At MCTC Marine Ltd., we are committed to safeguarding your personal data. Protecting your privacy is of paramount importance to us. Our data protection practices comply with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (the “General Data Protection Regulation” or “GDPR”), which governs our operations in Cyprus. Where applicable, and in order to enhance transparency and protection for data subjects in the Philippines, we also incorporate certain provisions and rights established under the Philippine Data Privacy Act of 2012.
Names and Address of the Controller
MCTC Marine Ltd
Archiepiskopou Leontiou A, 183
3020 Limassol, Cyprus
Tel: +357 25 000 021
Email: [email protected]
This also applies for the following companies of MCTC Marine Ltd.
Marine Catering Technical Consultancy Far East Inc. (hereinafter “MCTC Philippines” or “MCTC Far East”)
4th and 8th Floor Döhle Haus Manila, 30 – 38 Sen. Gil Puyat Avenue, Barangay San Isidro, Makati City, 1234 Philippines
Tel: +632 8633 3113, +639 2934 3 6191
Email: [email protected]
MCTC Germany GmbH
Grosse Bleichen 32, D-20354, Hamburg, Germany
MCTC Singapore Pte. Ltd.
1 Fullerton Rd, #02-01 One Fullerton, Singapore 049213
MCTC Greece
Grigoriou Lampraki 58, Glifada, 16675, Greece.
MCTC Marine Ltd, MCTC Philippines, MCTC Germany GmbH, MCTC Singapore Pte. Ltd, MCTC Greece and any subsidiaries thereof (together “Group Companies”)
Address of the Data Protection Officer
We value your trust. If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to exercise your rights—such as withdrawing consent, requesting access, correction, restriction, or deletion of your data—please contact our Data Protection Officer using the details below:
Primary Contact (EU/International):
Email: [email protected]
Postal Address:
MCTC Marine Ltd
Archiepiskopou Leontiou A, 183
3020 Limassol, Cyprus
Philippines Contact:
Email: [email protected]
Introduction
MCTC Marine Limited and its affiliates (referred to as “we”, “our”, “us” or “MCTC”) recognise and respect the rights and privacy of individuals. This includes our applicants, current and former employees, suppliers, customers and other third parties.
This privacy notice (“Privacy Notice”) explains how we collect, handle, and process your personal data, and how, in doing so, we comply with our legal obligations. It applies whether we are considering your application for employment, continuing our relationship with you, providing you with a service, receiving a service from you, or if you are visiting our premises or our website.
We consider privacy to be important, and we are committed to protecting and safeguarding your data privacy rights. The use of the word “processing” in this Privacy Notice is intended to include such actions as collecting, handling, using, storing and protecting your personal data. This Privacy Notice applies to the personal data of Data Subjects such as yourself, our customers, visitors, suppliers of goods and services, website users.
Our website may provide links to third party sites. Since we do not control those Websites, we encourage you to review the privacy policies/notices of these third-party websites. MCTC is not responsible for the privacy practices or content of third-party websites. By visiting our website, you signify your acceptance of the terms of our Privacy Notice as may be amended from time to time. If you do not agree with the terms of this Privacy Notice, please do not use the Website.
Legal framework
This Privacy Notice has been implemented by the organization for the purposes of its compliance with the applicable data protection legislation which includes, but is not limited to, the GDPR.
How do we collect and use data?
You directly provide us with most of the data we collect. We collect and process data when you:
- Provide data by email or by hand or other method;
- Provide your data through our website;
- Use or view our website via your browser’s cookies.
We may also collect personal data through third parties, such as your employer in case of course participants.
We may process personal data as part of our services. Such processing may include, but is not limited to, employment contracts, document processing, marketing and procurement and is necessary to enable us to:
- Fulfill our contractual and legal obligations;
- Deliver our products and services;
- Manage the relationship with you and the way we communicate with you;
- Respond to enquiries that you may direct to us; and/or
- Action, as appropriate, any requests for our information or services.
- Provide shore-based training, distance learning courses, briefings and debriefings to course participants including the administration of the curriculum and timetable; monitor participants’ progress and educational needs; report on the same internally and to the employers of the participants.
