Privacy Policy

CAMBRIDGE HELICOPTERS LTD T/A AEROMEGA HELICOPTERS

Privacy Policy

 

Cambridge Helicopters Ltd t/a Aeromega Helicopters (“Aeromega”) has drawn up a Privacy Policy as required under the GDPR (General Data Protection Regulations) which become effective on 25th May 2018,

Data Impact Assessment

Aeromega is not obliged to carry out a Data Impact Assessment as we do not intend to:-

use New Technologies, or

process data that presents a high risk to personal rights and freedoms.

 

Reasons to Hold Personal Data

The six reasons for holding data are:

  1. Where consent of the individual has been obtained
  2. Holding data is necessary for the performance of a contract
  3. Compliance with a legal obligation
  4. Processing to protect the interests of a data subject or another person
  5. In the public interest
  6. Necessary for the purposes of legitimate interests pursued by the controller or a third party.

 

Aeromega will only hold and process data where it can be justified under a) b) or c) above.

 

Special Category Data

Aeromega does not, and has no reason to, process “Special Category” or Sensitive Data as described in the regulations. As a result, Aeromega is not required to appoint a Data Protection Officer.

 

Data Sharing

Aeromega will not share any personal data with third parties for marketing or promotional purposes.

 

Electronic Data Storage

Aeromega will store computerised personal data only in files or software package applications that are password protected and where access is limited to staff only. This includes:-

  • Excel Spreadsheets
  • Sage Accounting Software
  • Google Calendars

 

Parties for whom data may be held or processed

We may process data on the following categories of individuals:

Directors                                                          (Legal Obligation)

Permanent Staff Employees                        (Performance of a Contract)

Freelance Staff & Examiners                       (Performance of a Contract)

Student and Qualified Pilots                       (Legal Obligation)

One off Experience Participants                 (Legal Obligation & Performance)

Aircraft Owners                                           (Legal Obligation & Performance)

Passengers                                                   (Legal Obligation)

Suppliers                                                        Private individuals only

Charter Customer Enquiries                        (Performance of a Contract)

 

Specific Category Policies:

Directors                                           (Legal Obligation)

Consent of directors is not considered necessary as data is held for the Legal Obligation of reporting to Companies House, CAA and other such regulatory bodies.

 

Permanent Staff Employees       (Performance of a Contract & Legal Obligation)

Permanent staff are employed and data is processed as required under our obligations as Employer their contracts of employment. Personal data held will include contact detail, bank account & pension details, next of kin details. Salary, Pension and Payroll information shall only be shared paid with a payroll administrator company, the HM Customs and Inland Revenue as required by Law or the Employment Contract. However, a general personal details form shall be submitted by each such person which shall include a statement of consent to hold the data and will be reviewed annually,

 

Freelance Staff & Examiners                      (Performance of a Contract)

Freelance staff submitting invoices in respect or work carried out for the company shall provide the company with bank account details for payment under contracts performed. Such data will be held securely to facilitate the payment of such invoices. However, a general personal details form shall be submitted by each such person which shall include a statement of consent to hold the data and will be reviewed annually.

 

 

Student and Qualified Pilot Customers                  (Legal Obligation)

A general personal details form shall be submitted by each such person which shall include a statement of consent to hold the data and will be reviewed every three years. As an Authorised Training Organisation paper student records are required to be held by us for a period of three years after the last flight with an individual, after which they shall be destroyed.

 

One off Experience Participants          (Legal Obligation & Performance of a Contract)

A general personal details form shall be completed by each such person which shall include a statement of consent to hold the data for a period of one year after which it shall be deleted unless that persons falls under a different category.

 

Aircraft Owners                      (Legal Obligation & Performance of a Contract)

Specific consent of aircraft owners is not considered necessary as data is held and processed to comply with our Legal Obligations as an Authorised Training Organization and may only be shared with EASA and CAA and the aircraft insurers.

 

Passengers                                                      (Legal Obligation)

A general personal details form shall be completed by each such passenger which shall include a statement of consent to hold the data for a period of one year after which it shall be deleted unless that persons falls under a different category.

 

Suppliers (Private individuals only)

Aeromega does not consider specific consent as necessary since data will only be held or processed for individuals in connection with the performance of a contract or in the anticipation thereof.

 

Charter Customer Enquiries        (Performance of a Contract or in anticipation thereof)

Data collected from such persons is collected on behalf of Heliair Ltd, our charter partner and therefore shared with that company. The data is input directly into the Heliair Ltd system and the contract is formed between the Customer and Heliair direct. Aeromega does not consider that specific consent is necessary since, the data is required in anticipation of the performance of a contract – albeit with a third party. (Verbal consent to share the data should be sought on taking the enquiry and the appropriate box ticked on the charter enquiry form.

 

Your Rights

Your data will not be shared with any third party without your consent being obtained.

Your data will not be shared outside the EU for any reason.

Your data will be held by us whilst you are an active customer of Aeromega. If you have not flown with us within the last three years, your data will be deleted unless there is a legal obligation or a contractual reason for us to retain it for a longer period of time e.g. you hold funds on account with us.

You have the following rights:-

  • To withdraw your consent to your data being processed for marketing purposes (although we do not intend to use your data for this purpose);
  • To the rectification of any errors in the data held;
  • To data portability;
  • To complain to the ICO in the event that we are unable to reach a satisfactory settlement of any dispute;
  • To erasure of data held or processed;
  • To the right to be informed on request of data being held or processed;
  • the right to object to any data which is held or processed.

 

Subject Access Requests

Subject Access Requests must be addressed to the Managing Director (“MD”) who will ensure that requests are dealt with in a timely and accurate manner: A response to a request will be sent out within 3 full working days from receipt.

 

Actions in the Event of a Data Breach

If any employee suspects a breach has taken place, they must verbally inform the MD immediately and confirm by email as soon as possible thereafter. The Managing Director (MD) is responsible for reporting said breach to the ICO. The Managing Director/ Head of Training, Cambridge Helicopters Ltd t/a Aeromega Helicopters will also be responsible for informing all subjects of the data potentially involved in the breach and taking immediate steps to rectify the breach and preventing recurrence.

 

25th May 2018