Privacy policy | Aena

Privacy Policy

This policy is designed to inform all people who are users of the airport installations, as well as users of our corporate website.

What is the purpose of this document?

The purpose of this document is to notify you that your personal details are processed in accordance with Personal Data Protection standards, in particular, those of Regulation (EU) 679/2016 of the European Parliament and Council of 27 April 2016, relating to the protection of individuals with regards to the processing of personal data and free circulation of those data (General Data Protection Regulation (GDPR)), and Organic Law 3/2018, of 5 December, on Personal Data Protection and guaranteeing Digital Rights (LOPDGDD).

Who are the Data Controllers?

The data controller will be:

Aena SME, S.A. (AENA):
Address: Peonías, 12. 28042 Madrid.
Tax ID: A86212420
Companies Register of Madrid, Volume 28806, Folio 211, Section 8, Page M-518648.

In the event that you enjoy services provided at the Murcia Region International Airport, the data controller will be:

Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, S.A. (AIRM)
Address: Avenida de España, 101, Valladolises y Lo Jurado, 30154 Murcia.
Tax ID: A73988313
Companies Register of Murcia, Volume 3294, Folio 63, Page M-U93208.

What types of data will be processed?

The personal data that will be processed will be the following:

  • Identification and contact data, such as image, voice, recordings, etc.
  • Data relating to personal and health characteristics (e.g. People with reduced mobility).
  • Curricular and selection data, along with academic and professional data.
  • Data on personal circumstances, loyalty cards with companies, data on complaints or claims.
  • Financial data, relating to payment methods.
  • Your flight details.

Keep in mind that, on occasions, for the proper provision of services and the contract execution, you will be required to provide mandatory data, for the development of the contract, or data required to comply with relevant legal obligations. Otherwise, the contract cannot not be performed or signed, or Aena could not comply with its legal obligations.

Why do we process your personal data?

The personal data that you provide to us or that will be provided at the time you start your relationship with us and those that may be collected or generated throughout that relationship, will be processed for the purposes indicated in each fact sheet, personal data collection form or by any other means that is made available to you at the airport itself, and are summarised below:

Note: If there is a specific Privacy Policy for any service, the provisions thereof will apply.

  • How does this Policy affect me if I am a user of the airport facilities?

    We inform all users of our airport facilities of the following:

    • Video surveillance. Your image will be processed for video surveillance for the purpose of controlling and monitoring the airport (operation and maintenance) and security, protecting people and goods inside airport facilities. In some airports your image as a driver may be processed, taken at the time of entering and leaving the car park for security purposes. All this based on public interest (airport security, operational security and private security regulations). Your data (images) will be stored for a maximum of one month from their collection. Your data will be communicated to customs authorities in order to provide their customs and tax services (legal obligations), to security forces for the purpose of preventing a real and serious danger for public security or to prevent criminal offences, following the formal requirements of the Spanish Data Protection Agency, and to comply with legal obligations (National Security Programme and Regulation (EU) 2015/1998). Possible communication to third parties is also provided for based on their legitimate interest, after considering any rights and freedoms affects (Article 6.1.f GDPR). No international data transfers are envisaged.
    • Capacity and crowd control. Your data will be processed for capacity and crowd control via video cameras and with no user identification, based on the legitimate interest of Aena to prevent crowding at critical points of the airport.
    • Managing and addressing airport claims, as well as managing and processing all kinds of claims/complaints/suggestions/requests for information, basing this processing on consent provided. You can withdraw your consent at any time by sending an email to ocpd@aena.es, stating “Withdraw Consent + Type of Request + Airport”, attaching information proving your identity. Data will be stored while being processed and while any claims may arise. They will be transferred, where necessary, to the airline, company or body involved in the processing of this claim, complaint, request, or suggestion; to Judges and Courts, should your claim give rise to any legal action, and to the authorities provided by the law. No international data transfers are envisaged.

      This service includes the management, control and processing of claims, complaints and suggestions sent to Aena S.M.E., S.A., to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A. or to Aena Desarrollo Internacional S.M.E., S.A., as appropriate, as well as all kinds of complaint, claim or suggestion services via the Aena Procedures and Claims Portal.

    • Authorities. If you are an authority, your data will be processed to manage and control services provided to authorities, such as managing visits, managing authority lounges, recording and maintaining institutional contacts, to comply with legal obligations. We also inform you of the source of data; they can sometimes come from the public body or administration you belong to. Your data will be stored during your relationship with our company and while any claims may arise. Your data may be may be transferred, where appropriate, to the airline which you fly with, based on contractual performance, and to state security and law enforcement bodies to comply with legal obligations. No further communications or international data transfers to third parties are envisaged, except where there is a legal obligation.

    • Commercial communications. Your data will be processed to send commercial communications, where appropriate, based on your consent or on the legitimate interest of Aena, should they refer to products and/or services similar to those contracted. You can withdraw your consent or oppose processing at any time by sending an email to ocpd@aena.es, indicating “Withdrawal of Consent Commercial Communications”, attaching information accrediting your identity.

