The Onboard Spa
updated May 25, 2018
The Onboard Spa is committed
to protecting the privacy and security of your personal information.
This privacy notice describes how we
collect and use personal information about you during and after your
relationship with us, in accordance with the General Data Protection
It applies to everyone who:
uses our website
applies through us for
roles with our group companies for work onboard spas at sea
is provided with
training by us.
It may also apply during the course of
your employment by one of our group companies as further explained below.
We are responsible
for recruiting staff who want to work onboard in spas operated by our group
companies onboard cruise ships and we offer training to successful candidates
and in connection with that recruitment process and during any training
provided to you we will collect personal information from you.
If you are a
successful candidate and you are offered a role in an onboard spa, your
employment will be with one of our group companies, usually OneSpaWorld (Bahamas)
Limited, or on occasion with STO
respective employer company will then apply to the information they will hold
about you in connection with your employment. This policy will continue to
apply to the information you provided to us and to any further personal
information you may provide to us from time to time, for instance in connection
with any medical matter or application to work on a different vessel where we
deal with the process of transferring you to a different vessel.
Who we are
We are The Onboard Spa a company incorporated in England and Wales with company
number 00580061 and our registered office is at The Lodge, 92 Uxbridge Road,
Harrow Weald, Middlesex, HA3 6DQ. In this policy The Onboard Spa is
referred to as “we”, “us” or “The Onboard Spa”.
Our Contact Details
Data Protection Officer who has been appointed for the group of which we are a
member can be contacted by email at [email protected].
What is the
purpose of this document?
The Onboard Spa is a "data controller".
This means that we are responsible for deciding how we hold and use personal
information about you. You are being sent or asked to acknowledge or agree to
this policy because you are doing any or all of the following:
using our website;
applying for work with one of our group companies
for whom we act as a recruiter of staff;
traveling to our training facilities or to and
attending training offered by us;
joining or debarking a vessel.
This policy makes you aware of how and
why your personal data will be used, and how long it will usually be retained
for. It provides you with certain information that must be provided under the
General Data Protection Regulation ((EU) 2016/679) (GDPR).
We will comply with data protection law
and principles, which means that your data will be:
Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have
clearly explained to you and not used in any way that is incompatible with
Relevant to the purposes we have told you about
and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes
we have told you about.
The kind of
information we hold about you
In connection with your browsing of our
website or applying online we may collect, store and use usage data including how you use our
In connection with your application for
work with our group, we will collect, store, and use the following categories
of personal information about you:
The information you have provided on our
application form, including name, title, address, telephone number, personal
email address, date of birth, gender, employment history, qualifications, passport
Information provided to us by a recruitment
agent on your behalf including the information listed above and any curriculum
vitae and covering letter.
Any information you provide to us during an
The results of any tests you undertake as part
of the application or training process in order to determine the skills that
We may also collect, store and use the
following "special categories" of more sensitive personal
your health, including any medical condition, health and sickness records and
in particular the information necessary for undertaking the checks necessary
for a Pre Employment Medical Examination Certificate.
Information about criminal convictions and
How is your
personal information collected?
We collect personal information about
candidates from the following sources:
You, the candidate.
Recruitment agencies where your application is
forwarded to us from a recruitment agency.
How we will use
information about you
We will use the personal information we
collect about you to:
Assess your skills, qualifications, and
suitability for a role at an onboard spa with one of our group companies.
Communicate with you about the recruitment
To offer and provide training at our training
academy to you and to record whether you have successfully fulfilled the
Provide your details to our group companies for
the purpose of our group companies employing you for a role in one of their
Provide your details to the cruise lines on whose
ships our group companies operate to comply with legal or contractual requirements.
Those obligations include legal requirements to provide your name, nationality,
passport details, and medical information to the cruise lines on whose vessels
you will work.
administer and protect our business and our website (including troubleshooting,
data analysis, testing, system maintenance, support, reporting and hosting of
data analytics to improve our website, services, marketing, candidate
relationships and experiences
Comply with legal or regulatory requirements.
