MSC Cruises
MSC Cruises Family App - Privacy Notice

MSC Cruises is committed to processing the personal data of its employees fairly, transparently, and lawfully. This Privacy Notice explains how MSC Cruises handles personal data for all employees, including both ashore and onboard (collectively referred to as the "MSC Cruises Family"). This Privacy Notice is accessible through the MSC Cruises Family Application, which allows employees to manage their employment-related activities, including accessing payslips, training programs, and other relevant employment features.

1. Data Controller and Contact Information

The MSC Cruises entity that enters into the employment contract with an employee is the Data Controller responsible for processing their personal data. Employees may refer to their employment contract for details on their specific Data Controller. A Group Data Protection Officer (DPO) is appointed to oversee data protection matters and can be contacted at dpo@msccruises.com.

2. Purpose, Legal basis and Retention Period of Data Processing

MSC Cruises processes personal data for various purposes related to employment. Below is a structured overview of these activities:

2.1. Processing necessary for the performance of the employment contract
No. Purpose of Data Processing Description & Categories of Data Legal Basis Data Retention Period
1 Access to work premises and vessels Name, arrival/departure time, badge data, building or cruise ship entered/exited Legitimate interest, contractual obligation Duration of employment + 10 years
2 Time and absence management Name, telephone, holiday allowance, leave records, remote work requests, presence at work Contractual obligation Duration of employment + 10 years
3 Access to IT systems & MSC Cruises Family App Name, work email, work phone, system logs, website access logs, app activity related to employee services Legitimate interest, contractual obligation Duration of employment + applicable IT retention policies
4 Work permits & documentation Name, contact details, ID card/passport, work permits, visas, certificates, criminal record (if required) Legal obligation Duration of employment + 5-10 years based on legal requirements
5 Business travel Name, contact details, passport details, visa, flight and hotel information Contractual obligation Duration of employment + 10 years
6 Business expenses Name, amount paid, location of purchase, invoice/bank details Contractual obligation, legal obligation Duration of employment + 10 years
7 Payroll, compensation, benefits (including app access to payslips) Name, ID, job title/position, place of work, bank details, marital status/family (if relevant), salary, tax contributions, pension, insurance Legal obligation, contractual obligation Duration of employment + 10 years
8 Use of company mobile phone (if applicable) Name, assigned phone number, call logs, security access logs Legitimate interest, contractual obligation Duration of employment + applicable IT retention policies
9 Disciplinary actions Name, job title, nature of action, comments Legitimate interest, contractual obligation Duration of employment + applicable legal period
10 Performance management & training (including app-based training access) Name, job title, evaluations, attendance, training completion records Legitimate interest, contractual obligation Duration of employment + 10 years
11 Internal recruitment & mobility Name, job title, career progression records Legitimate interest, security measures Duration of employment + 10 years
12 Ship access for work Name, ID card, emergency contact details, food preferences (if relevant) Legitimate interest, security measures Duration of employment + 10 years
13 Internal & external communications (e.g. to inform of new hires) Name, job title, image, work, language skills, previous achievements/experiences Legitimate interest Duration of employment or until employee opts out
14 Labor claims Name, job title, claim details Legal obligation Until legal proceedings conclude + applicable statutory period
15 Compliance with group policies Name, job title, contact details Legal obligation Duration of employment + applicable retention policies
2.2. Processing specific to employees onboard
No. Purpose of Data Processing Description & Categories of Data Legal Basis Data Retention Period
1 Travel to and from MSC Cruises ships Name, contact details, date of birth, travel itinerary, passport/visa details Contractual obligation Duration of employment + 10 years
2 Security, safety, and medical teams onboard Health records, security reports, CCTV footage (if applicable) Legal obligation, security measures CCTV: 30 days; Medical: 10 years
3 Compliance with maritime regulations Work logs, compliance records Legal obligation Duration of employment + applicable retention policies

Please note that the Data Controller for all security and safety aspects onboard the ship is MSC Cruise Management (UK) Ltd, 5 Roundwood Avenue, London.