    • Managing airport users: visits. Your data may be processed for Managing airport users: visits should you visit one of our airports, based on your consent. We will also manage your temporary accreditation for the visit (as visitor and/or on operational or professional grounds), facility access control and security, and to control visits to the airport or centre, basing this processing on a legal obligation (private security regulations) and public interest (airport security). Data will be stored for a period of one month and while any claims may arise. Your data may be communicated to security forces in compliance with legal requirements, no more transfers or international transfers are envisaged unless required by law.

    • Managing the service when you request assistance for People with Reduced Mobility (PRM). Your data will be processed to manage the service when you request assistance for People with Reduced Mobility (PRM), basing this processing on existing public interest and, on public interest pursuant to Regulation (EC) No 1107/2006 of the European Parliament and of the Council of 5 July 2006 on the rights of disabled persons and persons with reduced mobility when travelling by air. We will also process your data for sending a satisfaction survey in order to find out about your experience and be able to improve the service, based on our legitimate interests.

      In this regard, we have performed an internal analysis weighing up your right to data protection and our interest in conducting such surveys, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part regarding this processing, and that specially protected data will not be processed, nor will this involve automated decisions.

      You can object to this or request additional information using the channels provided for this purpose in this policy by sending an e-mail to dpd@aena.es.

      The service is provided by going to the airport points identified for this service, or by previously booking the service on the Aena website or through your airline. Aena may receive your data from the airline if you have booked on your company’s website, or if you travel on a flight arriving at an Aena network airport from other airports. Your data will be stored while necessary to comply with the purpose and while any claims may arise. No transfers (unless required by law) or international data transfers are envisaged.

      Additionally, at the information points situated in different points of the airport, we will process your data (image taken by the camera at the information point and your voice, which are activated when you press the call button on the information point) to better manage the assistance requested, based on the legitimate interest of providing the best service. Your data (voice only) will be stored for one year to be able to analyse any possible complaints or incidents in the service and will not be disclosed to any third parties.

      In this regard, we have performed an internal analysis weighing up your right to data protection and our interest in providing a better on-site service in the airport in relation to any questions or enquiries you may have, concluding that there is a reasonable expectation on your part regarding this processing, and that specially protected data will not be processed, nor will this involve automated decisions.

      You can object to this or request additional information using the channels provided for this purpose in this policy by sending an e-mail to dpd@aena.es.

      Data processed: Identification, contact, health data (type of disability or special needs) and of your flight. Image and voice at information points.

    • Recording telephone calls to certain telephone numbers. Where appropriate, we can process your voice to record telephone calls to certain telephones (operational, incident investigation, emergencies), based on your consent, contract performance, vital interest, public interest, claims, as appropriate (depending on the type of call made). Recordings will be stored while necessary for the purpose for which they were made, however, they will be blocked and only available to judges and courts for the remaining time before destruction. No transfers or international transfers are envisaged, unless required by law.

      Recordings will be stored while necessary for the purpose for which they were made, however, they will be blocked and only available to judges and courts for the remaining time before destruction. No transfers or international transfers are envisaged, unless required by law.

    • Managing and addressing vehicle car park complaints. If you use one of our vehicle car parks (public, subscription or personnel), your data may be used to manage the car park or address vehicle car park complaints. We also inform you that images taken by car park access cameras, which are cameras used to capture vehicle data (registration recognition and reading system, front and/or back), will be used to comply with legal obligations including those stemming from car park contract regulating legislation such as, for example, the obligation to identify the vehicle. In some airports your image as a driver is processed, taken at the time of entering and leaving the car park for security purposes, based on public interest (by video surveillance). Furthermore, you entry and exit data, registration and details of your booking, where appropriate (see information on “Aena Car Park Booking” processing), will be processed to manage the car park, based on contract performance. Your data may be processed to address and resolve claims, in compliance with legal requirements.

      In the case of subscription or personnel car park, we will also process your data (identification, contact and, where appropriate, company data), which may be provided by your company, to manage your subscription, based on contract performance (and where appropriate, the contract between your company and Aena. In this case, your data may be communicated to your company to develop the contract).

      Data processed: Vehicle images (recognition of registration, front and/or back), entry and exit data, registration, details of your booking and, where appropriate, payment methods.

      Images taken will be stored during your stay in the car park and then stored for a maximum period of one month.

      Data for managing the car park will be stored during your stay and/or your contract (as indicated above) and while any claims may arise.

      Data may be communicated to your bank to charge the service provided (where appropriate), to your company, as necessary to perform the contract (where appropriate) and data transfers are envisaged to state security forces for the purpose of preventing a real danger to public security or to prevent criminal offences, and to judges and courts in case of legal injunction. Communicating data to competent public administrations for their inspection activity is also envisaged in compliance with state and regional Road Transportation Organisation regulations. No international transfers are envisaged.

