Carnival Corporation & PLC
Global Privacy Notice For Staff And Crew

Last Updated: November 6, 2020

Carnival Corporation & plc and its divisions (collectively referred to as “Carnival,” “we,” “our,” or “us”) are a global cruise business with a portfolio of leading cruise brands, including P&O Cruises Australia, Princess Cruises, Carnival Cruise Line, Holland America Line, Seabourn, Cunard Line, P&O World Cruises, AIDA and Costa (“Carnival Brands”).

This Privacy Notice applies to all employees, crew, contractors, temporary staff, external agents, partners, consultants and vendors, including concessions staff on board ships, working on behalf of Carnival (referred to in this Privacy Notice as “Staff and Crew”). We’ve developed this Privacy Notice to explain how your personal information is collected, used, stored, processed, transferred and disclosed by Carnival in order to initiate, manage and execute our contractual relationship with you.

OVERVIEW

Your privacy is important to us. We respect the privacy rights of all individuals and we are committed to handling personal information responsibly and in accordance with applicable law. This Privacy Notice explains what personal information Carnival collects, uses, and maintains (collectively "processes") about you in the operation of its business, how it uses that data, and your rights to that data.

Please note that this Privacy Notice applies to Carnival’s processing of your personal information as an Employee. Additional details concerning Carnival's governance and privacy requirements for Employee data can be found in internal resources including the Employee Handbook, Information Security Standard, Technology Use and Privacy Policy, Information Governance Policy and all related articles in seafarer’s agreements. This Privacy Notice does not apply to the handling of your personal information by other companies or organizations outside of Carnival brands, such as staffing agencies or benefits providers, who may process your personal information in accordance with their own policies.

This Privacy Notice does not cover your use of Carnival's consumer products and services as a consumer, outside of your regular employment or assignment with any of the affiliate brands of Carnival. To learn more about Carnival's data collection practices that cover your use of our products as a consumer, please read our Privacy Policies located on the applicable brand websites.

This Privacy Notice is not intended and shall not be read to create any express or implied promise or contract for employment, for any benefit, or for specific treatment in specific situations. Nothing in this Privacy Notice should be construed to interfere with Carnival's ability to process employee data for purposes of complying with its legal obligations, or for investigations, subject to compliance with internal policy and local legal requirements.

Carnival’s processing of personal information and other employee data is in all cases subject to the requirements of local law, internal policy, and any consultation requirements with worker representatives (where appropriate). To the extent this Privacy Notice conflicts with local law in your jurisdictions, local law controls.

WHAT PERSONAL INFORMATION WE COLLECT

The data we collect can include the following, but is not limited to:

a) Name and Contact Data. Your first and last name, employee identification number, email address, postal address, phone number, photo, beneficiary and emergency contact details, and other similar contact data. Additionally, you may opt to provide additional contact information such as personal email address(es) and/or cell phone number(s).

b) Demographic Data. Your date of birth and gender. We may also collect and process sensitive demographic information about you in accordance with local requirements and applicable law, as described in the Special Categories of Personal Information section below.

c) National Identifiers. Your national ID/passport, residency, visa and work permit status, social security number, or other taxpayer/government identification number.

d) Employment Details. Your job title/position, office location, employment contract, offer letter, hire date, termination date, performance history and disciplinary records, leave of absence, sick time, and vacation/holiday records.

e) Spouse/Partner and Dependents' Information. Your spouse/partner and dependents' first and last names, dates of birth, and contact details where permissible by local law.

f) Background Information. Academic and professional qualifications, education, CV/Resume, credit history and criminal records data (utilized for background check and vetting purposes where permissible and in accordance with applicable law and consultation requirements).

g) Financial Information. Bank account details, tax information, salary, retirement account information, company allowances and other information necessary to administer payroll, taxes and benefits.

h) Workplace, Device, Usage, and Content Data. Emails sent and received, building and information system access, device, system and application usage when accessing and using corporate buildings, ships, services and assets.

i) Background Checks. We may also collect personal information about you from third parties or public sources as needed to support the employment relationship, including through lawful background screenings, to the extent permitted by law, through a third-party vendor for information about your past education, employment, credit and/or criminal history.

j) Location and Movement Data, if you are staffed on a MedallionClass™ ship or property, your position and movement information collectedthrough sensors and readers located throughout ships and in certain resorts which emit a signal that detects the presence of the Medallion® wearable device, creating a record of your position and movements throughout the MedallionClass™ ships or properties. Similar information may be collected through the OceanOrbit™ wearable device technology.

k) Social Media and other Third-Party-Sourced Data. In the event of a natural disaster or other life/safety emergency, we may rely on public social media posts or other public sources to account for Staff and Crew if otherwise unable to contact them. Additionally, if there is an investigation of an employee matter, we may obtain information relevant to the incident from external sources including private parties, law enforcement or public sources like news sources and public social media posts.

