International Association of Maritime Institutions General Privacy Notice

 

International Association of Maritime Institutions General Privacy Notice
 

v1.0 June 2026
 

Approved by: IAMI Directors

Version: Ver 1.0

Issue Date: Sept 2026

Review Date: Sept 2029

Contact Person: Commercial Manager, IAMI

​

The purpose of this privacy notice is to explain how the International Association of Maritime Institutions (“IAMI”) processes personal data to fulfil its data protection responsibilities in general. It covers all related activities by the staff and associates/ consultants of IAMI, as well as anyone making casual enquiries regarding the services being offered by IAMI.

​

The role of IAMI in data protection terms is that of a data controller when it determines the purpose and use of personal data. The Privacy Manager (PM) will ensure this happens in accordance with the UK data protection legislation. The PM is contactable using dataprotection@iami.org.uk

This privacy notice does not cover personal data collected by assessment centres, such as the student data, that is then given to IAMI for processing examinations, for which IAMI is a data processer. The management of student information is the responsibility of the assessment centres as the data controllers in these instances.
 

The personal data processed by IAMI will be sufficient to administer enquiries, and to deal with any contractual and/or commercial arrangements we may have with you. To ensure that IAMI can fulfil its legal obligations, typically it will collect contact information and, only if necessary, health related data to facilitate visits etc.

​

Please note that if you decline to provide the information asked for, IAMI may not be able to fulfil all aspects of its legal obligations for you.

IAMI’s duty of confidentiality means that our staff will treat your personal data with due respect and confidence. It is only disclosed to others when absolutely required. IAMI uses reasonable organisational and technical measures to ensure personal data is kept secure. We also expect the same duty of confidentiality of all third parties with whom it shares personal data. The number of organisations that might receive personal data is kept to a minimum and is reviewed regularly. The servers used to process all information by IAMI are located in the UK.
 

IAMI’s processing of personal data is in accordance with the principles of data protection and always against a lawful reason such as those listed below:

• To fulfil its contractual obligations, including contract preparation

• When processing is necessary for the purposes of its stated legitimate interests, such as responding to enquiries, and marketing when permitted or the legitimate interests of third parties

• For the purpose of disclosing data to a third party, in response to a valid request, we may apply a ‘recognised’ legitimate interest

• When processing is necessary for the purposes of recognised legitimate interests

• To comply with legal obligations

• When processing against a pre-defined purpose for which consent has been

• sought and recorded prior to that processing commencing; please note that consent can be withdrawn at any time by asking the privacy manager
  
  IAMI will share personal data but only when necessary, with some or all of the following:
   

• Administrative support where personnel are bound by a data processing agreement and/or contractual arrangements

• Solicitors appointed by IAMI to handle any legal matters if necessary

• Nominated, auditors, suppliers and insurance companies

• Accountants appointed by IAMI for payment handling and related record keeping

• Appointed contractors for specific outsourced services who are subject to a data

• processing agreement or equivalent, as bound by their contracts
  
  IAMI follows a retention schedule to determine the length of time it holds different types of personal data. The key retention periods are as follows:
   

• Contractual/ commercial related data will be retained throughout the life of the relevant engagement plus another 7 years following its conclusion

• Contact data is stored indefinitely unless IAMI receives a valid request to erase someone’s data

• Financial records and invoices, which may include personal data, will be retained for 6 years following the end of the current tax year of processing, with the exception of banking details that will be deleted only once any financial payments have been completed
  
  Please note that IAMI will retain copies of data beyond the stated periods if it has a legitimate interest or legal obligation to do so. This may include, for instance, evidence to defend itself in a court of law. Such instances will be the exception and would, in any event, be justified internally and registered beforehand.
  
  At the end of the retention period, IAMI will destroy, delete or return the personal data for which IAMI has no lawful basis to retain. If it is technically impractical to delete electronic copies of this data, it will be put beyond operational use. It should be noted that IAMI allows up to 3 months after the retention period has ended to complete the action.
  
  UK’s data protection legislation sets out ‘data subject rights’ (although these do not apply in all situations), and these are summarised below:
   

• Right to be informed as to how someone’s personal data is being processed – this is done through this notice

• Right to access personal data held by IAMI; this is done by submitting a (Data) ‘Subject Access Request’ or SAR

• Right to rectification of personal data if IAMI has collected it incorrectly or it needs to be updated

• Right to erasure of someone’s personal data for which IAMI no longer has a legitimate purpose to process

• Right to restrict processing under certain circumstances, during which personal data will be put out of operational use until the related matter is resolved

• Right to data portability of personal data in a machine-readable version, but this only applies to data provided with consent or under contract

• Right to object to processing personal data for which IAMI does not have a legal or contractual obligation

• Right to complain about the way IAMI has managed/ processed someone’s personal data

• Rights related to automated decision making and profiling, however IAMI does not use these techniques in its decision making
  
  Further details on all data subjects’ rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.
  
  Raising concerns, exercising rights, or making queries about IAMI’s processing of personal data can be done by contacting the PM. Please be aware that IAMI will verify your identity, if necessary, before responding fully. For that reason, you may be asked for proof of identification that, in context, will enable IAMI to confirm your identity. Alternatively, you may contact the ICO directly, using the details provided above but beware they are likely to refer the matter back to you if you have not addressed it with us beforehand.
  
  Date & new version number: June 2026 v1.0
  Summary of changes: New document
  Reason for changes: New document