Privacy Notice – Ship Registry

This Privacy Notice applies to the processing of personal information by the Isle of Man Ship Registry, Department for Enterprise, Isle of Man Government.

We are the Isle of Man Government Department for Enterprise (known as “DfE”); we are responsible for creating an environment, through innovation and collaboration, where our economy thrives. We are divided into one executive directorate, three registries and four agencies: the purpose of the Ship Registry is to provide a ship registry which adds real value to our clients in a rapidly changing global maritime environment. This Privacy Notice tells you what to expect when the Ship Registry collects and uses personal information, including how we use this website.

CrewMatters+ Mobile Application

The CrewMatters+ mobile application is operated by the Isle of Man Ship Registry, Department for Enterprise, Isle of Man Government. Where the CrewMatters+ application is used, personal information may be processed in connection with user accounts, communications, files shared within the application, and support or safety reports submitted through the service.

Any such processing is carried out in accordance with this Privacy Notice and applicable data protection legislation.

How we use your information

This privacy notice tells you what to expect when the Ship Registry collects personal information on this website. It applies to information we collect when people:

• Visit and use our website, including submission of information
• Visit our webpage on gov.im
• Contact us by email, in person or over the phone
• Make a request under the Code of Practice for Access to Government Information (“Access Code”) or Freedom of Information 2015
• Make a Data Subject Rights request (e.g. a subject access request) This Privacy Notice also provides information on:
• Consenting to the use of Cookies and Passive Technologies on your Browser
• Why will we process personal data (aka “the legal basis”)?
• How will we securely process personal data?
• Miscellaneous
  • Under what circumstances can The Ship Registry contact me?
  • Retention period
  • Public Records and Law Enforcement
  • Processing special category (sensitive) data and the data of children (under 16s)
  • Sending us private messages on social media
• Contact details
  • Department for Enterprise Data Protection Officer:
  • Isle of Man Information Commissioner:
  • Complaints

 

Visit and use our website, including submission of information

www.iomshipregistry.com is the official site of the Isle of Man Ship Registry. The website is used to submit notifications and make applications, receive payments and requests:

 

How	What	Legal basis
When you submit an application for a Discharge Book or Seamans Card using Form R001 or related webform	Your name and contact details and any other personal information you provide to complete the form (this might include special category data pertaining to your race or ethnic origin)	Legal obligation - To allow the issuance of seafarers’ documentation under The Merchant Shipping (Seaman’s Documents) Regulations 1987 as they have effect in the Isle of Man
When you submit an Endorsement application using Form A-1 or apply online via webform	Your name and contact details and any other personal information you provide to complete the form	Legal obligation - To allow the issuance of endorsements under STCW2010 (Regulation 1/10)

 

How	What	Legal basis
When you register as a Representative Person using form REG 6 or related webform	Your name and contact details. It should be noted that the register is a public document and accordingly the information that is prescribed by statute to be recorded on the register will be available to members of the public. This may be by public access to our electronic registry database (“MAVIS”), by purchasing a transcript of registry for a specific ship, or by other means deemed appropriate by the Department	Legal obligation - Required by The Merchant Shipping Registration Act 1991
When you apply to register a vessel and submit the relevant REG forms or related webforms	Your name, owner’s name and contact details and any other personal information you provide to complete the forms. It should be noted that the register is a public document and accordingly the information that is prescribed by statute to be recorded on the register will be available to members of the public. This may be by public access to our MAVIS database, by purchasing a transcript of registry for a specific ship, or by other means deemed appropriate by the Department	Legal obligation - Required by The Merchant Shipping Registration Act 1991
When you submit an MLC Complaints Form	Your name, rank, contact details plus other information that may be necessary to investigate your complaint (this might include special category data relating to, for instance, medical information)	Legal obligation – Merchant Shipping (Maritime Labour Convention) Regulations 2013 – to investigate complaints made under these Regulations
When you submit a CSR form	Owner’s name and contact details	Public task - Vessel security requirement
When you are a witness to a casualty / death investigation	Your name, DOB and contact details (this might include special category data pertaining to your race or ethnic origin)	Legal obligation - Merchant Shipping (Masters & Seamen) Act 1979 The Isle of Man Merchant Shipping (Accident Reporting and Investigation)
When you are a member of crew listed in a vessel’s Official Log Book	Your name and contact details and any other personal information you provide to complete the form	Legal obligation - Merchant Shipping (Official Log Books and List of Crew) Regulations 2015, requires Manx ships to keep and maintain an official log book and to make and maintain a list of crew
When you apply to be an online MAVIS user	Your name and contact/company details	Public task - To allow clients to process online
When you make a payment (including all methods of payment)	Your name and contact details	Public task - To allow clients to pay online

 

Stored and secured

We securely store personal information electronically and manually:

• Ongoing email communications are stored on our Isle of Man Government email system, Microsoft Outlook; and dependent on the nature of your enquiry
• Records management tools: MAVIS, Umbraco or the Isle of Man Government secure network
• All our online services and websites are secure, this includes records in our registry
• Finally, we do have hard copy records for Vessels Official Log Books that are retained onsite for 24 months, then held in secure offsite third-party storage for 60 months.

