Privacy Policy

1. Introduction and controller identity

This Privacy Policy explains how The Crew Atelier collects, uses, shares, retains and protects personal data when you visit our Website, interact with our Services, contact us via WhatsApp or email, subscribe to our communications, apply for or benefit from the sponsorship programme, or otherwise engage with us.

The Crew Atelier is operated by [The Crew Atelier OÜ], a company registered in Estonia under registration number [to be inserted], with registered office at [registered office address, Tallinn, Estonia] ("The Crew Atelier", "we", "us", "our"). The Crew Atelier is an independent yacht career concierge and career-intelligence company. It is not a recruitment agency, employment agency, yacht management company, training provider, visa agency, immigration consultancy, legal practice or educational institution.

The Crew Atelier is the data controller for the personal data described in this policy. We have appointed a person responsible for privacy matters who can be reached at concierge@thecrewatelier.com.

This policy is written to satisfy the transparency requirements of the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the UK Data Protection Act 2018 and UK GDPR, and the South African Protection of Personal Information Act (POPIA), together with equivalent international data-protection principles where they apply to you.

2. What personal data we collect

The categories of personal data we collect depend on how you engage with us. We only collect what we reasonably need to deliver the Services and to comply with our legal obligations.

• Identity data: full name, preferred name, nationality (from a searchable dropdown), age band or date of birth where relevant, city and country of residence.
• Contact data: email address, WhatsApp number with country code (mandatory for concierge communication), postal address where relevant.
• Career data: current role or level (student, entry-level, junior crew, senior crew, officer, parent supporting a candidate), sea time, department, department preferences, career goals, previous vessels, references, availability windows, budgets.
• Documents you upload: CVs, cover letters, headshots, passport pages, ENG1 medical certificates, seaman's discharge book pages, STCW and specialist certificates, transcripts, character references, letters of recommendation. You choose what to upload; you should redact sensitive information you do not want us to see.
• Financial data: billing name, billing address and country, VAT number where applicable, transaction reference, order amount, currency and product. Full card numbers are handled directly by Stripe and never reach our servers.
• Communication data: the content of your emails, WhatsApp messages, contact-form submissions, intake-form answers, call notes, feedback, testimonials, complaints and correspondence.
• Technical data: IP address, device type, browser type and version, operating system, screen resolution, referrer URL, pages visited, time on page, and interactions with buttons and links (where analytics consent is granted).
• Marketing preferences: subscription status, unsubscribe records, cookie-consent choices, language and locale preference.

Special-category and sensitive data. ENG1 medical certificates, health-related notes, and certain travel documents may be considered special-category or sensitive data. We only process such data with your explicit consent, and solely to deliver the Service you have requested. You may withdraw that consent at any time by emailing concierge@thecrewatelier.com; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Children. Our Services are aimed at adults aged 18 and over. Where a parent or guardian purchases a Service for a minor, the parent or guardian is our contracting party. We do not knowingly market to or collect data directly from children under 16.

3. How we collect personal data

• Directly from you: when you submit a contact form, intake form, enquiry form, booking form, checkout, WhatsApp message, email, subscription, sponsorship application or referral entry.
• Automatically: through cookies and similar technologies described in the Cookie Policy, and through server logs necessary to keep the Website secure and available.
• From third parties: from the Payment Processor (payment status and metadata), the booking platform (call bookings), the email service provider (delivery and engagement events), and — where you introduce them — captains, schools, agencies, referees or parents.

4. Purposes and lawful bases for processing

We rely on the following lawful bases under the GDPR (and their equivalents under UK GDPR and POPIA):

• Performance of a contract — to deliver the Services you have purchased, respond to your enquiries, coordinate calls, prepare and deliver Roadmaps and CVs, coordinate travel and accommodation, and provide WhatsApp support.
• Legitimate interests — to operate, secure and improve the Website and Services, prevent fraud and abuse, keep records of engagements, respond to reviews and testimonials, and market our own similar Services to existing clients where we have no reason to believe you would object.
• Consent — for optional marketing emails, non-essential cookies, analytics beyond the strictly necessary, the use of testimonials with attribution, and the processing of special-category data (e.g. ENG1 medical documents).
• Legal obligation — to meet accounting, tax, anti-money-laundering, sanctions, consumer-protection and litigation-related obligations.