      Furthermore, in the case of subscribers to some car parks at our airports, we will process you (contact) data to send commercial communications (based on explicit consent) and to conduct surveys (based on Aena’s legitimate interest in improving the service provided). Aena informs you that consent can be revoked at any time and you can oppose processing by sending an email to ocpd@aena.es

    • Controlling passengers passing through security checkpoints to boarding areas, Fast Track and Fast Lane. As a passenger, your data will be processed for Controlling passengers passing through security checkpoints to boarding areas and, where appropriate, recording access incidents (to comply with a legal obligation) and conduct statistics (based on legitimate interest). Processing consists of verifying that the boarding pass read is for a flight that day and has not been previously used. If everything is correct, you can pass through the checkpoint. In any case, you will have the chance to challenge the decision taken and ask for these controls to be repeated by a security operator.

      Fast Lane and Fast TrackFast checkpoint for airline VIP passengers. Legitimation: processing necessary to perform a contract. The system allows the passenger to pass through the Fast Lane checkpoint if they have acquired this VIP right with their airline or have acquired the right to pass through on the Aena website. Data processed: your boarding pass data using the pass readers located before the security checkpoint and Fast Lane checkpoint. Data will be communicated to the company operating your flight or the handling company operating your flight on behalf of the airline in order to streamline boarding for the scheduled flight, as well as to verify the authenticity of the identity document if we detect that your pass has already been registered (based on performing contracts); to state security forces for the purpose of preventing a real and serious danger to public security or to prevent criminal offences, following the formal requirements of the Spanish Data Protection Agency and to comply with legal obligations (National Security Programme and Regulation (EU) 2015/1998); and to customs authorities (to comply with legal requirements). In the case of the Fast Lane, your data will be transferred to the airline for control and, where appropriate, to the company invoicing you for the service provided, based on performing the contract with your airline.
    • Airport Medical Services.If you go to one of our medical assistance points available at airports, your data will be processed for Managing airport medical services provided by Aena or any external collaborating entity contracted for this purpose, in order to provide a first aid service (emergency primary care and emergency medical transfer) at the airport, based on compliance with legal obligations (healthcare regulations) and, where appropriate, to protect your vital interests in case you are unable to give consent. We will also process your data to obtain aggregate statistics on the service based on our legitimate interests.

      Your data will be stored for as long as necessary to comply with the purpose for which they were collected and to determine any liabilities that may arise from this purpose and from their processing, taking as a reference applicable healthcare regulations. Your data may be communicated to hospitals or health centres if the service provided understands it is necessary for this purpose. In no other case will your data be communicated unless required by law or legal injunction. No international data transfers are envisaged.

    • Legal defence and legal advice. In cases in which your a party of a legal case of Aena S.M.E., S.A. or Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A (as an affected or interested party, etc.) your data may be used for Legal defence and legal advice, based on compliance with a legal obligation.
    • Lost Property. If you find lost property, or you claim for lost property, your data (identification and contact data, documentation accrediting ownership of the property) will be processed for managing lost property, to control property kept in the warehouse, entry and exit records, returns, identification of the individuals who find and claim lost property; processing is based on compliance with a legal obligation. Data will be stored for two years and while any claims may arise, and they will be communicated to the Council Lost Property Office should it provide this service in order to comply with Art. 615 and 616 of the Civil Code, and where appropriate, to other authorities provided by law. If an identity document is found, it will be handed over to the state security forces. In the case of bank cards, their data may be communicated to the bank. No international data transfers are envisaged.
    • Statistical purposes. Your data may be used to prepare statistics and improve the services provided, based on legitimate interest or compliance with a legal obligation (in case of statistics requested by public bodies such as the National Statistics Institute), as applicable. The result of this processing will never provide specific information on you.
    • Record of entry/exit of documentation and archiving. If you submit or are party to documentation submitted in Aena records, your data may be processed for the Record of entry/exit and archiving documentation, based on processing necessary to process your request. Data will be stored while necessary to manage the record and documentation and while any claims may arise. Personal data may be communicated to entities or individuals addressed by the request. International data transfers may be made when the request is directed to a country outside the European Economic Area (EEA), necessary for processing or performing a contract.
    • Authorisations to conduct air activities, with remote piloted aircraft systems (drones or RPAS).If you request authorisation to conduct air activities, with remote piloted aircraft systems (drones or RPAS) or another type of air activities, we will process your personal data (identification and contact data, types of operations, aircraft details and details of the operations with aircraft) to manage the authorisation with the bodies involved; processing is based on legal obligations (aeronautical security regulations). Data will be stored during the formalities and while any claims may arise, and they will be communicated to AESA and to Air Traffic Service Providers at the airports involved and the airspace affected, in accordance with legal obligations (aeronautical security regulations).
    • Free Aena WiFi service. In order to offer the WiFi service, AENA may obtain personal contact data provided by the USER when logging into or registering in the WiFi service. Specifically, you are informed that:

      - If you register for access through a Facebook account or another social network, we can use the data provided via social networks.

      - If you register through our Aena Club service, we can use the USER’s Aena Club credentials data (username and password).

      - If you register directly through the WiFi access portal, we can use the personal data provided when registering for access.

