Privacy notice

Question 1

Use of our website

Accepted Answer

We collect your personal data using ‘cookies’ or tags when you visit our website or when you submit any information to us using our website (including if you subscribe to our newsletter, enter a competition, complete any form, create a user account, submit feedback or register for an event on our website). For more information on which types of cookies we use, please see the relevant section in our cookies policy. What personal data is collected When you access our website, we may collect anonymised usage data recording how you use and navigate our website, your preferences/settings for our website, your IP address and details of the device, browser and operating system you use to access our website. How we use your personal data We may use your personal data for the following purposes: Identifying and resolving any errors with our website’s performance. Analysing visitor information (including browser information and returning visitor numbers) to help improve the performance of the website and tailor adverts and information to you appropriately (including travel information for your planned journeys). To permit your access to and use of a user account if you register for one on our website. To ensure certain features of our website work correctly. To monitor the effectiveness of our advertising. To maintain the security of our website and to investigate any incidents relating to the use of our website. To log your consent preferences when you opt-in to receiving electronic marketing communications. Our legal basis for collecting and using your personal data It is in our legitimate interest to provide you with a functioning, secure, relevant and easy to navigate website. We have a legal obligation to record your electronic marketing and cookie consent preferences. How long we keep your personal data for If you have an account registered with us, your data will be kept until either you or we close that account (except if we are communicating with you in connection with your account, in which case, we will keep such data until we have completed the purpose of our communications). All other data may be kept for up to 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency). Who we share your personal data with We may provide your data to: Our sub-contractors for the purposes of improving and maintaining our website. Our sub-contractors e.g. Google for the purposes of analysing your browsing behaviour when you visit our website and tailoring adverts and information to you. Our cookie suppliers/third party developers for the purpose of monitoring and improving the performance of our website. Our sub-contractors (Dot Digital) who host our CRM system.

Question 2

Check-in and hold baggage procedures

Accepted Answer

What personal data is collected When you check-in baggage using a self-service kiosk or a manned check-in desk, your name and flight details are collected from the boarding pass that was issued to you by the airline you are flying with. Your flight details are verified and generate a bag tag with a unique identifier, usually a barcode. This unique identifier will be linked to your boarding pass. Your hold baggage is then screened by x-ray before being loaded onto an aircraft and the x-ray images are collected. How we use your personal data We collect personal data for the following purposes: To track your bag’s journey through our baggage system to its final location to ensure it is loaded onto the correct aircraft. To identify you as the owner of the bag if additional security screening checks are required and you need to be notified. In this case, we will notify you using our tannoy system and ask that you contact a member of our staff. To ensure the aircraft does not depart if your baggage is on board, but you are not. For investigating any incidents or resolving any issues. Our legal basis for collecting & using your personal data It is in our legitimate interest to provide you, and the airline who contracted us, with a service of ensuring your baggage is loaded onto the correct flight. We have to comply with our legal obligations of ensuring that no aircraft departs containing hold baggage if the owner is not on board, as per the Department for Transport and Civil Aviation Authority. We have a legal obligation to screen hold baggage as per aviation security regulations. How long we keep your personal data for Your data is held on self-serve kiosks for up to 24 hours only before it is deleted. We retain your hold baggage tag data for up to 30 days before all personal data is removed. After this time, we keep the identifier and its scanning points, but we cannot identify you from this data. We retain x-ray images of your hold baggage for up to 7 days. Images may be kept for longer if they are required for investigation purposes. Who we share your personal data with We will share your bag’s status and location with the airline you are travelling with and their relevant contractors, such as ground handling agents and any relevant special assistance providers. We will also share your personal data with our security contractors, who are responsible for conducting hold baggage security screening procedures if your bag requires additional security checks. We may share your personal data with any IT or other contractors who maintain, repair and manage our hold baggage system. We may share your personal data with our regulators to demonstrate our compliance with our legal obligations to them. We may share your personal data with the Police, Border Force or other law enforcement agencies for the purposes of their investigations.