Special Categories of Personal Information. We do not process special categories of personal information (also referred to as ‘sensitive’ personal information) about you except where there is a legal reason to do so, either as part of your contract of employment, where we are under an obligation to process that data, or where you have asked us to do so. Special categories of personal information may include data such as:

a) Racial or Ethnic Origin, which may be revealed by personal details or by photographs processed for organizational or operational reasons (e.g. company security pass), religious beliefs, if you have requested to observe religious holidays other than Catholic holidays, in accordance with the law;

b) Trade Union Membership, if you have requested that we withhold trade union membership fees from your wages or you hold, or are a candidate for, a position as a trade union officer;

c) Membership of a Political Party, if you hold a publicly elected office or work at a polling station as a party-appointed scrutineer;

d) Philosophical Beliefs, with specific regard to conscientious objection to military service or information on religious affiliation where this is required for tax purposes;

e) Health Data, which may be information from the provision and referral of care by Carnival medical services, an Employee’s health status as determined by the contracted physical and Carnival’s health facilities, in any event managed by doctors bound by professional secrecy, or about the Employee’s physiological or medical state, including information on disabilities, temperature checks, medical examination records, medical histories, attestations of health status, contact tracing history, medical certificates justifying absences, fitness to work, certificates, including occupational health and safety certificates and maternity certificates, maternity or paternity leave, documents or status, and records regarding injuries and industrial accident insurance;

f) Images and Biometric Information, including photos, images and videos collected through CCTV cameras, on-board photographers, and unique facial recognition identifiers that can recognize you from photos or videos as used to confirm your identity, in particular during boarding and disembarkation; and

g) Criminal Convictions, Offenses and Pending Criminal Charges, where required by the law for the purposes of employment and for management of the Contract of Employment or for assessment of the Employee's professional aptitude.

PURPOSES OF PERSONAL INFORMATION PROCESSING

The processing of your personal information and those of your family members, including special categories of such data, is carried out for the following purposes and in accordance with the following legal basis:

a) Administer and Manage the Contract of Employment. The personal information provided for the employment contract will be processed in order to:

i. Fulfill obligations arising from the employment contract of and associated legal obligations (e.g. payment of wages, payment of social security contributions, preparation of paychecks, management of annual leave, documents justifying absences, provision of benefit plans and programs, etc.);

ii. Carry out the organizational management of your work, as well as for Carnival’s operational/management demands, such as creation of job descriptions for the corporate Intranet, collection and retention of information that is useful for your career advancement (e.g. your educational record, training courses attended, knowledge of foreign languages, previous work experience), internal auditing and risk management activities etc.

b) Workplace Security and Monitoring. The personal information will also be processed for security purposes, protection of Carnival property (including intellectual property) and crime prevention and investigation, partly by means of inspections (e.g. internal audits), electronic surveillance including facial recognition technology and/or location and movement tracking on MedallionClass™ ships or property, closed circuit cameras (CCTV) as well as tools for reporting misconduct to the competent corporate bodies (e.g. compliance website and hotline). The primary purpose of this monitoring is to protect Carnival, its employees, staff, crew, passengers and partners, for example:

i. For network and device management and support;

ii. For proof of business transactions and recordkeeping;

iii. For the protection of confidential information and Carnival assets;

iv. For public health and safety reasons;

v. For investigating wrongful acts or allegations or potential violations of Carnival policy; and

vi. For other legitimate business purposes as permitted under applicable law.

You are informed that the security checks and other means of monitoring entrances to Carnival’s head office, ships and other premises, as well as associated inspections, internal auditing and reporting of misconduct, will be carried out in full compliance with the principle of necessity and, where applicable, with the prohibition on the use of cameras to monitor the work of Staff and Crew and that the image data will only be processed by persons expressly authorized to this end and only be stored for the time strictly necessary for the aforementioned security purposes, or for any longer periods laid down in specific trade union agreements or stipulated by judicial authorities.

c) Other Overriding and Legitimate Business Purposes. We also may process your personal information when it is necessary for other legitimate purposes, such as general HR administration, general business management and operations, disclosures for auditing and reporting purposes, management of network and information systems security and business operations, provision and improvement of employee services, physical security and to protect the life, health and safety of Staff and Crew, guests and others. We may also use special applications and systems that record employee performance metrics, such as sales-related or code databases for business operations purposes, as well as for the purposes of reviewing, rewarding and coaching Staff and Crew on their performance. We may also process your personal information to investigate potential violations of law or breaches of our internal policies.

