Data Transfers Policy

1          INTRODUCTION

  • This data transfers policy (“Policy”) explains how Walblue Transport And Maritime Limited and its subsidiaries and/or affiliates (together “Walblue Transport And Maritime Limited”) transfer Personal Data to a

Third Country for processing.

  • This Policy: forms part of Walblue Transport And Maritime Limited’s Data Protection Policy ; and
  • May be amended by Walblue Transport And Maritime Limited at any time, consistent with the requirements of applicable laws and regulations. Any revisions will take effect from the date on which the amended Policy is published, as indicated in the version number set out herein.

2          DEFINITIONS

  • Data Controller” means the person or entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data;

 

Data Processor” means any person or entity (other than an employee of the Data

Controller) which processes Personal Data on behalf of the Data Controller;

Data Subject” is as defined in the Data Protection Policy; “Personal Data” is as defined in the Data Protection Policy; “process” or “processing” or “processed” is as defined in the Data Protection Policy; and

 

Third Country” means any country outside the European Economic Area (“EEA”) which is not subject to an adequacy decision by the European Commission or whose laws do not provide an adequate level of protection for the rights of Data Subjects in respect of their Personal Data.

 

  • Words denoting the singular shall include the plural and vice versa.
  • Unless otherwise stated, all defined terms have the same meaning as defined in the Data Protection Policy.

3          SCOPE

  • This Policy covers: the transfer of Personal Data from the EEA to a Third Country; and the transfer of Personal Data from a Third Country to another Third Country
  • Such transfers include without limitation transfers to an international organization which has locations in both a Third Country and the EEA. If making a transfer to an international organization located in a Third Country, simply because it has locations in both a Third Country and the EEA does not stop this transfer from being a transfer to a Third Country.

 

  • This Policy is a global policy which applies to transfers made by Walblue Transport And Maritime Limited globally.1

 

  • For the purposes of this Policy, the UK does not qualify as a Third Country because the EU General Data Protection Regulation 2016/679 (“GDPR”) will be directly effective in the UK from 25 May 2018 and will be transposed into UK national laws by virtue of the UK Data Protection Bill on or before the UK’s exit from the EU.

4          TRANSFERS

  • When transferring Personal Data to Third Countries, in its capacity as a Data Processor, Walblue Transport And Maritime Limited shall ensure that, prior to any such transfer: such transfers are permissible under any contract that is in place between the relevant Walblue Transport And Maritime Limited entity and the Data Controller on whose behalf such Walblue Transport And Maritime Limited entity is processing the Personal Data; and the recipient of such Personal Data agrees to be bound by data protection obligations that are at least equivalent to those which apply to the relevant Walblue Transport And Maritime Limited entity under the contract referred to in Section 1(a).

 

  • When transferring Personal Data to Third Countries, in its capacity as a Data Controller, Walblue Transport And Maritime Limited shall ensure that, prior to any such transfer: it has satisfactorily completed the Data Transfers Checklist in order to carry out appropriate due diligence to satisfy itself that the recipient of such Personal Data provides sufficient guarantees in respect of the Personal Data. This includes ensuring that the recipient implements appropriate technical and organizational measures to safeguard the Personal Data against unauthorized or unlawful processing and against accidental loss or damage; and there is an adequate level of protection in place in respect of the Personal Data being transferred including the following: checking if the country of the recipient is one which has been approved by the European Commission as being an ‘adequate protection jurisdiction’ such that Personal Data may be transferred to that Third Country without any further safeguards being necessary; or ensuring that the Walblue Transport And Maritime Limited company transferring the Personal Data has a contract in place with such recipient that includes data protection obligations that meet the minimum requirements of the GDPR; or ensuring that the recipient of Personal Data is Privacy Shield certified.

 

  • The general prohibition on transfers of Personal Data to Third Countries can be derogated from in certain specific situations. A transfer, or set of transfers, may be made where the transfer is: made with the Data Subject’s informed consent; necessary for the performance of a contract between the Data Subject and the recipient or for pre-contractual steps taken at the Data Subject’s request; necessary for the performance of a contract made in the interests of the Data Subject between the controller and another person; necessary for important reasons of public interest; necessary for the establishment, exercise or defence of legal claims; necessary to protect the vital interests of the Data Subject or other persons, where the Data Subject is physically or legally incapable of giving consent; or made from a register which, by law, is intended to provide information to the public (and which is open to consultation by either the public in general or those able to show a legitimate interest in inspecting the register).

 

  • DATA INTEGRITY

Walblue Transport And Maritime Limited shall only transfer any Personal Data in a manner that is consistent with the purposes for which such Personal Data was collected or otherwise processed. Prior to any such transfer, Walblue Transport And Maritime Limited shall take reasonable steps to ensure that the Personal Data being transferred is accurate, complete, relevant and up-to-date.

 

  • NOTICE

Walblue Transport And Maritime Limited shall ensure that any transfers of Personal Data are made within the parameters of any privacy or other notices that have been given to the Data Subjects to which the Personal Data relate. Any such notices about the possibility of transfer will have been given at the time the Personal Data was collected, in clear and transparent language. If no such privacy notices were given, then such notices will be given to the relevant Data Subjects prior to transfer, unless a derogation or exemption applies.

 

  • DATA MINIMIZATION

Walblue Transport And Maritime Limited agrees to limit the Personal Data to be transferred to the minimum necessary to fulfil the necessary processing purpose(s). The transfers shall be limited to those who need to know the same in connection with the processing purpose(s).

 

  • DOCUMENT CONTROL

The Global DPO is the owner of this Policy and is responsible for ensuring that this procedure is reviewed in line with the relevant review requirements.

A current version of this Policy is available at www.walbluetm.com/data-transfers-policy