Privacy notice

Introduction

We take your privacy seriously. This Privacy Notice sets out details about your privacy rights and how we gather, use and share your personal information – including the personal information we already hold about you now and any further personal information we might collect about you, either from you or from a third party. How we use your personal information will depend on the services which we provide to you.

Our Data Protection Officer (DPO) provides help and guidance to make sure we apply good practice standards to protecting your personal information. Our DPO can be reached by email at [email protected] if you have any questions about how we use your personal information.

This Privacy Notice provides up to date information about how we use your personal information and will update any previous information we have given you about using your personal information (also referred to as personal data). We may make updates to this Privacy Notice from time to time, and we recommend that you review the current version of this Privacy Notice whenever possible. If we make any material changes to the manner in which we process and use your personal information, we may contact you to let you know about the change.

This Privacy Notice was last updated on 2nd May, 2023.

About us

We are what is known as the ‘controller’ of the personal information which we gather and use. When we say ‘we’ or ‘us’ in this Privacy Notice, we mean Edinburgh Airport Limited. We are registered with the Information Commissioner’s Office, or ICO, under registration number Z206328X.

Your privacy rights

You have the right to object to how we use your personal information. You also have the right to see what personal information we hold about you. In addition, you can ask us to correct inaccuracies, delete or restrict personal information or to ask for some of your personal information to be provided to someone else. To make enquires or for further information about exercising any of your rights in this Privacy Notice, please contact our DPO at [email protected].

You are entitled to exercise any of the following privacy rights:

Right to object

You can object to our processing of your personal information. Please contact us as noted below, providing details of your objection.

Access to your personal information

You can request access to a copy of your personal information that we hold, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge by contacting us as noted below.

Right to withdraw consent

If you have given us your consent to use your personal information to send you marketing emails, you can withdraw your consent at any time by clicking the “unsubscribe” link in any marketing email which you receive or by contacting our DPO at [email protected]. 

Rectification

You can ask us to change or complete any inaccurate or incomplete personal information held about you.

Erasure

You can ask us to delete your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.

Portability

You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.

Restriction

You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.

Taking action

The easiest method of exercising your rights as set out above is to email our data protection officer on [email protected] or write to us at Edinburgh Airport Limited, Capital House, Edinburgh, EH12 9DN, United Kingdom, marked for the attention of the data protection officer.

Please note that in order to protect your privacy, we may ask you to prove your identity before we take any steps in response to a request you have made.

Whilst we would always ask that you contact us first, you also have the right to lodge a complaint about our handling of your personal data with the Information Commissioner’s Office.

You can contact them on 0303 123 1115, email them at [email protected] or write to them at The Information Commissioner’s Office – Scotland, 45 Melville Street, Edinburgh, EH3 7HL.

The types of personal information we use

We use a variety of personal information depending on the services and facilities we deliver or provide to you.

We are governed by regulations from the Civil Aviation Authority and Department for Transport. In order to comply with these regulations, we need to collect and process certain personal data relating to you and your flight. This includes personal data to allow us to validate your boarding pass when entering our Security Hall to go to the departure lounges and personal data to allow your bags to be processed and sorted in our Baggage Hall. We also operate a CCTV system throughout the airport and its surroundings for security and operational reasons.

The personal information we may collect and use includes information given when you sign up to receive free WiFi when you are at the airport, when you book car parking or purchase or request services from us, or if you make a complaint or enquiry about our services.

In delivering our services and providing our facilities, we may collect a variety of technical information, your name and contact details, car registration details and payment information.

When you are at the airport, we may collect and process the following information about you:

Surveillance Systems

There are surveillance cameras throughout the airport and surrounding areas that will record static or moving images of your time at the airport, audio and other data such as vehicle number plate data. We use both static and mobile devices, such as staff activated body worn video (BWV) cameras. More information about how we use Closed Circuit Television (CCTV) Cameras and BWV cameras is set out below.

Boarding Pass Validation

Under aviation regulations, passengers are required to have a valid boarding pass in order to transfer through our Security Hall to the departure lounges. We use technology to capture boarding pass personal data such as passenger name, seat and flight number.

Queue and Passenger Flow Measurement

We use technology which collects and processes technical information from Bluetooth and WiFi signals which may be emitted from your device when you are in the airport;

Hold Baggage Identification

In order to identify items of hold baggage to their owner and the relevant flight, we capture information on the bag tags that are attached to each item of hold baggage. This information includes passenger names and flight details.

WiFi

When you sign up to use our free WiFi services at the airport we will collect your title, full name, email address, date of birth, and country of residence.

