Published on 16/05/2023
1. Who are we?
In this Privacy Notice (the "Notice"), the terms "we", "our", and "us" are used to refer to our group companies, consisting of:
CalMac Ferries Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC302282 (registered as a data controller with the Information Commissioner's Office under registration number Z9867027);
David MacBrayne Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC015304 (registered as a data controller with the Information Commissioner's Office under registration number Z9867148); and
David MacBrayne HR (UK) Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC282760 (registered as a data controller with the Information Commissioner's Office under registration number Z9867009).
We are a controller of your data which means that we are responsible for looking after it.
This Notice sets out how we process your personal data, howsoever collected, including, but not limited to, by phone call, text, email, social media, paper form, through using our website or when you attend one of our community stakeholder events or from third parties.
We are committed to protecting the privacy of the individuals whose personal data we process. Any personal data that is processed in accordance with data protection law, including:
the UK General Data Protection Regulation;
the Data Protection Act 2018; and
the Privacy and Electronic Communications Regulations
3. What personal data we may process about you
We may process the following types of personal data:
Your full name, gender, and date of birth;
Your full postal address;
Contact information such as phone numbers, email address or social media identifiers;
Data relating to your travel booking and itinerary, including payment information;
Information regarding any additional boarding assistance needed, and other information related to your needs and preferences such as dietary requirements;
Vehicle details and registration number;
Geo-demographic information, which may include your postcode, preferences and interests;
Job application details including CVs;
CCTV image data collected at ports, on vessels and (on some routes) via Bodycams;
Data collected through your access to, and use of, the CalMac public Wi-Fi service on vessels and in ports (your e-mail address, hardware device MAC address, and the date and time you connect to the CalMac WIFI Service);
Information about other passengers in your booking;
Advance Passenger Information (where required by legislation). This information includes your full name, your nationality, your date of birth and your gender, and
Communications you exchange with us (for example, your emails, letters, texts, phone calls, social media interactions with us, or your participation and interaction at community stakeholder events).
The personal data which we process is generally used for service and operational purposes, for example making reservations, processing payments, producing tickets, alerting of service interruptions, confirming orders, fulfilling your requests, protection of yourself and others and for identification purposes to comply with maritime law. It is also used for analytical purposes to assist in service improvements, future planning, promotional or marketing offers.
4. How we collect the personal data
Where we collect your data from is set out in more detail in this section.
Information which you provide to us directly
Make a reservation with us, including telephone reservations where the personal information is placed into our reservations system;
Sign up for any of our services or activities;
Request a brochure or newsletter;
Enter a competition;
Respond to a survey;
Create a customer account;
Purchase an adventure and/or good using our online sales platform
Provide passenger information to comply with maritime regulations;
Participate in our recruitment processes;
Provide feedback or otherwise interact with us, including via social media, email, phone call, text or at Community stakeholder events;
Respond to any queries or requests; and
Make a complaint or passenger claim.
You do not have to provide your personal data to us. However, if you do not provide your personal data to us when we need you to, we may not be able to provide our services to you or respond to your queries. For example, under Merchant Shipping (Counting and Registration of Persons on Board Passenger Ships) Regulations 1999, we are required to produce, for maritime safety, a passenger list for our longer sailings. If you do not provide this required data then you would not be eligible to travel on these routes.
Personal data that we collect about you
We will only request and collect personal data which is necessary or reasonable in order to provide you with our services.
We also collect personal data by using technology such as cookies. In order to ensure the accuracy of the data we hold for our customers and for the purpose of storing and using 'clean data' (address, postal code etc.), we cross reference with a third-party database on a monthly basis. We do not use the data for credit reference purposes and this will not affect or impact your credit rating in any way.
Our legal basis for using your personal data
We will only process your personal data where we have a legal basis or bases for doing so. The legal bases for our processing of your personal data are:
to enable us to enter into and to perform our contract with you. When you purchase services from us, a contract between you and us will have been entered into. In order for us to fulfil our obligations under such contract, we will need to collect and process your personal data, including payment information. Failure to provide the requisite personal information on sign-up and payment information on entering into the contract or objecting to this type of processing/exercising your deletion rights will mean that we cannot provide our services to you;
to allow us to exercise our legitimate interests as a data controller. We rely on legitimate interests as a data controller to process the personal data that you provide to us for the following purposes: surveys, the recording of CCTV imagery including using body worn cameras, customer research, soft opt in direct marketing, data cleansing, processing geo-demographic information, gender and date of birth for registering an account with us, business data append, sending newsletters to our stakeholders, and social media reporting;
to comply with our legal obligations;
with your consent, which you may withdraw at any time;
where it is necessary for the performance of a task carried out by us in the public interest or in the exercise of official authority vested in us;
to protect your vital interests or those of another person.
5. How we will use the personal data we collect
We will use your personal data in order to:
Manage your travel bookings and/or provide you with the services you request;
Manage the boarding process;
Send status updates and service communications to you;
Support your safety and wellbeing when you travel with us and to meet specific maritime regulations, with which we must comply;
Communicate with you about your account or transactions with us and send you information about our products and services;
Communicate with you regarding e-magazine subscriptions you have opted-in to;
Support specific management and administrative purposes;
Analyse and improve the services offered by us;
Enhance passenger experience, we want to ensure that you receive the best service possible therefore we may share your personal data with third parties to gain customer feedback on your journey, including customer surveys
Comply with our legal obligations;
Undertake our company administrative purposes, such as billing, accounting, invoice processing etc;
Undertake promotional and marketing activities, such as concession processing, competitions, service and targeted marketing campaign analysis, passenger route and buying analytics, systems development;
Investigate any allegations of complaints or abusive behaviour before, during or after using our services or crossings and impose any relevant sanctions or travel bans as is required to protect our vessels, other passengers and staff; and
Managing and maintaining the safety and security of our operations.