It is in our legitimate interests to
decide whether to recruit you for the purposes of providing you with training
since our business is the recruitment and training of staff for onboard spa
roles with our group companies and it is beneficial to our business and that of
our group companies for us to train staff who can on successful conclusion of
training be employed by our group companies to provide onboard spa services.
for our legitimate interests (to define types of candidates, to keep our website updated and relevant, to
develop our business and to inform our marketing strategy).
for our legitimate interests (for running our business, provision of
administration and IT services, network security, and in the context of a
business reorganisation or group restructuring exercise)
We also need to process your personal
information to decide whether to recommend to our group companies that they
recruit you and once you are recruited by a group company in order for them to
carry out a contract of employment with you it will be necessary for us to
provide the personal information that cruise lines require in respect of all
staff who work onboard their vessels.
Having received your application form we
will then process the information received to decide whether you meet the basic
requirements to be invited for an interview. If you are invited for an
interview we will use the information you have provided and the results from
any aptitude test that you take to decide whether you meet the requirements to
be offered training at our training academy. If you are offered and you accept
training with us we will use the information you have provided to us to provide
you with training, to assess whether you have satisfied the training
requirements and to recommend to our group companies whether you should be
If you fail to provide personal
If you fail to provide information when
requested, which is necessary for us to consider your application (such as
evidence of qualifications, medical certificate or work history), we will not
be able to process your application successfully. For example, if we require
references for this role and you fail to provide us with relevant details, we
will not be able to take your application further. If you fail to provide the
information or refuse to let us provide your information to a cruise line on
whose vessel you are to work our group company who employs you would be unable
to continue your employment as employment is conditional on the cruise line
being provided with information it requires from us by law and contract.
How we use
particularly sensitive personal information
We will use your particularly sensitive
personal information in the following ways:
We will use information about your disability
status to consider whether we need to provide appropriate adjustments during
the recruitment process, for example whether adjustments need to be made during
a test or interview.
We use information about your health
particularly with regard to whether you have been issued with an Employment
Medical Examination Certificate or not to determine whether we can offer
training to you and if your training commences before you have obtained an
Employment Medical Examination Certificate then in order to decide whether you
can successfully complete your training on the basis of the requirement to have
an Employment Medical Examination Certificate in order to have successfully
completed your training
about criminal convictions
We envisage that we will process
information about criminal convictions as we are required by the cruise lines
for who we operate spas to obtain certain information from you in respect of
your criminal convictions history to ensure that there is nothing which makes
you unsuitable for a role onboard a cruise ship and in order that we can
confirm to the cruise line that this is the case. All information in respect
of criminal convictions is treated by us as sensitive personal information and
we ensure that the persons in our organisation with access to that information
is limited to only those persons who have a need to know it.
We do not provide the details of your
conviction history to the cruise lines where we consider your conviction
history will make you unsuitable for a role onboard unless we have warned you
we consider you are unlikely to be able to work onboard and we have obtained
your agreement to share this information with the cruise line. The information
you provide to us will be used by us to confirm to the cruise line that you
meet their requirements for a role onboard.
Additionally we store this information
separately to other information we hold in respect of you in order to ensure
that we can limit access to this information to only those persons who have a
need to know or access it. We review our storage and retention policies in
respect of documents and data from time to time and in doing so we consider and
will continue to consider whether the measures we have taken to keep this
information secure could be improved.
By agreeing to this policy you are
consenting to the processing of information about your criminal convictions as
If you want to
check what information we hold with regard to your criminal convictions history
or to request we delete the information we hold please contact us at
You will not be subject to decisions that
will have a significant impact on you based solely on automated
Sharing of personal information with
Our group of companies are required to
take appropriate security measures to protect your personal information in line
with our policies. We do not allow our third-party service providers to use
your personal data for their own purposes. We only permit them to process your
personal data for specified purposes and in accordance with our instructions.
