PRIVACY POLICY

This policy is designed to inform all users of Aena facilities and users of our corporate website.

What is the purpose of this document?

The purpose of this document is to notify you that your personal details are processed in accordance with Personal Data Protection laws, in particular, those of Regulation (EU) 679/2016 of the European Parliament and Council of 27 April 2016, relating to the protection of individuals with regards to the processing of personal data and free circulation of those data (General Data Protection Regulation (GDPR)).

Who is the Data Controller?

The data controller will be:

Aena SME, S.A. (AENA)
Address: Peonías, 12. 28042 Madrid.
C.I.F (Tax ID. number): A86212420
Companies Register of Madrid, Volume 28806, Folio 211, Section 8, Page M-518648.

In the event that you enjoy services provided at the Murcia Region International Airport, the data controller will be:

Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, S.A. (AIRM)
Address: Avenida de España, 101, Valladolises y Lo Jurado, 30154 Murcia.
C.I.F (Tax ID. number): A73988313
Companies Register of Murcia, Volume 3.294, Folio 63, Sheet M-U93208.
 

How does this Policy affect me if I am a user of the airport facilities?

We inform all users of our airport facilities of the following:

What types of data will be processed?

The following types of data are processed:

  • Identification and contact data, such as image, voice, recordings, etc.
  • Data relating to personal and health characteristics (e.g. PMR).
  • Curricular and selection data, along with academic and professional data.
  • Data on personal circumstances, loyalty cards with companies, data on complaints or claims.
  • Financial data, relating to payment methods.
  • Data on your flight.

Why do we process your personal data?

The personal data that you provide to us or that will be provided at the time you start your relationship with us and those that may be collected or generated throughout that relationship, will be processed for the purposes indicated in each fact sheet, personal data collection form or by any other means that is made available to you at the airport itself, and are summarised below:

  • Video surveillance for security purposes and car park management, based on public interest.
  • If you are an authority, your data will be processed to provide assistance and services to authorities: managing visits, managing authority lounges, recording and maintaining institutional contacts, based on compliance with a legal obligation.
  • Managing services provided to users: access and check-in services, VIP Services users (lounges and Fast Line VIP service), Aena Club Client users, Publication Sales users, WIFI services, based on the execution of a contract.
  • Sending commercial communications, where appropriate, based on your consent.
  • Managing airport users: visits, instructions, based on the execution of a contract.
  • Managing the service for Persons with Reduced Mobility (PRM), based on the execution of a contract.
  • Where appropriate, recordings of your telephone calls to certain telephones (operational, incident investigation, emergencies), based on your consent, contract performance, vital interest, public interest, exercise of claims, as appropriate.
  • Managing the Car Park service: entry and exit control (cards), subscriber control (where appropriate) and invoicing the service, based on the execution of a contract.
  • Controlling and managing passengers passing through security checkpoints to the boarding area and Fast Line VIP service (where appropriate), based on the fulfilment of a legal obligation.
  • Managing and controlling medical care (if attended by the airport medical service), based on your consent, vital interest, as appropriate.
  • Managing, controlling and processing claims, complaints and denunciations submitted to Aena SME, S.A. or Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, S.A. (if applicable), based on your consent, legal obligation, as appropriate.
  • Legal defence and legal advice: in cases in which it is part of a legal file of Aena SME, S.A. or Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, S.A., based on compliance with a legal obligation.
  • For cases in which you are presenting a complaint through the complaints channel, your data will be processed based on your consent and legal obligations in order to process and investigate the claim.
  • Managing, controlling and processing data protection rights (where applicable), based on compliance with a legal obligation, consent, as appropriate.
  • Managing property that is lost and stored, and the transfer thereof, based on your consent, legal obligation, as appropriate.
  • Statistical purposes, based on legitimate interest or compliance with a legal obligation, as appropriate.
  • Record of entry/exit of documentation and archiving thereof (in case of presenting or being part of the documentation), based on compliance with a legal obligation, public interest, archiving purposes in public interest, as appropriate.
  • In the event that you are requesting authorisation to carry out air activities, with remotely-piloted aircraft (drones or RPAS) or any other air activity, we will process your personal data based on legal obligations (aviation safety regulations) in order to process the authorisation with the relevant bodies.

