Privacy Policy
Last reviewed: 8 October 2026
Your personal information, provided for the purpose of registering on Wish To Sail as a candidate or company, will be held and processed by Liberty Dreams LTD — Carpenter Court, 1 Maple Road, Bramhall, Stockport SK7 2DH, United Kingdom. Liberty Dreams LTD is the data controller for this information. This also includes situations where the data is collected or processed by third parties on our behalf.
The Data Protection Officer (DPO) can be contacted at: oliver@libertydreams.co.uk.
This Privacy Policy describes how and why we collect data for the purposes of Wish To Sail, how your data is used, and your rights.
1. Categories of data subjects
Wish To Sail processes personal data of three categories of data subjects:
- Maritime candidates — professionals who register to access company profiles and embarkation offers.
- Companies — shipping companies and maritime operators registered to consult candidate profiles.
- Website visitors — anyone browsing wishtosail.com.
2. Data we collect
2.1. From maritime candidates
- Identification data: first name, last name, date of birth, nationality, national ID number (DNI/NIF or equivalent).
- Contact data: email address, phone number, postal address, city, country.
- Professional data: qualifications, years of experience, STCW certifications, medical fitness certificates, Seaman's Book, languages.
- Documentation: photograph, curriculum vitae, criminal record certificates where applicable.
- Usage data: applications submitted, messages exchanged with companies, ratings received.
2.2. From companies
- Company identification data: legal name, address, country, website, tax identification number.
- Account contact person data: first name, last name, email address, phone number.
- Logos and descriptions: voluntarily provided by the company.
- Billing data: managed externally through WHMCS (GoCardless, PayPal); see Annex A — Data processors.
2.3. From website visitors
- Technical data: IP address, browser type, operating system, language, pages visited, time on page.
- Cookies: only with your prior consent (except strictly necessary); see our Cookie Policy.
3. Purposes of processing
Liberty Dreams LTD collects, processes and shares personal data for the following purposes:
- Managing user registration and account on Wish To Sail.
- Facilitating intermediation between qualified candidates and registered shipping companies, in accordance with the Maritime Labour Convention (MLC) 2006 and the STCW Convention.
- Verifying the professional suitability of candidates (review of certifications and documents).
- Managing billing and collection of services contracted by companies, through WHMCS.
- Sending operational communications related to the service (notifications, certificate alerts, application messages).
- Complying with legal and tax obligations (HMRC, Companies House, ICO).
- Improving the website through aggregated usage analytics (only with consent for cookies).
4. Lawful basis for processing
Under UK GDPR, the lawful bases for processing your personal data are:
4.1. Consent (art. 6.1.a)
For non-essential cookies, marketing communications and any processing requiring opt-in under PECR.
4.2. Performance of a contract (art. 6.1.b)
For provision of the matching service, account management and any action necessary for the performance of the terms and conditions accepted at registration.
4.3. Compliance with a legal obligation (art. 6.1.c)
For tax obligations (HMRC), company law obligations (Companies House), cooperation with authorities, and compliance with MLC 2006 and STCW in verifying maritime certifications.
4.4. Legitimate interests (art. 6.1.f)
For operational communications, platform security, fraud prevention and basic suitability checks. In these cases, Liberty Dreams LTD has conducted a Legitimate Interests Assessment (LIA) documenting that the legitimate interest is not overridden by the data subject's rights and freedoms.
Google Analytics 4 is also based on legitimate interest (UK GDPR art. 6.1.f, and where applicable, EU GDPR art. 6.1.f for users residing in the EEA). We implement Google Consent Mode v2: if you do not accept analytics, the gtag.js block loads with analytics_storage set to "denied" and Google sends only cookieless pings, used to model aggregated statistics anonymously (behavioural modeling). If you accept analytics, measurement is exact with full cookies. You can opt out at any time via the "Reject" button on the cookie banner. The internal LIA documentation for analytics is available on request to tickets@libertydreams.co.uk.
4.5. Special categories of data
Where we process special category data (e.g. medical certificates, criminal records), we rely on:
- Art. 9.2.b UK GDPR — obligations and rights in the employment context.
- Art. 9.2.g UK GDPR — substantial public interest reasons, under Schedule 1 part 2 of the Data Protection Act 2018.
5. Recipients and data processors
Wish To Sail currently works with shipping companies and maritime service providers registered in the United Kingdom and the European Union. Transfers to companies located outside these territories require a separate Data Processing Agreement signed on a case-by-case basis, in accordance with UK GDPR art. 46.