2.3. Optional processing based on employee consent
No. Purpose of Data Processing Description & Categories of Data Legal Basis Data Retention Period
1 Participation in team-building & events Name, contact details, photographs Consent Until event ends or upon request for removal
2 Use of food & beverage services Name, badge, food orders, payment details Consent Until termination of employment or service withdrawal
3 Participation in employee engagement programs Name, role, participation details Consent Until termination of employment or withdrawal
4 Emergency response teams Name, ID, job title, emergency contact details Consent Until termination of employment or withdrawal
3. Processing of IT Resources

Company IT resources, including computers, mobile devices, and internet access, are intended for business use. Employees using this MSC Cruises Family app should be aware that their interactions on this app may generate activity logs for security and operational purposes as per MSC Cruises' legitimate interest.

The app may also process technical data related to online activity via Software Development Kits (SDKs) to ensure its proper functioning. The app may use the following types of SDKs:

  • Necessary (technical) SDKs, which are strictly necessary for the app's operation and to allow employees to access content and services.
  • Analytics SDKs, which allow the Data Controller to understand how employees use the app and track traffic to and from it.
  • Preference SDKs, which are used to activate specific functions and configure the app according to employee preferences (e.g., language selection) to improve user experience.

For more details on the specific SDKs that we use, their purposes, and their type, employees may refer to the table below under Annex I.

4. Data Communication, Dissemination, and Transfer

Personal data may be shared with various recipients - acting as independent data controllers or data processors on behalf of an MSC Cruises entity - for employment-related purposes as outlined below.

Categories of Data Recipients Purpose of Communication Categories of Personal Data Communicated
Public bodies (labor, tax, and administrative authorities) Compliance with applicable regulations Identification data, employment contract details, salary information, nationality (for work permits, where applicable)
Pension funds and insurance providers Employee contributions and benefits Identification data, employment contract details, salary information
Consultants, auditors, and similar service providers HR, tax, and legal compliance Limited personal data as needed for operational and compliance purposes
Payroll service providers Salary processing Identification data, bank details
Business and IT service providers Technical and administrative support Limited personal data necessary for service provision
Travel service providers Booking and travel arrangements Employee travel details (destination, duration, accommodation preferences, passport/visa details, where necessary)
Training and certification providers Employee professional development Identification data, job title, contact details (where applicable)
MSC Group companies Internal coordination and operations Identification data, job title, and other relevant data for group coordination, financial, and administrative purposes

Where data transfers are necessary across different jurisdictions, MSC ensures that appropriate safeguards are in place, such as an adequacy decision, using standard contractual clauses, or other approved transfer mechanisms

5. Employee Rights

Employees have rights regarding their personal data, including:

  • Access and rectification.
  • Erasure or restriction of processing where applicable.
  • Objecting to certain processing activities.
  • Data portability where applicable.
  • Withdrawing consent for optional data processing.
  • Lodging a complaint with the relevant supervisory authority.

Employees can exercise their rights by contacting dpo@msccruises.com.

6. Changes to this Notice

This Privacy Notice may be updated periodically. Employees will be informed of significant changes through official company communications.