If there is a specific Privacy Policy for any service, the provisions thereof will apply.

How does this Policy affect me if I am a user of the website?

We inform all users of our website of the following means of processing:

  • As regards the Contact methods provided via our website, the purpose is to provide a response to your requests for contact, services, information, queries, suggestions or complaints of any nature that we may receive by making use of the contact methods provided, based on legitimate interest, legal obligation, performance of contract and/or consent, as appropriate in each case.
  • With respect to the Aena Employment section, the purpose is to manage your job applications and the information you provide us through our website, related to the selection processes being carried out within the Aena Group, as well as to keep you informed, through Aena SME, S.A., of future calls for permanent positions in these companies of the group, all based on your consent, legal obligation or public interest, as appropriate in each case.
  • As regards our Customer Club, the purpose is to inform you of possible benefits to you as a member of the Club, as well as providing you with detailed and updated information regarding discounts, promotions, offers and benefits of the services provided by Aena regarding VIP Products, Parking, Flights, and other Aena airport management services. In accordance with the general Terms and Conditions which regulate the Aena Customer Club service, sending communications with information regarding these discounts, promotions, offers, news and benefits of the Aena services is a necessary requirement for subscription to the agreement between yourself as a registered member and user of the Club, and Aena, and to have access to these benefits. Therefore, by unsubscribing from these communications you will also cancel your Club membership, meaning you will not be informed of the benefits applicable to the services offered through the Club. If you would not like to receive these communications you may cancel your Club membership at any time through the relevant channels. This processing is based on the execution of the contract.

    At the same time, with regards to our Customer Club, and with your permission, the purpose is to email you commercial and advertising correspondence, such as offers and discount coupons for AENA Airport shops or for third parties concerning the following areas or sectors: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling (third-party communication). This processing is based on your consent.

    In order to access this service, Aena offers the possibility of downloading the mobile application (APP) onto the device for registering with and managing the service. Whenever you have enabled location services (settings option on your device), Aena will collect information on WiFi access points or relating to latitude and longitude in order for this information to assist us in showing your location so that we can provide you with our services. This processing is based on your consent and/or the execution of a contract, as appropriate in each case.

    Customer Club members may use the following services:

    1. Mobile payment. You are hereby informed that Aena will store the last four digits of your credit card in order to identify the card used for payment of the contracted service.

      When using the Parking services, your car registration number will be stored to allow us to determine how long you have used the parking services, so that we can bill you accordingly.

      If paying using your mobile device to use a VIP lounge managed by Aena, your ID information will be collected for identification purposes.

    2. Payment by Registration. This new stay management and payment system by Aena will entail processing the vehicle registration and credit card details provided by the user in his or her Aena Customer Club profile.

      The Payment by Registration service involves reading and identifying the vehicle registration when entering and leaving the car park. It will therefore not be necessary to issue a ticket when entering and leaving. Once you have entered the car park, the reader will recognise your registered number plate, and this will be associated with the user with the Payment by Registration service enabled, which will automatically raise the barrier and allow you to enter and park your vehicle. This service is only intended for vehicles. This means that motorcycles are excluded from using the Payment by Registration system, in light of complexities arising when reading their registration numbers.

      In order to enjoy club discounts, you will need to scan your return boarding pass so that the new balance can be calculated and automatically saved.