Access by

Employees of the Isle of Man Ship Registry, and their contracted suppliers for the provision of specific services and authorised online services users have access. In addition, all records held on MAVIS can be accessed by the software developers for the purposes of maintenance only.

Shared to

By law we may be required to share some information with other regulatory or enforcement authorities for legitimate interests for example, in the event of an accident, your information may be shared with courts if any prosecutions arise from the investigation. In addition, as a public registry, some information can be accessed by the public, you will be made aware if you are submitting personal information for such a purpose, for example, when you register as a Representative Person using form REG 6 this information will be available to the general public; in addition, when you apply to register a vessel and submit the relevant REG forms, this will available to members of the public . This may be by public access to our MAVIS database, by purchasing a transcript of registry for a specific ship, or by other means deemed appropriate by the Department.

Retention

Retention details are held within out Information and Records Management Policy – Retention of Records

Procedure. Please contact our Data Protection Officer for more information.

Visit our webpage on www.gov.im

www.gov.im/about-the-government/departments/enterprise is a sub-site for DfE on The Isle of Man Government website, Cabinet Office Government Technology Services (GTS) own the website. The Cabinet Office/GTS Privacy Notice in relation to how you use www.gov.im can be found at the top of each page next to the Terms and Conditions or following this link: www.gov.im/privacy.

However, if we do want to collect personally identifiable information through our gov.im sub-site, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. The only people who have access to personal information submitted on this website are those who have a legitimate need to.

Contact us by email, in person or over the phone

We will only ask for your name and postal or email contact details. You may choose to provide extra information if you are making an enquiry.

The “contact us” section of the Ship Registry website invites emails to:

• shipping@gov.im
• survey@gov.im
• marine@gov.im
• seafearers@gov.im
• dfe@gov.im
• finance@gov.im
• marketing@gov.im
• crewmatters@gov.im 

All emails to these addresses are directed to email mailboxes in the Ship Registry. Email mailboxes are accessed by only a select number of staff central to the Ship Registry who are able to allocate enquiries out to the team who will be able to address your enquiry or request. Such emails will only be shared outside the Registry or the Department with your knowing, and we will only do so in order to address your enquiry or request.

We securely store personal information electronically and manually:

• Ongoing email communications are stored on our Isle of Man Government email system, Microsoft Outlook
• We have three main records management tools across the Ship Registry all specifically designed for the type and use of the information recorded; depending on the nature and destination of your communication, your information will likely be stored in either: MAVIS, Umbraco or the Isle of Man Government secure network.

In normal circumstances we will only keep a record of this communication in an active area (e.g. emails will be used in Outlook) until the request or enquiry has been fulfilled; after this time, they will be stored in accordance with our Retention Policy.

 

Make a request under the Code of Practice for Access to Government Information (“Access Code”) or Freedom of Information 2015

How

You may decide to write to us to request information in accordance with the Access Code (for information created before 10-Oct-2011) or send us a paper or electronic form in accordance with the Freedom of Information (FOI) Act 2015 (for information created after 10-Oct-2011). Such requests will be handled by the DfE Freedom of Information Team.

What

In order for us to fulfil your request, you will be asked for your name, address; telephone number or email address (to contact you about your request); any other information to allow us to identify you or your information. By providing this personal information to us you  consent to us using the personal information for the purpose of processing your request. We do not need any other personal information in order to process your request and you should only submit the information requested above.

Legal basis

DfE collects and processes your personal information to allow us to respond to requests for information made under the Freedom of Information Act 2015 or the Access to Government Information Code

Stored and secured

Access Code: DfE manages requests entirely on the secure Government network.

FOI: electronic requests are automatically submitted to DfE via the secure FOI management system, iCasework; paper requests are sent to DfE’s Information Governance and Privacy Team, where requests are then manually added and managed on iCasework. Here your data will be stored and held as is set out in the DHA Privacy Policy.