      The legal basis for processing USER data is performance of the contract for providing the WiFi service according to the General Terms of Use, as well as compliance with legal obligations related to Article 31 bis of the Criminal Code and the obligation set forth in Law 25/2007 on storing electronic communication data.

      Meanwhile, and if the USER explicitly accepts by checking this option, Aena may use the data provided during registration for the WiFi service, as well as data obtained from browsing and geolocation, to provide a personalised service by sending commercial communications and advertising by email, sent by Aena itself, and newsletters with information of interest for the passenger or promotions and discount vouchers for AENA or third party airport stores for the following fields or sectors: Cars and vehicle rental, leisure, travel agencies, tourism, transport, airlines, catering, textiles, fashion, beauty and cosmetics, financial and insurance, press and magazines, gaming, gambling.

      Processing is based on your consent. AENA informs you that consent provided for this purpose can be revoked at any time by sending an email to serviciowifi@aena.es or ocpd@aena.es, indicating the subject “WITHDRAWAL WIFI CONSENT”. If the USER request revocation and/or deregistration from sending commercial communications and advertising and/or information by electronic means indicated, AENA informs you that data associated with the device and USER registration credentials data will be processed for the purpose of processing the deregistration request. In no case does withdrawal of consent condition performance of the WiFi service provision contract. Sending commercial communications and advertising and/or information by electronic means indicated, prospective offers for products and services for commercial, advertising or general information purposes, as well as for statistical and segmentation purposes is based on consent requested from the USER.

      Data processed: Identification data such as email address (if accessing through email), password and username (if accessing through Aena Club) or other equivalent data is accessing through social networks. Some other data may also be registered in the system and as also mandatory for the purposes mentioned, such as: name of the device connecting to WiFi, MAC address, IP address, telephone number and IMEI if using a telephone) and connection and browsing data, geolocation.

      Your data will be stored while necessary to comply with the purpose for which they were collected and during the legally mandatory term provided in Law 25/2007. They are also stored for as long as claims and liabilities may arise as a result of the processing of your data for the purpose for which they were collected.

      Data will not be transferred to third parties unless required by law. International data transfers may be carried out if necessary to perform the activity or provide the service, in which case Aena will take the appropriate measures.

    • Making personalised calls using the Airport Public Address system. On certain occasions, at the request of your airline or your handling agent, or other third parties (family members, for example, if you are a minor or an elderly person), we may call you using the airport public address systems to ask you to come to a certain location in the airport, such as the departure gate when the flight gate is about to close, Aena information desks or check-in desks, etc. This processing is based on your legitimate interest in the performance of the transport contract, or that of other third parties, such as your airline or your family members, in locating you and being able to meet up at a point in the airport. Your data (name, surname(s), flight number or destination, and the location you should go to) will be communicated to all users present in the airport due to the nature of the announcement, so that you hear the message and know it refers to you. However, whenever possible, the call will be made to a specific sector within the terminal.

    • Aena Life and Accident Insurance beneficiaries. If you are appointed as a life and accident insurance beneficiary by an Aena employee, we inform you that Aena group companies (depending on which company our employee works for) will process your personal data (full name and identity number) in order to manage the insurance and communication to the insurance broker and insurance company, all in compliance with legal obligations applicable to our companies. Your data will be stored while necessary for the purpose and subsequently for three years (Royal Legislative Decree 5/2000, of 4 August, approving the consolidated text of the Social Violations and Penalties Act).

  • How does this Policy affect me if I am a user of the website?

    We inform all users of our website of the following means of processing:

    • Contact information. As regards the Contact methods and data provided via our website, the purpose is to provide a response to your requests for contact, services, information, queries, suggestions or complaints of any nature that we may receive by making use of the contact methods provided, based on legitimate interest, legal obligation, performance of contract and/or consent, as appropriate in each case.
    • Aena Employment. There are two types of processing related to the Aena Employment section:

      • “Jobseekers” section: Data collection during registration (email address) will be processed for the purpose of keeping you informed by email of future job vacancies; processing is based on consent provided. You can withdraw from this processing yourself by once again entering your email on the form (as if you were registering). The system detects that you are already on the distribution list and will give you the chance to unsubscribe.
      • Manage job applications and the information you provide us (identification details, contact details, CV and information provided for the selection process) via our website, related to recruitment processes conducted by Aena Group, based on carrying out pre-contractual measures, legal obligation (Law 19/2013 on Transparency. Data are also communicated to trade union representatives according to labour legislation and Law 11/1985 on Freedom of Trade Union Association) or public interest (certain information requested from candidates for security purposes), as applicable in each case.

      You can withdraw your consent at any time by sending an email to ocpd@aena.es, stating solely “Withdrawal of Data Subjects' Consent”, attaching information proving your identity.

      Aena, Aena Desarrollo Internacional and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia will be responsible for the processing of your personal data that will be used to manage job applications and selection processes managed through the website.

      Your data will be stored during the selection process and while any claims may arise.

