Privacy statement EN
Royal Schiphol Group/Lelystad Airport Privacy Statement
With this Privacy Statement, Lelystad Airport wants to offer transparency on how Lelystad Airport treats your personal data and for what purposes these data are used.
This Privacy Statement does not apply to data processing by other organisations based at Lelystad Airport. Lelystad Airport has no access to this data processing by third parties or to the data involved, and is not the controller for it.
For what purposes does Lelystad Airport process your data?
Prior to processing, Lelystad Airport determines the purpose of the processing and the legal basis on the grounds of which we process the data.
The purposes for and bases on which Lelystad Airport processes personal data are:
1. To implement statutory regulations and tasks in the public interest
There are a number of legal obligations that require personal details to be processed to comply with that obligation.
The safety of all visitors and Lelystad Airport staff is paramount to us. Personal data that may be processed for that purpose include, for instance, camera images that are recorded in the terminal. The camera images are removed after 28 days, unless there are good reasons for storing the images for a longer period, for example for an investigation of an incident.
Security Lelystad Airport
In performing its task as the operator of the airport, Lelystad Airport processes personal data for airport security purposes, such as for access control purposes.
Lelystad Airport employees working in the area behind the security checkpoints, are granted access to that area only by a special Lelystad Airport ID, the Lelystad Airport Pass.
The processing of personal data is necessary for the registration and issuance of passes granting access to the protected and secured areas that are regulated by the access control system.
With respect to the Lelystad Airport Pass Lelystad Airport processes the following personal data: name and initials.
2. Supply of services to customers and passengers
After explicitly agreeing to the terms and conditions, visitors to Lelystad Airport may use the Wi-Fi network. In order to activate this service, Lelystad Airport processes the MAC address of the device. If you make use of the free Wi-Fi network, your data are immediately deleted after the session is ended.
Product and service improvement
Lelystad Airport processes your personal data in order to improve our services and to keep you informed about the services and products you purchase or may purchase from us, as explained in further detail in this Privacy Statement, unless you have objected to this use of your data.
3. Operation of Lelystad Airport online services such as its website and social media
General data on website visits, such as the most frequently requested pages, are tracked on Lelystad Airport's websites (www.lelystadairport.nl en www.uitbreidinglelystadairport.nl) without identifying visitors. The purpose is to be able to adapt the design of our website as much as possible to visitors' requirements. These data can also be used to place more targeted information on the site. This enables Lelystad Airport to further optimise the services we offer to you via the website.
If you sign up for our electronic newsletter, you thereby give us your consent to use your email address to send you the newsletter. If you have also given explicit consent for receiving other information such as offers and questionnaires, we will send those to you as well. You can always unsubscribe from this via the link at the bottom of the newsletter page of every newsletter.
The Lelystad Airport web server and the server of its web host iClicks, automatically collects IP addresses. Your IP address is a number with which computers on the network can identify your computer, so that data (such as internet pages) can be sent to your computer. We use IP addresses to manage the website and to ensure it is as relevant as possible.
Our social media channels (Facebook, Instagram and LinkedIn) provide the latest news, information, offers and useful facts about Lelystad Airport. These channels are an easy way to contact Lelystad Airport, participate in discussions, respond to posted content or take action in some other way. We are always happy to exchange ideas with you and receive your opinion on Lelystad Airport and its services. Engaging with customers like this allows us to continually improve our service. We request that you do not place privacy-sensitive information about yourself or others (e.g. email address, name, address, telephone number) on these channels, but that you share your information with us via a private message if necessary. Lelystad Airport will only use the data shared by you to answer your question and to improve its customer service (for instance, by means of anonymised Q&As that can be modified by input from customers). Lelystad Airport may remove publicly shared privacy-sensitive data.
4. Recruitment and selection
Lelystad Airport only uses applicants' personal data for recruitment and selection purposes. Unless required by law, Lelystad Airport will not provide these data to other persons or bodies outside Lelystad Airport without the applicant's prior consent. Applicants' data will be deleted no later than four weeks after the application procedure has ended, unless the personal data are retained, with the applicant's consent, for one year after the end of the application procedure with a view to possible future vacancies.