  • The purpose of Sale of Publications is to manage orders placed via the Publications Shop. At the same time, and with your permission, we will inform you of ways in which you might benefit, and will also provide you with information that may be of interest to you relating to services provided by Aena regarding Sale of Publications. We would also like to email you commercial and advertising correspondence, such as offers and discount coupons on specific dates, including World Book Day, the Book Fair, Black Friday etc. This processing is based on the execution of a contract and your consent.
  • The purpose of Aena Car Park Bookings is to manage car parking space bookings that you make via our website, as well as to send you information that may be of interest to you. At the same time, and with your permission, we will email you commercial and advertising correspondence, such as newsletters with information of interest to passengers, offers and discount coupons for Aena Airport shops or for third parties concerning the following areas or sectors: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling. This processing is based on the execution of a contract and your consent.
  • The purpose of airport VIP Services is to manage VIP Lounge access purchases that you make via our website, as well as to send you information that may be of interest to you. At the same time, and with your permission, we will email you commercial and advertising correspondence, such as newsletters with information of interest to passengers, offers and discount coupons for Aena Airport shops or for third parties concerning the following areas or sectors: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling.

    VIP Service users may also use the Fast Line for preferential access to the security checkpoints of existing filters. The purpose of the processing is to manage priority access bookings that you make via our website, as well as to send you information that may be of interest to you. This processing is based on the execution of a contract and your consent.

  • As regards the PRM Services, we hereby inform you that the data you provide via the form provided for this purpose on the Aena website will be used to manage the services requested by you for assistance for persons with reduced mobility, as well as to carry out a satisfaction survey to improve the service.
  • The purpose of the Corporate Responsibility blog is to manage subscriptions for receiving information via email on news from the blog, newsletter, projects and initiatives from Aena’s Corporate Social Responsibility department. This processing is based on your consent.

In the event that you, on behalf of your company, request a service addressed to companies (e.g. Companies portal), your personal data, as representative thereof, will be processed for the performance of the necessary steps for the service requested. Likewise, they may be used to establish contact with your company, through your data, all based on the execution of the contract, legitimate interest, legal obligation or consent, as the case may be.

How long will we store your data for?

Your data will be retained while necessary to comply with the purpose for which they were collected.

They are subsequently stored for as long as claims and obligations may arise as a result of the processing of your data for the purpose for which they were collected.

Who receives your data?

It is anticipated that the following parties will receive your data:

  • To entities involved in Administrative and Legal Proceedings (where appropriate).
  • To Courts (where appropriate).
  • To Security Forces and Custom Authorities (to comply with legal obligations).
  • To your bank or savings bank to pay for the services provided.
  • To the State Air Security Agency (AESA) for inspections.
  • To your airline, the moment you pass through the security checkpoints to your boarding gate or in the event that we provide a service related to your airline (for example, VIP lounges) for check-in purposes.
  • To other entities involved in processing your claim or complaint.
  • To Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E, in the event that you make a reservation through Aena's website for a service for said airport.
  • To Aena Desarrollo Internacional S.M.E., S.A., in the event that you present any request, claim, complaint, or request any service addressed to that entity.
  • In the event that you are requesting authorisation to carry out air activities, with remotely-piloted aircraft (drones or RPAS) or any other air activity, your data will be disclosed to AESA and the Air Traffic Service providers of the relevant airports and affected air space, in accordance with legal obligations (aviation safety regulations).
  • In the event that you are presenting a complaint through the complaints channel, your data may be disclosed to administrative and judicial authorities for investigation into the claims made (based on legal obligations).
  • To persons, institutions or authorities that may require them by law.
  • To the entities of the Aena group that will benefit from the selection processes, in the event of applying for a position for said entities, that is:

     

    • Aena SME, S.A., registered in the Companies Register of Madrid, Volume 28.806, Folio 211, Section 8, Sheet M-518648, with Tax ID Number (CIF) A86212420, and with registered office at Calle Peonías 12, Madrid 28042.
    • Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., registered in the Companies Register of Murcia, Volume 3294, Folio 63, Sheet MU93208, with Tax ID Number (CIF) A-73988313 and registered address at Avenida España 101, Valladolises y Lo Jurado CP 30154 Murcia.
    • Aena Desarrollo Internacional S.M.E., S.A., registered in the Companies Register of Madrid in Volume 11.288, Folio 153, Section 8, Sheet M-177.425, Entry 4, with Tax ID Number (CIF) A37250883 and registered address at Calle Peonías, 12, 28042 Madrid.