Question 3

Special Assistance services

Accepted Answer

In partnership with our service provider, OCS Group Limited, we deliver special assistance services to passengers on behalf of the airline they are travelling with. If you have booked a special assistance service through your airline or other service provider, we will receive a notification of your request and the type of assistance you require. Your airline or other service provider will be the data controller of your personal data. We may ask you to provide feedback on your experience with our special assistance provider. This survey is optional, and the results will be shared with relevant Edinburgh Airport and OCS Group Limited personnel.

Question 4

Security checks and screening

Accepted Answer

Before entering a security restricted area, for example into the departure lounge or through a security control post, you, your cabin baggage and other belongings you are carrying will be screened by our security team. What personal data is collected. We may collect the following information from you: Your name and flight details. The date and time you entered the security hall. Your contact details, such as home address, email address or contact number. An image of your boarding pass, photographic identification or other documentation X-ray images of your cabin baggage. Details about your job, hobbies, medical condition or other health data. How we use your personal data We collect this data for the following purposes: To verify that you are authorised to enter the security restricted area. To verify that you are travelling on a scheduled flight from Edinburgh Airport. To verify that you are authorised to carry prescription medication or other items whose carriage on an aircraft is restricted. As part of further security checks or investigations e.g. if you or your items generate an alarm on our security equipment. To investigate and resolve incidents, complaints or reunite owners with lost property. Our legal basis for collecting and using your personal data We have a legal obligation, as imposed by the Civil Aviation Authority and the Department for Transport, to collect this data. It is also in our legitimate interests to use this data to investigate incidents and complaints. How long we keep your personal data for When you use our e-gates to scan your boarding pass to enter the security hall, we keep this data for up to 30 days. We store x-ray images of your cabin baggage for up to 60 days. We will keep any other personal data relating to your time in security for up to 13 months. Who we share your personal data with We may share your data with the following third parties: Police, Border Force and other law enforcement agencies for the purposes of their investigations. The Civil Aviation Authority, Department for Transport and other regulatory authorities. Airline staff and other trusted third parties for the purposes of their investigations. Any IT contractors or other personnel who are responsible for maintaining our equipment and systems.

