• As you interact with our website, or a website for one of the OSM Thome business units, we will automatically collect technical data using cookies, add-ins, or other similar technologies.
• We collect data through cookies as described in our Website Cookie Notice when you visit our following websites: osmthome.com, osmpeoplerecruitment.com, evigo.mind-laboratory.com, nordicmedicalclinic.com or axiamaritime.com.
• Cookies are text files containing small amounts of information that are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie.
• The information we collect through cookies consists of data relating to your device, IP address, and your use of the website, including browsing actions and patterns.
• We use the data collected through cookies for the purposes of offering you the best user experience and for improving the website content by tracking usage patterns and recording preferences. You can accept and reject cookies by heading to the settings section in your browser.
  For more information about the cookies we use, please see our Website Cookie Notice.

 

When you contact us, for example for customer offers, for website feedback, or send an email through any of the contact points indicated, or use our online forms, we can collect personal data about you, such as your name, e-mail address, phone number, address and other information you wish to provide us with to respond to your comment or enquiry.

If you register for one of our events, we can collect information about your name, contact information, and, if applicable, dietary preferences or similar information.

The legal basis for this processing is that the processing is necessary for fulfilling a contract with you. In some cases the legal basis for processing is our legitimate interest to meet your request and to improve our business, where these interests are aligned with your rights to data protection

OSM Thome processes business-related data regarding customers, suppliers, partners and their employees. The purpose of processing is to support and manage internal and external relationships, protection of business interests and security, and to provide products and services to third parties and business operations..

The legal basis for this processing is our legitimate business interests in ensuring good management of and support for customers, suppliers, partners, and third parties and to comply with legal obligations.

OSM Thome may process personal data necessary to comply with legal obligations, for example tax and accounting information and information relating to legal proceedings.

The purpose and legal basis for this processing are our legal obligations and legitimate interests in the establishment, exercise, or defense of legal claims.

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to continue the contract we have or are trying to enter into with you. If this is the case, we will notify you if this is the case at the time.

• In relation to the recruitment process, many of the different legal entities within OSM Thome will be involved. Below you will find general information regarding how and why we use your personal information during recruitment, including which personal information we collect. For information regarding specific legal entities’ use of your personal information during recruitment, please see the information in the specific box below. 

  How and why we use your personal data

  • When you apply for a job through our website, we use a job application portal operated by an external service provider on our behalf, for processing and handling your job application. When you apply for a job, we collect your name, contact information, CV, resumes, applications, education level, competencies and skills, career, and work experiences. If relevant, you may also provide us with your social security number, job certificates, references, photographs and other relevant background information. We will only collect information which is necessary for the purpose it is intended. 
  • During the course of interviews and employment process we will also process interview notes, pre-employment medical examination, training certificate, minimum qualifications and letters of offer and acceptance of employment.  
  • We use this information in order to determine your eligibility for the job that you apply for by assessing whether you are the right candidate for the position in question, including the verification of references and qualifications. 
  • With your consent, we may also retain your data for the purposes of identifying you as a potential candidate for future suitable vacancies and/or to inform you of future suitable vacancies. 
  • The legal basis for processing and storing your job application, CV, and related information is your consent, and that the processing is necessary in order to take steps at your request prior to entering into a contract. You can withdraw your consent or update your information at any time through the job application portal or by contacting us at [email protected]. 
  • For certain very limited positions, it may be necessary to process your criminal records in order to ensure that you are permitted to undertake the role in question. Such information will only be processed in accordance with GDPR Article 10 and applicable local legislation.

   

  How Is Your Personal Data Collected?

  In the course of your ordinary dealings with us, we may collect personal information directly from you when you:

  • Submit your employment application, CV, personal data sheet, and similar applications.
  • Fill out forms, contracts, and agreements necessary for the processing of your employment applications.
  • Submit your personal information when you register with any of our online portal and crew management system, including but not limited to “E-Crew” and our “Applicant Kiosk” in the Philippines.
  • Communicate with us (such as when you contact us for inquiries regarding job availability or the status of your application). We may also collect information indirectly from third parties (such as headhunters, background check providers, and recruitment agencies) based on your consent to the third party or when permitted by law.

  Disclosure of your Personal Data

  In general, we share your personal information within OSM Thome Group when necessary to fulfill a request from you, entering into an employment contract with you or in other circumstances where sharing is necessary. All OSM Thome business units have entered into an Intra Group Data Agreement which, among other things, ensures your right to privacy when personal data is exchanged between the companies.

  We may also share your personal data with the parties indicated below for the purposes set out above.

  • Third party provider and processors whom we have a contract to share and protect personal data and maybe based in EU or in Non-EU countries
  • Third party service provider which the company contracted to support its business operation and services being offered.
  • Internal Third Parties or other companies in OSM Thome Group business units that are based in the EU as well as in non-EU countries.