Access by

Access Code: Only the DfE Information Governance and Privacy Team

FOI: As the Department of Home Affairs manage iCasework, they are joint controllers for this information; iCasework Limited act as a Data Processor on behalf of the Department of Home Affairs. They therefore have access to the personal information; iCasework have access to the system in order to maintain it.

Shared to

Neither Access Code nor FOI requests are routinely shared with anyone; occasionally the requests themselves may be shared with other Government bodies in order to provide or advise on an answer, but no personal information would be shared. In addition, FOI request responses are routinely added to the Isle of Man Government FOI Request Publication Log online; again, no personal information is included here.

Retention

Your personal information will be held for a period of one year after your request has been closed; on the DfE network for Access Code requests, and on iCasework for FOIs.

Make a Data Subject Rights request (e.g. a subject access request)

How

Under the Data Protection Act, you have rights as an individual which you can exercise in relation to the information we hold about you. At any point while we are in possession of or processing your personal information, you, the data subject, have the following rights:

 

Access	You have the right to request a copy of the information that we hold about you
Rectification	You have a right to correct data that we hold about you that is inaccurate or incomplete

 

Erasure	In certain circumstances you can ask for the data we hold about you to be erased from our records
Restriction of processing	Where certain conditions apply, you have a right to restrict the processing of your data
Portability	You have the right to have the data we hold about you transferred to another organisation
Objection	You have the right to object to certain types of processing such as direct marketing
Objection to automated processing	You also have the right not to be subject to automated processing including profiling
Judicial review	In the event that the Department for Enterprise refuses your request under right of access, we will provide you with a reason as to why. You then have the right to complain as outlined in Complaints

 

You can make any of these requests by contacting any member of DfE staff or contacting our Data Protection Officer directly using the details at the end of this notice. You may wish to speak to the Data Protection Officer about your request in person or over the phone ahead of making your request. Such requests will be handled by the Data Protection Officer who will work directly with the Ship Registry staff.

What

In order for us to fulfil your request, you will be asked for the following; your: name; address; telephone number or email address (to contact you about your request); any other information to allow us to identify you or your information

Shared to

Your personal information for the purposes of a Data Subject Rights request will only be shared if your are requesting one of the above rights be extended to our third parties or contractors that may be processing your personal data on our behalf (i.e. they are our Data Processors). We will contact the data processors to advise them of your request in order for them to fulfil your request also. You will be advised if this is the case.

Retention

Data Subject Rights requests and any disclosure correspondence will be kept for three years following the closure of the request. However, requests where there has been a subsequent appeal (either to the DfE Data Protection Officer or the Isle of Man Information Commissioner) will be kept for 6 years following the closure of the appeal.

Consenting to the use of Cookies and Passive Technologies on your Browser

What is a Cookie?

Cookies and passive technologies are pieces of information that a website transfers to your computer. Cookies can make the web more useful by storing information about your preferences on particular sites, enabling us to provide more useful features for you. DfE does not directly employ any cookies or passive technology on the gov.im sub-site; any such features used will be managed by Cabinet Office in accordance with their cookie statement, found here: gov.im/about- this-site/cookies/ . A list of cookies employed by the Isle of Man Ship Registry website can be found here: iomshipregistry.com/cookies/

Consenting to cookie and passive technology use

The first time you visit each of our website, you will be provided with an option to approve (or “opt-in”) to the use of all cookies on the website with a pop up in the bottom right-hand corner. We have no way of knowing whether you allow cookies or not, and no way to trace your selection back to you. Instead, your own internet browser remembers the selection so it will treat that cookie the same each time (until you change your cookie settings).

 

Withdrawing consent to cookie and passive technology use

You can usually manage and disable all cookies and passive technologies directly through your internet browser; you may therefore find it helpful to check the guidance provided by your internet browser provider. The most common providers and links to their guidance on cookies and passive technologies have been provided below:

Google Chrome: support.google.com/chrome/answer/95647?hl=en

Microsoft Edge: privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy Mozilla Firefox: support.mozilla.org/en-US/products/firefox/privacy-and-security Apple Safari: support.apple.com/en-lb/guide/safari/sfri11471/16.0/mac/11.0

Opera: opera.com/help/tutorials/security/privacy

Why will we process personal data (aka “the legal basis”)?

We will only process your personal information if a lawful basis exists:

 

Public task	if it is the public interest for us to collect or store e.g. when handling enquiries from members of the public
Legal obligation	Information Rights requests (e.g. data subject rights requests) are made using provisions within either the Freedom of Information Act 2015 or Data Protection Act 2018. We are unable to fulfil these requests without processing your personal information.
Consent	if we rely on your consent to process your information, we will make it obvious what we are asking for consent to do and always tell you how you can withdraw your consent e.g. registering for services, newsletters and competitions.