Your personal data may be shared with the following data processors, with whom Liberty Dreams LTD maintains the corresponding Data Processing Agreements (DPAs):
Annex A — Data processors
| Processor | Purpose | Location |
|---|---|---|
| Krystal Hosting UK | Database and file hosting | United Kingdom |
| Mautic (self-hosted) | Email marketing and campaign tracking | United Kingdom (own server) |
| WHMCS (billing platform) | Client, subscription and invoice management | United Kingdom |
| GoCardless (payment processor) | Direct debit (IBAN, address) | United Kingdom / Ireland |
| PayPal (payment processor) | Card / PayPal account payments | United States (SCCs adopted by EU/UK) |
| Google Analytics 4 (web analytics) | Aggregated usage statistics | United States (SCCs adopted by EU/UK) |
| Registered shipping companies | Access to approved candidate profiles | United Kingdom and European Union |
We do not sell or transfer your personal data to third parties for our own commercial purposes.
6. International transfers
Transfers of data to processors in the United States (PayPal, Google Analytics) are covered by the Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) and recognised by the United Kingdom (International Data Transfer Agreement and UK Addendum).
Transfers to recipient companies not located in the United Kingdom or the European Union will require a specific Data Processing Agreement before any access to personal data.
7. Storing your information
| Data category | Retention period |
|---|---|
| Inactive candidate account | 36 months from last activity, then anonymisation |
| CV, photograph and certificates | 30 days after account anonymisation |
| Inactive company account | 48 months from last activity |
| Billing data | 7 years (HMRC tax obligation) |
| Job applications | 5 years or while the account is active |
| Platform messages | 36 months |
| STCW / MLC certificates | 7 years |
| Audit and access logs | 24 months |
| Backups | 3 months rotation |
| GDPR request tickets | 6 years (defence of claims) |
Once the indicated periods have elapsed, the data is irreversibly deleted or anonymised.
8. Your rights
Under UK GDPR, you have the following rights:
8.1. Right of access (art. 15)
To request a copy of the personal data we hold about you. This right is commonly known as a Subject Access Request (SAR). You can exercise it through our Data Rights form or by writing to tickets@libertydreams.co.uk.
8.2. Right to rectification (art. 16)
To correct inaccurate or incomplete data. You can do this directly from your profile or by emailing us.
8.3. Right to erasure / "right to be forgotten" (art. 17)
To request deletion of your data where applicable. Please note that we may retain certain data where we have a legal obligation to do so (e.g. billing data for 7 years).
8.4. Right to restriction of processing (art. 18)
To request that we limit processing in certain circumstances (e.g. while the accuracy of data is being verified).
8.5. Right to data portability (art. 20)
To receive your data in a structured, commonly used and machine-readable format (JSON). Authenticated candidates can download their data directly from Export my data.
8.6. Right to object (art. 21)
To object to processing based on legitimate interests, including direct marketing communications.
8.7. Right not to be subject to automated decision-making (art. 22)
Not to be subject to decisions based solely on automated processing without human intervention. Wish To Sail does not make automated decisions with legal effects on you.
8.8. Right to withdraw consent (art. 7.3)
Where processing is based on your consent, you may withdraw it at any time, without retroactive effect. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, write to tickets@libertydreams.co.uk indicating which right you wish to exercise and attaching a copy of an identity document. We will respond within a maximum period of one month from receipt of your request. If your request is complex, we may extend this period by a further two months, informing you of the extension within the initial one-month period.
9. Complaints to the ICO
If you consider that our processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
10. Changes to this policy
Liberty Dreams LTD reserves the right to modify this Privacy Policy to reflect legal, technical or commercial changes. When material changes occur, we will notify you through a visible notice on the platform and, where appropriate, request your consent again. We recommend reviewing this page periodically. The date of the last review is indicated at the top of this document.
UK/UE Legal equivalence for EEA residents
UK/UE legal equivalence for EEA residents: Liberty Dreams LTD, through its platform WishToSail.com (a company registered in the United Kingdom, Companies House nº 12724306), applies both the UK General Data Protection Regulation and the EU Regulation 2016/679 when the user resides in the European Economic Area. Maritime professional qualifications (STCW) are mutually recognised between the United Kingdom and the European Union under the EU-UK Trade and Cooperation Agreement 2020 (Part 2 Title III). The competent supervisory authority for UK residents is the Information Commissioner's Office (https://ico.org.uk/); for EEA residents, the supervisory authority of the Member State of residence, coordinated through the European Data Protection Board (https://edpb.europa.eu/). The recognition of qualifications is carried out in accordance with Directive 2005/36/EC and its successor Directive (EU) 2024/782, with reference to Cedefop (https://www.cedefop.europa.eu/).
Last reviewed: 8 October 2026.