Privacy policy
Last updated: October 2026
1. Who we are
Boaty Jobs is a specialist marine industry job board and a trading name of ActiveRoster Ltd (“we”, “us”, “our”), a company registered in England & Wales (company no. 17505500). Our registered office is at 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.
ActiveRoster Ltd is the data controller for personal data collected through this website (“the Service”). We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we offer the Service to people in the European Union, the EU General Data Protection Regulation may also apply.
Our designated data protection contact is: privacy@boatyjobs.com
2. What personal data we collect and why
We collect personal data only for specified, explicit, and legitimate purposes. The following table describes the categories of data we process, together with the legal basis under Article 6 UK GDPR.
| Data category | Purpose | Legal basis |
|---|---|---|
| Name and email address | Creating and managing your account; sending transactional emails | Performance of a contract (Art. 6(1)(b)) |
| CV / résumé | Enabling job applications; stored in a private encrypted bucket; never publicly accessible | Consent (Art. 6(1)(a)); performance of a contract |
| Profile photograph | Displaying on your account profile (optional upload) | Consent (Art. 6(1)(a)) |
| Profile details (current region, role, licences / certifications) | Completing your account profile and tailoring job alerts; not displayed to other users | Consent (Art. 6(1)(a)) |
| Job application data (cover letter, applied job, application status) | Facilitating the application process between job seekers and employers | Performance of a contract (Art. 6(1)(b)) |
| Applications sent through our application form (name, email, phone, location, qualifications, availability, message, CV, IP address) | Sending your application to the employer named on the listing and confirming it to you; handling support requests and preventing abuse | Consent (Art. 6(1)(a)) — given with the consent box on the form; legitimate interests (Art. 6(1)(f)) for abuse prevention |
| Saved jobs list | Allowing you to bookmark and revisit job listings | Legitimate interests (Art. 6(1)(f)) — service feature expected by users |
| Job notification preferences | Sending you email alerts for new matching jobs | Legitimate interests (Art. 6(1)(f)); you may opt out at any time in account settings |
| Payment data (billing name, last 4 digits of card, transaction reference) | Processing payments for featured and premium job listings; fraud prevention; tax and legal obligations | Performance of a contract; legal obligation (Art. 6(1)(c)) |
| Usage and analytics data (page views, session data, device type) | Understanding how users interact with the Service so we can improve it | Consent (Art. 6(1)(a)) — only collected after cookie consent is given |
| GDPR consent record (consent flag and timestamp) | Demonstrating compliance with our accountability obligations | Legal obligation (Art. 6(1)(c)) |
3. Data retention
- Active accounts: personal data is retained for as long as your account is active.
- Deleted accounts: when you delete your account, a soft-delete flag is applied immediately. Your profile is deactivated and removed from all public views. After a 30-day grace period, all personal data associated with your account is permanently and irreversibly purged from our systems, except where we are required by law to retain certain records.
- Job applications: application records are retained for 12 months after the associated job listing expires, after which they are anonymised (the link to your user record is removed).
- Applications sent through our application form: we keep a copy of your application, including any CV you upload, for 90 days for support and abuse handling, then delete it permanently. CVs are stored privately and are never available at a public web address. The copy the employer receives by email is held by them under their own privacy policy.
- Payment records: transaction records are retained for 6 years from the end of the financial year they relate to, as required by UK tax and company law.
- Analytics data: aggregated and anonymised after 26 months.
4. Who we share your data with
We do not sell, rent, or trade your personal data.
Employers you apply to. When you apply through the application form on a job listing, we send your application and CV to the employer named on that listing, and only to them. The employer becomes responsible for your data from that point and will contact you directly.
Otherwise, we share data only with the following sub-processors and only to the extent necessary for the purposes described above:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database hosting, file storage (CVs, photos), and authentication | EU region (Frankfurt) — covered by UK adequacy regulations |
| Stripe | Payment processing for employer listing tiers | UK, EU and United States — transfers covered by the safeguards in section 5 |
| Resend Inc. | Transactional email delivery (account notifications, application updates, applications sent to employers) | United States — covered by the safeguards in section 5 |
| Cloudflare, Inc. | Website hosting and delivery; Turnstile bot protection on the application form (processes your IP address and browser signals) | Global network — covered by the safeguards in section 5 |
We may also disclose your data if required by law, court order, or to protect the rights, property, or safety of ActiveRoster Ltd, our users, or the public.
5. International transfers
We are based in the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected: either the destination is covered by UK adequacy regulations (as the European Economic Area is, where Supabase stores our database in Frankfurt), or we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses (for example for Resend and other United States providers).
6. Your data protection rights
Under the UK GDPR you have the following rights:
- Right of access (Art. 15): you may request a copy of the personal data we hold about you. Job seekers can use the “Download my data” feature in their account dashboard for an immediate export.
- Right to rectification (Art. 16): you may correct inaccurate or incomplete personal data via your account settings at any time.
- Right to erasure / right to be forgotten (Art. 17): you may request deletion of your account and all associated personal data using the “Delete my account” button in your account dashboard. Hard deletion occurs within 30 days.
- Right to restriction of processing (Art. 18): you may request that we restrict processing of your data in certain circumstances (e.g. while a dispute is pending).
- Right to data portability (Art. 20): you may request your data in a structured, machine-readable format. Job seekers can use the “Download my data” feature to receive a JSON export immediately.
- Right to object (Art. 21): you may object to processing based on legitimate interests, including direct marketing and analytics.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at privacy@boatyjobs.com. We will respond within one month, as required by Article 12 UK GDPR.
7. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at privacy@boatyjobs.com. You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO)Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
If you live in the European Union, you can also complain to the data protection authority in your country.
8. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These include encryption at rest and in transit, row-level security policies on our database, private storage buckets for CVs, and access controls limiting data access to authorised personnel only.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email at least 14 days before the change takes effect. The “Last updated” date at the top of this page will always reflect the most recent revision.
This privacy policy should be reviewed by a qualified solicitor with UK data protection expertise before it is relied on.