d) Legally Required Purposes. We may process your personal information when we consider it necessary for complying with laws and regulations, including collecting and disclosing personal information as required by law (e.g., for minimum wage, working time, tax, health and safety, social security, anti-discrimination laws, global migration), under judicial authorization, or to exercise or defend our legal rights.

e) Purposes Related to Health Data. We generally use health data for the following purposes:

i. Health and Safety. Your health data will be used to protect the health and safety of you, other Staff and Crew, our guests, and the public at large. We may also combine health data with location information, where available, for contact tracing purposes in the event of a communicable disease outbreak or other health and safety hazard.

ii. Legal and Regulatory Compliance. We may be subject to national or international laws, regulations or orders that require us to process your health data, generally for public health reasons including to track and mitigate risks of communicable disease such as COVID-19.

iii. Employee Management. Your health data will be used to ensure compatibility between your personal health - including that of your family members - and assigned duties, within the confines of applicable law.

f) Purposes Related to the Use of your Facial Image. We may use your image (e.g. in photos or video) and biometric facial recognition identifiers, for the following purposes:

i. Security Purposes. Your photograph will appear on your Carnival security pass. These passes are used to monitor access and to enable the ready identification of all persons on the premises and ships. We may also use facial recognition technologies to verify identity, for authorization purposes, and to manage our workforce, particularly during the boarding and disembarkation processes. Unique facial identifiers will be destroyed when the purpose for collecting the identifiers has been satisfied or within three years of your last interaction with us, though images (such as photos or videos) may be retained longer in a manner consistent with our corporate retention schedule.

ii. Organizational and Operational Purposes. Your photograph may be posted on the corporate Intranet, for the ready identification of job descriptions and for applying for government visas or a Seaman’s book.

iii. Advertising. Your photograph may be published in Carnival magazines and promotional material in connection with and/or during events in which you may take part. You will generally be given the ability to not participate in such filming or the use of your image in advertising and promotional materials, should you prefer so.

iv. Background Checks. Your photograph may be provided to entities for the purposes of conducting a background check prior to an offer of employment being made.

HOW AND WHY WE SHARE PERSONAL INFORMATION

a) To facilitate the employment process or execute the contract of employment and/or to comply with the associated contractual and legal requirements. Failure to provide the personal information may make it impossible to execute or fulfil the employment or service contract or to fulfill some or all of the associated contractual and legal requirements. Carnival will only share your personal information with those who have a legitimate need for it. Wherever we permit a third party to access personal information, we will make sure the data is used in a manner consistent with this notice (and any internal data handling guidelines consistent with the sensitivity and classification of the data.) your personal information may be shared with our subsidiaries and affiliates and other third parties, including service providers, for legitimate purpose including but not limited to as follows: In order to carry out the uses of personal information described above;

b) To enable third parties to provide services to us. Categories of recipients of data would include insurance providers, benefit enrollment vendors, leave of absence administration vendors, payroll support services, relocation, tax and travel management services, health and safety experts, and manning agents, such as Global Talent Partners;

c) To comply with our legal obligations, regulations or contracts, or to respond to a court order, administrative or judicial process, such as a subpoena, government audit or search warrant. Categories of recipients would include counter-parties to contracts, judicial and governmental bodies;

d) In response to lawful requests by public authorities (such as national security, public health matter or law enforcement); we reserve the right to cooperate with these bodies also on a voluntary basis where appropriate and where we believe we have a legal justification for doing so;

e) To seek legal advice from external lawyers and advice from other professional advisers such as accountants, management consultants, etc.;

f) As necessary to establish, exercise or defend against potential, threatened or actual litigation (such as adverse parties in litigation);

g) Where necessary to protect Carnival, your vital interests, or those of another person;

h) In connection with the sale, assignment or other transfer of all or part of our business (such as a potential purchaser and its legal / professional advisers); and

i) Otherwise in accordance with your consent.