Question 5

CCTV (closed circuit television) and other surveillance systems

Accepted Answer

There are CCTV cameras throughout the airport and surrounding areas that will record static or moving images of your time at the airport, audio and other data such as vehicle number plate data.  What personal data is collected Closed Circuit Television (CCTV) Cameras The Edinburgh Airport CCTV system consists of a combination of fixed cameras and Pan, Tilt and Zoom (PTZ) cameras. CCTV cameras are located internally and externally around the campus and may collect static or moving images of you whilst you are at the Airport. Automated Number Plate Recognition (ANPR) Cameras We use ANPR cameras externally around our car parks and drop-off/pick-up points that capture images of your vehicle’s number plate and also the date(s) and time(s) your vehicle was in our car parks.  Body Worn Video (BWV) Cameras and Other Mobile Recording Devices Edinburgh Airport security colleagues and our representatives may, in limited circumstances, use BWV cameras or other officially issued devices to record video and audio footage when they attend an incident. Our colleagues will inform you if you are being filmed unless the situation means we are unable to communicate this with you. Human Detection Systems. We use artificial intelligence (AI) technology at various entry/exit points in the terminal building to detect when a person is about to enter a security restricted area through an unauthorised route i.e. any area that is not a security checkpoint.  How we use your personal data We use surveillance systems for the following reasons: Help deter, detect and investigate crime and other incidents. Assist in the overall management of the Airport, including incident response.  Assist and gather information for Border Force and Police Scotland in their enforcement and regulatory functions at the Airport. Assist in the investigation of and support of civil proceedings. Where appropriate and proportionate, ensure that regulations, policies and procedures are being correctly adhered to in all areas. Where appropriate and proportionate, provide a source of evidence where misconduct by staff or third-party contractors has been alleged or identified. Where appropriate and proportionate, assist in disciplinary-related proceedings. Where appropriate and proportionate, provide effective feedback to staff for training and awareness purposes. Check that health, safety and environmental processes and standards are being correctly adhered to. Provide evidence of airport regulatory compliance to the Department for Transport (DfT) and Civil Aviation Authority (CAA). Where appropriate and proportionate, provide evidence of Airport operations for research purposes and process improvement. Our legal basis for collecting and using your personal data It is in our legitimate interest to ensure the safety and security of our staff, visitors and property. It is also in our legitimate interest to ensure the operational effectiveness of the airport.  We have a legal obligation to view and share footage from our surveillance systems in response to a data subject access request under the UK GDPR (General Data Protection Regulation) and other data laws. We also have a legal obligation in some circumstances to share footage with our regulators, law enforcement agencies or other official government body when officially requested. For security reasons, Edinburgh Airport may not share footage from the following areas: Any area within the security footprint, including the security screening hall and other checkpoints; Any area where a security process is taking place, including the immigration hall and Border Force customs channels. How long we keep your personal data for We retain images and audio recordings from our CCTV and other surveillance systems for up to 30 days before they are automatically deleted from our systems.  We retain ANPR data for 3 months. We may save any data for longer, until it is no longer required, if it is needed as part of an investigation. Who we share your personal data with We may share audio and visual images from our surveillance with the following parties: Police or other law enforcement agencies or security services. Our regulators including the DfT and CAA. Where appropriate and proportionate, we may share your data with other trusted third parties, including legal professionals or insurers for the purposes of their investigations. Our trusted third party business partners or contractors. Our IT suppliers or other personnel responsible for maintaining our surveillance systems. Please note, where we have shared data from our surveillance systems with third parties for their own purposes, such as to investigate incidents, they will be the data controller. Some trusted third parties have access to Edinburgh Airport’s CCTV system such as the Police, UK Border Force and some campus business partners. These third parties may take control of the cameras and use them for their own purposes, such as incident investigations for example. Edinburgh Airport is not responsible for the cameras when in control of these third parties. Some third parties based at Edinburgh Airport have installed their own CCTV systems. These third parties are controllers in their own right.

Question 6

Wi-Fi

Accepted Answer

What personal data is collected When you sign-up to use our Wi-Fi, we collect your name, email address, the MAC address of your electronic device and details of the browser you use to access our website. How we use your personal data We use your personal data for the following purposes: To provide you with access to our Wi-Fi connection. To detect and prevent misuse of our Wi-Fi connection. Analysing visitor information (including browser information) to help improve the performance of our Wi-Fi and to tailor adverts and information we provide to you appropriately. To contact you with marketing materials (if you have provided your consent for us to do so). To contact you to seek your feedback on our Wi-Fi or your experience at the airport. Our legal basis for collecting and using your personal data We collect this data in order to provide you with a service you have requested from us. We will send you marketing emails if you have given us consent to do so. It is in our legitimate interest to provide a functioning Wi-Fi connection that is not misused. How long we keep your personal data for We will keep your personal data for 30 days after you sign-up for Wi-Fi services. If you opt-in to receive marketing messages, we will use your data as outlined in the 'Marketing and newsletters' section below. Who we share your personal data with We may share your data with our Wi-Fi provider and any person responsible for maintaining our systems.