Car Parking and Other Services

When you book car parking or purchase or request other services from the airport (such as purchasing fastTrack or lounge access or signing up for our newsletter), we will collect (depending on the service) your full name, email address, postcode, car registration number and flight information. The collection of mobile number is optional and we only use this to send SMS regarding booking details if you have specified you want them.

Shopping

 Where you decide to use the Shop and Collect services offered at the airport – allowing you to shop in World Duty Free and other participating stores in the departure lounge and collect your shopping on your return – we and our Shop and Collect service provider may collect your name, email address, postal address, returning flight number and information about your purchases.

Health & safety / incident records

If you are involved in an incident whilst at the airport, we may capture personal details, incident details and details of any injuries sustained.

Competitions

If you enter any of our competitions, we may collect your name and contact details; and

Complaint/Enquiry

If you make a complaint or enquiry about the airport, we will collect your name, email address, phone number, postal address, travel details and information about the nature of your complaint or enquiry.

How we gather your personal information

We only use personal information which we have obtained directly for the purposes described in this notice.

Your personal information is gathered in the following ways:

Wi-Fi

When you sign up to receive WiFi services, your information is collected on the login page.

Car Parking and other Services

When you book car parking or purchase or request other services from us your information is collected on the booking page.

 Our car parks also use Automated Number Plate Recognition (ANPR) systems.

Shop and Collect

When you use the Shop and Collect service, your information will be collected by a member of staff.

Health & safety/incident reports

If you are involved in a health & safety incident while at the airport, a member of staff may complete a form about the incident and may collect your information directly from you when completing this form.

Competitions

If you enter one of our competitions, your information is collected in the entry form.

Complaint/Enquiry

When you make a complaint or enquiry, your information may be collected by a member of staff or will otherwise be collected via the format you choose to make your complaint or enquiry (post, website, email or telephone).

We also may obtain some personal information about you when you are at the airport from our CCTV, Queue and Passenger flow technology and passenger processing systems.

CCTV

We are required by law to implement and maintain an extensive CCTV system throughout the airport, terminal, car parks and surrounding areas. This is primarily for reasons of public safety and for the prevention and detection of crime. Footage is handled in accordance with data protection laws, and in particular is only held for a limited period of time before it is automatically deleted. Please contact the DPO at [email protected] if you would like to know more about how our CCTV systems operate.

Use of Body Worn Video (BWV) Cameras

Edinburgh Airport security colleagues and our representatives may in limited circumstances use BWV cameras to record video and audio footage when they attend an incident. Our colleagues will inform you if you are being filmed unless the situation means we are unable to communicate this with you. While we do not rely on consent, the footage is handled by authorised colleagues in line with the rest of this privacy notice.

BWV cameras automatically record footage on a continuous loop for 30 seconds, which is continuously overwritten unless the device is manually switched on to save footage. The recording function will be manually turned off by the operator. BWV cameras will only be recording when the situation requires it, for example for investigation purposes. Video and audio recordings will be saved for 31 days unless it is needed for investigative or evidential purposes.

Queue and Passenger flow

Technology is used throughout the airport to collect and process Bluetooth and WiFi signals that may be emitted by your device.

Boarding Pass Validation

We capture your information when you scan your boarding pass at the entrance to our Security Hall.

Hold Baggage Identification

We capture your personal information when your hold bag is checked in and a bag tag is printed.

How we use your personal information

We will use your personal information for the following purposes:

