Legal Entity: Messe Rand Consulting Group BV
MCG Maritime & Energy Institute is an operating division of Messe Rand Consulting Group BV.
Effective Date: 12 October 2026
Last Updated: 12 October 2026
Registered Office: Westplein 12–14, 3016 BM Rotterdam
The Netherlands
Website: www.mcgmei.org
Privacy Contact: data@mcgmei.org
1. Introduction
MCG Maritime & Energy Institute (“MCGMEI”, “the Institute”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and personal data of individuals who interact with its educational, professional, research, consultancy and institutional activities.
The Institute provides executive education, professional training, certification programs, customised institutional programs, policy dialogues, leadership development, international study visits and professional networking opportunities across the maritime, ports, shipping, logistics, energy, oil and gas, and offshore sectors.
This Data Protection and Privacy Policy explains how personal data is collected, used, stored, disclosed and protected in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the applicable Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other relevant Dutch and European Union legislation.
This Policy applies to participants, prospective students, clients, institutional representatives, employees, consultants, trainers, speakers, event delegates, suppliers, website visitors and other individuals whose personal data is processed by the Institute.
2. Data Controller
The legal entity responsible for processing personal data in connection with MCGMEI's activities is:
Messe Rand Consulting Group BV
Operating through “MCG Maritime & Energy Institute”
The Netherlands
Email: data@mcgmei.org
Registered Office: Westplein 12–14, 3016 BM Rotterdam
The Netherlands
Throughout this Policy, references to MCGMEI mean the Institute's activities operated by Messe Rand Consulting Group BV.
3. Personal Data We Collect
The categories of personal data collected depend on the nature of the individual's relationship with the Institute.
3.1. Identity and Contact Information
We may collect:
- Full name, title and professional designation.
- Email address, telephone number and business address.
- Nationality and country of residence where necessary for program administration.
- Identification details where required for legitimate administrative, security or legal purposes.
3.2. Professional and Educational Information
We may process:
- Employer, job title, department and professional experience.
- Educational qualifications and relevant professional certifications.
- Course applications, attendance records, assessment results and certification details.
- Training preferences and feedback.
3.3. Registration and Administrative Information
This may include program registration details, correspondence, invoices, payment confirmations and information necessary to administer courses, events and contractual relationships.
3.4. Travel and Study Visit Information
Where the Institute organises international training or institutional visits, we may process passport or identification details, visa documentation, travel itineraries, accommodation details and emergency contact information where necessary for the relevant arrangements or legal obligations.
Such information will be limited to what is necessary and retained only for an appropriate period.
3.5. Website and Digital Information
Where applicable, we may collect IP addresses, browser and device information, website usage data, cookie preferences, online registration details and learning platform activity.
3.6. Photographs, Audio and Video
Photographs, recordings and video footage may be collected during training sessions, conferences, workshops and other events for documentation, reporting or promotional purposes, subject to applicable law and the relevant lawful basis.
3.7. Special Categories of Personal Data
The Institute does not routinely require special categories of personal data, such as health information. Where such information is necessary, for example to arrange accessibility support, it will be processed only where an appropriate legal condition under the GDPR is satisfied and suitable safeguards are in place.
4. Purposes of Processing
Messe Rand Consulting Group BV processes personal data for the following purposes:
- Managing applications and registrations for courses and professional programs.
- Delivering training, assessments, learning support and certification.
- Communicating schedules, program updates and administrative notices.
- Organising conferences, workshops, study visits, travel and accommodation.
- Managing client relationships, institutional partnerships and supplier arrangements.
- Processing payments and maintaining financial and accounting records.
- Maintaining attendance, assessment and certification records.
- Protecting the security of participants, personnel, premises and digital systems.
- Evaluating and improving the quality of educational services.
- Sending newsletters, course announcements and promotional communications where legally permitted.
- Complying with applicable Dutch and EU legal obligations.
- Establishing, exercising or defending legal claims.
Personal data will not be used for purposes incompatible with the original purpose of collection unless a lawful basis permits the further processing.
5. Legal Bases for Processing
Under the GDPR, the Institute relies on one or more of the following legal bases, depending on the circumstances:
- Contractual necessity: Where processing is necessary to register a participant, deliver a program or perform a contract.
- Legal obligation: Where processing is required to comply with applicable Dutch or EU legislation, including tax, accounting or other statutory requirements.
