User Privacy Notice
This User Privacy Notice describes how CCL Aviation, collect, use and look after the personal data of users of our portal (CCL Connect). It also tells you about your rights and how the law protects you.
CCL Connect is not intended for children and we do not knowingly collect data relating to children.
This User Privacy Notice supplements the other notices or terms on CCL Connect and our website and is not intended to override them. It is important that you read this User Privacy Notice, together with any terms and conditions we may provide on specific occasions.
This User Privacy Notice does not form part of any contract with you.
CCL Aviation is made up of different legal entities, Cambridge Communications Limited, CCL Aviation (UK) Limited (United Kingdom), CCL Aviation PTE. LTD (Singapore), CCL Aviation Limited (NZ) and CCL Aviation, Inc. (USA). This privacy notice is issued on behalf of CCL Aviation Group so when we mention CCL Aviation, we, us or our in this privacy notice, we are referring to the relevant company in the CCL Aviation Group responsible for processing your data.
As part of providing our services via CCL Connect, we, on behalf of our group of companies and Korean Air and Boeing (our customers) collect, use and hold certain personal information about you for the purposes of contractor management. This may include personal information about current and past contractors or employees of our customers, suppliers and other third parties.
In providing our services via CCL Connect, we will act as both a controller and, in some instances, as a processor in respect of your personal information. In the cases where we are not the controller, the controller will be the relevant customer.
To assist you further in understanding this User Privacy Notice, set out in the Schedule is a glossary of terms used in this User Privacy Notice, examples of types of personal data we collect, how we use it, the lawful basis for processing such data and further details of your rights.
We have appointed a data privacy manager (DPM). If you have any questions about this User Privacy Notice, including any requests to exercise your legal rights, please contact our DPM in writing, either: by email to privacy@cclaviation.com; or by post to Bridgewater House, Caspian Road, Altrincham, Cheshire WA14 5HH.
You have the right to make a complaint at any time to the ICO (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact our DPM in the first instance.
We may change this User Privacy Notice at any time by updating this page. Please check CCL Connect from time to time to ensure you are aware of any changes.
This User Privacy Notice was last updated on 1 June 2018.
Your duty to inform us of changes: it is important that the data we hold about you is accurate and current. Please keep us informed if your personal data changes during your time as a user of CCL Connect by updating your information in the user portal or by emailing us at privacy@cclaviation.com.
Third party links
CCL Connect includes links to third-party websites, plug-ins and applications. By clicking on these links or enabling connections you may be allowing third parties to collect or share your personal data. We have no control over these third-party websites, plug-ins or applications and are not responsible for their privacy notices, therefore you should also read their privacy notices to understand what personal data they collect about you and how they use it.
We collect, use, store and transfer the types of data set out below.
In relation to all users:
|
contact data |
email addresses, telephone numbers, addresses |
|
identity data |
first name, middle name, last name, former name(s), username or similar identifier, title, marital status, |
|
profile data |
username and password |
|
technical data |
user’s internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used to access our website |
In relation to contractors, in addition to the types of data set out above, we also collect, use, store and transfer the following types of data:
|
identity data |
salutation, first name, middle name, last name, contractor number, BEMSID or airline pilot ID, US SSN (US Boeing instructors only), primary aircraft type, rank, airline, photograph, passport information, pilot’s licence, HMRC information (including National Insurance number and unique taxpayer reference) (as applicable), date of birth, gender |
|
special data |
health data including details of medical conditions |
|
application data |
curriculum vitae, employment history, qualifications, information you provide during an interview, screening test results, references, disciplinary and regulatory investigation history |
|
emergency contact details |
emergency contact details: first name, last name, relationship, telephone number and any special notes |
|
criminal convictions data |
the certificate and/or record of any criminal convictions we receive following a basic DBS check being carried out on your behalf, information received from the police authority within your country of residence and where you have resided in such country for less than 7 years, the police authority within your previous country of residence. |
|
accident data |
any information we receive as part of our screening process from a relevant aviation authority relating to your aviation accident record |
By providing us with another person’s personal data, you are confirming that you have advised them that you will be supplying their information to us and that they have consented to us processing their personal data.
Failure to provide personal data: if we are required by law, or under the terms of a contract we have with you, to collect certain personal data necessary for us to provide you with the services available via CCL Connect, and you fail to provide it, we may not be able to allow you to continue to access CCL Connect or benefit from the services provided via CCL Connect. We will notify you of this at the relevant time.
We collect personal data:
Further details can be found here in our Website Privacy Notice
We only use your personal data when the law allows us to. We will use your personal data for the purposes set out below.
