Privacy Notice

Published on 14/10/2024

1. Who are we?

In this Privacy Notice (the "Notice"), the terms "we", "our", and "us" are used to refer to our group companies, consisting of: 

• CalMac Ferries Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC302282 (registered as a data controller with the Information Commissioner's Office under registration number Z9867026); 
• David MacBrayne Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC015304 (registered as a data controller with the Information Commissioner's Office under registration number Z9867148);  
• David MacBrayne HR (UK) Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC282760 (registered as a data controller with the Information Commissioner's Office under registration number Z9867009); and  
• Argyll Ferries Ltd with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC391762, (registered with the Information Commissioner’s Office under registration number ZB712463). 

2. Purpose

We are a data controller of personal data which means that we are responsible for processing it lawfully. 

This Notice sets out how we process your personal data, howsoever collected, including, but not limited to, by phone call, text, email, social media, paper form, through using our website or when you attend one of our community stakeholder events or from third parties. 

We are committed to protecting the privacy of the individuals whose personal data we process. Any personal data that is processed in accordance with data protection law, including: 

• the UK General Data Protection Regulation; 
• the Data Protection Act 2018; and 
• the Privacy and Electronic Communications Regulations 

3. What personal data we may process about you

We may process the following types of personal data: 

• Your full name, gender, and date of birth; 
• Your full postal address; 
• Contact information such as phone numbers, email address or social media identifiers; 
• Data relating to your travel booking and itinerary, including booking reference number, payment and bank account information; 
• Vehicle details and registration number; 
• Geo-demographic information, which may include your postcode, preferences and interests; 
• Job application details including CVs; 
• CCTV image data collected at ports, on vessels and (on some routes) via Bodycams; 
• Data collected through your access to, and use of, the CalMac public Wi-Fi service on vessels and in ports (your e-mail address, hardware device MAC address, and the date and time you connect to the CalMac WIFI Service); 
• Information about other passengers in your booking; 
• Advance Passenger Information (where required by legislation). This information includes your full name, your nationality, your date of birth and your gender; 
• Communications you exchange with us (for example, your emails, letters, texts, phone calls, social media interactions with us, or your participation and interaction at community stakeholder events), including phone recordings; 
• Device type and browser and cookie preferences; 
• Username and password when you set up an account; 
• Health data (e.g. for concessions, access requirements, dietary requirements, or recording of health and safety incidents) 
• Where you have provided us with consent, name and imagery for marketing or broadcasting purposes. 

The personal data which we process is generally used for service and operational purposes, for example making reservations, processing payments, producing tickets, alerting of service interruptions, confirming orders, fulfilling your requests, protection of yourself and others and for identification purposes to comply with maritime law. It is also used for analytical purposes to assist in service improvements, future planning, promotional or marketing offers. 

4. How we collect your personal data 

Information which you provide to us directly: 

• Make a reservation with us, including telephone reservations where the personal information is placed into our reservations system; 
• Sign up for any of our services or activities; 
• Request a brochure or newsletter; 
• Enter a competition; 
• Respond to a survey; 
• Create a customer account; 
• Purchase an adventure and/or good using our online sales platform; 
• Provide passenger information to comply with maritime regulations; 
• Participate in our recruitment processes; 
• Provide feedback or otherwise interact with us, including via social media, email, phone call, text or at community stakeholder events; 
• Respond to any queries or requests; and 
• Make a complaint or passenger claim. 

Information which we receive from others: 

• Booking information provided by others making a booking on your behalf; 
• Profiling data. 

You do not have to provide your personal data to us. However, if you do not provide your personal data to us when we need you to, we may not be able to provide our services to you or respond to your queries. For example, under Merchant Shipping (Counting and Registration of Persons on Board Passenger Ships) Regulations 1999, we are required to produce, for maritime safety, a passenger list for our longer sailings. If you do not provide this required data, then you would not be eligible to travel on these routes. 

5. Our legal basis for processing your personal data

We will only process your personal data where we have a legal basis or bases for doing so. The legal bases for our processing of your personal data are: 

• to enable us to enter into and to perform our contract with you; 
• to allow us to exercise our legitimate interests as a data controller. We rely on legitimate interests as a data controller to process the personal data that you provide to us for the following purposes: surveys, the recording of CCTV imagery including using body worn cameras, customer research, data cleansing, processing geo-demographic information, gender and date of birth for registering an account with us, business data append for our B2B Customers, smart scheduling for marketing communications’ sending newsletters to our stakeholders, travel trade newsletters and surveys,  recording visitors  to our premises and social media reporting, data matching and establishing lookalike audiences for social media advertising; 
• to comply with our legal obligations; 
• with your consent, which you may withdraw at any time; 
• where it is necessary for the performance of a task carried out by us in the public interest or in the exercise of official authority vested in us; 
• to protect your vital interests or those of another person. 