COVID-19 NOTICE

In response to the global coronavirus pandemic and to protect against the risks of other communicable illness, all Staff and Crew may be required to undergo health screenings and we will collect additional information recommended by public health authorities or other government agencies or to otherwise demonstrate the ongoing health and fitness to travel of our Staff and Crew, including:

Contact Information. Information such as name, nationality, country of residence, originating address, destination address, telephone, and email;
Symptoms and Health Information. Information regarding the presence or absence of possible COVID-19 or other global pandemic symptoms, which may be collected through temperature scans, tissue sampling, medical examinations, surveys or questionnaires, as well as information about pre-existing medical conditions;
Exposure. Information regarding potential exposure to or infection with COVID-19 or other global pandemic, which may include recent travel history, contacts with guests, crew or other individuals.
Contact Tracing via Wearable Device Technology and OceanOrbit™ Contact Tracing System. Information about on-board contacts with crew, guests or other individuals collected via wearable technology such as the Medallion® on MedallionClass™ ships and/or properties or the OceanOrbit™ Contract Tracing system. These devices collect data, such as personal contact, time stamp, duration of contact and frequency of contact with others.
As Required by Law. Any additional information collected pursuant to directives by public health organizations or other government agencies in the jurisdictions in which we operate.

We collect and use this information because:

we must comply with certain regulatory requirements regarding public health, including to determine your fitness to travel consistent with applicable government regulations and guidelines;
we have a legitimate business interest in ensuring the health and safety of our passengers, crew and the public;
we have a legitimate business interest in complying with legal and regulatory requirements applicable in the various jurisdictions in which we operate;
we need to use this information to perform our contract with you.

Contact Tracing through OceanOrbit™ Contract Tracing System. To help mitigate and manage the potential spread of COVID-19 or other global pandemic illnesses, we use wearable device technology to identify individuals who may have been exposed to COVID-19 and to rapidly detect potential secondary cases that may arise after transmission from an infected individual. The OceanOrbit™ device is a wearable portable electronic device that collects data as guests and crew interact with one another in public and in private areas by broadcasting and recording the presence and proximity of other OceanOrbit™ devices. The OceanOrbit™ system collects time stamps, duration of contact and frequency of contacts. The raw data is associated with the device ID number but will be correlated with guest or crew personal information in the event that contract tracing is called for. On MedallionClass™ ships, we may use on board contact data collected in connection with the Medallion®, rather than the OceanOrbit™ system, which will be linked to your personal information in the same manner as all other OCEAN® data. As part of our contract tracing efforts, we take reasonable precautions to respect our Guests’ privacy and confidentiality by communicating contact exposure information in a manner that is not personally identifiable. However, information about you may be disclosed in a manner that could allow the recipient to determine your identity. For example, if we determine that it is necessary to disclose to a guest that she was in contact with an individual who tested positive for COVID-19 for a period of 1-2 hours on a particular date, that guest may be able to ascertain the likely identity of the unnamed individual based on her personal experience.

We may disclose your personal information, contacts and health information with third parties or individuals to attend to your medical and safety needs and those of our other Staff and Crew or guests; to comply with legal and regulatory requirements; to facilitate public health response initiatives ; to conduct contract tracing of individuals who are exposed to or test positive for COVID-19 or other communicable illness; or if we reasonably believe that such disclosure is necessary to inform your health care or to protect the personal safety or health of our guests, Staff and Crew, or other individuals. For example, we may disclose personal identifiers and health or medical information to our personnel and contractors, port agents and authorities, government officials, health agencies or any other individual or institution as reasonably needed to support public health initiatives, comply with our legal or regulatory obligations, attend to your medical and safety needs, facilitate investigations and remedies, track and mitigate risks of communicable illness including COVID-19, and to protect the rights, health and safety of our guests, Staff and Crew, and others.

WHERE WE STORE AND PROCESS PERSONAL INFORMATION

Carnival operates at the global level and therefore personal information may need to be transferred to countries outside of where it was originally collected. For example, because we are headquartered in the United States, information collected in other countries is routinely transferred to the United States for processing. When we transfer your personal information to another country, we will ensure that this transfer complies with applicable laws and legislation. Carnival has Standard Contractual Clauses in place for the collection, use, and retention of personal information transferred from the European Economic Area (“EEA”), the United Kingdom and Switzerland to other countries which have been approved by the European Commission. This data is only transferred to other Carnival Group companies and/or to third party service providers, and only for the aforementioned purposes. You may request a copy of the applicable safeguards by contacting the Data Protection Officer using the contact information below.

SECURITY OF YOUR PERSONAL INFORMATION

Carnival is committed to protecting the security of your personal information. We will use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. For example, we store the personal information you provide on computer servers with limited access that are located in controlled facilities, and when we transfer certain highly confidential or sensitive personal information, we protect it through the use of encryption.

RETENTION PERIOD

Personal information will be stored according to applicable laws or regulatory requirements and kept as long as is necessary to fulfill the purposes for which the personal information was collected. Generally, this means that your personal information will be retained as documented in our corporate retention schedule and applicable riders and supplements.