      Jobseekers: we inform you that once you have registered as a jobseeker, your email address will be stored for the following three years. After this period, it will be deleted from our database and you will have to register again if you are still interested in future selection processes.

      As indicated, your data regarding your employment applications may be communicated to trade union representatives if necessary pursuant to applicable regulations. We also inform you that, as provided for in Law 19/2013, of 9 December, on Transparency, access to public information and good governance, if you take part in some processes, candidate results may be published on the website after being disassociated from other personal data.

      For certain employment applications, your data may be provided to state security forces in order to check criminal records, based on public interest (National Security Programme for Civil Aviation).

      To Aena group entities benefiting from selection processes, dedicated to airport management activities, based on your consent and if you apply for a job at those entities; no transfers or international transfers are envisaged, unless required by law.

    • Aena Club. Regarding our Aena Club service, the purposes are:

      • Processing your personal data to manage your Aena Customer Club membership, based on performance of contract as a result of Acceptance of Terms and Conditions.
      • Managing the sending of commercial communications to inform you of the advantages you can obtain on services provided by Aena for VIP Parking Services, and other Aena airport management services, as well as to communicate information on these services (processing based on Aena’s legitimate interest; you may oppose this processing by checking the relevant box when registering or using the channels provided for this purpose in this policy).
      • Sending surveys on Aena services used and, in this way, finding out your level of satisfaction, based on Aena’s legitimate interest in finding out customer opinions and considering them to improve the quality of its services. You can oppose this processing or request additional information using the channels provided for this purpose in this policy.
      • Sending electronic commercial and advertising communications, sent by Aena, without transferring your data to third parties, such as offers and discount coupons for Airport shops or for third parties collaborating with Aena concerning the following areas: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, textiles, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling. This processing is based on your express consent, which you can revoke at any time using the channels provided for this purpose in this policy.
      • If you go to our Market Place at any time, your Aena Club member data will be processed to enable you to log into the service, as well as to manage, process and monitor the products and/or services you acquire (based on performing a contract by accepting the terms and conditions of the service) and, sending you commercial communications based on your consent provided. You can go to the Market Place Privacy Policy for more information on this processing.
      • If you place a car park booking as an Aena Club member, we will run a public query on the Traffic Department’s Statistics Portal to verify the environmental seal associated with the vehicle registration in order to offer benefits or discounts to users with less contaminating vehicles, based on Aena’s legitimate interest in promoting environmental protection.

      Aena Club is a service that Aena offers to users registered as club members. Its main and inherent purpose is to inform you of discounts, promotions, offers, news and advantages of certain Aena services and provisions available to you as a club member, as well as to send you accurate and updated information on them and related to your member status. However, by unsubscribing from these communications we will be unable to inform you of the discounts, promotions, offers, news and advantages applicable to the services offered through the Club.

      Therefore, if you do not want to receive these communications with information on the benefits, you can request to unsubscribe from communications at any time using the channels provided for this purpose.

      • From your account, by logging into the clubcliente.es portal and accessing "My account" to manage consents.
      • Through the unsubscribe link included at the bottom of the communication received.
      • Emailing ocpd@aena.es, with the subject "Unsubscribe Commercial Communications".

      If you request a service for Murcia International Airport, you data will be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., the Aena subsidiary that manages that airport, to provide the service.

      No further communications or international data transfers are envisaged, except where there is a legal obligation.

      Your data will be stored while you are a Club member and during the legal periods necessary to deal with any claims or liabilities arising from processing.

      You can withdraw your consent at any time.

      Aena Club members may also use (based on performance of a contract) the following services:

      1. Mobile payment. You are hereby informed that Aena will store the last four digits of your credit card in order to identify the card used for payment of the contracted service.

        When using the Parking services, your car registration number will be stored to allow us to determine how long you have used the parking services, so that we can bill you accordingly.

        If paying using your mobile device to use a VIP Lounge managed by Aena, your ID information will be collected for identification purposes.

        In the event that you associate the payment made via our mobile app with your status as a “Aena Club” member, we inform you that Aena will process the information collected to create a commercial profile on you as a member of the “Aena Club”, the segmentation of the customers who form part of the Club, the sending of personalised commercial offers based on products and services used, and improvement of your experience as user of our mobile app by analysing your browsing data.

      2. Payment by Registration. This new stay management and payment system by Aena will entail processing the vehicle registration and credit card details provided by the user in his or her Aena Customer Club profile.

        The Payment by Registration service involves reading and identifying the vehicle registration when entering and leaving the car park. It will therefore not be necessary to issue a ticket when entering and leaving. Once you have entered the car park, the reader will recognise your registered number plate, and this will be associated with the user with the Payment by Registration service enabled, which will automatically raise the barrier and allow you to enter and park your vehicle. This service is only intended for vehicles. This means that motorcycles are excluded from using the Payment by Registration system, in light of complexities arising when reading their registration numbers.

        In order to enjoy club discounts, you will need to scan your return boarding pass so that the new balance can be calculated and automatically saved.