Data protection and storage
Lelystad Airport will exert to protect your personal data against loss and unauthorised use. All Lelystad Airport employees who have access to personal data as part of their work are required to maintain confidentiality. Your data will only be supplied to parties outside Lelystad Airport if this is necessary for the performance of the aforementioned purposes. Lelystad Airport has agreed in a data processing agreement with Lelystad Airport partners who are responsible for performing certain services or parts thereof that they will also do everything within their power to protect the personal data and that they will comply with the provisions of the GDPR.
If a data leak occurs despite the measures referred above, we will naturally handle it in accordance with the rules. If you yourself believe or suspect that there is a data leak, we ask you to report this as soon as possible by means of this web form.
Lelystad Airport will endeavour to ensure that processed personal data are accurate and precise. Moreover, Lelystad Airport will not process more personal data than necessary, and will store them for no longer than is necessary for the purposes for which they were collected. Lelystad Airport has defined/will define a suitable retention period for the various processing operations of personal data.
If your personal data have been collected by Lelystad Airport, you have the right to request access to or rectification or removal of these data. You may also request us to transfer the data to another party or request that these data be processed only to a limited extent. Furthermore, you may object to the processing of these data.
In specific situations, Lelystad Airport is not obliged to act on a request of a data subject, based on those rights, namely if imposing restrictions on the rights of the data subjects is necessary to safeguard, for instance: national or public security; the prevention, investigation, detection and prosecution of criminal offences or if this necessary to safeguard the rights or freedoms of others.
You may also request us to transfer the data to another party or request that these data be processed only to a limited extent.
In addition, you may also object to the processing of these data.
Below, you will find further explanation regarding the rights you have as a data subject:
Right of access
The data subject has the right to obtain from Lelystad Airport confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
e) the existence of the right to request rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;
f) the right to lodge a complaint with the Dutch Data Protection Authority;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including ‘profiling’, if applicable.
Right to rectification
The data subject has the right to obtain from Lelystad Airport without undue delay the rectification of inaccurate personal data concerning him or her or – taking into account the purposes of the processing – to have incomplete personal data completed.
Right to be forgotten
The data subject has the right to obtain the erasure of personal data concerning him or her and Lelystad Airport has the obligation to erase those personal data where, for instance, one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
c) the personal data have been unlawfully processed;
Right to restriction of processing
The data subject has the right to request restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) Lelystad Airport no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing (pursuant to Article 21 (1) of the GDPR) pending the verification whether the legitimate grounds of Lelystad Airport override those of the data subject.
Right to data portability
The data subject has the right, under certain circumstances and solely where technically feasible, to receive the personal data concerning him or her, which he or she has provided to Lelystad Airport, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller.
Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, including profiling based on those provisions.
Data Protection Officer
Royal Schiphol Group has appointed a Data Protection Officer (DPO), who verifies whether Lelystad Airport processes personal data in accordance with the GDPR.
If you have any questions about your data or the way in which we treat your privacy, or if you want to exercise the rights referred to above, you can fill in the web form below or send an email to the DPO via firstname.lastname@example.org. As soon as possible after receipt of your request, we will inform you about the handling of your request.
If you are dissatisfied with the way in which we treat your privacy and/or the rights referred to above, you can file a complaint with the Dutch Data Protection Authority via https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/privacyrechten/klacht-over-gebruik-persoonsgegevens?qa=klacht.
The recipients of your data
The following persons and/or institutions may receive your personal data:
a) anyone at Lelystad Airport who is responsible for carrying out or supervising tasks related to the processing of your personal data or anyone involved in this;
b) processors and subprocessors contracted by Lelystad Airport to perform certain tasks relating to the processing of your personal data;
c) government bodies, such as the police and judicial authorities, insofar as this is necessary to comply with statutory obligations.
Transfer of data to countries outside the EU
In certain cases, Lelystad Airport may transfer personal data to countries outside the EU, but ensures that this takes place in accordance with the relevant legal requirements, e.g. using EU model contract conditions.
Lelystad Airport reserves the right to revise its privacy statement from time to time. This may be the result of changed policy, changes in data processing or changes in the systems with which Lelystad Airport processes data. This is a continuous process. The most recent version of the Privacy Statement is always available on our website, and we advise you to check it regularly.
This version was drawn up on 24 May 2018 (amendments on 29-05-2018).
Royal Lelystad Airport Group
P.O. Box 2201
8203 AE Lelystad
8218 PC Lelystad