1. To provide you with services which you have requested, ordered or purchased from us or a third party (such as car parking bookings), we will use (depending on the service): your name; title; email address; date of birth; residential address; nationality; postcode; telephone number; car registration; travel details (including flight information) and payment information. We collect this information for the purpose of processing and confirming your booking or providing the other services you have purchased or requested. Our car parks use Automated Number Plate Recognition (ANPR) systems to facilitate easy access and exit.
2. Our collection of a mobile number is optional and if given we only use this to send SMS messages regarding booking details if you have specified you want them, or to send “push notifications” to provide relevant service information.
3. To enable us to identify you and your purchases when you have used our Shop and Collect service, we will use the personal information you gave to our staff member when requesting this service.
4. To enable compliance with aviation regulations so that only passengers with a valid boarding pass can enter our Security Hall and make their way to the departure lounges, we will use your boarding pass personal information.
5. We use technical information from Bluetooth and WiFi signals to help us monitor passenger movements throughout the airport and in particular to monitor queue times and manage passenger flows.
6. Where it is appropriate for us to do so (including for security reasons, to respond to a complaint or query from you, or to let your airline know if you are in the departure lounge) we may use your personal information (such as boarding pass data and CCTV images) to locate where you are or were within the airport.
7. We will use your bag tag information to process your hold luggage to the correct flight and to securely identify the luggage to a passenger.
8. We will use your payment information to allow for you to make payment to us where required in advance of the provision of any services which you have ordered or purchased. We will share this information with third party payment processors where required for this purpose.
9. Where you have registered with us for access to our free WiFi service, we need to use your name and email address in order to provide you with this service.
10. Where you have entered a competition promoted by us, we will use your name and contact details to let you know if you have won a prize.
11. Where you have agreed to receive marketing emails from us, we need to use your name and email address. We may use your postcode and country of residence to ensure that the marketing emails you receive are relevant to your personal circumstances (for example, we often send marketing emails which are relevant only to passengers based in the UK). We use your date of birth to verify your age; this is required to ensure that we do not record personal information on our database of, or send any marketing emails to, any individual under the age of 18. We may pass your personal information on to our service providers who help us with these marketing activities.
12. To comply with our legal obligations (such as our obligations to maintain an extensive CCTV system for the prevention and detection of crime) we will use any information you have given us where it is necessary for us to use that information to comply with any such legal obligation.
13. In order to comply with health, safety or legal obligations and to ensure the proper operation of the airport we will use the personal and incident details captured as a result of any incident.
14. To address your complaints or enquiries, we will use the information you provided when submitting your complaint or enquiry to us.

Our legal basis for using your personal information

We only use your personal information where it is permitted by the laws which protect your privacy rights. We only use personal information where:

1. We have your consent (if consent is needed), for example your consent to send you marketing emails.
2. We need to use the information to comply with our legal and regulatory obligations (for example, recording footage of your time at the airport using our CCTV system).
3. We need to use the information to perform a contract with you (for example, where you have ordered services from us).
4. It is fair to use the personal information either for our legitimate interests or your legitimate interests, where there is no disadvantage to you. For example, we may use your data for appropriate operational reasons, to enable a third party to provide you with a service that you have ordered from us, to contact you about products or services, market to you, to collaborate with others to improve our services, or to use non-privacy invasive technologies to be able to better run our airport operations, including informing passengers about queue wait times.
5. We rely on your consent to use your personal information, you have the right to withdraw your consent at any time, please see below.
6. Special protection is given to certain kinds of personal information that is particularly sensitive. This is information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sex life or sexual orientation, genetic or biometric identifiers, trade union membership or criminal convictions or allegations. We will not collect or use any personal information of this kind under this Privacy Notice.

Sharing your personal information with others

1. We will share personal information with relevant third parties where:
2. You have given us your express consent to do so (see below for more information).
3. We need to do so for the purposes of making any services which you have ordered or purchased available to you.
4. It is necessary to allow us to meet or enforce a legal obligation (for example, we may need to share CCTV footage of you with the police or with the Department of Transport in certain circumstances) where it is fair and reasonable for us to do so in the circumstances.
5. We will only share your personal information with third parties to the extent needed for the purposes set out in the above section on our legal basis for using your personal information.
6. We will share your personal information with our partners for marketing purposes where you have given us permission to do so.
7.  We will never share your information with a third party for marketing purposes without your express consent. 
8. Who we share your personal information with depends on the services which you have purchased or ordered (for example, car parking booking and WiFi services).
9. We will also share your personal information with our sub-contractors (companies who supply services to us) where it is necessary to do so: 

IT Suppliers

Information may be stored and processed on systems provided and supported by our third party IT suppliers (such as our WiFi service provider, our provider of IT infrastructure services, the provider of our complaint management system and/or the provider of our health and safety management systems).

Payment processors

Information may be processed by payment companies for the purposes of processing any payment which you make to us.

In order to offer you Klarna’s payment methods, we may pass your personal contact and order details to Klarna, so Klarna can assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data is processed in line with Klarna’s own privacy notice.

Car park management

Information may be stored and processed by our car park operator Edinburgh Airport Services Limited (EASL) for the purposes of facilitating any booking which you have made for car parking.

Shop and Collect

Information is collected and used by our Shop and Collect service provider Omniserve.

Marketing

We use third party software applications to help us issue marketing communications. Some marketing activities may be outsourced to third party organisations who assist us with our campaigns or communications. Where you consent to receive marketing your information may be shared with them for this purpose.

Persons of Restricted mobility (PRM)

Information is collected and used by our PRM service provider Av-Tech.

Customer feedback and enquiries 

Your feedback and enquiries are collected and processed on our behalf by Zendesk.

