Privacy Statement

1. Controller and Contact

ESL Shipping Oy (business ID 0201126-4), Lintulahdenkuja 10, 00500 Helsinki, Finland (“ESL Shipping”, the “Company”, “we” or “us”) is the controller of the personal data described in this Privacy Statement (the “Statement”).

ESL Shipping has not appointed a Data Protection Officer, as the Company does not fall within the categories requiring mandatory appointment under Article 37 GDPR.

All enquiries relating to this Statement, requests to exercise the rights described in Section 11, and reports of suspected personal data breaches should be addressed to: privacy@eslshipping.com

2. Scope of this Statement

This Statement describes how ESL Shipping processes personal data relating to:

representatives, personnel and employees of our customers, suppliers, agents and other business partners;
prospective customers and other business contacts;
users of our website at eslshipping.com;
participants in our events and webinars; and
recipients of our newsletters and other communications.

The following are governed separately and are outside the scope of this Statement:

recruitment and job applications, which are covered by a separate recruitment privacy statement;
personal data of the Company’s own employees and vessel crew, which is processed under separate employment and crewing arrangements; and
the use of cookies and similar technologies on our website, which is described in the Cookie Policy referred to in Section 6.

3. Personal Data We Process

We process the following categories of personal data.

Category	Examples
Identification and contact data	Name, job title or position, employer, business e-mail address, business telephone number, business address
Relationship data	Correspondence and communications with us, records of meetings and calls, role in a contract or project, service and transaction history
Event data	Registrations for events and webinars, attendance and participation details
Marketing data	Subscriptions, consents given and withdrawn, opt-outs, and responses to our communications
Technical and usage data	IP address, device and browser type, pages viewed, time and duration of visit, referring source, and cookie or similar identifiers
Data from external sources	Information obtained from public registers, business information services and publicly available sources

We do not process special categories of personal data as defined in Article 9 GDPR, nor personal data relating to criminal convictions and offences.

Providing certain personal data is necessary for us to enter into or perform a contract, or to provide our services; where this is the case, we will indicate it at the point of collection. Other personal data is provided voluntarily.

4. Purposes and Legal Bases

We process personal data only where we have a lawful basis under Article 6 GDPR. The purposes and the corresponding legal bases are set out below.

Purpose	Legal basis
Managing and administering our relationship with business partners	Performance of a contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f))
Providing, delivering and invoicing our services	Performance of a contract (Art. 6(1)(b))
Complying with statutory obligations, including accounting, tax, sanctions screening and regulatory reporting	Legal obligation (Art. 6(1)(c))
Communicating about our services, and sending newsletters and other marketing communications	Legitimate interests (Art. 6(1)(f)), or consent (Art. 6(1)(a)) where required by law
Organising and administering events and webinars	Performance of a contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f))
Market and customer analysis, surveys, and development of our services	Legitimate interests (Art. 6(1)(f))
Operating and securing our website, and measuring how it is used	Legitimate interests (Art. 6(1)(f)) for strictly necessary purposes; consent (Art. 6(1)(a)) for cookies and similar technologies that require it
Establishing, exercising or defending legal claims	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have carried out a documented balancing test to confirm that our interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Information about that assessment is available on request using the contact details in Section 1.

5. Sources of Personal Data

We collect personal data primarily from the data subject directly, or from the business partner with which the data subject has a relationship, such as their employer.

We may also collect and supplement personal data from public registers, business information services, and publicly available sources such as company websites and professional networking services. Technical and usage data is collected automatically when our website is used, as described in the Cookie Policy.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Strictly necessary cookies are used on the basis of our legitimate interest in operating and securing the website. All other cookies, including those used for analytics and marketing, are used only where the visitor has given consent.

Consent may be given, refused, changed or withdrawn at any time through the consent banner on our website. Details of the cookies used, their purposes and their retention periods are set out in our Cookie Policy, available at eslshipping.com.

7. Disclosure of Personal Data

We may disclose personal data to the following categories of recipients, and only to the extent necessary for the purposes described in Section 4:

companies within the same group of companies as ESL Shipping;
service providers acting as processors on our behalf, including providers of IT, cloud, hosting, marketing, analytics and event services;
professional advisers, including legal, accounting and audit advisers; and
competent authorities, courts and other public bodies, where required by applicable law; and
prospective purchasers and investors, and their professional advisers, in connection with a sale, merger, demerger, listing or other reorganisation of our business or any part of it, together with the entity that acquires the relevant business.

Where a third party processes personal data on our behalf, we enter into a written data processing agreement meeting the requirements of Article 28 GDPR before processing begins.

Disclosures made in connection with a corporate transaction or reorganisation are limited to what is necessary for the transaction, are made subject to confidentiality undertakings, and do not change the purposes for which the personal data may subsequently be processed.