- Provide educational support and related services to course participants including but not limited to tailored nutritional consultation services.
- Carry out operational management including the compilation of course participants’ records; the administration of invoices, fees and accounts; the maintenance of archives and other operational purposes;
- Carry out staff administration including the recruitment of staff and/or engagement of sub-contractors; administration of payroll, annual leave and sick leave; review and appraisal of staff performance; conduct of any grievance, capability or disciplinary procedures; and the maintenance of appropriate human resources records for current and former staff; and provide references;
- Monitor the course participants’ progress and educational needs, report on the same internally and to the employers of the participants.
Rights of the data subject
If your personal data is processed, then you are a “data subject” within the meaning of the GDPR. You have the following rights vis-à-vis the controller:
- Right of access: You may request information about your data processed by us, including the purposes of processing, the category of personal data, the categories of recipients to whom the data have been or will be disclosed by us, the envisioned period of storage, the existence of a right of rectification, erasure, restriction of processing or objection to it, the existence of a right to lodge a complaint, the source of your data if collected indirectly, and the existence of automated decision-making, including profiling.
- Right to rectification: You have the right to demand without undue delay the rectification of inaccurate personal data stored by us as well as to have incomplete personal data stored by us completed.
- Right to erasure: You have the right to demand that personal data stored by us, unless processing is required to fulfil a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
- Right to restrict processing of your personal data: You have the right to demand that processing of your personal data be restricted in the following circumstances:
(a) if you want us to establish the data’s accuracy;
(b) where our use of the data is unlawful, but you do not want us to erase it;
(c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
(d) where you have objected to our processing and verification of overriding legitimate grounds is pending. Personal data under restriction will remain stored but will not be processed while the restriction is in effect.
- Right to data portability: You have the right to receive the personal data on you that you have provided us in a structured, commonly used and machine-readable format or to demand that it be transmitted to another controller.
- Right to object: You may object at any time to the processing of your personal data where such processing is based on our legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds.
- Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. You may contact the supervisory authority responsible for the location of our company, as indicated at the end of this Privacy Notice.
- Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal applies only to future processing and does not affect the lawfulness of processing carried out prior to withdrawal. Withdrawing consent is as straightforward as giving it.
Additional Right Applicable to the Philippines
Individuals within the scope of the Philippine Data Privacy Act of 2012 are additionally afforded the Right to Damages. This right entitles you, as a data subject, to seek compensation in accordance with Philippine law for any damage arising from the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use or processing of your personal data.
Procedure for Exercising Your Rights
To exercise any of your rights as a data subject, please contact our Data Protection Officer as outlined in this Privacy Notice.
Upon receipt of your request, we have one month to respond.
When a request is made electronically, and unless you request otherwise, we will provide the information in a commonly used electronic format.
If an individual exercises his or her rights in accordance with the GDPR, we will not charge any fees. However, a reasonable fee based on administrative costs may be charged for any further copies or where requests are manifestly unfounded, repetitive, or excessive.
What personal data do we collect?
Customers
To enable us to communicate with you and to ensure that we meet certain legal requirements such as KYC (know your customer), we need to have certain details of yours or details of individual contacts at your organisation (such as their names, telephone numbers and e-mail addresses). This may also include job titles or other contact information necessary for the provision of our services or compliance with applicable regulations.
In addition, to fulfil our legal obligations under applicable anti-money laundering and counter-terrorist financing laws, we may be required to collect and verify information relating to your organisation’s ownership structure, including details of Ultimate Beneficial Owners (UBOs), authorised representatives, and other individuals exercising control. Such information may include names, dates of birth, identification documents, nationality, residential addresses, shareholding or ownership interests, and related corporate documentation.
We may also collect information on bank account holders, payment beneficiaries, and other parties involved in financial transactions to comply with sanctions screening, fraud-prevention, and regulatory requirements. Where appropriate, we may conduct politically exposed person (PEP) checks, sanctions check, adverse-media screening, or credit-risk assessments, which may require us to obtain or review additional financial or compliance-related information.
