Privacy Policy

Last updated: 30 October 2026

This policy explains how ABEAM CREW S.L. uses the personal data of candidates, clients and other people who contact us through this website or by email.

1. Who is responsible for your data

ABEAM CREW S.L., CIF B56812852
Carrer de la Soledat 4, 07001 Palma de Mallorca, Balearic Islands, Spain
Email for data protection matters: info@abeamcrew.com

2. What data we use, why, and on what legal basis

Candidates (Find a Job form, vacancy applications, CVs sent by email)

  • Data: name, email, phone, the position you apply for, your message, and your CV with the information it contains (experience, certificates, nationality, photo).
  • To assess your application and contact you about it. Legal basis: steps taken at your request before entering into a contract (GDPR art. 6.1.b).
  • To send your CV to clients who are hiring crew, only when you agree to it. Legal basis: your consent (GDPR art. 6.1.a).
  • To keep your CV in our candidate database and contact you about future vacancies, only when you agree to it. Legal basis: your consent (GDPR art. 6.1.a).
  • If we receive your details from someone else, for example a recommendation or a professional network such as LinkedIn, we will inform you within one month, tell you where your details came from and how to object (GDPR art. 14).
  • Please do not send medical certificates or other documents about your health: we do not process health data or other special categories of personal data. Send a passport only when we ask for it for a specific vacancy.

Clients (Find Crew form and business contacts)

  • Data: name, email, phone, company or yacht, and the details of your request.
  • To answer your request and provide our recruitment services. Legal basis: steps before a contract and the contract itself (GDPR art. 6.1.b).
  • To keep business records required by law. Legal basis: legal obligation (GDPR art. 6.1.c).

General enquiries (Contact Us form and email)

  • Data: name, email, phone and your message.
  • To answer you. Legal basis: our legitimate interest in replying to messages addressed to us (GDPR art. 6.1.f).

Website visitors

  • Spam protection of our forms on our own server: a hidden field that only automated programs fill in, a minimum time to fill in a form and a limit on the number of messages from one connection. For this limit a scrambled (hashed) form of your IP address is kept for 10 minutes. No third parties are involved. Legal basis: our legitimate interest in protecting the website (GDPR art. 6.1.f).
  • Security of our website: when someone logs in or tries to log in to the website’s administration area, we record it with a shortened IP address (its last part removed) and keep the record for 90 days. Legal basis: our legitimate interest in protecting the website and the data in it (GDPR art. 6.1.f).
  • Visitor statistics with Google Analytics, only if you accept analytics cookies. Legal basis: your consent (GDPR art. 6.1.a). See our Cookie Policy.

Fields marked as required are needed to handle your request. Without them we cannot process your application or enquiry. We do not make decisions about you by automated means alone.

3. Who receives your data

  • Clients: yacht owners, captains and yacht management companies that are hiring crew. We share a candidate’s CV only with the candidate’s consent.
  • Service providers working on our behalf: IONOS SE (website hosting and email, EU) and Google Ireland Ltd (Analytics, only with your consent, and storage of our backup copies, which are encrypted so that Google cannot read them). They act under data processing agreements and may not use the data for their own purposes.
  • Public authorities, when the law requires it.

We do not sell personal data.

4. Transfers outside the European Economic Area

Some of our clients are located outside the EEA, currently in the United States, the United Kingdom and the United Arab Emirates. The United Kingdom offers a level of data protection recognised by the EU as adequate; the other countries may not offer the same level of protection as the EU. We send your CV to such a client only with your explicit consent or when it is necessary for a contract you have asked for (GDPR art. 49.1.a and 49.1.b).

Google may process data in the United States under the EU-US Data Privacy Framework.

5. How long we keep your data

DataRetention period
Applications without consent to the candidate database6 months after we receive the application
Candidate database (with consent)2 years after we receive your CV, unless you renew your consent
Client requests and business recordsDuration of the business relationship, then 6 years as required by Spanish commercial and tax law
General enquiries1 year after we receive the message
Copies of applications and messages in our mailbox, including attached CVsThe same periods as above
Security records (logins and login attempts, activity in the administration area)90 days, then automatically deleted
Backup copiesUp to 90 days, then automatically deleted
Google Analytics data14 months

6. Your rights

You can ask us at any time to:

  • give you access to your data or a copy of it;
  • correct inaccurate data;
  • delete your data;
  • restrict or object to its use;
  • transfer your data to you or to another organisation.

You can withdraw your consent at any time. This does not affect anything we did before you withdrew it.

To use these rights, email info@abeamcrew.com. We will reply within one month. If we have reasonable doubts about your identity, we may ask you to confirm it.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

7. Security

We protect personal data with access control, encrypted connections (HTTPS) and encrypted backups. CVs sent through this website are kept in a protected area that cannot be reached from the internet. Only staff who need them for their work can open them, after logging in with a password and a one-time code from their phone (two-factor authentication), and every access is recorded. Applications and their files are deleted automatically when their retention period ends.

8. Age

Our services are intended for adults. If you are under 18, please do not send us your personal data.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version.