- We take your privacy seriously. This Privacy Notice sets out details about your privacy rights and how we gather, use and share your personal information – including the personal information we already hold about you now and any further personal information we might collect about you, either from you or from a third party. How we use your personal information will depend on the services which we provide to you.
- Our Data Protection Officer (DPO) provides help and guidance to make sure we apply good practice standards to protecting your personal information. Our DPO can be reached by email at email@example.com if you have any questions about how we use your personal information.
- This Privacy Notice provides up to date information about how we use your personal information and will update any previous information we have given you about using your personal information (also referred to as personal data). We may make updates to this Privacy Notice from time to time, and we recommend that you review the current version of this Privacy Notice whenever possible. If we make any material changes to the manner in which we process and use your personal information, we may contact you to let you know about the change.
- This Privacy Notice was last updated on 17th April 2019.
2. About Us
- We are what is known as the 'controller' of the personal information which we gather and use. When we say 'we' or 'us' in this Privacy Notice, we mean Edinburgh Airport Limited. We are registered with the Information Commissioner's Office, or ICO, under registration number Z206328X.
3. Your Privacy Rights
- You have the right to object to how we use your personal information. You also have the right to see what personal information we hold about you. In addition, you can ask us to correct inaccuracies, delete or restrict personal information or to ask for some of your personal information to be provided to someone else. To make enquires or for further information about exercising any of your rights in this Privacy Notice, please contact our DPO at firstname.lastname@example.org
- You are entitled to exercise any of the following privacy rights:
- Right to object: You can object to our processing of your personal information. Please contact us as noted below, providing details of your objection.
- Access to your personal information: You can request access to a copy of your personal information that we hold, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge by contacting us as noted below.
- Right to withdraw consent: If you have given us your consent to use your personal information to send you marketing emails, you can withdraw your consent at any time by clicking the "unsubscribe" link in any marketing email which you receive or by contacting our DPO at email@example.com.
- Rectification: You can ask us to change or complete any inaccurate or incomplete personal information held about you.
- Erasure: You can ask us to delete your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
- Portability: You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
- Restriction: You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.
- The easiest method of exercising your rights as set out above is to:
- Email our data protection officer on firstname.lastname@example.org
- Or write to us at Edinburgh Airport Limited, Capital House, Edinburgh, EH12 9DN, United Kingdom, marked for the attention of the data protection officer.
- Please note that in order to protect your privacy, we may ask you to prove your identity before we take any steps in response to a request you have made.
- Whilst we would always ask that you contact us first, you also have the right to lodge a complaint about our handling of your personal data with the Information Commissioner’s Office.
- You can contact them on 0303 123 1115,
- Email them at: Scotland@ico.org.uk
- Or write to them at: The Information Commissioner's Office – Scotland, 45 Melville Street, Edinburgh, EH3 7HL
4. What Kinds of Personal Information We Use
- We use a variety of personal information depending on the services and facilities we deliver or provide to you.
- We are governed by regulations from the Civil Aviation Authority and Department for Transport. In order to comply with these regulations, we need to collect and process certain personal data relating to you and your flight. This includes personal data to allow us to validate your boarding pass when entering our Security Hall to go to the departure lounges and personal data to allow your bags to be processed and sorted in our Baggage Hall. We also operate a CCTV system throughout the airport and its surroundings for security and operational reasons.
- The personal information we may collect, and use includes information given when you sign up to receive free Wi-Fi when you are at the airport, when you book car parking or purchase or request services from us, or if you make a complaint or enquiry about our services.
- In delivering our services and providing our facilities, we may collect a variety of technical information, your name and contact details, car registration details and payment information.
- When you are at the airport, we may collect and process the following information about you:
- CCTV: there are CCTV cameras throughout the airport and surrounding areas which will record images and video footage of your time at the airport. More information about how we use CCTV is set out in paragraphs 5.2 and 6.1 below;
- Boarding Pass Validation: under aviation regulations, passengers are required to have a valid boarding pass in order to transfer through our Security Hall to the departure lounges. We use technology to capture boarding pass personal data such as passenger name, seat and flight number;
- Queue and Passenger Flow Measurement: we use technology which collects and processes technical information from Bluetooth and Wi-Fi signals which may be emitted from your device when you are in the airport;
- Hold Baggage Identification: in order to identify items of hold baggage to their owner and the relevant flight, we capture information on the bag tags that are attached to each item of hold baggage. This information includes passenger names and flight details.