Question 7

Queue and passenger flow measurement

Accepted Answer

We have installed BlipTrack sensors in several areas around our campus to monitor queue times and passenger flow throughout the airport. What personal data is collected BlipTrack sensors detect Bluetooth or Wi-Fi-enabled devices. When a device passes within range of one of our sensors, the device’s Bluetooth or Wi-Fi MAC address (which is a unique identifier used to enable communication between Bluetooth and Wi-Fi devices) is captured. The information is not stored by the sensor but is processed to allocate a unique and anonymous value to your device. The data is not paired with any other data that could reveal your identity to us. When your device passes within range of other sensors, they will recognise this value and can determine how long a device was in an area for, or how long it took to travel between sensors. You can find out more about the BlipTrack system here - Trust Centre - Veovo How we use your personal data We collect this data to generate anonymised reports to understand passenger movement whilst at the airport and to understand the factors that affect queuing times and journey times, so that we can make improvements where necessary. Our legal basis for collecting and using your personal data It is in our legitimate interest to improve passenger experience whilst at the airport by analysing queueing times and the flow of movement from one area to the next. How long we keep your personal data for Your device’s MAC address is immediately randomised by the sensors. This randomised data is held on the sensor for up to 24-hours only and cannot be used to identify you. You can find out more here - Trust Centre - Veovo. Who we share your personal data with We share this data with Veovo, who provide our BlipTrack system. We may share the anonymised reports with our third party business partners to assist in improving their services to you.

Question 8

Marketing and newsletters

Accepted Answer

Marketing & Newsletters What personal data is collected When you opt-in to receive marketing updates, newsletters or other correspondence from us, we will collect your name and email address and in some cases your telephone number. We collect this data in addition to the data collected when you use our website (See the section ‘Use of our Website’ above. We will also store your data when you have opted-out of receiving electronic marketing communications, so we can ensure you are not sent electronic marketing communications. As part of our business outreach, we contact professionals whose roles are relevant to our services, using publicly available or provided contact details. These communications are based on our legitimate interest in promoting our services. How we use your personal data To send you updates based on your preferences and transaction details if you have opted-in to receiving them.  To promote our products and services. We may send you market research surveys or feedback requests to help improve our products or services.  When you have opted-out of receiving marketing communications, we will add your details to a suppression list, so we can ensure you are not sent electronic marketing messages. Email Tracking We include tracking pixels in some of our marketing emails. These allow us to understand whether an email was opened, when it was opened, what links were clicked, and may collect some basic device information (such as IP address and email client). This helps us assess the effectiveness of our communications and improve the relevance of future emails. We only use tracking pixels if you have provided consent when signing up for our marketing emails. You can withdraw your consent at any time by clicking "unsubscribe" in any email. If you prefer not to be tracked, you can choose not to subscribe to marketing emails or disable images in your email client. Our legal basis for collecting & using your personal data We will send you marketing emails if you have provided us with your consent.  It is in our legitimate interest to obtain feedback so that we can improve our services where necessary. It is in our legitimate interest to promote our products and services and to assess the effectiveness of our communications. We have a legal obligation to record your electronic marketing consent preferences. We will always offer you the opportunity to opt-out or unsubscribe from receiving marketing emails and newsletters from us.  How long we keep your personal data for We keep your data on our marketing databases for up to 2 years after your last interaction with us or until you opt-out of receiving marketing updates. We will keep your personal data on our marketing suppression list indefinitely to ensure you are not sent marketing messages if you have opted-out of receiving them. Who we share your personal data with We may share your data with our IT service providers, including DotDigital or other sub-contractors who maintain our systems or help us manage our electronic communications. We also advertise on Facebook, Instagram, and Google as well as other online platforms or websites. We will advertise to individuals who are signed up with an online platform and have consented to the relevant cookies for third party sites.