  For the transfer of personal data, not covered by the Intra Group Data Agreement, we will always enter into a data processing agreement with the third party. Personal data is only transferred across jurisdictions if the transfer is subject to safeguards ensuring a sufficient level of data protection.

  We do not share the information we collect about you with any third parties other than those indicated in the foregoing. However, we may share this information with law enforcement agencies, government, and regulatory bodies to meet legal and regulatory obligations.

Information collected when we organize your travels

You will find more information about collection of your personal data in the general part above. The following regarding collection of your personal data is specific for the services provided by Energia Global Travel:

For contact through Energia Global Travel we may collect personal data such as your place of birth, travel documents, biometric information, education and work information, financial information, visa application and other required travel documents and other information that you wish to provide us to respond to your comment or enquiry or are needed to fulfill the services which you engage with us.

The legal basis for this processing is that the processing is necessary for fulfilling a contract with you or for taking steps prior to entering into a contract, or that it is in our legitimate interest to meet your request and to improve our business and services and these interests are not overridden by your rights to data protection.

Disclosure of Your Personal Data

We share your personal data with the parties set out below for the purposes set out above.

• Airline, Hotel, Car Rental companies, Embassy(ies), and /or third party provider and processors whom we have a contract to share and protect personal data and maybe based in EU or in Non-EU countries
• Third party service provider which Energia Global Travel contracted to support its business operation and services being offered.
• Internal Third Parties or other companies in OSM Thome business units that are based in the EU as well as in Non-EU countries.

For the transfer of personal data, not covered by the Intra Group Data Agreement, we will always enter into a data processing agreement with the third party. Personal data is only transferred across jurisdictions if the transfer is subject to safeguards ensuring a sufficient level of data protection.

We do not share the information we collect about you with any third parties other than those indicated in the foregoing. However, we may share this information with law enforcement agencies, Government, and regulatory bodies to meet legal and regulatory obligations.

Nordic Medical Clinic processes sensitive personal data due to its services. Some of the information listed under “General information regarding personal data that applies to all groups” will therefore vary from how Nordic Medical Clinic processes personal data. If there are any differences from the general information, the following will apply to Nordic Medical Clinic.

Personal data collected

Nordic Medical Clinic collects, stores, and processes personal data from its current and past patients and any other referrals from our customers endorsed to go through any of our medical and holistic health services. The kind of information we hold about you includes:

• Contact information, such as name, addresses, telephone numbers, email addresses, and other contact details.
• Personal information, such as date and place of birth, nationality, immigration status, religion, civil status, government-issued ID, etc.
• Photographic and biometric data, such as photos, fingerprints, and signatures.
• Sensitive information such as your health information and medical record.

Collection of your personal data starts upon endorsement from your manning agency. Further information is collected upon completing the appointment forms and as you go through the medical procedures necessary.

How and why we use your personal data

The collected personal data is used solely for the following purposes:

• Evaluation of your pre-employment medical exam
• As basis for medical findings and recommendation
• For status monitoring of the manning agency who endorsed you to take the medical service from NMC
• Compliance to legal and/or regulatory requirements (e.g. MARINA, Flagstate requirements)
• As means to communicate with you as part of our holistic health approach (e.g. Feedback Call)

The legal basis for processing the personal data for the listed purposes is that the processing is necessary in order to take steps at your request prior to entering into a contract. For the purpose of compliance to legal and/or regulatory requirements the legal basis for processing is that the processing is necessary to fulfill a legal obligation.

For the purpose of statistical reporting requirements, your personal information is anonymized.

Sensitive data such as your health data is used to consider whether you are fit for a specific role on board a ship. It is required by law that all our seafarers are in adequate physical health, and it is our responsibility to ensure that you meet the standards. For on shore staff, we may use health data to consider if you are eligible for a role which involves frequent travelling and to determine if you are fit to visit our managed vessels. The legal basis for handling such sensitive data is that it is necessary to fulfill a contractual obligation.

Disclosure of your Personal Data

We will only share your personal data with the following third parties for the purposes of communicating your “fit-to-work” status in order for them to complete your recruitment process:

• Internal customers being other companies in the OSM Thome Group
• External customers availing our medical services
• Regulatory authorities, accrediting bodies and government agencies as supported by applicable laws and permitted by our Privacy Policy.
• Clinic Management System staff that performs system update
• Contracted third parties, partners, or service providers engaged under confidentiality and data protection agreements (including non‑disclosure agreements or equivalent arrangements) for projects, pilots, or services that involve medical data processing.

All  third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions and or applicable agreements.

Data Security

We have implemented security measures to protect your personal data from accidental loss, unauthorized use or access, alteration, or disclosure. Access to your personal data is limited to employees, agents, contractors, and other third parties who need it to perform their job duties, based on the need-to-know principle. They will only process your personal data on our instructions, and they are bound by confidentiality. For more details, contact us at [email protected].

We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Should third parties need access to your personal data, we require a non-disclosure agreement and/or a data sharing agreement with them, in compliance with the DPA and the DPA-IRR.