- Wi-Fi: when you sign up to use our free Wi-Fi services at the airport we will collect your title, full name, email address, date of birth, and country of residence;
- Car Parking and Other Services: when you book car parking or purchase or request other services from the airport (such as purchasing fastTrack or lounge access or signing up for our newsletter), we will collect (depending on the service) your full name, email address, postcode, car registration number and flight information. The collection of mobile number is optional and we only use this to send SMS regarding booking details if you have specified you want them;
- Taxi Bookings: when you book a taxi to take you from the airport to your destination from our website, we will collect your full name, email address, phone number and flight number. We will also collect information about your destination and the type of vehicle you are looking to book via our website;
- Shopping: Where you decide to use the Shop and Collect services offered at the airport - allowing you to shop in World Duty Free and other participating stores in the departure lounge and collect your shopping on your return - we and our Shop and Collect service provider may collect your name, email address, postal address, returning flight number and information about your purchases;
- Health & safety / incident records: If you are involved in an incident whilst at the airport, we may capture personal details, incident details and details of any injuries sustained;
- Competitions: if you enter any of our competitions, we may collect your name and contact details; and
- Complaint / Enquiry: if you make a complaint or enquiry about the airport, we will collect your name, email address, phone number, postal address, travel details and information about the nature of your complaint or enquiry.
5. How We Gather Your Personal Information
- We only use personal information which we have obtained directly for the purposes described in this Notice. Your personal information is gathered in the following ways:
- Wi-Fi: when you sign up to receive Wi-Fi services, your information is collected on the login page;
- Car Parking and other Services: when you book car parking or purchase or request other services from us your information is collected on the booking page. Our car parks also use Automated Number Plate Recognition (ANPR) systems;
- Shop and Collect: when you use the Shop and Collect service, your information will be collected by a member of staff;
- Health & safety / incident reports: if you are involved in a health & safety incident while at the airport, a member of staff may complete a form about the incident and may collect your information directly from you when completing this form;
- Competitions: if you enter one of our competitions, your information is collected in the entry form; and
- Complaint / Enquiry: when you make a complaint or enquiry, your information may be collected by a member of staff or will otherwise be collected via the format you choose to make your complaint or enquiry (post, website, email or telephone).
- We also may obtain some personal information about you when you are at the airport from our CCTV, Queue and Passenger flow technology and passenger processing systems.
- CCTV: we are required by law to implement and maintain an extensive CCTV system throughout the airport, terminal, car parks and surrounding areas. This is primarily for reasons of public safety and for the prevention and detection of crime. Footage is handled in accordance with data protection laws, and in particular is only held for a limited period of time before it is automatically deleted. Please contact the DPO at email@example.com if you would like to know more about how our CCTV systems operate;
- Queue and Passenger flow: technology is used throughout the airport to collect and process Bluetooth and Wi-Fi signals that may be emitted by your device.
- Boarding Pass Validation: we capture your information when you scan your boarding pass at the entrance to our Security Hall;
- Hold Baggage Identification: we capture your personal information when your hold bag is checked in and a bag tag is printed.
6. How We Use Your Personal Information
- We will use your personal information for the following purposes:
- to provide you with services which you have requested, ordered or purchased from us or a third party (such as car parking or taxi bookings), we will use (depending on the service): your name; title; email address; date of birth; residential address; nationality; postcode; telephone number; car registration; travel details (including flight information) and payment information. Where you use our taxi booking service, we will also collect information about your destination and the type of vehicle you wish to book. We collect this information for the purpose of processing and confirming your car park booking or providing the other services you have purchased or requested (such as fastTrack, lounge access or taxi bookings). Our car parks use Automated Number Plate Recognition (ANPR) systems to facilitate easy access and exit;
- our collection of a mobile number is optional and if given we only use this to send SMS messages regarding booking details if you have specified you want them, or to send “push notifications” to provide relevant service information;
- to enable us to identify you and your purchases when you have used our Shop and Collect service, we will use the personal information you gave to our staff member when requesting this service;
- to enable compliance with aviation regulations so that only passengers with a valid boarding pass can enter our Security Hall and make their way to the departure lounges, we will use your boarding pass personal information;
- we use technical information from Bluetooth and Wi-Fi signals to help us monitor passenger movements throughout the airport and in particular to monitor queue times and manage passenger flows;
- where it is appropriate for us to do so (including for security reasons, to respond to a complaint or query from you or to let your airline know if you are in the departure lounge) we may use your personal information (such as boarding pass data and CCTV images) to locate where you are or were within the airport;
- we will use your bag tag information to process your hold luggage to the correct flight and to securely identify the luggage to a passenger;
- we will use your payment information to allow for you to make payment to us where required in advance of the provision of any services which you have ordered or purchased. We will share this information with third party payment processors where required for this purpose;
- where you have registered with us for access to our free Wi-Fi service, we need to use your name and email address in order to provide you with this service;
- where you have entered a competition promoted by us, we will use your name and contact details to let you know if you have won a prize;
- where you have agreed to receive marketing emails from us, we need to use your name and email address, we may use your postcode and country of residence to ensure that the marketing emails you receive are relevant to your personal circumstances (for example, we often send marketing emails which are relevant only to passengers based in the UK), we use your date of birth to verify your age; this is required to ensure that we do not record personal information on our database of, or send any marketing emails to, any individual under the age of 18; and we may pass your personal information on to our service providers who help us with these marketing activities;
- to comply with our legal obligations (such as our obligations to maintain an extensive CCTV system for the prevention and detection of crime) we will use any information you have given us where it is necessary for us to use that information to comply with any such legal obligation;
- in order to comply with health, safety or legal obligations and to ensure the proper operation of the airport we will use the personal and incident details captured as a result of any incident;
- to address your complaints or enquiries, we will use the information you provided when submitting your complaint or enquiry to us.
