Privacy Policy

1. Introduction & Scope This Privacy Policy (“Policy”) describes how Caribbean Staffing Solutions, Inc., doing business as CSS Shipboard(“CSS,” “we,” “our,” or “us”), collects, uses, discloses, and safeguards personal information through the website and web application located at https://cssshipboard.com (the “Site”) and any related online HR and onboarding services (collectively, the “Service”). CSS Shipboard provides recruitment, onboarding, and employment-related services to Park West Gallery and its affiliated cruise-line partners. In providing these services, CSS Shipboard acts as the data controller responsible for the processing of personal information collected through the Service.

This Policy applies to all applicants, employees, contractors, and other individuals whose personal information we process in connection with employment consideration or administration, regardless of nationality or country of residence. If you have questions about this Policy or your personal information, you may contact us at privacy@cssshipboard.net or by mail at Caribbean Staffing Solutions, a Turks & Caicos company with an address of: P.O. Box 64, Suite C12, Marketplace Providenciales, Turks & Caicos Islands, BWI (hereinafter referred to as “CSS” or the “Company”)

2. Information We Collect We collect and process personal information that you provide directly to us, information we generate during the onboarding process, and information received from third parties. This may include: – Identifying details such as your name, date of birth, gender, and login credentials – Government-issued identification, including passports, national IDs, visas, or residency permits – Social Security numbers or other national identification numbers – Contact details such as your address, phone number, and email – Employment history, qualifications, work authorization, and references – Background screening information, such as criminal record checks or education verification – Medical and health information, including screenings, immunization data, and fitness-for-duty assessments – Sensitive or special category data such as disability or medical condition disclosures – Uploaded documents and images, including scanned IDs, passports, or medical certificates – Technical and usage data such as IP addresses, browser type, and log files – Communication records such as messages and correspondence exchanged with CSS

We collect this information through forms, uploads, and your use of the Service. We may also receive limited data indirectly via analytics tools and integrations with authorized third parties.

3. How We Use Your Information We use personal information to: – Process applications, onboarding, and hiring – Verify identity, eligibility, and credentials – Conduct background checks and screenings – Manage visa and immigration compliance – Handle health and safety requirements – Communicate with you regarding your application or employment – Protect the security and integrity of our systems – Improve, maintain, and operate the Service – Comply with legal and regulatory requirements – Support audits, dispute resolution, or legal defense

We do not use your data for unrelated marketing or advertising purposes unless you have expressly consented. Sensitive or medical data are processed only as necessary and with additional safeguards.

4. Legal Basis for Processing (If GDPR Applies) Where the GDPR or similar laws apply, our processing is based on one or more of the following legal grounds: – Your consent, where required – The performance of a contract (for example, processing your employment application) – Compliance with legal or regulatory obligations – Legitimate interests, such as system security or fraud prevention – Vital or public interest, in limited circumstances

CSS Shipboard complies with applicable data-protection laws in the regions where we operate, including the EU General Data Protection Regulation (GDPR), UK Data Protection Act, U.S. state privacy laws (such as CCPA/CPRA), Canada’s PIPEDA, Australia’s Privacy Act 1988 (Cth), South Africa’s POPIA, and the Philippines Data Privacy Act of 2012.

5. Third-Party Processors and Integrations We share certain data with trusted third-party service providers (“processors”) who assist us in operating the Service. These include document processing and optical character recognition providers such as DocSumo, background-checking services such as Employment Screening Associates (ESA), as well as secure hosting, analytics, and infrastructure vendors.

Each processor is required to maintain confidentiality, security, and data-protection standards consistent with applicable law. DocSumo publicly states that it maintains HIPAA, GDPR, and SOC 2 Type II compliance for document processing systems. We disclose only the minimum information necessary for these providers to perform their duties.

In certain cases, CSS Shipboard acts as a data processor, handling personal information solely on behalf of and under the instructions of its clients, such as Park West Gallery and its cruise-line partners. In such circumstances, the client’s own privacy policy may also apply.

6. Data Retention and Deletion We retain personal information only for as long as necessary to fulfill the purposes described in this Policy or as required by law. When data are no longer needed, we securely delete, anonymize, or archive them according to industry best practices. You may request deletion of your personal data at any time by contacting privacy@cssshipboard.net, subject to legal or regulatory retention requirements.

7. Data Security and HIPAA / Sensitive Data Protections We employ administrative, technical, and physical safeguards to protect your data, including encryption, access controls, network monitoring, and secure backups. Although data are stored on a HIPAA-compliant server, CSS Shipboard itself is not a “covered entity” under HIPAA. Nevertheless, we apply equivalent levels of protection to any medical or health-related information collected and require our third-party processors to do the same.

8. International Data Transfers Because CSS Shipboard serves an international applicant base, your personal data may be transferred to or processed in countries that may have different data protection standards. When data are transferred across borders, we apply appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms as required by law.

CSS Shipboard complies with the EU-U.S. Data Privacy Framework (DPF) and, where applicable, the UK Extension and Swiss-U.S. DPF, as administered by the U.S. Department of Commerce.

9. Your Rights and Choices Depending on your location, you may have the right to: – Access and obtain a copy of your personal data – Request correction of inaccurate information – Request deletion of your data where legally permitted – Restrict or object to processing under certain conditions – Request portability of your data to another controller – Withdraw consent at any time (where processing is based on consent) – Lodge a complaint with a relevant data protection authority To exercise these rights, contact us at privacy@cssshipboard.net. We may request verification of your identity before fulfilling a request.

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). To exercise these rights, contact us at privacy@cssshipboard.net.

10. Cookies and Analytics We use cookies and similar technologies to measure site usage, analyze performance, and improve our Service. Some cookies are essential for basic site functionality, while others support analytics (for example, Google Analytics). You can adjust cookie settings in your browser at any time. Disabling cookies may limit certain features of the Service.

11. Children’s Privacy Our Service is not directed to children under 16 years of age. We do not knowingly collect personal data from minors. If you believe a child has submitted personal information, please contact us so we can remove it.

12. Changes to This Privacy Policy We may update this Policy periodically to reflect changes in our data practices or legal obligations. Material updates will be communicated through notices on the Site or by email before taking effect. Continued use of the Service after changes indicates acceptance of the updated Policy.

13. Contact Us Caribbean Staffing Solutions, a Turks & Caicos company with an address of: P.O. Box 64, Suite C12, Marketplace Providenciales, Turks & Caicos Islands, BWI (hereinafter referred to as “CSS” or the “Company”) Email: privacy@cssshipboard.net