  

6. How we will use the personal data we collect 

We will process your personal data in order to: 

• Manage your travel bookings and/or provide you with the services you request; 
• Manage the boarding process; 
• Send status updates and service communications to you; 
• Support your safety and wellbeing when you travel with us and to meet specific maritime regulations, with which we must comply; 
• Communicate with you about your account or transactions with us and send you information about our products and services; 
• Communicate with you in relation to various marketing activities; 
• Support specific management and administrative purposes; 
• Analyse and improve the services offered by us; 
• Enhance passenger experience, we want to ensure that you receive the best service possible therefore we may share your personal data with third parties to gain customer feedback on your journey, including customer surveys; 
• Comply with our legal obligations; 
• Undertake our company administrative purposes, such as billing, accounting, invoice processing etc; 
• Undertake promotional and marketing activities, such as concession processing, competitions, service and targeted marketing campaign analysis, passenger route and buying analytics, systems development; 
• Undertake surveys; 
• Investigate any allegations or complaints of unacceptable behaviour before, during or after using our services or crossings and impose any relevant sanctions or travel bans as is required to protect our vessels, other passengers and staff; and 
• Managing and maintaining the safety and security of our operations. 

Consistent with your choices we may send you information regarding offers and promotions. You can alter your choices and withdraw your consent at any time using the process set out in section 14. 

We will not share your personal data with third parties for marketing purposes without your explicit consent. You have right to withdraw your consent to processing of this nature at any time using the process set out in section 14. 

7. Security and international transfers of your personal data 

The security of your personal data is extremely important to us. We are committed to implementing appropriate technical and organisational measures and we take all reasonable precautions in order to prevent your personal data from being accidentally or unlawfully destroyed, lost, altered, accessed or otherwise used in an unlawful manner. 

We will only transfer your data outside of the United Kingdom where we comply with legal requirements. 

8. When and why we disclose your details to  third parties 

The personal data that you provide to us will be processed within our own systems, which are located within our premises or those of an appointed third party, with whom we have appropriate data processing agreements, and/or, data sharing agreements, as appropriate. 

Ordinarily, we will not share your personal data other than as detailed above, except where disclosure is required or permitted or required by law or you have given your consent for us to do so. 

If we are investigating any complaint, abusive or violent behaviour, information may be collected from any sources and information disclosed to Police Scotland, the Local Authority / Council and/or Council departments, Scottish Fire & Rescue Service and others involved in any complaint. 

We are a member of the David MacBrayne Group of companies (referred to in this Notice as "DML Group"). In common with many businesses that operate as part of a group, different members of DML Group carry out certain administrative tasks that need to be undertaken in order to allow us to provide our services to you. To allow those tasks to be carried out, we may share your personal data with other DML Group members. Any sharing of your personal data with another DML Group member will always be carried out in accordance with the terms of this Notice. 

9. The use of cookies on our websites and how you can reject these cookies 

Cookies are small text files which are stored on your computer when you visit certain web pages. We use cookies to understand how our sites are used which helps us to improve your overall online experience. Some of the cookies we use are necessary for some of our sites to work whilst other cookies are used to provide tailored advertising by trusted third parties.  

The cookies we and our third parties place on your computer do not collect personally identifiable information like your name, address or payment details. To find out more about cookies, visit www.aboutcookies.org. 

The privacy of your information is important to us, and we want to keep you well informed about cookies. We shall continue to work on initiatives in relation to recent cookie legislation to ensure you have the best experience when visiting our website. 

Cookies do not store sensitive information (for example, your name, address or payment details); they simply hold the 'key' which, once you access a website, is associated with this information. 

If you would prefer to restrict, block or delete cookies from us and our third-party advertisers, or any other website, you can use your browser to do this. Each browser is different so check the 'Help' menu of your particular browser to learn how to change your cookie preferences. If you choose to disable all cookies, we cannot guarantee the performance of our websites and some features may not work as expected. 

We use the following categories of cookies on our websites: 

Essential

These cookies are strictly necessary for core features of our websites to work, such as page navigation. These cookies do not record identifiable personal information and we do not need your consent to place these cookies on your device. Without these cookies, some services we provide, or you have asked for, cannot be provided.   

