Data protection notice: business relationship

Cargolux International Airlines S.A. Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “We”) is committed to protecting the personal data of our customers, prospects, suppliers, consultants, business partners and more generally, of any data subject concerned by our processing activities (hereafter referred to as “You”).

Cargolux processes your personal data in the scope of our business relationship. This Data Protection Notice explains how we process your personal data, complying with the rules currently stated in the General Data Protection Regulation EU 2016/679 (hereafter referred to as the “GDPR”) on the protection of individuals with regards to the processing of personal data and on the free movement of such data.


Who is the controller of your personal data?

Cargolux is responsible for collecting and processing your personal data in relation to the business and commercial relationship.


What personal data will Cargolux process and why do we process it?

In the scope of the contractual and/or pre-contractual relationship with Cargolux, we may process various types of personal data about You:

  • Name, surname, and designation,
  • Job title and company or organization You are associated with,
  • Exercise of public and political offices as well as relevant links to political parties, governmental bodies or public entities,
  • Meeting records and communications between You and Cargolux,
  • Answers and supporting documentation You provide to us through the Cargolux vetting process, trainings, surveys and other forms and questionnaires,
  • Business contact details,
  • Your signatures in contracts and other relevant documentation,
  • Shipment information (booking history, details of transactions, purchase information, shipment description),
  • Other information You choose to share with us.

Except for when proved impossible or involving a disproportionate effort, prior to providing Cargolux with personal data of its current or former executives, directors, managers and employees; current or former subcontractors; contactable references; or any other natural persons, You shall ensure that any and all affected data subjects are informed of the Data Protection Notice, and that they have not objected to the processing of their Personal Data by Cargolux.

When providing Cargolux with special categories of Personal Data, You shall further ensure that the explicit consent of the data subjects have been obtained. Cargolux is entitled to request, at any time, evidence of the consent granted.

How do we collect your personal data?

We may collect the categories of personal data mentioned above by various channels:

  • We collect the personal data that You provide directly to us.
  • We receive your personal data from our partners or other companies involved in the management of our business relationship with You.
  • We retrieve information that may be accessible on administration databases that are publicly accessible.
  • We may also receive personal data that You have made public on social media networks.


What are the purposes and the legal basis for Cargolux's processing activities?

The information we request from You is considered as the minimum necessary data enabling Cargolux to pursue the purposes described below:

  • To provide You with our services, advice, or assistance and communicate with You for operational needs.
  • To enter into a business relationship with Your company and execute day-to-day activities,
  • To maintain up to date and accurate information in our Systems regarding You and Your company,
  • To provide You trainings and documentation related to trainings when needed,To process your Company customer’s application request.
  • To process sales quotations and cargo consignment bookings for the company You represent.
  • To respond to complaints, claims and requests.
  • To defend ourselves in the case of litigation and investigations.


The legal basis for the processing of your personal data is necessary for the performance a contract, based on the performance of the General Terms and Conditions of Carriage executed between Cargolux and the customer.


  • To conduct background checks to fulfill applicable domestic and foreign legal and regulatory requirements including Know Your Customer (KYC) and Know Your Supplier (KYS), as well as internationally recognized CSR and ethical principles.
  • To prevent conflicts of interest and confidentiality issues.
  • To ensure compliance with national and international laws and regulations.
  • To assess, accept or reject a shipment benchmarked against relevant legal, customs and regulatory requirements and our General Terms and Conditions of Carriage.


The legal basis for the processing of your personal data is necessary for compliance with an applicable legal obligation.


Who do we share your personal data with?

We may disclose your personal data:

  • to members of Cargolux on a need-to-know basis,
  • to third parties providing services to us, namely, website hosting, IT services and other similar services to enable them to provide their services,
  • to service providers which assist Cargolux in the scope of conducting background checks,
  • to representatives of Cargolux and service providers at relevant Stations involved in the acceptance, transit or delivery of your shipment,
  • to certain regulated professionals such as lawyers or auditors (if necessary to defend ourselves in the case of litigation and investigations),
  • to issue invoices and other financial documentation,
  • to other natural and legal persons, public and private, when communication is necessary or functional to carry out our activities,
  • to third parties outside the Cargolux group, if obliged by competent authorities as per the applicable laws.


How do we protect your personal data?

We have implemented technical and organizational security measures to protect your personal data from unauthorized access, improper use, alteration, unlawful or accidental destruction and loss.


Nevertheless, no data transmission or storage over the internet can be guaranteed to be 100% secured. If You feel that the security of any account You might have with us has been compromised, please immediately notify us of the problem by contacting us with the "Contacting Us" section below.


Where do we transfer your data to?

Your personal data are processed by us within the European Union.


In case of international transfers originating from the EU/EEA to a country outside the EU/EEA, the transfer of your personal data may occur where the European Commission has determined that the country outside the EU/EEA ensures an adequate level of data protection. For transfers to countries outside the EU/EEA for which the level of protection has not been recognized as adequate by the European Commission, Cargolux will implement appropriate safeguards provided for by current data protection law (e.g. the entry into standard data protection clauses) or rely on a derogation applicable to specific situations.


For how long do we keep your data?

Cargolux does not keep your personal data for any longer than is necessary. The duration of retention depends on the purposes for which data are processed as described below:

  • Personal data processed in connection with a business relationship is erased 10 years from the end of the business relationship, unless longer statutory retention periods or limitation periods apply.
  • Personal data processed of rejected business partners during a compliance verification will be erased 5 years from the conclusion of the due diligence process.
  • Personal data processed in the scope that is necessary to comply with a legal or regulatory obligation will be kept for as long as required by applicable laws and regulations.


After this retention period, the data will be erased from Cargolux’s system.


What are your rights?

In accordance with the applicable data protection laws (and subject to conditions and restrictions set forth therein), You may exercise at any time the following rights in relation to your personal data:

  • Right of access, which enables You to obtain from us confirmation of whether your personal data is being processed or not and, if so, obtain access to such data (considering we process a large quantity of information; when exercising your right of access You should specify the transaction, information or processing activities to which your request relates)
  • Right to rectification, which enables You to obtain from us the correction and/or integration of any of your personal data that are incorrect and/or incomplete;
  • Right to erasure, which enables You, in specific cases provided for by art. 17 GDPR, to obtain from us the erasure of your personal data;
  • Right to restriction of processing, which enables You, in the specific cases provided for by art. 18 of the GDPR, to restrict the processing of your personal data by us;
  • Right to object, which enables You to object to the processing of your personal data when certain conditions are met;
  • Right to data portability, which enables You, in certain cases (subject in particular to technical feasibility) and only with regard to the data You have provided to us, to request receipt of your personal data in a structured and commonly machine-readable format.


To exercise any of these rights, You may contact us by email or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg


You have the right to lodge a formal complaint with the relevant Data Protection Authority (in Luxembourg, Commission Nationale pour la Protection des Données “CNPD”).

This Data Protection Notice may be modified to reflect changes on the Website or on our processing activities, to comply with legal amendments, or to integrate best practices. Updates of the Data Protection Notice will be published on our Websites.