Data protection notice: access control

Cargolux International Airlines S.A. Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “We”) is committed to protecting the personal data of visitors of Cargolux premises, or any data subject concerned by our processing activities (hereafter referred to as “You”).

The physical access control process grants or denies access at all entrances and exits from Cargolux premises. This Data Protection Notice explains how we process your personal data, complying with the rules currently stated in the General Data Protection Regulation EU 2016/679 (hereafter referred to as the “GDPR”) on the protection of individuals with regards to the processing of personal data and on the free movement of such data.


Who is the controller of your personal data?

Cargolux is responsible, as a data controller, for collecting and processing your personal data under in the scope of the Access Control process to have access to Cargolux premises.


What personal data will Cargolux process and why do we process it?

We collect data when You enter Cargolux premises, including the following categories of data:

For visitors of Cargolux premises:

  • Name and surname
  • Personal identification documents (ID/Passport)
  • License plate number
  • Picture (for Contractor badge only)
  • Date and time of visit


For visitors of Cargolux premises subjected to LuxAirport access control:

  • Name and surname of visitor and escort
  • Personal identification documents (ID/Passport) of visitor and escort
  • Badge number of escort
  • Date and time of visit


What are the purposes and the legal basis for Cargolux's processing activities?

We collect and use your personal data for the following purposes:

  • To ensure the security of the premises, to control and record access to/from the premises, including at entrance gates.
  • To prepare escorted access with relevant authorities for visits of Cargolux premises on airside.
  • To record and report security incidents in and around the premises, and if necessary, investigate such incident.
  • To provide temporary access badges for visitors and contractors.

The legal basis for the processing of your personal data is necessary for compliance with an applicable legal obligation, pursuant to relevant legislation on aviation security.


Who do we share your personal data with?

We may communicate your personal data to:

  • Internal employees on a need-to-know basis.
  • Service providers that perform corporate security services for Cargolux.
  • The Police, law enforcement or other government and regulatory bodies or agencies, upon request and to the extent permitted by law.


How do we protect your personal data?

We have implemented technical and organizational security measures to protect your personal data from unauthorized access, improper use, alteration, unlawful or accidental destruction and loss.

The processing of your personal data is carried out through IT, electronic and manual tools, with logics strictly related to the purposes in compliance with the appropriate technical and organizational measures required by law to ensure a level of security that is adequate to the risk, in order to avoid unauthorized loss of or access to your data.


Where do we transfer your data to?

Your personal data are processed by us within the European Union and no transfer of your personal data occurs outside of the European Union/European Economic Area (EU/EEA).


For how long do we keep your data?

We will retain your personal data for 90 days, except in the event of an incident, investigation or legal proceedings.

At the end of that period your personal data will be deleted or destroyed.


What are your rights?

In accordance with the applicable data protection laws (and subject to conditions and restrictions set forth therein), You may exercise at any time the following rights in relation to your personal data:

  • Right of access, which enables You to obtain from Cargolux confirmation of whether your personal data is being processed or not and, if so, obtain access to such data (considering we process a large quantity of information; when exercising your right of access You should specify the transaction, information or processing activities to which your request relates)
  • Right to rectification, which enables You to obtain from Cargolux the correction and/or integration of any of your personal data that are incorrect and/or incomplete;
  • Right to erasure, which enables You, in specific cases provided for by art. 17 GDPR, to obtain from Cargolux the erasure of your personal data;
  • Right to restriction of processing, which enables You, in the specific cases provided for by art. 18 of the GDPR, to restrict the processing of your personal data by Cargolux;
  • Right to object, which enables You to object to the processing of your personal data when certain conditions are met;
  • Right to data portability, which enables You, in certain cases (subject in particular to technical feasibility) and only with regard to the data You have provided to Cargolux, to request receipt of your personal data in a structured and commonly machine-readable format.


To exercise any of these rights, You may contact us by email or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg


You have the right to lodge a formal complaint with the relevant Data Protection Authority (in Luxembourg, Commission Nationale pour la Protection des Données “CNPD”).

This Data Protection Notice may be modified to reflect changes on the Websites or on Cargolux processing activities, to comply with legal amendments, or to integrate best practices. Updates of the Data Protection Notice will be published on Websites once available.