This notice documents your privacy rights and how we gather, use and share personal data about you when you visit our website at www.airportx.com.

This notice was last updated 28 July 2023.

AirportX is a trading business of Edinburgh Airport Limited. Edinburgh Airport Limited (EAL) is a 'data controller' and gathers and uses certain information about you. When we say 'we' or 'us' in this notice, we mean Edinburgh Airport Limited. We are registered with the Information Commissioner's Office (or ICO) under registration number Z206328X.

You have various rights in respect of the personal data we hold about you. If you wish to exercise any of these rights, or for more information about your rights, please contact the Data Protection Officer at [email protected].

1. Access to your personal data: You can request a copy of your personal data that we hold, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making.
2. Rectification: You can ask us to change or complete any inaccurate or incomplete personal data held about you.
3. Erasure: You can ask us to delete your personal data where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
4. Restriction: You can ask us to restrict the personal data we use about you where you have asked for it to be erased or where you have objected to our use of it. For example, where the accuracy of the data we hold about you is contested by you, you can ask that we restrict its use until we have verified its accuracy.
5. Portability: You can ask us to provide you or a 3rd party with some of the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred to you or a 3rd party.
6. Right to object: You can object to our processing of your personal data where we are relying on a legitimate interest (or the legitimate interests of a 3rd party) to process your personal data and there is something about your particular situation which makes you want to object to processing on these grounds.
7. Automated decision-making, including profiling: Automated decision-making takes place when an electronic system uses personal data to make a decision about you without human intervention. You have the right not to be subject to automated decisions that will create legal effects or have a similar significant impact on you, unless you have given us your consent, it is necessary for a contract between you and us or is otherwise permitted by law. You also have certain rights to challenge decisions made about you.

When you use AirportX.com, we may collect the following information about you when you have provided it to us:

• Your name.
• Your date of birth.
• Your email address.
• Your contact details, including your address, email address and contact telephone number.
• Your employment and/or education history.
• Your IP address.

AirportX.com collects information about how you use the website. You can find out more information in our Cookie Policy on our website.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have made an enquiry or complaint to us.
• You have sent your CV or resume to us.
• You have applied for a job or secondment with us.
• You visit our website and consent to the use of cookies and similar technologies.
• You have made an information request to us.

To summarise, we process your personal data for the following key purposes:

• To respond to an enquiry you have made with us.
• To assess your suitability for a job or secondment with us.
• Advertising, marketing and public relations, including sending you direct marketing communications (insofar as we are permitted by law).

Please see our Job Applicant Privacy Notice for full details about how we use your information during the recruitment process.

We only use your personal data where it is permitted by law, where:

• You have given us your consent to (if consent is needed). For example, if you have given us consent to send you marketing emails.
• We need your information in order to enter into a contract with you. For example, for recruitment purposes.
• It is fair to use your personal data for our legitimate interests or your own, where there is no disadvantage to you. For example, we need to use your personal data to answer any enquiry you have submitted to us or for our legitimate business purposes.

Your information will be shared internally when you send us your CV, or other details for recruitment purposes or if you make an enquiry with us about our services.

We may share your personal data insofar as we are permitted by law, with the following 3rd parties:

• Suppliers and service providers used by us including IT service providers, where it is necessary to do so.
• Our business partners, where necessary for the purposes of answering any enquiry you make with us or to make any service you have requested available to you.
• Relevant business partners for marketing purposes, where you have given us your consent to do so.
• Auditors, law enforcement agencies or other compliance authority personnel where necessary to meet or enforce a legal obligation.
• We will only transfer your personal information outside the EEA where either:

  The transfer is to a country that ensures an adequate level of protection for your personal information; or

  We have put in place our own measures to ensure adequate security as required by data protection law. These measures include ensuring that your personal information is kept safe by carrying out strict security checks on our overseas partners and suppliers, backed by strong contractual undertakings approved by the relevant regulators.

We will never retain your personal data for any longer than is necessary for the purposes we need to use it for.

We may keep your personal data for up to six (6) years after we finish supplying any services.

If you send us your CV, or other documentation for recruitment purposes, you can find details about how long we keep your data for in our Job Applicant Privacy Notice.

We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We hope that the Data Protection Officer can resolve any query or concern you raise about our use of your information at [email protected]. If not, contact the Information Commissioner's Office, at https://ico.org.uk.