Annex I - List of SDKs
Vendor Name Description Sdk Identifier Categorization
openapi4j.org app_links Handles deep linking and app links integration. https://pub.dev/packages/app_links Necessary
fluttercommunity.dev connectivity_plus Checks and monitors network connectivity. https://pub.dev/packages/connectivity_plus Necessary
dart.dev crypto Provides cryptographic algorithms for secure data handling. https://pub.dev/packages/crypto Necessary
flutter.dev cupertino_icons Offers Cupertino-style icons for iOS apps. https://pub.dev/packages/cupertino_icons Necessary
fluttercommunity.dev device_info_plus Retrieves device and OS information. https://pub.dev/packages/device_info_plus Necessary
flutter.cn dio A powerful HTTP client for Dart. https://pub.dev/packages/dio Necessary
dynatrace.com dynatrace_flutter_plugin Monitors app performance. https://pub.dev/packages/dynatrace_flutter_plugin Analytics SDKs
fluttercommunity.dev equatable Simplifies object equality comparisons. https://pub.dev/packages/equatable Necessary
firebase.google.com firebase_core Initializes Firebase in a Flutter app. https://pub.dev/packages/firebase_core Necessary
firebase.google.com firebase_messaging Integrates Firebase Cloud Messaging for push notifications. https://pub.dev/packages/firebase_messaging Necessary
bloclibrary.dev flutter_bloc Manages state with the BLoC pattern. https://pub.dev/packages/flutter_bloc Necessary
dexterx.dev flutter_local_notifications Displays local notifications in apps. https://pub.dev/packages/flutter_local_notifications Necessary
endigo flutter_pdfview Renders and views PDFs in Flutter apps. https://pub.dev/packages/flutter_pdfview Necessary
sarbagyastha.com.np flutter_rating_bar Adds customizable rating bars to apps. https://pub.dev/packages/flutter_rating_bar Necessary
steenbakker.dev flutter_secure_storage Provides secure key-value storage. https://pub.dev/packages/flutter_secure_storage Necessary
flutter.dev flutter_svg Renders SVG images in Flutter. https://pub.dev/packages/flutter_svg Necessary
karthikponnam.dev fluttertoast Displays toast messages on various platforms. https://pub.dev/packages/fluttertoast Necessary
sandromaglione.com fpdart A functional programming library for Dart. https://pub.dev/packages/fpdart Necessary
talsec.app freerasp Offers runtime application self-protection (RASP). https://pub.dev/packages/freerasp Preference
baseflow.com geocoding Converts addresses to coordinates and vice versa. https://pub.dev/packages/geocoding Necessary
baseflow.com geolocator Retrieves the device's current location. https://pub.dev/packages/geolocator Necessary
fluttercommunity.dev get_it A simple service locator for dependency injection. https://pub.dev/packages/get_it Necessary
flutter.dev go_router Manages navigation and routing in Flutter apps. https://pub.dev/packages/go_router Necessary
dart.dev http_parser Provides utilities for parsing HTTP messages. https://pub.dev/packages/http_parser Necessary
flutter.dev image_picker Allows users to pick images from the gallery or camera. https://pub.dev/packages/image_picker Necessary
dart.dev intl Facilitates internationalization and localization in apps. https://pub.dev/packages/intl Necessary
flutter.dev local_auth Enables biometric authentication like fingerprint or face ID. https://pub.dev/packages/local_auth Necessary
xaha.dev lottie Renders Lottie animations in Flutter apps. https://pub.dev/packages/lottie Necessary
felangel.dev mocktail Simplifies mocking in Dart tests. https://pub.dev/packages/mocktail Necessary
bdaya-dev.com oidc Implements OpenID Connect authentication. https://pub.dev/packages/oidc Necessary
bdaya-dev.com oidc_core Core functionalities for OpenID Connect. https://pub.dev/packages/oidc_core Necessary
bdaya-dev.com oidc_default_store Default storage for OIDC tokens and settings. https://pub.dev/packages/oidc_default_store Necessary
fluttercommunity.dev package_info_plus Retrieves package and app version information. https://pub.dev/packages/package_info_plus Necessary
flutter.dev path_provider Accesses device file system directories. https://pub.dev/packages/path_provider Necessary
codeness.ly pretty_dio_logger Logs Dio HTTP requests and responses prettily. https://pub.dev/packages/pretty_dio_logger Necessary