Course Participants
We collect the basic personal data (i.e. name, surname, contact details, performance details and nationality) of the course participants to provide the services their employer has engaged us to provide as per the service agreement we have signed with them. Depending on the nature of the training or assessment, this may also include information related to participation records, assessment results, or feedback necessary to monitor progress and performance. We may also collect additional personal data for providing tailored nutritional consultation services to you**, including information related to dietary preferences, nutritional requirements, or other relevant health or wellness information that you choose to share with us**. Where the training or consultancy services are provided on behalf of your employer, we may share your participation details, progress, performance records, and evaluation results with your employer in order to fulfil our contractual obligations and to enable them to monitor training outcomes.
Website Users
As you interact with our website, we may automatically collect Technical Data (i.e. which might include internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website) about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please refer to further information provided below on our Cookie Policy for further information. Our website does not enable our visitors to communicate with others.
Furthermore, you may contact our company directly via our website by entering your personal data which includes your name and email. If you choose to do so, you may add your company name and phone number. You do, however, have the option to contact us directly by email or phone without entering and sharing your personal data. Any personal details collected via our website will be used only to respond to your inquiries. Such data will be retained only for as long as necessary to address your request and will not be used for any other purpose unless explicitly requested or authorised by you. Your personal data will not be stored by us unless explicitly requested by you or required for the fulfilment of your inquiry.
Suppliers of goods and services
We collect a small amount of information from our Suppliers to ensure that operations work properly. We need contact details of relevant individuals at your organisation so that we can communicate with you. We also need other information such as your bank details so that we can pay for the services you provide (if this is part of the contractual arrangements between us). In addition, as part of our due diligence, compliance, and risk-management processes, we may conduct Know-Your-Supplier (KYS) and anti-money-laundering (AML) checks. This may require us to collect and verify information relating to your organisation’s ownership structure, authorised representatives, senior management, and other individuals acting on behalf of the supplier, including names, job titles, business contact details, identification documents where legally required, and information necessary to confirm the legitimacy of the business relationship.
We may also carry out sanctions screening, politically exposed person (PEP) checks, and adverse-media reviews on the supplier entity and, where relevant, associated individuals, in order to comply with applicable legal and regulatory obligations.
As part of our supplier-audit and compliance-monitoring activities, we may collect additional data and documentation such as organisational charts, management names, audit responses, operational procedures, quality and safety documentation, photographs or screenshots of facilities (where provided by the supplier or captured during a virtual audit), and other information relevant to verifying compliance with contractual, hygiene, safety, environmental, or regulatory standards. These audits may be conducted either on-site or remotely, depending on operational requirements.
Any personal data collected during these processes will be limited to what is necessary and proportionate, and will be processed in accordance with applicable data-protection laws.
Visitors
When visiting our premises, we collect the necessary personal data required for security and notification purposes.
How do we store your data?
We have in place the necessary technical and organizational measures for the security and confidentiality of the personal data that we process.
Personal data are stored securely, using a mixture of encryption, password protection, access-controlled areas and servers/back-ups all kept with multiple lock protection.
The legal bases we use for lawful processing
We process personal data only where we have an appropriate lawful basis. Depending on the specific processing activity, we rely on one or more of the following legal bases:
- Performance of a contract:
Processing is necessary to take steps prior to entering into a contract or to perform our contractual obligations, including:
- Establishing and maintaining contractual relationships
- Provision of contracted services
- Invoicing, payments, remittances, and collections
- Non-promotional service communications
- Contract review and administration
- Responding to enquiries and requests related to our services
- Compliance with a legal obligation:
Processing is required to comply with applicable legal and regulatory obligations, including:
- Compliance with legal and regulatory requirements
- Record-keeping and reporting obligations
- Responding to lawful requests from competent authorities
- Employment-related statutory obligations
- Legitimate interests:
Processing is necessary for our legitimate business interests, provided these interests are not overridden by the rights and freedoms of individuals. Such processing includes:
- Risk management and fraud prevention
- Performance measurement and business analytics
- IT, information security, and telecommunications support
- Business continuity and contingency planning
- Internal ethics reporting, investigations, and security monitoring
- Workforce planning and internal administration
- Internal training and professional certifications
- Interaction with other organisations, industry bodies, and professional associations
- Handling complaints and improving service quality
We ensure that appropriate safeguards are applied and that our legitimate interests are carefully balanced against the interests and fundamental rights of data subjects.