We ensure the secure storage of your paper files through physical security and your digital files through technical security.

How long will we use your personal information?

Your personal data, including medical records, shall be stored for fifteen (15) years in compliance with the Health Privacy Code of Joint Administrative Order No. 2016-0002.

CCTV recordings are retained for up to two years.

When your personal data is no longer needed, we take reasonable steps to securely destroy such information or permanently de-identify it. Paper files are securely shredded and electronic information is deleted. Once deleted, it will no longer be recoverable nor reproducible.

Special Notice For Processing Minors Personal Data – If You Are Under 18 Years Old

If personal information of children is gathered this requires consent of the parent or guardian.

If you are under 18 years old (or a different age to reflect local legal requirements of your country), please do not send us your personal information, for example, your name, address, and email address. Availing any of NMC medical services will require you to submit your personal information, please get your parent or guardian to do so on your behalf.

Except in cases where NMC organizes corporate social responsibility programs specifically designed for children, we may collect personal information as applicable and reasonably accepted by law.

How and why we use personal data

Visitors

When visiting we register your contact information and who you shall visit. The legal basis for processing your personal data when visiting is our legitimate interest, hereunder the need to register visitors for security purposes.

Customers and potential customers

For customers and potential customers we may collect their contact information, job title and information regarding which company they work for. The legal basis for processing this personal data is our legitimate interest, to be able to manage the customers and potential customers.

Offshore project staff

When offshore project staff are sailing or otherwise visiting a vessel, we process contact information, passport numbers and sometimes medical certificates of third parties such as contractors, our clients’ employees and others. The legal basis for this processing is our legal obligation to ensure security for onboarding the vessel. For processing special categories of personal data including medical certificates, ethnicity and other special information from the passport, the legal basis for processing is our employer obligation.

Suppliers

For suppliers we collect Contract information such as email, phone number, job title, company name, directorship data, financial data and legal background. The Legal basis for this processing is our legal obligation to register suppliers in our databases and sanction checks. Furthermore, the information is collected due to the legitimate interest of the company to ensure pricing, terms and conditions for delivery services and to ensure the legitimacy of supplier companies.

Beneficiary form

In the KYC process we handle information listed in the beneficiary form, including passports for owners and co-assured parties, for the purpose of verifying the identity of customers and associated information. The legal basis for this processing is contractual obligation / Collective Bargaining Agreement (CBA) / Philippine Overseas Employment Administration (POEA), and claims handling.

System integration and IT support

For vendors and customers we process their e-mail address, phone number and personal data residing on various systems, based on legitimate interest for system integration and automation.

For office and Vessel IT support we collect the name, email address, IP-address, address and phone numbers of customers and suppliers based on legitimate interest for handling IT incidents, service, problems, and change management.

Accounting and invoicing

In relation to accounting we process customers and suppliers contact information to keep records in accordance with our legal obligations.

We handle incoming invoices from suppliers, intercompany invoicing and/or outgoing customer invoicing. In relation to invoicing we process contact information, amount and any personal data relating to the services that the invoice concerns. The legal basis for this processing is that the processing is necessary to fulfill a contract. In some cases health data may be processed based on the services the invoice concerns. In this case the legal basis for processing special categories of personal data is to handle any possible claims.

Social media

We may process personal data such as names, pictures, likes, comments and interests of clients and partners when publishing content relating to clients and/or partners on our social media pages for OSM Thome, Jobs at Sea, OSM People, Crew Match and Local Manila. The legal basis for processing this personal data is our legitimate interest in broadcasting our line of services in Social media to costumers, potential costumers, employees, and business partners.

Prior to posting on our social media pages, we will process visitors, vendors and suppliers contact information, pictures and any other personal data being disclosed by consent. The legal basis for this processing is our legitimate interest as listed above. The legal basis for processing pictures is consent.

Video Surveillance

While conducting our business, we have installed surveillance cameras outside on some of our office locations to deter vandalism and to protect against theft. In addition, on some selected high risk office locations where we receive a greater number of visitors, the reception areas are monitored to ensure the protection of employees and visitors. Generally, recorded images are routinely destroyed and not shared with third parties unless there is suspicion of a crime, in which case they may be turned over to the police or other appropriate government agency or authority in accordance with local regulations.

The legal basis for such processing and monitoring is our legitimate interests to secure premises and to ensure a safe work environment in selected locations, in accordance with the applicable regulatory framework in each jurisdiction.

Disclosure of Your Personal Data

We share your personal data with the parties set out below for the purposes set out above.

• Internal Third Parties are other companies in OSM Thome that are based in the EU as well as in Non-EU countries. For the full list of all OSM Thome business units, with their geographical location, please visit appendix 1 of this notice.
• We do not share the information we collect about you with any third parties. However, we may share this information with law enforcement agencies, Government, and regulatory bodies to meet legal and regulatory obligations