Consistent with your choices we may send you information regarding offers and promotions. You can alter your choices and withdraw your consent at any time using the process set out in section 8.
We will not share your personal data with third parties for marketing purposes without your explicit consent. You have right to withdraw your consent to processing of this nature at any time using the process set out in section 12.
6. Security of your personal data
The security of your personal data is extremely important to us. We are committed to implementing appropriate technical and organisational measures and we take all reasonable precautions in order to prevent your personal data from being accidentally or unlawfully destroyed, lost, altered, accessed or otherwise used in an unlawful manner.
We will only transfer your data outside of the United Kingdom and / or the European Economic Area ('EEA') where we comply with the legal requirements.
7. When and why we disclose your details to third parties
The personal data that you provide to us will be processed within our own systems, which are located within our premises or those of an appointed third party, with whom we have appropriate data processing agreements, and/or, where appropriate, data sharing agreements.
Ordinarily, we will not share your personal data, save with third parties as detailed above, except where disclosure is required or permitted or required by law or you have given your consent for us to do so.
If we are investigating any complaint, abusive or violent behaviour, information may be collected from any source(s) disclosed in Sections 3 and 4 above and disclosed to Police Scotland, the Local Authority / Council and/or Council departments, Scottish Fire & Rescue Service and others involved in any complaint.
We are a member of the David MacBrayne Group of companies (referred to in this Notice as "DML Group"). In common with many businesses that operate as part of a group, different members of DML Group carry out certain administrative tasks that need to be undertaken in order to allow us to provide our services to you. To allow those tasks to be carried out, we may share your personal data with other DML Group members. Any sharing of your personal data with another DML Group member will always be carried out in accordance with the terms of this Notice.
Cookies tell us how often you visit our website, which helps us learn what information interests you. In this way, we can give you more of the content you like and less of the content you don't.
Cookies let you store preferences and usernames, register products and services, and personalise pages.
Most web browsers automatically accept cookies, but you can usually modify your web browser settings to decline or delete cookies if you prefer, this may however prevent you from taking full advantage of our website
List of Cookies and Purposes
YSC cookie is set by YouTube and is used to track the views of embedded videos on YouTube pages
A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface
5 months, 27 days
Twitter sets this cookie to integrate and share features for social media and also store information about how the user uses the website, for tracking and targeting
This cookie is set by Facebook to display advertisements when either on Facebook or on a digital platform powered by Facebook advertising after visiting the website
YouTube sets this cookie to store the video preferences of the user using embedded YouTube video
YouTube sets this cookie to store the video preferences of the user using embedded YouTube video
Provided by Google Tag Manager to experiment advertisement efficiency of website using their services
This cookie is installed by Google Analytics
The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors
Installed by Google Analytics _gid stores information about how visitors use a website while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source and the pages they visit anonymously
Hotjar sets this cookie to identify a new user's first session. It stores a true/false value, indicating whether it was the first time Hotjar saw this user.
Hotjar sets this cookie to know whether a user is included in the data sampling defined in the site's daily session limit
Hotjar sets this cookie to know whether a user is included in the data sampling defined by the site's pageview limit
Hotjar sets this cookie to detect the first pageview session of a user. This is a True/False flag set by the cookie
YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data
Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org .
9. Links and Third-Party Websites
This Privacy Notice applies to this website only.
This website may include links to other websites. Once you have used these links to leave our website, you should note that we do not have any control over that other website. We cannot, therefore, be responsible for the protection and privacy of any data you may supply whilst visiting such websites. We advise you to familiarise yourself with the individual privacy policies and other terms for each linked website prior to submitting your personal data.
10. Changes to this Privacy Notice
From time to time, we may change this Notice to accommodate industry practices, new regulatory requirements, or for other purposes. Any changes will be effective as of the date posted. If we make significant changes to our Privacy Notices, we may alert you to these either via a specific 'bulletin' notice on our home page, or by email and/or post.
This Notice was last reviewed and updated on 16 May 2023.
11. Your rights
You have a number of rights under data protection laws in relation to our processing of your personal data, which are set out below:
right of access
right to erasure
right to restriction of processing
right of rectification
right to object
right to data portability
rights in relation to automated individual processing, including profiling
You may contact us, using the details in paragraph 13 of this Privacy Notice, to request us exercise any of your rights.
Alternatively, you can use our Subject Data Request Form to assist you through this process.
In some instances, we may be unable to comply with your request, in which case we will write to you to explain why.
12. How long do we keep personal data?
Any personal data processed by us will be retained as per our Retention Policy, which is based on legal requirements and best practice.
Where data is held for longer, for example to provide longer term statistical and trend analysis with regard to our services, the data will be anonymised to the extent that no personal data remains within the analytical dataset.
13. Contacting us
If you have any questions or comments about this Notice, or our treatment of your personal data, please write to us by post or by email at:
CalMac Ferries Ltd.
PA 19 1QP
We have appointed RGDP LLP as our data protection officer. You can contact them directly with any questions of comments regarding this Notice or any other privacy queries, using the email address firstname.lastname@example.org
14. If you are unhappy
You also have the right to complain to the Information Commissioner's Office where you believe that we are not processing your personal data in accordance with the law.
Contact details are available at: www.ico.org.uk We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner's Office, so we would request that you contact us in the first instance (using the contact details at paragraph 13 above).