- Consent:
Where required by law, we rely on the individual’s consent, which may be withdrawn at any time. This includes:
- Marketing and other promotional communications
- Certain optional communications or activities where consent is the most appropriate legal basis
Marketing and other promotional communications
We may process personal data to inform you about products, services and offers that may be of interest to you and/or your business and/or your employers. The personal data that we process for this purpose consists of information you provide to us and data we collect and/or infer when you use our services. We can only use your personal data to promote our products and services to you if we have your explicit consent to do so or, in certain cases, if we consider that it is in your legitimate interest to do so.
You have the right to object at any time to the processing of your personal data for marketing purposes by contacting us at any time.
You have the right at any time to stop us from contacting you for marketing purposes by opting – out as easily as you have opted – in for receiving the said marketing communication.
Third-Party Access and Data Disclosure
The recording, processing and use of personal data is carried out by us as well as other companies in the corporate group of MCTC or by external service providers who are contracted by us and both contractually and legally bound to data protection. In these cases, we ensure that Group companies and these external service providers abide by the relevant legal data protection rules.
Otherwise, other than as set out in this Privacy Notice we will not share your personal data with any third parties, and no third parties shall have access to your personal data. We may, however, share limited personal data with third parties where this is required to conduct due-diligence checks, supplier or customer audits, sanctions screening, fraud-prevention activities, or to fulfil our contractual obligations with your organisation, provided that such third parties are subject to appropriate contractual, confidentiality and data-protection obligations.
We also use certain third-party software platforms and service providers to support our internal operations, including learning management systems, training platforms, and performance-evaluation tools. These providers may, in limited circumstances, access personal data when providing technical support, system maintenance, troubleshooting, or administrative services. Such providers act as data processors on our behalf and are bound by strict contractual obligations, including confidentiality, data-protection compliance, and limitations on the use of personal data. Any such access is restricted to what is strictly necessary and is monitored and controlled by MCTC.
We may also need to share your personal data from time to time to comply with the law. We will only forward data to the responsible authority in the event of official or legal demands as well as legal obligations to transmit data. This also applies in the event of a court order for transmission. In the case of an official, legal or judicial obligation to transmit data, we will examine in each individual case whether the transmission complies with the basic principles of the GDPR and/or the applicable national law. Where possible and lawful, we will notify you before disclosing your data to public authorities.
Job Applicants
We may contact the following parties in connection with our recruitment processes and, in order to obtain the information required from those parties, share your personal information:
- regulators, government departments, law enforcement authorities, tax authorities and insurance companies;
- any relevant dispute resolution body or the courts;
- any recruitment consultant or agency with which you are engaged;
- any training, education or certification body from whom we require verification of your attendance at, or certification from, such body (e.g. Universities);
- the referees whose details you have provided to us for the purposes of obtaining a reference for your application; and
- other third parties where necessary for the purposes of verifying your qualifications, experience, suitability for the role, or to comply with applicable legal or regulatory requirements.
Course Participants
Details of your course progress report, correspondence and grades will be shared with your employer.
The “Safe Food Handling and Nutrition Course” is endorsed by the Shipping Deputy Ministry of Cyprus, and we are therefore obligated to inform them every time a participant commences and completes the course. We share with the Shipping Deputy Ministry of Cyprus, your Name, Surname, Rank, Date of Birth, Nationality, Gender, your final grade, the date when you commenced with the course and the date when you completed the course. The Shipping Deputy Ministry of Cyprus may require this data to issue a Cyprus flag state endorsement upon completion of this course, if requested to do so in the future.
The countries where data will be stored, processed and/or transferred
Your personal data we collect may be stored and processed in the EU or any other country in which we or associated third parties maintain facilities. Such third parties may have access to personal data solely for the purposes of performing the contractual obligations as specific accordingly to our relationship, and not for any other purpose. This may include cloud-hosting providers, software platforms, and other service providers located outside the EU. In case we need to transfer your personal data, we will take all reasonable measures to safeguard the transfer of your personal data to third parties in a manner that complies with the applicable data protection laws.