Question 9

Incident reporting

Accepted Answer

We will keep a record of any health and safety or security related incident that has occurred on our campus. What personal data is collected If you have been involved in an incident on our campus, we may collect the following data from you: Your name. Your contact details including address, email address and contact number. Your flight details. Your identification details e.g. your passport number. Health data or other medical data where relevant. Any other information that is provided by you that may be sensitive in nature. Details about the incident, including any supporting images or footage. How we use your personal data To investigate and keep a record of all incidents that have occurred on our campus. We may contact you after an incident to check on your welfare or to provide you with an update of any investigation. Our legal basis for collecting and using your personal data We have a legal obligation under Health and Safety and aviation security regulations to ensure incidents do not reoccur. It is also in our legitimate interest to collect this data to defend or bring legal claims and to investigate incidents that have occurred on our campus. How long we keep your personal data for We will retain any personal data for up to 6 years. Who we share your personal data with We may share your data with: The Police or other law enforcement agencies for the purposes of their investigations. Emergency services or other medical staff. Our IT service providers. Third-party contractors who are responsible for maintaining our reporting systems. Legal representatives and insurers, where proportionate and necessary. Our regulators for demonstrating compliance with our legal obligations. If proportionate and necessary, we may share details of the incident with our campus partners to investigate and resolve incidents.

Question 10

Customer services, complaints, and feedback

Accepted Answer

Edinburgh Airport collects personal data to investigate and resolve complaints, enquiries, noise complaints and to improve services. What personal data is collected We may collect the following personal data from you when you submit feedback, lodge a complaint or contact our Customer Support Team: Your name. Your address. Your contact telephone number. Email address. Your vehicle registration number. Your flight details or other booking information. Voice recordings (when you have phoned our Customer Support Team). Photographic identification. How we use your personal data We collect personal data for the following purposes to: Investigate and resolve complaints, enquiries and feedback. Contact you with updates and information relating to your enquiry. Address noise complaints. Send you feedback and market research surveys. Confirm your identity when you request to have a copy of your data. Our legal basis for collecting and using your personal data It is in our legitimate interest to improve our services by obtaining customer feedback and to address or resolve any complaints. We will also collect your personal data if we have to defend potential legal claims because of a complaint. How long we keep your personal data for We store your data on our customer services database for up to 3 years. Noise complaints and any associated data will be held for up to 6 years. We store voice recordings for up to 6 months. Who we share your personal data with We may share your personal data with: Our trusted campus business partners to address your complaint or feedback. We may also share your details with the Police or other law enforcement agencies for the purposes of their investigations. Our regulators for demonstrating compliance with our legal obligations. Your data will be held on our customer relationship management (CRM) system and may also be shared with our IT service providers.  Edinburgh Airport may use generative AI tools to analyse feedback. We do this to identify key trends so we can improve our services to you. When we use AI tools, like ChatGPT or Copilot, to analyse reviews we take a number of precautions to protect your privacy, including dissociating your review from your account or personal information used to submit the review or feedback. When you leave feedback or a review, please do not submit content that contains confidential information or any data that you would not want to be seen by a reviewer or analysed by AI tools.

Question 11

Car parking, FastTrack, and lounge bookings

Accepted Answer

This section applies to you if you purchase car parking or FastTrack tickets through our website, the website of our sales agents or from one of our ticket machines at the airport. What personal data is collected We may collect the following data from you: Full name. Address. Flight information. Contact telephone number. Email address. Payment details. Vehicle registration number. How we use your personal data We need to collect your data for the following purposes: Managing your booking. Providing you with access to our car parks or FastTrack lanes. Charging you the correct amount for using our car parks or FastTrack services. Investigating incidents and maintaining security at the airport. To contact you regarding your booking or to seek feedback about your experience at the airport. To deal with any complaints, incidents or enquiries.  Who we share your personal data with We may share your data with the following parties: Police, other law enforcement agencies or security services for the purposes of their investigations. Our regulators to prove we are complying with our legal obligations to them. Where appropriate and proportionate, we may share your data with other trusted third parties, including legal professionals or insurers for the purposes of their investigations. Our subcontractors for the purposes of managing our car parks, managing access to our car parks or processing your payment. In cooperation with Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, we also offer you the following payment options for online bookings: Pay Later 30 Pay in 3 instalments Pay Now Payment is to be made to Klarna. Your personal data is handled in accordance with applicable data protection law and in accordance with the information in Klarna’s privacy statement. How long we keep your personal data for Where you have ordered or requested a service (such as car parking) from us, we will retain your personal information for 24 months from the date you last used the service, unless you used an airport user account to book, in which case we will keep it until you request that your account is deleted.