Transfers outside the EEA
we transfer your personal data out of the EEA including to our group companies,
we ensure a similar degree of protection is afforded to it by ensuring at least
one of the following safeguards is implemented:
We will only transfer your
personal data to countries that have been deemed to provide an adequate level
of protection for personal data by the European Commission
Where we use certain
service providers, we may use specific contracts approved by the European
Commission which give personal data the same protection it has in Europe.
Where we transfer
information between different entities in our corporate group we will use data
processing agreements which are based on the Standard Contractual Clauses which
are clauses which have been approved by the European Commission and by using
these we give your personal data the same protection it has in Europe.
Please contact us at
[email protected] if you want further information on the specific
mechanism used by us when transferring your personal data out of the EEA.
Where you are accessing our website you can disable or
How to provide or withdraw consent to the
installation of cookies
In addition to what is specified in this document, the
User can manage preferences for Cookies directly from within their own browser
and prevent – for example – third parties from installing Cookies.
Through browser preferences, it is also possible to delete Cookies installed in
the past, including the Cookies that may have saved the initial consent for the
installation of Cookies by this website. Users can, for example, find
information about how to manage Cookies in the most commonly used browsers at
the following addresses: Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Internet
With regard to Cookies installed by third parties, Users
can manage their preferences and withdrawal of their consent by clicking the
related opt-out link (if provided), by using the means provided in the third
We have put in place appropriate security
measures to prevent your personal information from being accidentally lost,
used or accessed in an unauthorised way, altered or disclosed. In addition, we
limit access to your personal information to those employees, agents,
contractors and other third parties who have a business need-to-know. They will
only process your personal information on our instructions and they are subject
to a duty of confidentiality.
We have put in place procedures to deal
with any suspected data security breach and will notify you and any applicable
regulator of a suspected breach where we are legally required to do so.
How long will you use my information
for if my application/training is unsuccessful?
Where our system declines your
application immediately on receipt of your online application your information
will be automatically deleted and is not retained by us.
Where your application is declined other
than as set out above or if you do not successfully complete your training with
us we will retain your personal information for a period of six (6) months
after we have communicated to you our decision about whether to accept you as a
candidate for training or after we have communicated to you that you have not
successfully completed your training. We retain your personal information for
that period so that we can show, in the event of a legal claim, that we have
not discriminated against candidates on prohibited grounds and that we have
conducted the recruitment exercise in a fair and transparent way. After this
period, we will securely destroy your personal information in accordance with
our data retention policy.
How long will you use my information
for if I am successful?
We will retain your personal information for
so long as you remain an employee of a group entity and for further seven (7) years
after termination of your employment. We retain your personal information for
that period so that we can comply with our regulatory obligations including in
respect of Maritime Labour Convention and/or tax laws to which we are subject.
After this period, we will securely destroy your personal information in
accordance with our data retention policy.
access, correction, erasure, and restriction
Your rights in connection with
are a resident of the European Union (“EU”) or the United Kingdom (“UK”) you
may have certain addition rights as detailed below.
Under certain circumstances, by law you
have the right to:
Request access to
your personal information (commonly known as a "data subject access
request"). This enables you to receive a copy of the personal information
we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you
to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of
your personal information. This enables you to ask us to delete or remove
personal information where there is no good reason for us continuing to process
it. You also have the right to ask us to delete or remove your personal
information where you have exercised your right to object to processing (see
Object to processing of your personal information where we are relying on a legitimate
interest (or those of a third party) and there is something about your
particular situation which makes you want to object to processing on this
ground. You also have the right to object where we are processing your personal
information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend
the processing of personal information about you, for example if you want us to
establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.
If you want to review, verify, correct or
request erasure of your personal information, object to the processing of your
personal data, or request that we transfer a copy of your personal information
to another party, please contact us at [email protected] in writing.
The corporate group of which we are a
part has appointed a data protection officer (DPO) to oversee compliance with
this privacy notice. If you have any questions about this privacy notice or how
we handle your personal information, please contact the DPO at
[email protected] You have the right to make a complaint at any time to
the Information Commissioner's Office (ICO), the UK supervisory authority for
data protection issues.