5. Marketing communications

We send marketing emails only where you have subscribed, or where you are an existing client and applicable law allows us to send similar-Services updates on a soft opt-in basis. Every marketing email contains a one-click unsubscribe link and a link to our /unsubscribe preference page. Transactional emails (order confirmations, delivery notifications, receipts) are sent on the basis of performance of a contract and are not subject to marketing opt-out.

6. Sharing your personal data

We do not sell personal data. We share personal data only with carefully selected third parties acting either as our processors (bound by written processing terms) or, in limited cases, as independent controllers, including:

• Stripe — payment processing and fraud prevention.
• Cal.com — appointment scheduling.
• WhatsApp / Meta — instant messaging with you where you initiate that channel.
• Our email service provider — transactional and marketing email delivery, bounce and unsubscribe management.
• Our hosting, database, analytics, error-reporting and storage providers — to run the Website and Services reliably and securely.
• Translation providers — where you request localised communication or we translate deliverables.
• Professional advisers — accountants, tax advisers, lawyers and insurers, under professional confidentiality obligations.
• Public authorities and regulators — where we are legally required to disclose, or where necessary to establish, exercise or defend legal claims.

We disclose personal data to captains, agencies, schools, embassies or other third parties only on your explicit instruction as part of the Service you have purchased (for example, forwarding a CV to a school on your behalf). We do not systematically forward CVs to yachts.

7. International data transfers

Because the Crew Atelier operates internationally and uses global providers, personal data may be transferred to, stored in, and processed in countries outside your country of residence, including outside the European Economic Area and outside the United Kingdom. Where we transfer personal data outside the EEA or UK, we rely on one or more of the following safeguards: an adequacy decision by the European Commission; the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable); and, where relevant, supplementary technical, contractual and organisational measures following a transfer impact assessment. A copy of the relevant safeguards is available on request to concierge@thecrewatelier.com.

8. How long we keep personal data

We retain personal data only for as long as is necessary to fulfil the purposes described in this policy and to meet our legal, accounting and reporting obligations. Indicative periods:

• Contact-form and enquiry data — up to 24 months from last contact, unless converted into a client engagement.
• Client engagement records (intake forms, Roadmaps, CVs, call notes, WhatsApp threads) — for the duration of the engagement and up to 7 years thereafter for record-keeping and defence of legal claims.
• Financial and tax records — 7 years from the end of the relevant financial year, as required by Estonian accounting law.
• Uploaded documents (passports, ENG1s, references, discharge books) — deleted from active storage no later than 12 months after completion of the Service, unless you request earlier deletion or later retention for continued concierge work.
• Marketing subscription data — until you unsubscribe, plus a suppression record to ensure we do not contact you again.
• Website analytics — retained in aggregated form according to the analytics provider's default retention window.
• Backups — data in backups is deleted or overwritten in the ordinary course of the backup rotation cycle.

9. Security measures

We implement appropriate technical and organisational measures to protect personal data, including encrypted transmission (HTTPS/TLS), access controls, hardened cloud infrastructure, principle-of-least-privilege for team access, secure document storage, incident-response procedures, and staff training. No system is entirely secure; you accept that the internet involves inherent transmission risk. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required and, where required, notify affected individuals without undue delay.

10. Your rights

Subject to conditions and exceptions under applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectification of inaccurate or incomplete personal data;
• Erasure ("right to be forgotten") in defined circumstances;
• Restriction of processing;
• Data portability in a structured, commonly used, machine-readable format;
• Object to processing based on our legitimate interests or for direct marketing;
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• Not be subject to a decision based solely on automated processing that produces legal effects concerning you (we do not carry out such automated decision-making);
• for POPIA-covered individuals, to submit a data-subject request under sections 23 and 24 of POPIA;
• Lodge a complaint with your local supervisory authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), your national data-protection authority in the EU/EEA, the UK Information Commissioner's Office, or the South African Information Regulator, as applicable.

To exercise any of these rights, email concierge@thecrewatelier.com. We will respond within one month; the period may be extended by two further months for complex or numerous requests. We may need to verify your identity before actioning a request.

11. Cookies and analytics

Detailed information about the cookies and similar technologies used on the Website, and how you can manage them, is set out in the Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. Material changes are notified by updating the "Updated" date at the top of this page and, where the change materially affects your rights, by email or in-app notification.

You can contact us at concierge@thecrewatelier.com or by post at the registered office address above. For data-protection matters, write to the same address marked "Data Protection" or email concierge@thecrewatelier.com.