    • Publications Shop. Regarding the Publications Shop, the purpose is to manage orders placed via the Publications Shop, processing based on performance of a purchase contract. At the same time, and with your permission, we will inform you of ways in which you might benefit, and will also provide you with information that may be of interest to you relating to services provided by Aena regarding the Sale of Publications. We would also like to email you commercial and advertising communications, such as offers and discount coupons on specific dates, including World Book Day, the Book Fair, Black Friday etc. This processing is based on your consent. Aena informs you that consent provided for this purpose can be revoked at any time by sending an email to ocpd@aena.es, indicating the subject “WITHDRAWAL SHOP CONSENT”. Your data will be stored while necessary to comply with the purpose for which they were collected and while any claims may arise. Your data will be transferred to the bank to pay for the service provided. Furthermore, if you contract any product requiring a payment and said payment is not made within the allotted time, thereby incurring a failure to comply with regulations governing such matters, the information on you as a debtor may be added to files related to the breach of financial obligations. No more data will be transferred to third parties unless required by law. No international data transfers are envisaged.
    • Aena Car Park Bookings. Regarding Aena Car Park Bookings:

      • The data you have provided will be processed for the purpose of managing your parking space booking on our website, processing based on performance of a contract.
      • Sending surveys on Aena services used to ascertain your level of satisfaction, based on Aena’s legitimate interest in finding out customer opinions and considering them to improve the quality of its services. You can object to this processing or request additional information using the channels provided for this purpose in this policy.
      • Sending electronic commercial communications to inform you of the advantages you can obtain on Aena products and/or services similar to those previously contracted. This processing is based on Aena’s legitimate interest in offering you that information, which you can object to or request additional information using the channels provided for this purpose in this policy.
      • Sending electronic commercial communications to inform you of other Aena airport management products and/or services different from those contracted, such as VIP Services, etc. This processing is based on your explicit consent by checking the relevant box, which you can revoke at any time using the channels provided for this purpose in this policy.
      • Sending electronic commercial and advertising communications, sent by Aena, without transferring your data to third parties, such as offers and discount coupons for Airport shops or for third parties collaborating with Aena concerning the following areas: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, textiles, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling. This processing is based on your explicit consent, which you can revoke at any time using the channels provided for this purpose in this policy.

      Your data will be communicated to your bank to pay for the services contracted, as well as, where applicable, to your company where it contracts the service you receive, legitimated by performing the contract signed.

      Furthermore, if payment is not made within the allotted time, thereby incurring a failure to comply with Law governing such matters, the information on you as a debtor may be added to files related to the breach of financial obligations.

      If you request a service for Murcia International Airport, you data will be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., the Aena subsidiary that manages that airport, to provide the service.

      No further communications or international data transfers are envisaged, except where there is a legal obligation.

      Data will be stored while you are a customer and during the legal periods necessary to deal with any claims or liabilities arising from processing.

    • VIP Services. The purpose of airport VIP Services is to manage your purchases to access those services via our website, as well as to send you information that may be of interest to you. The services are:

      • When you register on Meet & Assist, the data provided will be processed for the purpose of managing your service booking via our website, processing necessary to perform the contract.
      • When you process the “Right to Priority Access -Fast Lane-”, , the data provided will be processed for the purpose of managing the purchase of the priority access right via our website, processing necessary to perform the contract. For more information, see the “Controlling and managing passengers passing through security checkpoints to the boarding area and Fast Lane” section above.
      • When you purchase access to “VIP lounges or spaces”, the data provided will be processed for the purpose of managing the purchase of access to the VIP Services you have requested, processing necessary to perform the contract.
      • Sending surveys on Aena services used and, in this way, finding out your level of satisfaction, based on Aena’s legitimate interest in finding out customer opinions and considering them to improve the quality of its services. You can oppose this processing or request additional information using the channels provided for this purpose in this policy.
      • Sending electronic commercial communications to inform you of other Aena airport management products and/or services different from those already contracted, such as Car Park Services, etc. This processing is based on your express consent by checking the relevant box, which you can revoke at any time using the channels provided for this purpose in this policy.
      • Sending electronic commercial and advertising communications, sent by Aena, without transferring your data to third parties, such as offers and discount coupons for Airport shops or for third parties collaborating with Aena concerning the following areas: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, textiles, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling. This processing is based on your express consent, which you can revoke at any time using the channels provided for this purpose in this policy.

      Data processed: Identification and contact data, request made, payment methods, documentation accrediting the request (where applicable). For Meet & Assist: name, surnames, email, telephone, date and time of the service, airport and terminal.

      Data will be stored while you are a customer and during the legal periods necessary to deal with any claims or liabilities arising from processing.

      Your data may be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A. if you request a service for Murcia International Airport, the Aena subsidiary that manages that airport, to provide the service; to your bank to collect payment for the service provided; where appropriate, your personal data may be communicated by Aena to your company or airline, where it contracts the service you receive, in order to manage access to the service, legitimated by performing the contract signed; in some cases to state security forces and customs authorities to comply with legal obligations; and also, if you contract any product requiring a payment and said payment is not made within the allotted time, thereby incurring a failure to comply with regulations governing such matters, the information on you as a debtor may be added to files related to the breach of financial obligations No international data transfers are envisaged.