Transfers outside the UK

We may need to transfer your information outside the UK to service providers, agents, subcontractors and regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the UK or European Economic Area (EEA), such as the USA  We may need to transfer your personal information to territories that are outside the UK and EEA. We will only transfer your personal information where either:

1. The transfer is to a country which the UK has decided ensures an adequate level of protection for your personal information, or

2. We have put in place our own measures to ensure adequate security as required by UK data protection law. These measures include ensuring that your personal information is kept safe by carrying out strict security checks on our overseas partners and suppliers, backed by strong contractual undertakings approved by the relevant regulators such as the EU style model clauses.

How long do we keep your personal data for?

We will never retain your personal information for any longer than is necessary for the purposes we need to use it for. Where you have ordered or requested a service (such as car parking) from us or a third party, we will retain your personal information for 24 months from the date you last used the service, unless you used an airport user account to book, in which case we will keep it until you request that your account is deleted.

Where you have ordered or requested a service (such as car parking or taxi services) from us or a third party, we will retain your personal information for 24 months from the date you last used the service, unless you used an airport user account to book, in which case we will keep it until you request that your account is deleted.

Where you have used our Shop and Collect service your personal information will be retained for one month after you collect your goods.

We retain hold baggage information for up to 3 days within our databases.

We retain boarding pass information from our E-gates at the entrance to our Security Hall for up to 31 days.

Where you have made a complaint or enquiry, we may hold your information for up to three years after your complaint or enquiry has been resolved. We retain the personal information submitted when you make a noise complaint or query through our online Noise Lab tool for up to six years.

We retain information relating to health & safety and other incident reports for up to 5 years.

We may hold your personal information for longer where it is necessary to do so for the management of any active or potential legal proceedings, to resolve or defend claims, and for the purpose of making any necessary remediation payments.

We retain most CCTV and BWV camera footage for up to 31 days before it is securely destroyed. We may retain ANPR images for up to 3 months. Where we have saved particular footage related to an incident, legitimate request or claim we retain that footage for as long as is necessary to fulfil the purposes for which it has been retained.

We retain information obtained from queue and flow management technologies for 24 hours before it is deleted.

Keeping up to date

Where you have given us consent to receive marketing, we may use the contact details which you have provided to us to communicate relevant news and information about our services to you by email, post, text message, social media, and notifications on our app or website.

You can withdraw consent at any time by clicking the “unsubscribe” link in any marketing email which you receive or emailing us at [email protected].

Cookies and your online activities

We use cookies to track your use of our websites http://www.edinburghairport.com and http://www.planeparking.co.uk and to provide tailored marketing messages when you visit our websites.

When you first visit one of our websites a ‘cookies banner’ will appear directing you to this Notice and if you continue to browse without disabling our cookies you are consenting to our use of cookies as described here.

Please click here for further information about the cookies which we use and how details on how to disable them.

What are cookies?

A cookie is a small file which is sent to your browser and stored on your computer’s hard disc. Cookies help us understand and track your use of our websites and where we can improve the information and services provided.

What cookies do we use?

We use the following categories of cookies on our websites:

1. Strictly necessary: These cookies are essential for certain features of our websites to work (for example, when you make payments for car parking). These cookies do not record identifiable personal information and we do not need your consent to place these cookies on your device. Without these cookies some services you have asked for cannot be provided.
2. Performance: These cookies are used to collect anonymous information about how you use our websites. This information is used to help us improve our websites and understand how effective our adverts are. In some cases we use trusted third parties to collect this information for us but they only use the information for the purposes explained.
3. Functionality: These cookies are used to provide services or remember settings to enhance your visit for example text size or other preferences. The information these cookies collect is anonymous and does not enable us to track your browsing activity on other websites.
4. Relevant Advertising: These cookies are used by trusted third parties to deliver adverts more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. Information contained in these cookies is anonymous and doesn’t contain your personal information. To find out more about cookies used for targeting and advertising follow www.youronlinechoices.com and www.networkadvertising.org or contact us for further information about the trusted third parties we use.
5. Your activities: These cookies are used by us to store information such as what products you view on our website and which products you add to your basket. We sometimes use these to send you relevant emails regarding these products. This information will only be stored if you have opted in to receive marketing communications by email – if you have not opted in, no data will be stored.

Managing our cookies

If you would prefer to restrict, block or delete cookies from EAL and our third party advertisers, or any other website, you can use your browser to do this. Each browser is different, so check the “Help” menu of your particular browser to learn how to change your cookie preferences. If you choose to disable all cookies we cannot guarantee the performance of our websites and some features may not work as expected.