In these circumstances, personal data will only be transferred on the following bases:
- the country that we send the personal data to is approved by the European Commission as providing an adequate level of protection of personal data (adequacy decision); or
- the recipient has entered into a set of the standard contractual clauses with us as approved by the European Commission; or
- the recipient has provided appropriate safeguards; or
- you have explicitly requested for such transfer to be made. Where required, we will also conduct transfer impact assessments to ensure that the level of protection afforded to your personal data is essentially equivalent to that guaranteed within the EU.
How long will the data be retained
Retention of specific records may be necessary for one or more of the following reasons:
- Fulfilling statutory or other regulatory requirements
- Evidencing events/agreements in case of disputes
- Operational needs
- Historical and statistical purposes
Where we collect personal data for which we subsequently have no use for any business purpose we will then review and may destroy such personal data at our discretion.
Where we collect personal data on the basis of consent, we will proceed with their disposal upon receipt of the request for the withdrawal of consent, unless there is any other legal ground for continuing the processing of such data.
The personal data of the data subject will be erased or restricted as soon as the purpose of storing the data ceases to apply. Furthermore, data may be stored if doing so has been provided for by European or national lawmakers in EU regulations, laws or other provisions to which the controller is subject. The data will likewise be restricted or erased if a storage period stipulated by the aforementioned rules expires, unless it is necessary to continue storing the data in order to conclude or fulfill a contract.
We have an obligation, during a participant’s working life, to provide factual information on what they have studied and achieved, i.e. a transcript and copy of the certificate of achievement. The retention period for these records should reflect the need to fulfill this obligation over long periods of time. Participant records will be kept for not less than 6 years after a participant has completed the course to provide detailed records which may be used in the event of a claim made by the participant. Certain records may be retained for longer periods where necessary to comply with maritime, educational, or regulatory requirements, or where retention is required to demonstrate training history for certification or flag-state purposes.
Operational, HR, supplier, customer, and audit-related records will be retained only for as long as necessary to fulfill the purposes for which they were collected, including legal, contractual, accounting, compliance, or reporting obligations. Once retention periods expire, personal data will be securely deleted, anonymised, or archived in accordance with our internal policies and applicable law.
What happens if the data is not collected?
Your personal data is required for communication and setting up a contractual agreement to provide employment, products, and services. Without this data we will not be able to communicate with you or enter into a contractual agreement with you. This includes both business and employment contracts.
We need personal data to:
- Enable consensual bilateral communications
- Engage in pre-contractual activities
- Honour contractual obligations
- Be able to employ personnel
- Be able to provide our services
- Comply with legal, regulatory, and health and safety obligations (including KYC/AML, statutory training, or certification requirements)
Without this data, we will not be able to perform these primary activities. In certain cases, failure to provide required information may result in our inability to proceed with employment, training enrolment, service provision, onboarding as a supplier or customer, or compliance with mandatory legal obligations.
Surveys, Feedback and Evaluation Activities
When you take part in our feedback survey, we record your organisation name, your job role and your answers to questions we ask about your opinion of, and use of, our products and services.
We use this information to develop and improve our products and services and our customer relationships. Your job role, organisation and some or all of your comments may be publicly displayed on our website as a testimonial. We will do this based in our legitimate interest in marketing our products and services.
Your details will not be shared with any third parties nor to make any automated decisions that might affect you.
Automated decision making
We do not use automated decision making.
Hyperlinks
Our internet sites may contain hyperlinks (i.e., electronic cross-references) with which internet sites from other companies can be called up. This Data Privacy Notice does not apply to these linked internet sites belonging to other companies. We are not responsible for the content, security, or data-protection practices of such external sites and encourage you to review the privacy policies of any third-party websites you visit.
