Privacy notice – Get permission for marine work

This notice explains how the Marine Management Organisation (MMO) uses your personal data when you use the Get permission for marine work service.

Marine Management Organisation is an executive non-departmental public body sponsored by the Department for Environment, Food & Rural Affairs.

Who controls your data

Marine Management Organisation is the data controller for the information you provide.

Postal address:

Marine Management Organisation
Data Protection Team
Lancaster House, Hampshire Court, Monarch Road
Newcastle upon Tyne NE4 7YH
United Kingdom

Email: dataprotection@marinemanagement.org.uk

You can read more about how MMO handles personal data in the MMO's Personal Information Charter.

What data we collect

The personal data we collect includes:

• name and title
• organisation and job title (if relevant)
• postal address and postcode
• email address and contact telephone number
• date of birth (for account verification and password reset)
• IP address and technical log information
• photographs or video supplied with an application or generated during inspections
• your declared interests (sector, topic area, marine plan area)

We also use essential cookies to remember your session and security settings.

Where you provide your consent, we use Microsoft Clarity cookies to collect information about how you use Get permission for marine work. This includes mouse movements, clicks, scrolling, and other interactions. This information helps us to improve our service.

You can read full details about the cookies we use in the cookies policy.

Why we need it

We use your information to:

• process marine licence applications
• publish the details of every application and licence on the public register, as required by law
• monitor compliance, including site visits after a licence is granted
• issue invoices and collect licence fees
• answer queries and manage complaints
• improve the service through analytics and user feedback

If you choose not to provide the information we ask for, we may be unable to accept your application, process your query or meet our legal duties.

Legal basis for processing

We rely on four UK GDPR bases to process your personal data:

Public task – Article 6(1)(e)

We run the Get permission for marine work service and keep the public register under the Marine and Coastal Access Act 2009

Legal obligation – Article 6(1)(c)

We must keep financial and audit records, such as licence invoices

Legitimate interests – Article 6(1)(f)

We use anonymised analytics to improve the service and have checked that this does not override your rights and freedoms

Consent – Article 6(1)(a)

We send optional alerts or newsletters only if you ask for them. You can withdraw consent at any time. Withdrawing consent will not affect processing we carry out on other legal bases

We do not use automated decision-making that has legal or similarly significant effects on you.

What we do with your data

We will never sell or rent your information.

We share only what is necessary to deliver the service or where the law requires it:

• public register – your name, address and certain licence particulars appear online as required by law
• statutory consultees and advisors (for example CEFAS) – they receive the parts of an application needed to give technical advice
• other Defra group bodies or competent authorities – where another law or regulation requires us to share information
• Shared Services Connected Ltd (SSCL) – receives billing data so it can raise invoices
• authorised engineers may access data under strict support procedures
• aggregated, anonymised analytics may be processed by GOV.UK PaaS and Defra platforms

How long we keep your data

We keep personal data for seven years after the licence expires or a decision is made, whichever is later, unless a longer period is legally required (for example, ongoing litigation). After that it is securely deleted or anonymised in line with the MMO retention schedule.

Where your data is stored and processed

Data is stored on UK-based cloud platforms operated for Defra:

• Amazon Web Services (AWS UK regions) – Common Data Platform (MongoDB)
• Microsoft Azure UK regions – Dataverse and Power Apps
• Defra Strategic Reporting Database (UK)

No routine transfers are made outside the UK. If exceptional transfers are necessary, we will use UK-approved safeguards such as International Data Transfer Agreements.

How we protect your data

• encryption in transit (TLS) and at rest
• role-based access controls and logging
• regular vulnerability scanning, penetration testing and audit
• supplier contractual clauses aligned to the UK GDPR and the Government Security Policy Framework

Your rights

You have the right to:

• be informed about how we use your data
• access a copy of your data
• rectify inaccurate data or complete incomplete data
• erase your data in certain circumstances
• restrict or object to processing
• data portability (where applicable)
• not be subject to automated decisions with legal effect

To exercise any of these rights, email dataprotection@marinemanagement.org.uk or write to the address in the first section.

How to withdraw consent

If we process your data on the basis of consent, you can withdraw it at any time by contacting us. This will not affect any processing we have already carried out or other processing that relies on a different legal basis.

Questions, complaints and other contacts

For questions about this notice or how we handle your data contact the Data Protection Manager (details in first section) or contact:

• Access to Information Team – access-to-information@marinemanagement.org.uk, 0300 123 1032
• Defra Group Data Protection Officer, Seacole Building, 2 Marsham Street, London SW1P 4DF, United Kingdom

If you are unhappy with our response you can complain to the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow SK9 5AF, 0303 123 1113, ico.org.uk.

Changes to this notice

We review and update this notice at least annually or whenever we change how we process personal data. Last updated 20 June 2025.

Marine Management Organisation, Lancaster House, Hampshire Court, Newcastle upon Tyne NE4 7YH