Question 12

Flights, holiday, and taxi bookings

Accepted Answer

When you book a flight, holiday or taxi service through our website, you will be directed to the relevant operator’s website to complete your booking. Edinburgh Airport does not collect your personal data in relation to the sale of holidays, flights, taxi or other transport bookings. Please refer to the operator’s website if you wish to know how they handle your personal data.

Question 13

Reserve and Collect shopping at the Airport

Accepted Answer

When you reserve your World Duty Free shopping through our website, you are directed to the World Duty Free website to complete your reservation. Edinburgh Airport does not collect your personal data in relation to the sale of products purchased at any retail outlet at the airport or click and collect purchases made through the retailer’s website. Please refer to the retailer’s website if you wish to know how they handle your personal data.

Question 14

Edinburgh Airport ID passes

Accepted Answer

What personal data is collected When you apply for, or are provided with, an Edinburgh Airport ID card we may collect the following data from you to process your application and to record when you use your ID card to access a secure area at the Airport: Full name. Date of birth. Photographic and other identification documents. Photographic image of you. Vehicle registration number. National insurance number. Place of birth. Work/education history. Address. Current employment details. Results of a background check – obtained from your referees and our third-party suppliers. Results of a Disclosure Scotland Criminal Records Check (CRC) Contact telephone number. Email address. Payment details. Date and time of access, when you use your ID pass to open a secure door. How we use your personal data We may use your data for the following purposes: Issuing your ID pass in line with current aviation security and other regulations. Investigating incidents at the airport. Ensuring you can access security restricted areas. Assist in the overall operation of the airport including incident response. Maintaining security within the airport. Our legal basis for collecting and using your personal data We have a legal obligation imposed by the CAA and DfT to collect your personal data in line with aviation security regulations. It is in our legitimate interest to use your personal data to assist in the overall operation of the airport and to investigate incidents. How long we keep your personal data for If you are issued with a temporary ID pass, we may keep the data we collect about you for up to 12 months after the expiry date printed on your ID card. If you are issued with a full ID pass, we may keep your data for up to 6 years from the date your application was completed. We may keep your data for longer if we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or any law enforcement agency. Who we share your personal data with We may share your data with the following parties: Police, other law enforcement agencies or other trusted third parties for the purposes of their investigations. Compliance authority personnel including the DfT, CAA and Border Force.  Our subcontractors for the purposes of managing or maintaining our ID pass application system (ID Gateway), ID pass readers (CEM systems) or associated IT systems.

Question 15

Events, meetings, and training

Accepted Answer

What personal data is collected When you arrange or attend any events, meetings or training at the airport, we may collect the following data from you: Full name. Occupation. Date of birth. Contact telephone number. Email address. Contact address. Medical or dietary requirements. Any special assistance requirements you require. Vehicle registration numbers. Payment details. Proof of identity. Photographic or other images of you. Records of any training courses, assessments or qualifications undertaken at Edinburgh Airport. You may be issued with an Edinburgh Airport ID pass for your visit. Please see the section titled “Edinburgh Airport ID Passes” to find out the personal data we use to issue you with an ID pass. How we use your personal data We collect your data in order to: Correspond with you. Arrange and administer your request. Where relevant, register training candidates with the SQA or other awarding body. Where relevant, administer training courses you have attended. Investigate any incidents, enquiries or complaints. To facilitate your access into and around the airport. To publicise an event on our website, social media platforms, internal communications or other publicly available sources. Demonstrate compliance with our legal obligations to our regulators. Our legal basis for collecting & using your personal data It is in our legitimate interest to deal with your request or correspondence. We also collect your data in order to fulfil a contract we may have made with you at your request. How long we keep your personal data for We may keep the data we collect about you for up to 12 months after the event. We may keep images associated with an event for longer for our own records. Where proportionate and relevant, we may keep data about you for longer if it is required as evidence for an ongoing investigation. For further details on how long the SQA retain your data for, please click on the following link here. Who we share your personal data with We may share your data with the following parties: Police, other law enforcement agencies or security services for the purposes of their investigations. Our regulators for the purpose of demonstrating compliance with our legal obligations. Where applicable, our third-party contractors or business partners responsible for running the event or issuing ID passes. We may post images of the event on our website, social media channels, third-party media outlets or other Edinburgh Airport advertising material. Awarding bodies such as the SQA to register you for a qualification offered at Edinburgh Airport.