7. Our legal basis for using your personal information
- We only use your personal information where that is permitted by the laws that protect your privacy rights. We only use personal information where:
- we have your consent (if consent is needed), for example your consent to send you marketing emails;
- we need to use the information to comply with our legal and regulatory obligations (for example, recording footage of your time at the airport using our CCTV system);
- we need to use the information to perform a contract with you (for example, where you have ordered services from us); and/or
- it is fair to use the personal information either in our interests or someone else's interests, where there is no disadvantage to you – this can include where it is in our interests for appropriate operational reasons, to enable a third party to provide you with a service that you have ordered from us (for example, to enable our taxi and private car hire partners to provide services ordered through our taxi booking website) to contact you about products or services, market to you, to collaborate with others to improve our services, or to use non-privacy invasive technologies to be able to better run our airport operations, including informing passengers about queue wait times.
- Where we rely on your consent to use your personal information, you have the right to withdraw your consent at any time. Please see paragraph 11 below.
- Special protection is given to certain kinds of personal information that is particularly sensitive. This is information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sex life or sexual orientation, genetic or biometric identifiers, trade union membership or criminal convictions or allegations. We will not collect or use any personal information of this kind under this Privacy Notice.
8. Sharing Your Personal Information with Others
- We will share personal information with relevant third parties where:
- you have given us your express consent to do so (see paragraph 8.2 below for more information);
- we need to do so for the purposes of making any services which you have ordered or purchased available to you (for example, where you have ordered goods via Shop and Collect, your information is shared with our Shop and Collect service provider, and when you book car parking services or taxi services, your information is shared with third party providers who help us deliver these services);
- it is necessary to allow us to meet or enforce a legal obligation (for example, we may need to share CCTV footage of you with the police or with the Department of Transport in certain circumstances); or
- where it is fair and reasonable for us to do so in the circumstances.
- We will share your personal information with our partners for marketing purposes where you have given us permission to do so. We will never share your information with a third party for marketing purposes without your express consent.
- Who we share your personal information with depends on the services which you have purchased or ordered (for example, car parking, taxi booking, Shop and Collect and Wi-Fi services).
- We will also share your personal information with our sub-contractors (companies who supply services to us) where it is necessary to do so.
- IT Suppliers: Information may be stored and processed on systems provided and supported by our third party IT suppliers (such as our Wi-Fi service provider, our provider of IT infrastructure services, the provider of our complaint management system and/or the provider of our health and safety management systems).
- Payment processors: Information may be processed by payment companies for the purposes of processing any payment which you make to us.
- Car park management: Information may be stored and processed by our car park operator Empark for the purposes of facilitating any booking which you have made for car parking.
- Taxi and Private Car Hire: where you book a taxi from our taxi booking website, your information is passed to Edinburgh City Private Hire Limited, who are our taxi and private car hire partners. Information is passed to Edinburgh City Private Hire Limited via their contractor, iCabbi.
- Shop and Collect: Information is collected and used by our Shop and Collect service provider Omniserve.
- Marketing: we use third party software applications to help us issue marketing communications. Some marketing activities may be outsourced to third party organisations who assist us with our campaigns or communications. Where you consent to receive marketing your information may be shared with them for this purpose.
We will only share your personal information with third parties to the extent needed for the purposes set out in paragraph 6 above.