- Legitimate interests: Where processing is necessary for legitimate business, administrative, security or operational interests, provided those interests do not override the individual's fundamental rights and freedoms.
- Consent: Where an individual has given valid consent for a specific purpose, such as certain promotional communications, optional publicity or processing requiring consent.
- Vital interests or public interest: Where applicable and where the relevant GDPR conditions are satisfied.
Where special categories of personal data are processed, an additional condition under Article 9 of the GDPR must be satisfied.
Individuals may withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Disclosure to Third Parties
The Institute does not sell personal data.
Personal data may be disclosed where necessary and lawful to:
- Trainers, assessors, academic partners and certification bodies.
- Hotels, airlines, travel agents, transport providers and host institutions involved in program delivery.
- IT service providers, website hosts, learning management platforms and communication service providers.
- Payment processors, accountants, auditors, insurers and legal advisers.
- Institutional clients sponsoring or commissioning programs, where the disclosure is necessary and lawful.
- Competent public authorities where required by law.
Information shared with sponsoring employers or institutions will be limited to what is necessary for the relevant purpose and supported by an appropriate legal basis.
Where third parties process personal data on behalf of Messe Rand Consulting Group BV, appropriate data processing agreements and confidentiality obligations will be established where required.
7. International Transfers of Personal Data
Although the data controller is established in the Netherlands, MCGMEI may organise international programs and work with participants, partners and service providers located outside the European Economic Area (EEA).
Where personal data is transferred to a country outside the EEA, the Institute will comply with Chapter V of the GDPR.
Depending on the circumstances, transfers may rely on:
- An applicable European Commission adequacy decision.
- Appropriate safeguards, such as Standard Contractual Clauses, where required.
- Another permitted transfer mechanism under the GDPR, where its conditions are satisfied.
Where required, the Institute will assess the protection available in the destination country and implement supplementary safeguards.
International travel or a participant's location outside the EEA does not, by itself, remove the need to comply with applicable GDPR requirements.
8. Data Security
Messe Rand Consulting Group BV takes appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, destruction and misuse.
Measures may include:
- Access controls and role-based permissions.
- Password protection and appropriate authentication.
- Secure electronic storage and communications.
- Confidentiality obligations for personnel and service providers.
- Backup and recovery procedures.
- Secure deletion and disposal of records.
- Periodic reviews of information security practices.
No electronic transmission or storage system can be guaranteed to be completely secure. However, the Institute will take reasonable and appropriate steps to protect the information under its control.
Where a personal data breach occurs, the Institute will assess the incident and notify the competent supervisory authority and affected individuals where required by the GDPR.
9. Data Retention
Personal data will be retained only for as long as necessary for the purposes for which it was collected, subject to statutory retention requirements and the need to establish, exercise or defend legal claims.
The Institute will apply documented retention periods appropriate to each category of data. Indicative periods include:
- General enquiries and unsuccessful applications: ordinarily up to 12 months after the last meaningful interaction, unless a longer period is justified.
- Program administration and attendance records: for the duration of the program and ordinarily up to 24 months afterwards, unless longer retention is necessary.
- Certification records: for as long as reasonably necessary to verify qualifications and maintain reliable certification records.
- Financial and accounting records: for the period required by applicable Dutch law.
- Marketing preferences: until consent is withdrawn or a valid objection is received, subject to retaining minimal information necessary to respect opt-out requests.
- Passport, visa and travel documentation: only for the period necessary for program administration, applicable legal obligations or the establishment, exercise or defence of legal claims.
These periods are subject to review and will be adjusted where necessary to comply with applicable law. Once data is no longer required, it will be securely deleted, destroyed or anonymised, where appropriate.
10. Cookies and Website Technologies
The Institute's website may use cookies and similar technologies to support website functionality, security and user preferences.
Analytics, advertising and other non-essential cookies will be used in accordance with applicable Dutch and EU law, including obtaining consent where required.
Visitors may manage their cookie preferences through the website's cookie settings, where available. Browser settings may also be used to manage cookies, although disabling certain cookies may affect website functionality.
Third-party websites and services linked from the Institute's website operate under their own privacy policies. Messe Rand Consulting Group BV is not responsible for independent processing by those third parties.