Question 16

Competitions and prize draws

Accepted Answer

What personal data is collected When you enter a competition or prize draw, we may collect the following information from you: Your name. Email address. Telephone number. Address or postcode. Identification documents or reference numbers. Details of your hobbies or interests. Date of birth. How we use your personal data We collect your data to: Send you marketing updates by email if you have opted-in to receiving them. Run the competition or prize draw. Contact any winner(s) of the competition or prize draw. Provide any prizes to the winner(s). Publicise the winner(s) of the competition or prize draw on our website, social media channels, third-party media outlets or other Edinburgh Airport advertising material. Our legal basis for collecting and using your personal data We will send you marketing emails if you have provided us with your consent. We require your details in order to run the competition or prize draw and inform the winner(s) . We will always offer you the opportunity to opt-out or unsubscribe from receiving marketing emails and newsletters from us. How long we keep your personal data for We will keep your personal data for the duration of the competition. If you have opted-in to receiving marketing updates, your personal data will be held as described in the “Marketing & Newsletters section.” Who we share your personal data with With the relevant third-party who is running the competition with us. We may share your data with our IT service providers, including DotDigital or other sub-contractors who maintain our systems. We may announce the winner(s) of any competition or prize draw on our website, social media channels, third-party media outlets or other Edinburgh Airport advertising material.

Question 17

Recruitment

Accepted Answer

When you apply for a role through our careers website (Home - Careers at Edinburgh Airport) we will collect personal data from you in order to process your job application. For more information, please see our Job Application Privacy Notice.

Question 18

Taxi rank

Accepted Answer

This section applies to taxi companies who are authorised to use our taxi rank located at the East Terminus to pick up or drop off fares.  We collect and use your personal data when you use our taxi rank, including vehicle barrier systems and the SmartGo mobile app. What personal data is collected When you enter or exit the official taxi rank, the following information will be collected from you from our automatic number plate recognition cameras (ANPR): Your vehicle registration number. Time of entry into/exit from the taxi rank. If you register to use the SmartGo app to pay for use of the taxi rank, the following information may be collected from you: Full name Email address Payment details Billing address Vehicle registration number Transaction history We will also collect your payment details when you use our payment machines or pay at the barrier upon exit from the taxi rank. We do not store your payment card data. How we use your personal data We need to collect and use your data for the following purposes: Confirming that only authorised vehicles enter the taxi rank to prevent misuse. Providing access to and exit from our taxi rank. Charging the correct amount for using our taxi rank. Monitoring use of the taxi rank. To deal with and resolve any complaints, incidents or enquiries. Maintaining security at the taxi rank. Where we have to comply with a legal obligation.  Our legal basis for collecting and using your personal data Fulfilling our contractual obligations regarding the use of the taxi rank. It is in our legitimate interest to resolve any complaints, issues or for incident investigation. It is in our legitimate interest to monitor the use of our taxi rank to assess the efficiency of the operation and to make improvements where necessary. We may have to share your personal data to fulfil a legal obligation imposed on us. Who we share your personal data with We may share your data with the following parties: Police, other law enforcement agencies or security services for the purposes of their investigations. Our regulators to prove we are complying with our legal obligations to them. Where appropriate and proportionate, we may share your data with other trusted third parties, including legal professionals or insurers, for the purposes of their investigations. Our trusted sub-contractors, including Evopark and Planet Payment, for the purposes of managing our taxi rank, processing your payment, maintenance or resolving any issues. How long we keep your personal data for Any data associated with your SmartGo user account will be retained until you request that your account is deleted. We will retain ANPR data for 3 months from the time you exit the taxi rank.