Aena, Aena Desarrollo Internacional and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia will be responsible for the processing of your personal data that will be used to manage job applications and selection processes managed through the website. In this way, no further international transfers or transfers of data are foreseen, except where there is a legal obligation.

What security measures are guaranteed with regards to your data?

Aena and Aena Concesionaria del Aeropuerto Internacional de la Región de Murcia, as the data controllers, will adopt the technical and organisational measures required to guarantee the security of the personal data provided, preventing their unauthorised alteration, loss, processing or access.

How do I go about exercising my rights?

Any data subject is entitled to receive confirmation as to whether or not his or her personal data are being processed. The General Data Protection Regulation also stipulates the following rights for the data subject:

  • Access to his or her data.
  • Requests for rectification or deletion of his or her data.
  • Requests for limitation of data processing.
  • Portability of his or her data.
  • Objection to his or her data being processed.

You may exercise your rights of access, rectification, suppression, opposition, limitation of processing and portability, as well as withdraw your consent, both against AENA, S.M.E., S.A. and against Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., by sending an email to ocpd@aena.es or by writing to Calle Peonías, 12, 28042-Madrid, as well as online at https://serviciostelematicos.aena.es.

How do I contact the Data Protection Officer?

If you have any doubts relating to Data Protection, please contact our Data Protection Officer at the following email address: dpd@aena.es.

Furthermore, you are entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD); the control and supervisory body for data protection in Spain.

ADOLFO SUÁREZ MADRID-BARAJAS BIOMETRIC SYSTEM PRIVACY POLICY

In compliance with Article 26.1 of the RGPD, we inform you of the fundamental elements of the joint responsibility agreement:

If you as a passenger have voluntarily chosen to use the biometric system in use in the devices in the airport or in the Aena App, please note that the information gathered by this system (image of your face via selfie and video selfie, front and back of your DNI/NIE/passport, boarding pass and NFC chip data) will be used by Aena, S.M.E. S.A., with business address at C/Peonías 12, 28042 Madrid (C.I.F.: A86212420) as the data controller, in order to facilitate your transit through the airport, speed up security checks, and enable your identification when boarding as part of a pilot project for this purpose. The data will be gathered through the Aena app, the Iberia app or the enrolment kiosks located in the airport, as applicable, and your image will subsequently be gathered by the facial recognition cameras located at certain checkpoints to enable you to go through them.

Any user can register as a biometric passenger in the Aena systems. However, the biometric system is only active for Iberia flights from Madrid Barajas (MAD) to Oviedo (OVD) and Brussels (BRU).

The registration process is in two parts: in the first you can register your image and identity documents (this process need only be done once, or if you wish to add other identity documents to your biometric profile), and in the second, after you get your boarding pass, you can register it before the flight and associate with your biometric profile.

The first process will capture your image (selfie and video selfie - the latter only if you are registering via an app, as “proof of life”), the image of your identity document (DNI/NIE/Passport), and the personal data and image of the NFC chip in your identity document, in order to validate your identity and confirm the validity of your identity document. After that, Aena will process the data from your image (selfie), document type and the identifying personal data obtained from it, and your associated boarding pass, in the subsequent second stage.

In this process, Aena, S.M.E. S.A acts as joint data controller together with IBERIA LAE SA OPERADORA SU. In the identification of passengers at the boarding gate, Aena acts as the Data Processor for Iberia.

Processing is based on your explicit consent given to either of the jointly responsible data controllers (you may withdraw your consent at any time in an email to ocpd@aena.es attaching a copy of your DNI/NIE/Passport, as the database is encrypted and we need this information to find it) and on the public interest of Aena to ensure airport security, set forth in Articles 6 and 9 of the General Data Protection Regulation.