We do not sell personal data, and we do not disclose personal data to third parties for those third parties’ own independent marketing purposes.

8. Social Media Pages and Embedded Content

ESL Shipping maintains its own accounts and pages on social media platforms, including LinkedIn, Facebook, Instagram and YouTube. These accounts are operated by ESL Shipping.

When you visit or interact with one of our pages, the platform provider processes personal data relating to you as a controller in its own right, under its own terms and privacy notice, and over which we have no control.

In respect of the aggregated visitor statistics that platform providers make available to page operators, ESL Shipping and the platform provider act as joint controllers within the meaning of Article 26 GDPR. The allocation of responsibilities between us is determined by the joint controller arrangement published by the relevant platform. We receive these statistics in aggregated form only and cannot identify individual visitors from them. A data subject may exercise their rights under the GDPR against either joint controller.

Our website may include content embedded from third-party platforms, such as video. Where such content is loaded, technical data including your IP address is transmitted to the provider of that content, which may also set cookies or similar identifiers. Embedded content that is not strictly necessary is loaded only where you have given consent for the relevant cookie category, as described in Section 6.

9. International Transfers

Personal data may be transferred to, or accessed from, countries outside the European Economic Area (EEA), including by our group companies and by service providers acting on our behalf.

Where personal data is transferred outside the EEA, we ensure that an appropriate transfer mechanism under Chapter V GDPR is in place. This is either a European Commission adequacy decision covering the recipient country or framework, or the European Commission’s Standard Contractual Clauses together with any supplementary technical and organisational measures required following a transfer impact assessment.

Information about the transfer mechanism applied to a specific transfer, and a copy of the relevant safeguards, is available on request using the contact details in Section 1.

10. Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or for as long as required by applicable law. Retention periods for each category of personal data are defined in our internal data retention schedule. The principal periods are:

Category	Retention period
Business partner relationship data	At least three (3) years from the end of the relationship or from the data subject’s most recent contact with us
Accounting records	Six (6) years from the end of the financial year, as required by Finnish accounting legislation
Contract documentation	Ten (10) years from the end of the contract, reflecting applicable limitation periods
Marketing data	Until consent is withdrawn or an objection to direct marketing is made, after which suppression data only is retained
Website and cookie data	As set out in the Cookie Policy

We review the necessity and accuracy of the personal data we hold on a regular basis. When personal data is no longer required, it is securely deleted or anonymised.

11. Your Rights

Data subjects have the following rights under Articles 15 to 22 GDPR.

Right	What it means
Access (Art. 15)	To obtain confirmation of whether we process your personal data, and a copy of that data
Rectification (Art. 16)	To have inaccurate personal data corrected and incomplete data completed
Erasure (Art. 17)	To have personal data deleted where one of the grounds in Article 17 applies
Restriction (Art. 18)	To have processing restricted while, for example, the accuracy of the data is being verified
Portability (Art. 20)	To receive personal data you have provided in a structured, commonly used, machine-readable format, where processing is based on consent or contract and is automated
Objection (Art. 21)	To object to processing based on legitimate interests. Where you object to direct marketing, we will stop processing for that purpose without exception
Withdrawal of consent (Art. 7(3))	To withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Requests may be submitted using the contact details in Section 1. We will verify your identity before disclosing any personal data. We respond within one month of receipt; this period may be extended by a further two months where a request is complex or where we have received a number of requests, in which case we will inform you within the first month.

If you consider that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your residence, place of work, or the place of the alleged infringement. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).

12. How We Protect Personal Data

We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as required by Article 32 GDPR. These measures include encryption of data in transit and at rest, multi-factor authentication, role-based access control applied on a least-privilege basis, centralised endpoint protection and patch management, regular vulnerability scanning, and tested backup and recovery procedures.

Organisational measures include mandatory security and privacy awareness training for all personnel, data processing agreements with all processors, non-disclosure agreements with contractors, and periodic review of access rights. Our information security arrangements are governed by an information security management system aligned with ISO/IEC 27001.

13. Automated Decision-Making and Profiling

We do not carry out automated decision-making that produces legal effects concerning a data subject or that similarly significantly affects them, within the meaning of Article 22 GDPR.

Where our website uses analytics or marketing technologies that involve profiling for audience measurement or the targeting of communications, this takes place only on the basis of consent, which may be withdrawn at any time as described in Section 6.

14. Changes to this Statement

We may update this Statement from time to time to reflect changes in our processing activities, in applicable law, or in our organisation. The current version is always published on our website, and the effective date is shown at the top of this Statement.

Where a change is material, we will draw attention to it by an appropriate notice on our website or by other suitable means before the change takes effect.

Previous versions of this Statement are retained and are available on request using the contact details in Section 1.

15. Related Documents

Cookie Policy, available at eslshipping.com
Recruitment Privacy Statement, available at eslshipping.com

Updated: 27.9.2026