Functionality and analytics

These cookies are used to provide services or remember settings to enhance your visit, collecting and reporting information on its usage e.g. text size or other preferences. The information these cookies collect is anonymous and does not enable us to track your browsing activity on other websites. 
 

Targeting and marketing

These cookies are used by us or trusted third parties to deliver adverts more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. Information contained in these cookies is anonymous and does not contain your personal information. To find out more about cookies used for marketing, go to www.youronlinechoices.com and www.networkadvertising.org or contact us on our feedback page for further information about the trusted third parties we use. 

Cookies List

Here is a list of the main cookies we use, and what they are used for: 

 

List of Cookies and Purposes
Cookie Name	Purpose		More information
	Domain	Type	Description	Duration
__cf_bm	.payments.worldpay.com	Essential  Third-Party	This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of their website.	30 minutes
_ga	.calmac.co.uk	Functionality & Analytics  First-Party	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.	2 years
_ga_VJ1D9RNLM1	.calmac.co.uk	Functionality & Analytics  First-Party	This cookie is used by Google Analytics to persist session state.	1 year
SRM_B	.c.bing.com	Functionality & Analytics  Third-Party	This is a Microsoft MSN cookie that ensures the proper functioning of this website.	1 year
MR	.c.clarity.ms	Functionality & Analytics  Third-Party	This is a Microsoft MSN party cookie which we use to measure the use of the website for internal analytics.	7 days
IDE	.doubleclick.net	Targeting & Marketing  Third-Party	This cookie is set by Doubleclick (owned by Google) and carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.	1 year
test_cookie	.doubleclick.net	Targeting & Marketing  Third-Party	This cookie is set by DoubleClick (which is owned by Google) to determine if the website visitor's browser supports cookies.	15 minutes
_gcl_au	.calmac.co.uk	Targeting & Marketing  First-Party	Provided by Google Tag Manager to experiment advertisement efficiency of website using their services.	3 months
SM	.c.clarity.ms	Functionality & Analytics  Third-Party	This is a Microsoft MSN cookie which we use to measure the use of the website for internal analytics.	Session
MUID	.clarity.ms	Targeting & Marketing  Third-Party	This cookie is widely used my Microsoft as a unique user identifier to sync across many different Microsoft domains.	1 year
ANONCHK	.c.clarity.ms	Targeting & Marketing  Third-Party	This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.	10 minutes
CLID	www.clarity.ms	Targeting & Marketing  Third-Party	This cookie is used to enable sharing media content to social media. It may also gather information on website visitors when they use social media to share website content from the page visited.	1 year
MR	.c.bing.com	Functionality & Analytics  Third-Party	This is a Microsoft MSN which we use to measure the use of the website for internal analytics.	7 days
_fbp	.calmac.co.uk	Targeting & Marketing  First-Party	Used by Meta to obtain data for data matching, profiling, and to deliver a series of advertisement products such as real time bidding from third party advertisers. This cookie consents to data being shared with Meta via the Meta Pixel.	3 months
wd		Functionality & Analytics	This cookie stores the browser dimensions and is used by Facebook to optimise the rendering of the page	1 week
usida		Targeting & Marketing	This cookie collects information about your browser, as well as unique identifiers to tailor advertising	Session
sb		Functionality & Analytics	This cookie stores browser information to improve security settings	2 years
datr		Functionality & Analytics	This cookie helps to protect you from fraud. For example, it helps CalMac identify trusted browsers where you have logged in before. It also helps us to identify the browsers used by malicious actors and to prevent cyber-security attacks	2 years
MUID	.bing.com	Targeting & Marketing  Third-Party	This cookie is widely used my Microsoft as a unique user identifier to sync across many different Microsoft domains.	1 year
_clck	www.clarity.ms	Targeting & Marketing  Third Party	This cookie is used to store a unique user ID	1 year
receive-cookie-deprecation	www.google.com	Targeting & Marketing  Third Party	This cookie is used to facilitate third-party cookie depreciation from Chrome Web Browser	6 months
_clsk	www.clarity.ms	Functionality & Analytics  Third Party	This cookie is used to store and combine pageviews by a user into a single session recording	1 day
YSC	.youtube.com	Targeting & Marketing  Third-Party	YSC cookie is set by YouTube and is used to track the views of embedded videos on YouTube pages	Session
VISITOR_INFO1_LIVE	. youtube.com	Targeting & Marketing	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface	5 months, 27 days
Personalisation_id	.twitter,com	Targeting & Marketing  Third-Party	Twitter sets this cookie to integrate and share features for social media and also store information about how the user uses the website, for tracking and targeting	2 years
yt_remote-device-id	youtube.com	Functionality & Analytics  Third-Party	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video	never
Yt_remote-connected-devices	Youtube.com	Functionality & Analytics  Third-Party	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video	never
_ga_VJ1D9RNLM1	.calmac.co.uk	Targeting & Marketing  First-Party	This cookie is installed by Google Analytics	2 years
_gid	.calmac.co.uk	Targeting & Marketing  First-Party	Installed by Google Analytics _gid stores information about how visitors use a website while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source and the pages they visit anonymously	1 day
_hjFirstSeen	.calmac.co.uk	Functionality & Analytics  First-Party	Hotjar sets this cookie to identify a new user's first session. It stores a true/false value, indicating whether it was the first time Hotjar saw this user.	30 minutes
_hjincludedinSessionSample	www.calmac.co.uk	Functionality & Analytics  First-Party	Hotjar sets this cookie to know whether a user is included in the data sampling defined in the site's daily session limit	2 minutes
_hjIncludedinPageviewSample	www.calmac.co.uk	Functionality & Analytics  First-Party	Hotjar sets this cookie to know whether a user is included in the data sampling defined by the site's pageview limit	2 minutes
_hjAbsoluteSessionInProgress	.calmac.co.uk	Functionality & Analytics  First-Party	Hotjar sets this cookie to detect the first pageview session of a user. This is a True/False flag set by the cookie	30 minutes
CONSENT	.youtube.com	Functionality & Analytics  Third-Party	YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data	2 years
Muc_ads	.twitter.com	Targeting & Marketing  Third-Party	Collects data on user behaviour and interaction in order to optimize the website and make advertisement on the website more relevant.	2 years
_dc_gtm_UA-530570-1	.calmac.co.uk	Functionality & Analytics  First-Party	To store service request numbers	minute