Your data will be stored for the duration of the biometric identification service provided by Aena (1 year), and you may cancel this at any time (withdrawing your consent, as indicated above, or exercising your right to erasure).

This biometric identification service is voluntary, so if you do not want to use it you can transit the airport in the traditional way presenting the corresponding documentation at the checkpoints of each airport.

The boarding pass and DNI/NIE/Passport information will also be supplied to Aena by your airline (Iberia) for verification purposes once you have obtained your boarding pass. If you have previously registered through the Iberia app, we will also have received your biometric data (image of your face (selfie and video selfie - the latter only if you are registering via app), data from your identity document (DNI/NIE/Passport), boarding pass and personal data from the NFC chip) from Iberia with the data needed for providing our service to you, based on your explicit consent, given at that time to Iberia, to participating in this project.

Aena SME, S.A., as data controller, may process your data for the study, viability assessment and monitoring of the pilot project, based on its legitimate interest in assessing the effectiveness of the biometric identification system.

Your data may be supplied to the National Security Forces for public security purposes, according to DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, and to the airline operating your flight (in this pilot project, Iberia) to facilitate its security obligations in terms of the identification of passengers and the fulfilment of its transport contract, and to any public authorities if required by law. No data is expected to be transferred to another country unless required by law.

For the development of this pilot project, Aena SME, S.A, will use other service providers who must unavoidably have access to the information, acting as data processors (for example: Informática El Corte Ingles S.A., GUNNEBO Entrance Control Ltd, and Gemalto S.A). In these cases, Aena SME, S.A will make sure they offer sufficient guarantees that they will apply the appropriate technical and organisational measures, so the processing complies with the relevant regulations and guarantees the protection of your rights.

After registering in this project and correctly linking your boarding pass, you will not have to show any identity documents at security checkpoints or at the boarding gate. However, you must carry your identity documents and boarding pass in case any problem should arise.

Aena SME, S.A., as the joint data controller, will take the necessary technical and organisational measures to ensure the security of the personal data provided, avoiding their alteration, loss, or unauthorised processing in connection with the processing operations in which it is involved.

You may exercise your rights of access , rectification, erasure, objection, portability and restriction of processing of your data, attaching a copy of your DNI/NIE/Passport, via the following email address ocpd@aena.es, via the Online Services Portal on the Aena website (www.aena.es), or by writing to Aena at Calle Peonías, 12 – 28042 Madrid. If you have any questions, please email our Data Protection Officer at dpd@aena.es.

You may also present a complaint to the Spanish Data Protection Agency (www.aepd.es) at any time.

Only if you are accessing this service via the Aena app, responsibility of Aena S.M.E., S.A.:

At the start of each phase of the process, and for the sole purpose of verifying that you have previously joined this project, you will be asked to fill in a form with certain personal data - Document type (DNI/NIE or Passport), document number and country where it was issued - in order to check whether your biometric profile or your boarding pass is already registered in our systems. If you are logged into the app as a member of Aena Club Cliente, your personal data previously registered in Aena Club Cliente will be used to pre-populate the data form for this search, and if applicable, the data registered in Aena Club Cliente will be updated with the result of this process.

Also, if you are a member of Aena Club Cliente (ACC), you register via our app and you are logged into it, an email will be sent to your email address as registered in the ACC service to welcome you and confirm the result of the registration process.

In order to capture your data, our app will ask you to download and install on your mobile phone a specific application for this process, which is available on the App Store and on Google Play. This application, sponsored by Aena, does not store data - it merely gathers your image and identity document data, checks them against its systems supporting this process, and sends them in encrypted form to the systems of Aena S.M.E., S.A. where they will be stored. These support systems will only maintain records of the checking process for the legally established period in order to comply with any responsibilities arising from this process.

You can consult this privacy policy whenever you want by going to the “Privacy Policy” section of the Aena website (www.aena.es).