Columbia Group General Privacy Notice
UPDATED: 2/februāris/2026
Introduction: This General Privacy Notice explains what we do with your personal data in relation to this website only. Each entity included on this website has its own website and Privacy Notice. SIA “CSM BALTIJA” (CSM Baltija) does not exercise control over the content of these websites.
It applies to any Customers, Prospective Customers, Vendors, Prospective Vendors, Local Authority Inspectors, Business Partners, Prospective Seafarers and any Company Website Visitors of whom we process personal data.
It describes how we collect, handle, and process your personal data.
This notice is layered. So, if you wish, you can easily select any processing activity to see what to expect us to do with your personal data.
The Data Controller
SIA “CSM BALTIJA” (CSM Baltija) is the controller for the personal data that is processed through this website. You can contact CSM Baltija in a number of ways, which are set out below:
SIA “CSM BALTIJA”
Address: 20, Katrinas Dambis, Riga, 1045, Latvia
Phone: +37 167 325 007
Email: columbia@csmlv.com
The Data Protection Officer (DPO)
If you wish to contact the Data Protection Officer of CSM Baltija in relation to the processing of your personal data by CSM Baltija, you can do so in a number of ways, which are set out below:
Name: Deniss Vinogradovs
Address: 20, Katrinas Dambis, Riga, 1045, Latvia
Phone: +37 167 325 007
Email: dataprotection@csmlv.com
Processing Activities
Communication
Data Subject
This section applies to the personal data of Customers, Prospective Customers, Vendors, Prospective Vendors, Local Authority Inspectors, Port Agents, Vessel Flag Inspectors, and Business Partners.
Purpose of Processing
Where you provide us or we are provided with your personal data, we shall process them for communication purposes only.
Categories of personal data
This includes your personal identification details, contact information and employment information.
Legal Basis
The legal basis we rely on to process your personal data is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
If legitimate interest, it must be identified
The legitimate interest pursued by us is the direct marketing of our services.
PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same
If necessary personal data is not provided, we shall not be able to conduct the required direct marketing and approach new business opportunities.
Recipients
There are no recipients of your personal data for these purposes.
Retention Period
We shall store such personal data for ten (10) years following the termination of our collaboration
Recruitment of non PAX Seafarers
Data Subject
This section applies to the personal data of Prospective Seafarers.
Purpose of Processing
Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.
Categories of personal data
This includes your contact information, background checks, crew data sheet information, education and skills, employment information, PEME invoices, personal identification, and professional experience and affiliations.
Legal Basis
The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same
If necessary personal data is not provided, allowing us to conduct the required recruitment of non PAX seafarers, we shall not be able to fulfil our contract with you or contract with you.
Recipients
The only recipients shall be:
(a) our Customers (Shipowners);
- our Manning Agents.
They shall be assisting with the necessary formalities for this matter. They are located globally.
We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.
Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.
Retention Period
We shall store such personal data for as long as it is necessary to facilitate the recruitment of non PAX seafarers.
Recruitment of PAX Seafarers
Data Subject
This section applies to the personal data of Prospective Seafarers.
Purpose of Processing
Where you provide us or we are provided with your personal data, we shall process them for recruitment purposes only.
Categories of personal data
This includes your contact information, background checks, education and skills, personal identification, and professional experience and affiliations.
Legal Basis
The legal basis we rely on to process your personal data is GDPR Article 6(1)(b). This allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same
If necessary personal data is not provided, allowing us to conduct the required recruitment of PAX seafarers, we shall not be able to fulfil our contract with you or contract with you.
Recipients
The only recipients shall be:
(a) our Customers (Shipowners);
(b) our Manning Agents.
They shall be assisting with the necessary formalities for this matter. They are located globally.
We rely on GDPR Article 46(2)(c) for cross-border transfers. This allows us to transfer personal data to such recipients based on the Standard Contractual Clauses adopted by the EU Commission.
Where applicable, we rely on GDPR Article 45 for cross-border transfers. This allows us to transfer personal data to such recipients based on the EU Commission’s adequacy decision.
Retention Period
We shall store such personal data for two (2) years from the collection of your personal data.
Cookie Management
Data Subject
This section applies to the personal data of Company website visitors.
Purpose of Processing
Where you provide us or we are provided with your personal data, we shall process them for cookie management purposes only.
Categories of personal data
This includes your browsing information.
Legal Basis
The legal basis we rely on to process your personal data for necessary cookies is GDPR Article 6(1)(f). This allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
The legal basis we rely on to process your personal data for non-necessary cookies is GDPR Article 6(1)(a). This allows us to process personal data when the data subject has given consent, subject to the applicable conditions, to the processing of his or her personal data for the specified purposes.
If legitimate interest, it must be identified
The legitimate interest pursued by us is maintaining the integrity of our IT systems and the continuity of our business.
PD required by law (statutory) or by contract or necessary to enter into a contract and the possible consequences of failure to provide same
If necessary personal data is not provided, allowing us to conduct the required cookie management, we shall not be able to track visitor behaviour, maintain the integrity of our IT systems, maintain the continuity of our business and measure site performance.
Recipients
There are no recipients of your personal data for these purposes.
Retention Period
We will store such personal data for the periods below depending on the type of cookie as from the Cookies’ activation:
-
-
-
-
- Necessary cookies shall be stored for:
- __cf_bm for a few seconds;
- _cfuvid limited to the duration of a session.
- Performance cookies shall be stored for:
- _ga for 2 years;
- _ga_xxxxxxxxxx for 1 year.
- Functional cookies shall be stored for:
- wp-wpml_current_language limited to the duration of a session.
- Necessary cookies shall be stored for:
-
-
-
Data Subject Rights
Data Subject Rights
We shall respond without undue delay to requests made by Data Subjects to exercise their rights in relation to the personal data we process.
Under certain circumstances, data subjects have certain rights, including:
Access
Data subjects have the right to obtain the following from the Company:
a) Confirmation that the Company is processing their personal data;
b) Copy of their personal data;
c) Other supplementary information which is already included in the Company’s General Privacy Notice
Rectification
Where personal data is inaccurate, data subjects have the right to request that it be corrected and incomplete personal data be completed based on information they may provide.
Erasure
The right to erasure is also known as “the right to be forgotten.” It applies only in certain circumstances.
Restriction on Processing
Data subjects may request from the Company the restriction of processing of their personal data.
Object to Processing
Data subjects have the right to object to the processing of their personal data in some circumstances. However, data subjects have the absolute right to object to the processing of their personal data for direct marketing purposes.
Portability
Under certain circumstances, data subjects have the right to receive personal data in a structured, commonly used and machine-readable format. This allows data subjects to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.
Right to withdraw consent if processing is based on consent
Where the legal basis for processing is the consent of data subjects, the GDPR entitles data subjects to the right to withdraw their consent at any time.
Right to lodge a complaint with a supervisory authority
Data subjects have the right to complain if they have concerns about the way the Company is handling their personal data.
Automated decision making
Data subjects have the right not to be subject to a decision which is based on automated decision making or profiling, without the involvement of human intervention.
We do not use automated decision making.
How do I exercise my rights?
If you wish to contact us/our Data Protection Officer, you can do so in the ways set out in the relevant section at the beginning of this notice.
Changes to the General Privacy Notice
If any changes are made to the General Privacy Notice, these will be posted on this page. Please check back frequently to stay informed of any updates or changes.
Where we intend to further process your personal data for a purpose other than that for which the personal data were collected, we shall provide you, prior to that further processing, with information on that other purpose and with any relevant further information.