    • PRM services request service. As regards the PRM services request service, we inform you that the data you provide via the form provided for this purpose on the Aena website will be used to manage the services requested by you for assistance for persons with reduced mobility (based on public interest), as well as to carry out a satisfaction survey to improve the service (based on legitimate interest). For more information, see the “Managing the service when you request assistance for People with Reduced Mobility (PRM)" section above.
    • Complaints Channel. If you submit a complaint via the Complaints Channel, we inform you that your data will be processed under a specific privacy policy available for consultation at the following link: https://www.aena.es/es/nota-adicional/politica-privacidad-canal-denuncias-aena
    • AENA Companies Portal. If you request a business service on behalf of your company (for example, Companies Portal), your personal data as representative will be processed to complete the formalities necessary for the services offered, such as the billing portal (invoice query and aircraft fleet), processing based on performance of a contract. We will also use your contact data to establish a relationship with your company. Processing based on legitimate interest (in accordance with Law 3/2018, on Personal Data Protection and the Guarantee of Digital Rights). No transfers, unless required by law, or international transfers are envisaged.
    • Aena Supplier Portal. If you request a business service on behalf of Suppliers (for example ,Suppliers Portal), your personal data as representative will be processed to complete the formalities necessary to provide the services requested and offered on the Suppliers Portal (Tender Specifications query and download, and subscribing for alerts on new Aena tenders).

      Processing based on your consent, and using your contact data to establish a relationship with your company, processing based on legitimate interest in accordance with Law 3/2018, on Personal Data Protection and the Guarantee of Digital Rights. AENA informs you that your consent provided for this purpose can be revoked at any time by sending an email to ocpd@aena.es, stating “WITHDRAWAL SUPPLIER CONSENT” in the subject line and attaching information so we can identify you. Your data will be stored while you do not request to unsubscribe and while any claims may arise. No transfers, unless required by law, or international transfers are envisaged.

    • Managing our profiles on Social Networks: In this regard, information collected via our social networks is used, based on Aena’s legitimate interest, to:

      • Manage and respond to doubts and incidents regarding services offered by Aena reported to us via social networks.
      • Analysing messages received and preparing anonymised reports. This helps us to better understand our customers, what they like and how they react to our services, so we can generally improve Aena services.

      Data processed are the identification data from your social network profile, comments posted, as well as personal data you provide us with to resolve your incident: Name and surnames, telephone, email, data necessary for a specific service (registration, booking locator, bank details, PRM, VIP Lounges, Fast Track, Fast Lane, etc.), as well as content generated by you or provided by you in private messages on our social networks.

      Your data will be stored while necessary to comply with the planned purposes and, subsequently, they will be stored duly blocked while liabilities may arise from performing our contractual or pre-contractual relationship, as well as to comply with Aena’s other legal obligations.

      Your data may be communicated to concessionaire companies related to the services provided by Aena or even provided by them, when communication is necessary to deal with your request or incident. No international data transfers are envisaged.

    • Managing Public Information Requests.If you submit a Public Information Request, your data will be processed to deal with your request for access to public information in accordance with Law 19/2013 on Transparency, Access to Public Information and Good Governance. The processing is required by law. Data will be stored while being processed and while any claims may arise. Your data will not be transferred to third parties unless required by law. No international data transfers are envisaged
    • Dealing with requests to Exercise Data Protection Rights. If you exercise your recognised rights before any group company, we will process your data to manage, control and process the exercise of data protection rights (where applicable), based on compliance with a legal obligation. Data will be stored during a period of three years after resolving the request (liability limitation period of Organic Law 3/2018, on Personal Data Protection and the Guarantee of Digital Rights). Your data will be communicated to entities involved in processing your request (where appropriate) as well as the authorities established by legal obligation. No international data transfers are envisaged.
    • Request for hidden disabilities lanyard: By filling in this form, your data will be recorded for the use of the ‘Hidden Disabilities Lanyard’. We will process your data for the purpose of making it easier to pass through the security checkpoints for families and PRMs at Aena’s airports and in order to be able to confirm that you have a flight for the day in question (processing based on your explicit consent, which you may withdraw at any time), and also to carry out a satisfaction survey (processing based on legitimate interest, in order to improve the service. In this regard, we have performed an internal analysis weighing up your right to data protection and our interest in conducting such surveys, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part regarding this processing, and that specially protected data will not be processed, nor will this involve automated decisions. For more information, write to dpd@aena.es. The data will be kept for the time necessary for the above purposes, as well as the time necessary to comply with legal requirements, and no transfers (unless required by law) or international transfers of data are foreseen.
    • Processing in connection with cookies. At Aena we use technical, analytical, advertising and personalisation cookies that collect the data subject's personal data, based on the need to provide the service (technical cookies) or on your express consent (analytical, advertising or personalisation cookies), granted by accepting all cookies or through the cookie options presented when you access one of our web domains. For more information see your cookies policy.