 

11. Links and Third-Party Websites 

This Privacy Notice applies to this website only. 

This website may include links to other websites. Once you have used these links to leave our website, you should note that we do not have any control over that other website. We cannot, therefore, be responsible for the protection and privacy of any data you may supply whilst visiting such websites. We advise you to familiarise yourself with the individual privacy policies and other terms for each linked website prior to submitting your personal data. For instance, where your personal data is processed by Meta, you should review their privacy centre (https://www.facebook.com/privacy/center/) and their privacy notice (https://www.facebook.com/privacy/policy/) in order to understand how to opt out or object to certain kinds of processing activities, such as targeted advertising, profiling, etc. 

12. Changes to this Privacy Notice 

From time to time, we may change this Notice to accommodate changes to our operations, new regulatory requirements, or for other purposes. Any changes will be effective as of the date posted. If we make significant changes to our Privacy Notices, we may alert you to these either via a specific 'bulletin' notice on our home page, or by email and/or post. 

This Notice was last reviewed and updated on 6 August 2024. 

13. Your rights 

You may exercise your data subjects’ rights under data protection laws in relation to our processing of your personal data. Your data subjects' rights include: 

• right of access – you have the right to ask us for copies of your personal information; 
• right to erasure – you have the right to ask us to erase your personal information in certain circumstances; 
• right to restriction of processing – you have the right to ask us to restrict the processing of your personal information in certain circumstances; 
• right of rectification – you have the right to ask us to rectify personal information that you think is inaccurate. You also have the right to ask us to complete information that you think is incomplete; 
• right to object – you have the right to object to the processing of your personal information in certain circumstances; 
• right to data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances; 
• rights in relation to automated individual processing, including profiling. 

You may contact us, using the details in paragraph 14 of this Privacy Notice, to request us exercise any of your rights. 

Alternatively, you can use our Subject Data Request Form to assist you through this process. 

14. How long do we keep personal data? 

Any personal data processed by us will be retained as per our Records Retention Policy, which is based on legal requirements and best practice.  

Where data is held for longer, for example to provide longer term statistical and trend analysis with regard to our services, the data will be anonymised to the extent that no personal data remains within the analytical dataset. 

15. Queries, Requests and Complaints 

If you have any queries, requests or complaints, please contact us as follows: 

• By post: Information Manager, CalMac Ferries Ltd, Gourock, PA19 1QP 
• By email: dataprotection@calmac.co.uk  

Alternatively, you can contact our data protection officer directly by email: info@rgdp.co.uk. Please mark the subject matter of your email: CalMac. 

You can also complain to the Information Comissioner’s Office if you are unhappy with how we have used your personal data: 

• By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 
• Website: https:///www.ico.org.uk 

We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner's Office, so we would request that you contact us in the first instance.