Introduction
Airbus Helicopters (also known as, “Airbus”, or “we” or “us”) uses several processes to ensure security on all Airbus Helicopters plants. These processes include access control management, CCTV, vehicle access control, the badge office activity and elementary control (legal obligation due to the qualification of the plants according to French regulation).
The protection of your privacy and the confidentiality of your Personal Data are important concerns, to which we pay particular attention throughout our business processes.
Airbus is committed to protecting the rights of individuals in line with the General Data Protection Regulation (reference EU2016/679) on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (hereinafter referred as : “GDPR”) as well as each applicable national Personal Data protection laws and regulations . The protection of your privacy and Personal Data is an important concern to which we pay special attention throughout our security processes.
This Privacy Notice will inform you of the Personal Data we collect throughout our management of security on the plant; how we use and disclose your Personal Data; how you can control the use and disclosure of your Personal Data; and how we protect your Personal Data.
Personal Data is information that can be used to identify a person either directly or indirectly (hereinafter referred as “Personal Data”). This definition covers a wide range of data enabling the identification of an individual.
The Personal Data we process under this Privacy Notice are as follows:
- Identification data: Name, prefix, home address, postal code, municipality/delegation, telephone number, mobile phone number, professional email address, photo, sex, date and place of birth, government identifier and passport number, nationality, CCTV data.
License plate number, driving record (violations, accidents), driving behavior, event data recorder records, vehicle colour and model, accident information, motor vehicle infractions.
- Professional data: Job title, department, department ID, business unit, work location, date of termination, investigation evidence.
- Location data: Location, movement.
We may collect this Personal Data:
- Directly from you when you fulfill the completion of the forms we are providing to you within the frame of our business.
- Indirectly for those Personal Data related to video surveillance, collected by our CCTV network on the plant.
By deploying security related processes on the plants, Airbus will collect and process your Personal Data for the following purposes (hereinafter referred as: the ‘Purposes’):
- To protect us and others. Where we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of policies, terms, and other policies.
- To protect company assets.
- Legal compliance. We use your Personal Data to comply with applicable legal obligations, including responding to an authority or court order or discovery request.
- Manage everyone’s access and reception. The Airbus Helicopters plants are considered as a sensitive zone according to French regulation. We therefore need to ensure security when allowing the access to the plants.
We will use your Personal Data for the above purposes only, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose (for preserving particular evidence under the applicable Data Protection Laws and Regulations, or in the context of legal statutes of limitation for example). If we need to use your Personal Data for an unrelated purpose, we will notify you prior this further Personal Data processing and provide you the relevant privacy information notice.
As a responsible company, we need a lawful basis for collecting and/or processing your Personal Data in accordance with the provisions set out in the GDPR and the relevant applicable Data Protection Laws and Regulations. The legal basis for processing your Personal Data under this Privacy Notice are:
On the basis of Airbus’ legal obligations
Airbus, as any other company, is subject to legal obligations and regulations. In some cases, the processing of your Personal Data will be necessary for Airbus in order to fulfil these obligations.
Airbus is indeed submitted to specific regulation due to the qualification of the plant (considering the military related activities on the plant).
French regulatory requirements:
- Instruction générale interministérielle 1300
- Some plants are under “restricted access”
We may disclose your Personal Data to the following recipient(s) on a strict need to know basis and for the Purposes as outlined in this Privacy Notice:
● Airbus Helicopters;
● Authorized persons working for or on behalf of Airbus, including our agents, service providers and advisers providing the variety of products and services we need such as our CCTV service providers
● Law enforcement or government authorities or other legal process to comply with applicable law, or in response to any subpoenas, court orders, or to establish or exercise our legal rights or to defend against legal claims.
Airbus processes your Personal Data mostly in the EEA. On occasion Personal Data is transferred to the relevant recipients as described in Section “Who will receive your Personal Data?” on a need-to-know basis, including entities outside the EEA.
This transfer is subject to appropriate safeguards, within Airbus through the legal framework of our Binding Corporate Rules (“BCR”), that can be found on our website www.airbus.com or viewed here - Airbus BCR's, or through alternative contractual frameworks or relevant adequacy decision where the relevant data recipients as defined in Section “Who will receive your Personal Data?” is engaged to help us ensuring security on the plant.