Question 19

Who we share personal data with

Accepted Answer

Internally, Edinburgh Airport allows access to personal data to people who need access to it to carry out their role. Externally, we may share personal data with third parties for specific purposes, as specified in the sections above. We may also share personal data with the following third parties: Companies that manage our IT infrastructure or cloud based IT systems. External advisors, for example solicitors, accountants and insurers. Our regulators, law enforcement agencies, intelligence services and other government authorities for the purposes of their investigations. Potential buyers or investors in our business where necessary in connection with a due diligence exercise. Our trusted third party business partners for the purposes of their investigations. Where we share personal data with third party service providers, we will always ensure that the service provider is committed contractually to only use personal data in compliance with Edinburgh Airport’s instructions and data protection laws. There are more specific examples in the sections above.

Question 20

Sending personal data overseas

Accepted Answer

Edinburgh Airport generally stores and processes personal data inside the UK and the European Economic Area (EEA). In some circumstances we or our service providers may transfer personal data outside the European Economic Area.  Edinburgh Airport ensures that any personal data transferred outside the EEA are done so in compliance with data protection laws.

Question 21

Your rights and how to exercise them

Accepted Answer

he law gives you certain rights in respect of your personal data. The easiest method of exercising your rights is by completing our online contact form, available here. Alternative methods of contacting our DPO are listed in the Introduction section above. Please note that in order to protect your privacy and ensure we are disclosing personal data to the correct person, we may ask you to prove your identity before we take any steps in response to a request you have made. Here is a summary of your rights below: Opting out of marketing You have the right to opt-out of receiving marketing updates and information. The quickest way is to use the “unsubscribe” links in our emails or other communications. You can contact us directly if you wish. Your right of access You have the right to ask us for copies of the personal data that we hold about you. Please note, for national security purposes, we may not provide copies of any data that reveal our security processes. We may offer you alternatives to providing you with a copy. Your right to data rectification You have the right to ask us to rectify any incorrect personal data we hold about you. You also have the right to ask us to complete any information about you that you think is incomplete. This right does not extend to matters of opinion, such as decisions which our staff may make about your fitness to fly. Your right to erasure In some limited circumstances, you have the right to have personal data that we hold about you erased. This right is not generally available where we still have a valid legal reason to keep the data (for example, for security reasons or because we are obliged to do so by law). Your right to object to processing You have the right to object to our processing of your personal data where we rely on “legitimate interests” as our legal basis for processing, but we may be able to continue processing if our interest outweighs your objection. Your right to restriction of processing You also have the right to ask that temporary restrictions are placed on how we use your personal data. For example, if you have submitted a request to have inaccurate information about you rectified, you can ask that we temporarily restrict how that data is used until we have verified your request. Your right to data portability You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. Withdrawing consent If we are processing your personal data on the basis of your consent, you have the right to withdraw that consent at any time, in which case we will stop that processing unless we have another legal basis on which to continue. Automated decision making and profiling Edinburgh Airport doesn’t make a decision about you solely based on automated decision making or profiling. We do use online tests to assess the suitability of candidates applying for jobs within our Security team that, if failed, will result in your application being rejected. You can read more about this in our Job Application Privacy Notice.

Question 22

Your right to complain

Accepted Answer

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting our Data Protection Officer using the details in the ‘Introduction’ section.  You can also complain to the ICO if you are unhappy with how we have used your personal data. You can contact them on 0303 123 1113 or by visiting their website at Information Commissioner's Office (ICO).

Privacy notice

Privacy notice

Introduction

Quick links

Services and facilities

Corporate social responsibility

Special assistance

Reserve & Collect