9. Transfers Outside the UK
- We may need to transfer your information outside the UK to service providers, agents, subcontractors and regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the European Economic Area (EEA), such as the USA We may need to transfer your personal information to territories that are outside the EEA. We will only transfer your personal information outside the EEA where either:
- the transfer is to a country which the EU Commission has decided ensures an adequate level of protection for your personal information, or
- we have put in place our own measures to ensure adequate security as required by data protection law. These measures include ensuring that your personal information is kept safe by carrying out strict security checks on our overseas partners and suppliers, backed by strong contractual undertakings approved by the relevant regulators such as the EU style model clauses. Some US providers may also be certified under the EU-US Privacy Shield which confirms they have appropriate measures in place to ensure the protection of your data.
10. How Long Do We Keep Your Personal Information For?
- We will never retain your personal information for any longer than is necessary for the purposes we need to use it for.
- Where we have been using your personal information to provide you with marketing emails, we will retain this information for 18 months from the last marketing e-mail you opened or until you opt out. We will delete your personal information following your request to be removed from our marketing email list (opting out) or if you have not opened a marketing e-mail for 18 months.
- Where you have ordered or requested a service (such as car parking or taxi services) from us or a third party, we will retain your personal information for 24 months from the date you last used the service, unless you used an airport user account to book, in which case we will keep it until you request that your account is deleted.
- Where you have used our Shop and Collect service your personal information will be retained for one month after you collect your goods.
- We retain hold baggage information for 14 months within our databases.
- We retain boarding pass information from our E-gates at the entrance to our Security Hall for 60 days.
- Where you have made a complaint or enquiry, we may hold your information for up to three years after your complaint or enquiry has been resolved. We retain the personal information submitted when you make a noise complaint or query through our online Noise Lab tool for up to six years.
- We retain information relating to health & safety and other incident reports for up to 5 years.
- We may hold your personal information for longer where it is necessary to do so for the management of any active or potential legal proceedings, to resolve or defend claims, and for the purpose of making any necessary remediation payments.
- We retain most CCTV footage for a period of 30 days before it is securely destroyed. CCTV footage covering certain areas in the airport is retained for a shorter period. Where we have saved particular footage related to an incident, legitimate request or claim we retain that footage for as long as is necessary to fulfil the purposes for which it has been retained.
- We retain information obtained from queue and flow management technologies for 24 hours before it is deleted.
11. Keeping You Up To Date
- Where you have given us consent to receive marketing, we may use the contact details which you have provided to us to communicate relevant news and information about our services to you by email, post, text message, social media, and notifications on our app or website.
- You can withdraw consent at any time by clicking the "unsubscribe" link in any marketing email which you receive or emailing us at firstname.lastname@example.org.
12. Cookies and Your Online Activities
- What are cookies? A cookie is a small file which is sent to your browser and stored on your computer's hard disc. Cookies help us understand and track your use of our websites and where we can improve the information and services provided.
- What cookies do we use? We use the following categories of cookies on our websites:
- Strictly necessary: These cookies are essential for certain features of our websites to work (for example, when you make payments for car parking). These cookies do not record identifiable personal information and we do not need your consent to place these cookies on your device. Without these cookies some services you have asked for cannot be provided.
- Performance: These cookies are used to collect anonymous information about how you use our websites. This information is used to help us improve our websites and understand how effective our adverts are. In some cases we use trusted third parties to collect this information for us but they only use the information for the purposes explained.
- Functionality: These cookies are used to provide services or remember settings to enhance your visit for example text size or other preferences. The information these cookies collect is anonymous and does not enable us to track your browsing activity on other websites.
- Relevant Advertising: These cookies are used by trusted third parties to deliver adverts more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. Information contained in these cookies is anonymous and doesn't contain your personal information. To find out more about cookies used for targeting and advertising follow www.youronlinechoices.com and www.networkadvertising.org or contact us for further information about the trusted third parties we use.
- Your activities: These cookies are used by us to store information such as what products you view on our website and which products you add to your basket. We sometimes use these to send you relevant emails regarding these products. This information will only be stored if you have opted in to receive marketing communications by email- if you have not opted in, no data will be stored.
- Managing our cookies: If you would prefer to restrict, block or delete cookies from EAL and our third party advertisers, or any other website, you can use your browser to do this. Each browser is different, so check the "Help" menu of your particular browser to learn how to change your cookie preferences. If you choose to disable all cookies we cannot guarantee the performance of our websites and some features may not work as expected.