer-first approach: seafarer profile data belongs to the seafarer, not to any employer, recruiter, or agency. This policy is written to reflect that principle.
This Policy is prepared with reference to the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).
This Policy applies to the following categories of Platform users:
The Platform is operated by a New Zealand company and is tailored to the New Zealand maritime industry, including being published at the malmomarine.co.nz domain. Account registration is not geographically restricted, and the Platform may be accessed and used by individuals outside New Zealand.
As part of onboarding, Malmo Marine carries out a visual review of certificates and documents uploaded by seafarers, to check that documents are not obviously altered or falsified.
This review is a manual visual check only. It does not involve confirmation with the issuing authority (e.g. Maritime New Zealand or an equivalent body) that a certificate is genuine or currently valid. Profiles that have undergone this review may display a “Reviewed” indicator. This indicator describes the review that has taken place — it is not a representation that Malmo Marine has verified a credential’s authenticity with the issuing authority.
We intend to introduce direct verification integrations with issuing authorities and training providers in future. Any such enhanced verification will be clearly and separately labelled once available, so that users can distinguish it from the initial document review process described above.
We use the following third-party service providers to operate the Platform. Each processes personal information on our behalf and is subject to its own privacy and security practices.
All of these providers are based outside New Zealand, or store or process personal information outside New Zealand. When we send personal information to them, we do so in line with Information Privacy Principle 12 of the Privacy Act 2020 (disclosure of personal information outside New Zealand). These providers hold the information on our behalf, and we remain responsible for it under the Privacy Act 2020. Where this occurs, we rely on the standard data processing terms offered by Google and Vercel, which impose contractual safeguards on those providers comparable to the protections required under the Privacy Act 2020. Google’s processing is covered by the Google Cloud Data Processing Addendum, which includes the Standard Contractual Clauses and covers the Firebase products we use (Firebase Authentication, including phone sign-in, Cloud Firestore and Cloud Storage). Vercel’s Data Processing Addendum applies automatically under our Vercel Pro plan.
Each category of email we send has its own preference setting, and every email includes a one-click unsubscribe link, in line with the Unsolicited Electronic Messages Act 2007. The one exception is the email that delivers a seafarer’s contact details to a recruiter or employer after a paid Contact Unlock. That email is the paid service itself, so it cannot be turned off.
A seafarer profile can only be made public once the seafarer has verified their phone number with a code sent by SMS. To send the code, the phone number is passed to Google (Firebase Authentication). We store that the number was verified, and when.
Where a seafarer deletes their account, the account is marked for deletion from that point. During the 30 days following the deletion request, the seafarer may reinstate their profile.
After this 30-day period, the profile is permanently deleted from our primary systems.
Backups of our systems run weekly and are kept for 90 days. Deleted account data is retained in backup systems for a maximum of 90 days from deletion, after which it is fully purged from backups.
Some records are kept after an account is deleted, because we need them for the purposes described below:
Invoices and accounting records are kept for 7 years, as required by Inland Revenue.
The Platform is intended for use by individuals aged 16 and over. We do not knowingly collect personal information from individuals under 16.
Under the Privacy Act 2020 and its Information Privacy Principles (IPPs), individuals have the right to:
Seafarers may access, export, and delete their own profile information directly through the Platform, consistent with our data ownership principles. To make an access or correction request that cannot be completed directly through the Platform, contact us using the details in section 15.
We will respond to access and correction requests within the timeframes required by the Privacy Act 2020 (currently, as soon as reasonably practicable and no later than 20 working days).
We take reasonable technical and organisational measures to protect personal information from loss, misuse, and unauthorised access, consistent with IPP 5 of the Privacy Act 2020. As with any online platform, we cannot guarantee that these measures will prevent every possible security incident.
Specifically, these measures include:
In the event of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals in accordance with our obligations under the Privacy Act 2020.
If you believe we have breached the Privacy Act 2020 or any of the Information Privacy Principles, please contact us first using the details in section 15 so we can attempt to resolve the issue directly.
If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner:
We may update this Policy from time to time. Material changes will be notified to users through the Platform or by email.
For questions about this Policy, or to make a request regarding your personal information, contact:
Malmo Marine Limited
Email: privacy@malmomarine.co.nz
Alternate contact: josh@malmomarine.co.nz