fluttercommunity.dev share_plus Shares content across apps and platforms. https://pub.dev/packages/share_plus Necessary
flutter.dev shared_preferences Stores key-value data persistently. https://pub.dev/packages/shared_preferences Necessary
dint.dev universal_html Provides a unified HTML and DOM API for Dart. https://pub.dev/packages/universal_html Necessary
flutter.dev url_launcher Launches URLs in the browser or external apps. https://pub.dev/packages/url_launcher Necessary
yuli.dev uuid Generates unique identifiers (UUIDs). https://pub.dev/packages/uuid Necessary
theideasaler calendar_date_picker2 Adds advanced calendar date pickers. https://pub.dev/packages/calendar_date_picker2 Necessary
flutter.dev flutter_lints Provides linting rules for clean and consistent Dart code. https://pub.dev/packages/flutter_lints Necessary
invertase.io melos Manages monorepos and multiple packages efficiently. https://pub.dev/packages/melos Necessary
okta okta-client-spring-boot-starter Integration with Okta authentication service okta-client-spring-boot-starter Necessary SDK (technical)
Spring spring-boot-starter-validation Starter for validation framework spring-boot-starter-validation Necessary SDK (technical)
Spring spring-boot-configuration-processor Helps process Spring Boot configuration annotations spring-boot-configuration-processor Necessary SDK (technical)
Spring spring-boot-starter-cache Starter for caching support spring-boot-starter-cache Necessary SDK (technical)
Spring spring-boot-starter-data-redis Starter for Redis data access spring-boot-starter-data-redis Necessary SDK (technical)
Spring spring-boot-starter-aop Starter for Aspect-Oriented Programming (AOP) spring-boot-starter-aop Necessary SDK (technical)
Apache commons-pool2 Generic object pooling library commons-pool2 Necessary SDK (technical)
Lombok lombok Code generation tool to simplify Java development lombok Necessary SDK (technical)
MapStruct mapstruct Code generator for Java bean mappings mapstruct Necessary SDK (technical)
Spring spring-boot-starter-test Starter for testing Spring Boot applications spring-boot-starter-test Necessary SDK (technical)
Spring Security spring-security-test Utilities for testing Spring Security configurations spring-security-test Necessary SDK (technical)
Spring spring-boot-starter-actuator Production-ready features for monitoring and managing apps spring-boot-starter-actuator Necessary SDK (technical)
Spring spring-boot-starter-freemarker Starter for Freemarker template engine spring-boot-starter-freemarker Necessary SDK (technical)
JSoup jsoup Java library for working with real-world HTML jsoup Necessary SDK (technical)
Spring spring-boot-starter-data-mongodb Starter for MongoDB data access spring-boot-starter-data-mongodb Necessary SDK (technical)
Google Firebase firebase-admin Admin SDK for Firebase services firebase-admin Necessary SDK (technical)
SpringDoc springdoc-openapi-ui OpenAPI documentation UI for Spring Boot springdoc-openapi-ui Necessary SDK (technical)
Spring spring-boot-starter-data-jpa Starter for JPA repositories spring-boot-starter-data-jpa Necessary SDK (technical)
Spring spring-boot-starter-web Starter for building web applications spring-boot-starter-web Necessary SDK (technical)
Spring spring-data-commons Shared classes and utilities for Spring Data spring-data-commons Necessary SDK (technical)
Spring spring-boot-starter-oauth2-client Starter for OAuth2 client support spring-boot-starter-oauth2-client Necessary SDK (technical)
Spring spring-boot-starter-oauth2-resource-server Starter for OAuth2 resource server support spring-boot-starter-oauth2-resource-server Necessary SDK (technical)
Hibernate hibernate-validator Implementation of Jakarta Bean Validation hibernate-validator Necessary SDK (technical)
Logstash logstash-logback-encoder Logback encoder for Logstash logstash-logback-encoder Necessary SDK (technical)
Jackson jackson-datatype-jsr310 Support for Java 8 date and time types in Jackson jackson-datatype-jsr310 Necessary SDK (technical)
FindBugs jsr305 Annotations for software defect detection jsr305 Necessary SDK (technical)
SpringDoc springdoc-openapi-starter-webmvc-ui OpenAPI documentation UI for WebMVC springdoc-openapi-starter-webmvc-ui Necessary SDK (technical)
Apache HttpComponents httpclient5 HTTP client library httpclient5 Necessary SDK (technical)