How will we securely process personal data?

All personal information is kept with the highest standards and safeguards in place. This includes technical security, preventing unauthorised access, undertaking audits and maintaining backups:

• Emails - Email communications are stored on our Isle of Man Government email system, Microsoft Outlook. We encrypt and protect all our emails in line with government standards. If your email service does not support this encryption, you should be aware that any emails we send or receive may not be protected in We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law
• Isle of Man Government Secure Network – There are strict access controls in place meaning that only those within specific Divisions can access team folders; in addition, only the teams within the Divisions who are able to access personal information, are those that have a business need to do so. The administration of the IOMG Secure Network is undertaken by Government Technology Services in the Cabinet Office; however, they are unable to access the content of any records and so will not be able to access your personal information
• Manual records - We do not routinely store manual records, however, those that are already in storage and new records we are required to hold any manually are either stored onsite or in a third party storage facility with whom we have a data protection agreements in place.
• MAVIS/Umbraco - We ensure the confidentiality and security of all data stored in MAVIS or Data is securely stored on PDMS servers located in the Isle of Man, with access strictly limited to authorized personnel for legitimate operational purposes. We implement robust security measures at both the server level, maintained by PDMS, and within the Umbraco software framework, to protect against unauthorized access and ensure data integrity.

 

Miscellaneous

Under what circumstances can The Ship Registry contact me?

Our aim is never to be intrusive, and we aim to always avoid asking irrelevant or unnecessary questions. Moreover, any information you provide to us will always be subject to rigorous measures and procedures to maintain your privacy. You will never be contacted by a means you did not consent to when providing us with your data.

Retention period

We only use personal information for as long as it is needed and will store it for the shortest amount of time possible, in accordance with the law and our Retention Schedule.

Public Records and Law Enforcement

Your personal information may be permanently retained for research use at the Isle of Man Public Record Office if the records containing your personal data are selected for permanent preservation under the Public Records Act 1999. The Isle of Man Public Record Office preserves records of Isle of Man public authorities that are of long-term historic and cultural value. To find our more, please contact the Public Records Office or the DfE Data Protection Officer.

Your personal information may also be processed by, and therefore shared to, competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. To find our more, please contact the DfE Data Protection Officer.

Processing special category (sensitive) data and the data of children (under 16s)

We have to put additional measures in place if we plan to process any special category personal data, including ethnic origin or religion; however, the Ship Registry does not process any special category personal information using this website. In order to process the personal information of children, we would have to put additional measures in place because they may be less aware of the risks involved. The Ship Registry does not target any services to children and does not process the personal information of children for marketing purposes, competitions or registering for services or user profiles.

Sending us private messages on social media

In addition to our official website, the Ship Registry also has several social media platforms: twitter.com/iomshipregistry?lang=en and https://www.linkedin.com/company/69553517/. We include them in this notice for completeness: You may choose to provide us with personal information on our social media platforms; we ask that you do also check the platform’s privacy policy and terms of service prior to sending us anything.

Social media message boxes are accessed by the team responsible for that service/product; this includes the Marketing and Business Intelligence Division, who have responsibility for maintaining Ship Registry’s social media platforms. Such messages will only be shared outside the Ship Registry with your knowing, and only in order to address your enquiry or request. The Marketing and Business Intelligence Division may at certain times require a third party to manage DfE’s social media; if this happens this policy will be revised.

Contact details

For any privacy enquiries, please feel free to contact our Data Protection Officer, or the Isle of Man Information

Commissioner:

Department for Enterprise Data Protection Officer:

 

Address	St George’s Court, Upper Church Street, Douglas, Isle of Man, IM1 1EX
Email	DPO-DfE@gov.im
Tel	+44 1624 686733

 

Isle of Man Information Commissioner:

 

Address	Isle of Man Information Commissioner, P.O. Box 69, Douglas, Isle of Man, IM99 1EQ
Web	inforights.im
Email	ask@inforights.im
Tel	+44 1624 693260

Complaints

In the event that you wish to make a complaint about how your personal information is being processed by the Ship Registry, DfE (or third parties), or how your complaint has been handled, you have the right to lodge a complaint directly with our Data Protection Officer in the first instance; as well as the Isle of Man Information Commissioner.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of the Ship Registry’s data collection and use of personal information. However, we are happy to provide any additional information or a further explanation if required. Any requests for this should be sent to the Data Protection Officer using the above contact details.

 

Notice Issued under DfE Data Protection Policy on 04 March 2026, subject to annual review