Cookies
A cookie (sometimes also referred to as a browser cookie, HTTP cookie, Internet cookie or Web cookie) is a small file sent from a Web server to your computer whenever you visit a website. Cookies allow your browser to store information that can be sent back to the server during subsequent visits. If you return to the website later, your Web browser sends the small file to the server to notify the website of any previous activity you engaged in on the site. Once you return to a website, the server can retrieve the cookie file from local computer to assist in expediting certain functions such as logging in and retrieving account or user data.
When do we use cookies on our websites?
Cookies may also be placed in your browser when visiting our website via third party application plugins or when using third party modules on the website. This applies when using social media “sharing” tools via third party application plugins. We do not, however, have access to details regarding your social media or personal data during this process. Some cookies are essential for the basic functioning of our website, while others help us analyse usage patterns, improve website performance, or personalise your experience. You can manage or disable cookies through your browser settings; however, doing so may affect the functionality of certain parts of the website.
The table below demonstrates the cookies that we use and explains why we use them.
| Cookie Name(s) | Type | Purpose / Description | Personal Data Collected | Additional Information |
| _ga, _gid, _gat, _gali | Analytics (Google Analytics) | These cookies are used to collect anonymous statistical information about how visitors use our website. This includes aggregated data such as the number of visitors, the pages visited, time spent on pages, general usage patterns, and where visitors came from. We use this information to compile reports and to help us improve website performance and user experience. | No personally identifiable information is collected. All data is aggregated and anonymous. | Read Google’s overview of privacy and safeguarding data: https://support.google.com/analytics/answer/6004245 |
| PHPSESSID | Strictly Necessary | This cookie is required for the basic functioning of the website. It stores a temporary session identifier that allows users to move between pages without re-entering login credentials. It is also required to access any secure or authenticated areas of the site. Without this cookie, users cannot remain logged in or proceed to secure pages. | No personal data is stored. Only a temporary session ID is kept. | Enables essential website functionality such as login persistence. |
Controlling Cookies on your Device
Cookies on an Internet device help make the user experience of our websites better. By continuing to use this website, you are consenting to the use of this site’s cookies and similar technologies for the purposes we describe in the Cookies section of this Privacy Notice. If you do not agree to the use of cookies in this or any such way, you can set your browser privacy and cookies settings accordingly. Most internet browsers are initially set up to automatically accept cookies. You can change the settings to block cookies or to alert you when cookies are being sent to your device, as well as delete them. There are a number of ways to manage cookies. Please refer to your specific browser instructions or help screen to learn more about how to adjust or modify your cookie browser settings. If you use different devices to view and access this website (e.g. PC, smartphone, tablet, Smart TV) you will need to ensure that each browser on each device is adjusted to suit your cookie preferences accordingly. For further information on Cookies, such as deleting, disabling or blocking cookies, please visit AboutCookies.org For more specific information on how to adjust cookie configurations, please refer to your browser’s help pages or settings menu.
We do not use cookies to personally identify you, but our website sets certain first-party cookies that are necessary for functionality or used to generate anonymous statistical information. A first-party cookie is a cookie set by the domain name that appears in your browser’s address bar. These cookies are either essential for the functioning of the website or are used to help us improve site performance.
Modifications to Privacy Notice
MCTC reserves the right to amend this Privacy Notice from time to time, and the updated versions will be posted on our website and date stamped so that you are aware of when the Privacy Notice was last updated. Your continued use of our Website following the posting of changes to these terms means you accept these changes. Where required by applicable law, we will notify you of any material changes to this Privacy Notice through appropriate means, such as a notice on our website or direct communication.
Contacting Us
If you have any questions about this Privacy Notice, please email or contact us as follows referencing “Privacy Notice”:
MCTC Marine Ltd
Archiepiskopou Leontiou A, 183,
3020, Limassol, Cyprus
Email: [email protected]
If you are based in the Philippines contact us through:
Marine Catering Technical Consultancy Far East Inc. (hereinafter “MCTC Philippines” or “MCTC Far East”)
4th and 8th Floor Döhle Haus Manila, 30 – 38 Sen. Gil Puyat Avenue, Barangay San Isidro, Makati City, 1234 Philippines
Tel: +632 8633 3113, +639 2934 3 6191
Email: [email protected]
Updated: Last update 25 February 2026