CHANGE OF PURPOSE

We will only use your personal information for the purposes outlined in this notice or such purposes as may be reasonably compatible with the original purpose for which it was collected or there is an alternative legal basis for the further processing.

CHANGES TO THIS PRIVACY NOTICE

We may occasionally update this Privacy Notice. When we do, we will revise the “last updated” date at the top of the Privacy Notice. If there are material changes to this notice or in how Carnival will use your personal information, we will use reasonable efforts to notify you wither by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement to learn how Carnival is processing your personal information.

HOW TO CONTACT US

If you have any questions about this Privacy Notice, please contact the Data Protection Officer at:

Mail: Carnival Privacy Office
attn: Data Protection Officer
450 3rd Ave West
Seattle, WA 98119 USA

Email: privacy@carnival.com

EUROPEAN STAFF AND CREW

Your Data Subject Rights. In addition to the information shared above, Staff, Crew and individuals from the European Economic Area (“EEA”), the United Kingdom and Switzerland may have certain rights under applicable data protection laws (including the EU General Data Protection Regulation and local legal implementation of that Regulation, which include the rights to:

a) Request Access. You have the right to obtain access to your personal information. This includes the right to obtain confirmation of whether we are processing your personal information; information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods; information about the categories of recipients with whom we may share your personal information and if those recipients are located in third countries; and a copy of the personal information we hold about you;

b) Right of Portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal information to another person;

c) Request Rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay;

d) Request Erasure (or Deletion) of Personal Information: You have the right to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified;

e) Restrict Data Processing: You have the right to require us to limit the purposes for which we process your personal information (for example, where the accuracy of the personal data is contested by you), for a period of time that enables us to verify the accuracy of that personal data; and

f) OBJECT: You also have the right to object to any processing based on our legitimate interests, at any time, where your objection is raised on grounds relating to your particular situation. Should you decide to object to the processing of your personal data, we will stop processing personal data concerning you, unless we can demonstrate compelling reasons for continuing to process your personal data that override your interests, rights and freedoms, or where we process your personal data to establish, exercise, or defend our legal claims.

Application of the above rights may vary depending on the type of data involved, and Carnival’s particular legal basis for processing the personal information.

To make a request to exercise one of the above rights, please contact privacy@carnival.com. We will consider and act upon any requests in accordance with applicable data protection laws. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may, in limited circumstances, charge you a reasonable fee to access your personal information; however, we will advise you of any fee in advance.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note, however, that this will not affect the lawfulness of the processing before its withdrawal.

You may also direct questions about how we handle personal information to the Data Protection Officer at privacy@carnival.com. While Carnival hopes it can answer any questions that you may have, if you have unresolved concerns you also have the right to complain to a relevant data protection supervisory authority in the EU. If you are based in the European Union, information about how to contact your local data protection authority is available here: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. If you are based in the United Kingdom, your local data protection authority is the Information Commissioner's Office, which can be contacted here: https://ico.org.uk/global/contact-us/.

Data Controller. The primary Data Controller of data processed subject to this Privacy Notice is the Carnival entity you have a contractual relationship with. Other Data Controllers that may access and process your personal information processed under this privacy notice include Carnival Corporation, Carnival plc, Princess Cruise Lines, Ltd., Holland America Line N.V., in its capacity as general partner of Cruiseport Curacao C.V., Seabourn Cruise Line Limited, Carnival plc trading Carnival Australia, Carnival plc trading as Carnival New Zealand, HAL Maritime Limited, HAL Beheer B.V., Navitrans B.V., Marine Manpower Services (Guernsey) LTD, Carnival Japan Inc., Cunard Celtic Ltd., Fleet Maritime Services (Bermuda), Ltd., HAL Properties Limited, Holland America Line Inc., Princess Cays Limited, Royal Hyway Tours, Inc., Tour Alaska LLC, Westmark Hotels of Canada Ltd., Westmark Hotels, Inc., Carnival Corporation Hong Kong Limited, Carnival Corporation Korea Ltd., Global Shipping Service (Shanghai) Co., Ltd., Carnival plc (Singapore Branch), Carnival plc Taiwan Branch, UK Carnival plc Cruises Beijing Representative Office, UK Carnival plc Cruises Chengdu Representative Office, UK Carnival plc Guangzhou Representative Office, and UK Carnival plc Shanghai Representative Office. Please see the “How and Why we Share Personal Information” Section above for more information about how we share personal data amongst the Data Controllers.

Carnival Corporation & PLCGlobal Privacy Notice For Staff And Crew