Our Binding Corporate Rules allow us to transfer Personal Data within our international organization, and they include a list of countries (below) which are structured to allow us to transfer Personal Data to the countries where we have a presence. Below is a list of countries where Airbus operates:
Algeria, Australia, Belgium, Brazil, Canada, Chile, China, Czech republic, Denmark, Egypt, Finland, France, French Guyana, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Ireland, Italy, Japan, Kazakhstan, Libya, Malaysia, Mexico, Morocco, Netherlands, New Zealand, Norway, Oman, Philippines, Poland, Qatar, Romania, Russia, Saudi Arabia, Singapore, Slovakia, South Africa, South Korea, Spain, Sweden, Taiwan, Tanzania, Thailand, Tunisia, Turkey, United Kingdom, United States of America, Uruguay, United Arab Emirates, Vietnam.
We process and store your Personal Data for at least one month from the date of collection for the CCTV processing in accordance with the GDPR or any local data protection laws requirements or as long as it is required to meet our contractual and local legal obligations.
Other data types are kept according to regulatory compliance implied by the French regulation
We use technical and organizational security measures in order to protect the Personal Data we have under our control against accidental or intentional manipulation, loss, destruction and against access by unauthorized persons. Our security procedures are continually enhanced as new technology becomes available.
Under some circumstances provided by law, you may at any time exercise your data protection rights as listed below:
● Right to access/obtain a report detailing the information held about you: You have the right to obtain confirmation as to whether or not your Personal Data is being processed by Airbus and if so, what specific personal data is being processed.
● Right to correct Personal Data: You have the right to rectify or request to have rectified any inaccurate Personal Data concerning you.
● Right to be forgotten: In some cases, for instance, when the Personal Data is no longer necessary in relation to the Purposes for which they were collected, you have the right for your Personal Data to be erased.
● Right to restrict the processing of your Personal Data: You have the right to restrict the processing of your Personal Data, for instance when the processing is unlawful and you oppose the erasure of your Personal Data. In such cases, your Personal Data will only be processed with your consent or for the exercise or defense of legal claims.
● Right to data portability: You have the right to receive the Personal Data concerning you in a structured, commonly used and machine-readable format and/or transmit those Personal Data to another data controller.
● Right to object: In some cases required by law, you may ask us to stop processing your Personal Data.
If you want to exercise your rights or you are unhappy with the way in which your Personal Data has been processed or should you have any questions regarding the processing of your Personal Data, you may refer in the first instance to the Airbus Data Protection Officer, who is available, at the following email address:
dataprotection@airbus.com or you can write to the address below:
Airbus SAS, Head of Data Protection, HAP, 2 rond-point Emile Dewoitine 31700 Blagnac cedex. France
In case of doubt of your identity, we may ask you to justify it by enclosing a copy of any identity document.
Under certain circumstances, when some Personal Data is necessary to enter into a contract or to comply with legal obligation, any failure to provide the requested Personal Data may conduct us not being able to fulfil our contractual/legal obligations or to achieve the expected results.
In the case of security related processing, if the data are not provided, people will not be allowed to access to the plants.
As a matter of principle, we do not use fully automated decision-making processes, including profiling. In the event that we should use such processes, we will inform you in advance. However, you can always change your cookies preferences from your web browser settings
If you remain unsatisfied, then you have the right to apply directly to a Data Protection Supervisory Authority. Listed below are the four main European countries where Airbus operates and the relevant Supervisory Authority
FRANCE: CNIL: Supervisory Authority France
GERMANY: Datenschutz-hamburg: Supervisory Authority for Airbus Operations GmbH
or
lda Bayern: Supervisory Authority for Airbus Companies in Bavaria, Germany
or
any other competent regional German authority as the case may be,
Airbus will update this Privacy Notice from time to time in order to reflect the changes in our practices and services and also to remain compliant to Data Protection Laws and Regulations. We will inform you of any substantial modification in how we process your Personal Data.