All users
|
Purpose/Activity |
Type of data |
Lawful basis for processing |
|
to administer and protect our business and CCL Connect (including troubleshooting, testing, system maintenance, support reporting and testing) |
|
as necessary for our legitimate interests in running our business and providing and maintaining CCL Connect |
|
to register you as a new user |
|
to provide CCL Connect services to you as a user |
|
to manage or relationship with you |
|
to provide CCL Connect services to you as a user as necessary for our legitimate interests in maintaining business records |
|
to keep records of contractor engagements |
|
as necessary for our legitimate interests in maintaining business records to comply with a legal obligation |
|
to comply with applicable laws and regulations |
|
to comply with a legal obligation |
Contractors
In relation to contractors, in addition to the purposes set out above, we will also use your personal data for the purposes set out below.
|
Purpose/Activity |
Type of data |
Lawful basis for processing |
|
to assess your suitability and/or continued suitability for the work |
|
to provide CCL Connect services to you as necessary to take steps at your request, so you can to enter into a contract with our customer; as necessary for our, and our customer’s legitimate interests in offering/utilising your services as a contractor (as applicable) |
|
to undertake checks with third parties, including background check agencies and referees |
|
with your consent as necessary for our legitimate interests in providing services to our customers and our customer’s legitimate interest in offering/utilising your services as a contractor (as applicable) to comply with a legal obligation |
Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your information.
How we use particularly sensitive personal information
We will use your particularly sensitive personal information to assess your continued suitability for the work - for example, whether you have a medical condition that would prohibit you from flying.
Information about criminal convictions
We will process information about criminal convictions as part of recruitment process and our on-going provision of services to you and our customers, including monitoring of contractors suitably for positions they are applying for.
In order to provide our services, we are required to carry out background checks (on contractors) during the application process which include us requesting and applying for (on your behalf), a basic DBS check to establish whether you have any criminal convictions (including those classified by the Department for Transport as disqualifying convictions) which would prevent you from applying for a particular role or restrict our customers from appointing you to a particular position. As part of our ongoing service provision, our customers may require us to request further DBS checks and checks with police authorities be carried out in respect of contractors using our services as part of their application process or if the particular contractor has not provided services to that customer for a period of time. In such circumstances we will obtain your consent and request the relevant DBS check or enquires to be made with the relevant police authority be undertaken on your behalf. We will only receive the results of such checks. You will be able to access and download your certificate directly from the DBS, simply follow the instructions you receive from the DBS. We retain information in accordance with section 8and section 7sets what safeguards we implement in respect of such records.
Change of purpose: we will only use your personal data for the purpose that we originally collected it for, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to use your personal data in this manner.
We may process your personal data (without your knowledge or consent) where this is required or permitted by law.
We may share the personal data we have about you with the following parties for the purposes set out in the table in paragraph 4above:
We will also share personal data that we hold about contractors with our customer users who access and use CCL Connect to assess contractors suitability for a vacancy. Customer users are required to comply with our website terms of use and the obligations of confidentiality we have in place as part of our contract with our customers.
Our customers may require contractors to provide further personal data to them and where contractors do so, the relevant customer will be the controller of such personal data and be responsible for safeguarding the personal data.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes. They can only process your personal data for specified purposes and in accordance with our instructions.
We share your personal data within the CCL Aviation group companies. This will involve transferring your data outside the European Economic Area (EEA). We ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data. Our servers which host CCL Connect are located within the EEA but CCL Connect can be accessed by our group companies and customers who are located inside and outside the EEA.
Many of our external third parties are based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA. Whilst we will take all steps reasonably necessary to ensure that your personal information is treated securely, we do not guarantee that the countries your personal data may need to be transferred to, treat personal data with the same level of protection as is required by companies operating within the EEA. You should also note that if you do not wish for your personal data to be transferred to a third country or third party then we will not be able to provide you with the services offered by CCL Connect.
Once your personal data is transferred to customers, we cannot guarantee they will treat your personal data with the same level of protection as required of companies operating within the EEA. However, our customers may have their own privacy policies in place, which may be useful to help you understand what personal data they collect about you and how they use it. If you do not want your personal data to be so transferred, please do not click the submit button.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those directors, employees, agents, contractors and other third parties who have a business need to know such information and they can only process your personal data on our instructions and will be subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will retain your personal data for as long as you are a registered user of CCL Connect and for as long as we deem reasonably necessary after that to satisfy any legal, accounting, or reporting requirements, following which we will securely destroy your personal information.
In determining the appropriate retention period for your personal data, we consider the amount, nature and sensitivity of the personal data, the potential harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We may also anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes. We can use anonymised information indefinitely without further notice to you.
You have certain rights in certain circumstances under data protection law. In summary, you have the right to:
You will not have to pay a fee to exercise any of your rights. However, if your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee for this information or refuse to comply with your request.
We may request specific information from you to help us confirm your identity when you contact us and ensure. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Schedule 1 Glossary
|
airline user |
a user accessing and using CCL Connect on behalf of an airline |
|
aggregated data |
information such as statistical or demographic data which may be derived from personal data but which cannot by itself identify a data subject |
|
contractor |
a user who has been successful in their application to access CCL for the purpose of applying for pilot or instructor vacancies |
|
controller |
a body that determines the purposes and means of processing personal data |
|
data subject |
an individual living person identified by personal data (this will generally be you) |
|
personal data |
information identifying a data subject from that data alone or with other data we may hold but it does not include anonymised or aggregated data |
|
processor |
a body that is responsible for processing personal data on behalf of a controller |
|
special categories of personal data |
information about race, ethnicity political opinions, religious or philosophical beliefs, trade union membership, health, genetic, biometric data, sex life, sexual orientation |
|
user |
any individual authorised to access and use CCL Connect |