11. Direct Marketing and Communications
The Institute may send administrative notices, course announcements, newsletters, invitations and other professional communications.
Marketing communications will be sent in accordance with applicable Dutch and EU electronic communications and privacy legislation. Where prior consent is required, the Institute will obtain it before sending the relevant communications.
Recipients may unsubscribe using the facility provided in the communication or contact the Institute through its designated privacy contact.
Opting out of marketing will not prevent the Institute from sending essential communications concerning an existing registration, contractual relationship or program.
12. Event Photography, Recording and Publicity
MCGMEI may photograph or record training sessions, conferences, workshops and institutional events for documentation, reporting, educational or promotional purposes.
The Institute will provide appropriate information about recording activities and establish a lawful basis for processing. Where consent is required, it will be obtained before the relevant use.
Publicity involving identifiable individuals will be managed in accordance with applicable data protection and personality rights requirements. Participants may raise concerns or request reasonable arrangements to avoid optional publicity use.
Where processing is based on consent, individuals may withdraw that consent without affecting the lawfulness of processing undertaken before withdrawal.
13. Rights of Individuals
Subject to the conditions and limitations of the GDPR, individuals whose personal data is processed have the right to:
- Access: Request access to their personal data.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion in circumstances provided for by law.
- Restriction: Request restriction of processing in qualifying circumstances.
- Data portability: Receive certain personal data in a structured, commonly used and machine-readable format where the legal conditions are met.
- Object: Object to processing based on legitimate interests and to direct marketing.
- Withdraw consent: Withdraw consent where processing relies on consent.
- Automated decisions: Obtain applicable safeguards and challenge decisions based solely on automated processing where Article 22 of the GDPR applies.
- Complain: Lodge a complaint with a competent data protection supervisory authority.
These rights are subject to applicable legal conditions and exceptions.
Requests may be submitted to the Institute's designated privacy contact. The Institute may request reasonable information to verify identity before disclosing personal data.
Requests will be handled within the time limits prescribed by the GDPR, ordinarily within one month, subject to lawful extensions where applicable.
14. Children and Minors
The Institute's programs are primarily intended for adult professionals and executives. MCGMEI does not knowingly collect children's personal data unless this is necessary for a specific lawful program or activity.
Where a program involves minors, the Institute will apply appropriate safeguards and comply with the GDPR and applicable Dutch law, including requirements concerning parental authorisation where relevant.
15. Third-Party Platforms
The Institute may use third-party systems for online registration, learning management, webinars, video conferencing, electronic communications and payment processing.
Depending on their role, these providers may act as processors on behalf of Messe Rand Consulting Group BV or as independent controllers.
The Institute will assess the provider's role and implement appropriate contractual and data protection safeguards where required. Individuals should also consult the relevant third party's privacy notice where that party independently determines how personal data is processed.
16. Data Protection Officer and Privacy Contact
Where the GDPR requires the appointment of a Data Protection Officer (DPO), Messe Rand Consulting Group BV will appoint one and publish the relevant contact details.
Where a formal DPO is not legally required, privacy enquiries and data subject requests may be directed to the Institute's designated privacy contact.
Privacy Contact: data@mcgmei.org
17. Complaints and Supervisory Authority
Individuals who have concerns about how their personal data is processed are encouraged to contact Messe Rand Consulting Group BV so that the matter can be reviewed.
Individuals also have the right to lodge a complaint with the competent supervisory authority.
For the Netherlands, the supervisory authority is:
Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Website: https://autoriteitpersoonsgegevens.nl/
The right to lodge a complaint does not prevent individuals from exercising other rights or seeking judicial remedies available under applicable law.
18. Changes to This Policy
Messe Rand Consulting Group BV may update this Policy to reflect changes in its operations, services, technology or applicable legislation.
The current version will be published on the Institute's official website, together with the date of the latest revision. Where required by law, affected individuals will receive additional information or be asked to provide consent before new processing activities commence.
19. Commitment to Privacy and Responsible Data Management
MCG Maritime & Energy Institute, operated by Messe Rand Consulting Group BV, recognises that trust, confidentiality and responsible information management are essential to professional education and international institutional partnerships.
The Institute is committed to processing personal data lawfully, fairly and transparently, respecting the rights of individuals and maintaining appropriate safeguards in accordance with applicable Dutch and European Union data protection legislation.