Data protection notice: video surveillance
Cargolux International Airlines S.A., Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “we”) is committed to the protection of your personal data in accordance with data protection legislation, especially the General Data Protection Regulation EU 2016/679 (the “GDPR”).
This Data Protection Notice is intended to inform Cargolux employees, visitors of its buildings, infrastructure and site (“You”) on the use of a video-surveillance system (the “video-surveillance system”), how long we keep data, what rights You have and how You can exercise them.
WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?
Cargolux is responsible, as a data controller, for collecting and processing your personal data under the video-surveillance system, determining the purposes and means of such processing.
WHAT PERSONAL DATA DO WE PROCESS?
We collect and use your image when You enter or circulate in buildings or locations covered by our video-surveillance system (the “premises”). Pictograms are displayed at the entrance of, and around the premises. The data we collect include the following categories of data:
- images caught on cameras installed in monitored premises indicated by pictograms (no sound is recorded),
- dates and hours of recordings.
WHY DO WE PROCESS YOUR PERSONAL DATA (PURPOSE AND LEGAL BASIS)?
We collect and use your personal data for the following purposes:
- to control access to and to ensure the security of the premises, the safety of Cargolux staff and visitors, as well as property, assets and information located or stored in the premises;
- to prevent, deter, and if necessary, investigate unauthorized access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information;
- to prevent, detect and investigate unauthorized or unacceptable behaviors, including potential criminal offences, such as theft of equipment or assets owned by Cargolux, its customers, visitors or staff or threats to the safety of persons present in the premises (in case of, e.g. fire, accident or physical assault).
The video-surveillance system is not used for purposes that are incompatible with those detailed above.
Where allowed by law, the video-surveillance system may be used as an investigative tool or to obtain evidence in internal investigations or disciplinary procedures, including in case of a security incident.
We collect your personal data to comply with a legal obligation, namely Reg. (EU) 952/2013 laying down the Union's Customs Code and the European Commission Implementing Regulation (EU) 2015/2447.
Where applied to Cargolux’s staff, video-surveillance systems comply with article L. 261-1 of the Luxembourg Labor Code.
WHO CAN ACCESS YOUR PERSONAL DATA?
In order to fulfil the aforementioned purposes, your personal data can only be accessed by a limited number of staff from the Corporate Security Department, and restricted to individuals on a need-to-know basis for operational and maintenance purposes, as well as Cargolux’s external security provider in limited cases.
We may communicate your personal data to:
- service providers/vendors (such as a contracted security company) that perform services on our behalf,
- the Police, law enforcement or other government and regulatory bodies or agencies, upon request and to the extent permitted by law.
WHERE DO WE TRANSFER YOUR PERSONAL DATA?
Your personal data are processed by us within the European Union and no transfer of your personal data occurs outside of the European Union/European Economic Area (EU/EEA).
SECURITY OF YOUR PERSONAL DATA
The processing of your personal data is carried out through IT, electronic and manual tools, with logics strictly related to the aforementioned purposes and, in any event, in compliance with the appropriate technical and organizational measures required by law to ensure a level of security that is adequate to the risk, in order to avoid unauthorized loss of or access to your data.
HOW LONG DO WE KEEP YOUR PERSONAL DATA?
We will retain your personal data for 21 days from their recording, except in the event of an incident, investigation or legal proceedings. At the end of that period your personal data will be deleted or destroyed.
WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?
In accordance with applicable data protection law (and subject to conditions and restrictions set forth therein), You may exercise at any time your right to access, which enables You to obtain from us confirmation on whether your personal data are being processed or not and, if so, obtain access to such data; we process a large quantity of information, and can thus request, in accordance with GDPR, that before the information is provided, You specify the transaction, information or processing activities to which your request relates.
In certain limited cases (in which case we will analyse whether the conditions for the exercise of such rights are fulfilled, in line with the GDPR), You may exercise the following rights in relation to your personal data:
- right to erasure: which enables You, in specific cases provided for by art. 17 GDPR, to obtain from us the erasure of your personal data;
- right to restriction of processing: which enables You, in the specific cases provided for by art. 18 of the GDPR, to restrict the processing of your personal data by us;
- right to object: which enables You to object to the processing of your personal data when certain conditions are met.
To exercise any of these rights, You may contact us by email dataprotection@cargolux.com or by postal mail:
Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg
Luxembourg
You have the right to lodge a formal complaint with the Commission nationale pour la protection des données.
CHANGES TO THIS DATA PROTECTION NOTICE FOR VIDEO-SURVEILLANCE
Changes may occur in the way we process personal data. In case these changes oblige us to update this Data Protection Notice for Video-surveillance, we will clearly communicate it to You, either via our website or via other appropriate means. The latest applicable version will always be available on our website.