For certain services (Aena Club, Parking Booking Management, VIP Services, Aena Marketplaces, carried out through our website or APP; boarding card data for the Security Control Fast Lane and Fast Trak filters) we will also process your data to perform an anonymisation process, based on our legitimate interest, thus obtaining aggregated and anonymous data, for further statistical or other legitimate business purposes.

In this regard, we have performed an internal analysis weighing up your right to data protection and our interest in conducting such surveys, concluding that there is a reasonable expectation (elimination of all data that allow your identification, through processes of erasure, aggregation or replacement of such data by other data that cannot be associated with a natural person) that specially protected data will not be processed, nor will this involve automated decisions. You can oppose this or request additional information using the channels provided for this purpose in this policy by sending an e-mail to dpd@aena.es.

How does this Policy affect me if I am also an employee of a company that works at the airport, or I work in a company that provides services to one of the Aena group companies?

If you work for an external company, you can consult the specific privacy policy by clicking here.

How does this Policy affect me if I am either an individual business owner or an Aena supplier?

In this case, Aena group companies will process your personal data as representative of your company or as an individual business owner, for the purpose of participating in contract tender and execution processes, as well as to process electronic notifications during the contracting process via our systems, or to manage the services provided by suppliers and to customers (managing the service contracted, use of telephone contact media and provided by the supplier to notify matters related to the service provided and its administrative management, obligations necessary to comply with tax regulations and to manage payment and collection of services provided).

In these cases, we inform you of the obligation to provide mandatory data, for the development of the contract, to apply pre-contractual measures or data required to comply with relevant legal obligations. Otherwise, the contract cannot not be performed or signed, or Aena could not comply with its legal obligations.

Data of the tender winning company, companies submitting tenders and the representatives of these companies will be processed by Aena for the purpose of correct management of the contractual and pre-contractual relationship, legal obligations (public sector contract regulation and regulations on electronic signatures) and based on your consent expressed by signing the annexes and forms that must be submitted with bids to take part in the tender.

Professional contact data provided may also be used to establish a relationship with your company, processing based on Aena’s legitimate interest.

Who may we receive your personal data from?

In general, Aena collects personal data directly from the interested party through the application or registration forms for the different services it offers, as informed in this policy.

Sometimes, personal data may come from third parties, such as airlines, customers and collaborating companies, when it is necessary for the execution of a contract to which the interested party or their company are parties, or when there is a legal requirement to do so.

How long will we store your data for?

Your data will be retained while necessary to comply with the purpose for which they were collected.

They are subsequently stored for as long as claims and obligations may arise as a result of the processing of your data for the purpose for which they were collected.

Who receives your data?

In addition to those indicated above, the communications envisaged are as detailed below:

  • To entities involved in Administrative and Legal Proceedings (where appropriate).
  • To Courts (where appropriate).
  • To Security Forces and Custom Authorities (to comply with legal obligations).
  • To State Security Forces for the purpose of preventing a real and serious danger for public security or to prevent criminal violations, following the formal requirements of the Spanish Data Protection Agency, and to comply with legal obligations (National Security Programme and Regulation (EU) 2015/1998).
  • To your bank or savings bank to pay for the services provided.
  • To the State Air Security Agency (AESA) for inspections.
  • To your airline if we provide you with a service contracted by the company (for example, VIP lounges) for the purpose of invoicing.
  • To other entities involved in processing your claim or complaint.
  • To Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E, in the event that you make a reservation through Aena's website for a service for said airport.
  • Furthermore, if you contract any product requiring a payment and said payment is not made within the allotted time, thereby incurring a failure to comply with regulations governing such matters, the information on you as a debtor may be added to files related to the breach of financial obligations.
  • To Aena Desarrollo Internacional S.M.E., S.A., in the event that you present any request, claim, complaint, or request any service addressed to that entity.
  • To entities issuing digital certificates provided for the purpose of verifying validity.
  • And to the individuals, entities or authorities that may require them by law.
  • Aena group entities that will benefit from the selection processes, in the event of applying for a position for those entities, that is:

    • Aena SME, S.A., registered in the Companies Register of Madrid, Volume 28806, Folio 211, Section 8, Sheet M-518648, with Tax ID Number (CIF) A86212420, and with registered office at Calle Peonías 12, Madrid 28042.
    • Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., registered in the Companies Register of Murcia, Volume 3294, Folio 63, Sheet MU93208, with Tax ID Number (CIF) A-73988313 and registered address at Avenida España 101, Valladolises y Lo Jurado, 30154 Murcia.
    • Aena Desarrollo Internacional S.M.E., S.A., registered in the Companies Register of Madrid in Volume 11288, Folio 153, Section 8, Sheet M-177.425, Entry 4, with Tax ID Number (CIF) A37250883 and registered address at Calle Peonías, 12, 28042 Madrid.

Aena, Aena Desarrollo Internacional and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia will be responsible for the processing of your personal data that will be used to manage job applications and selection processes managed through the website. In this way, no further international transfers or transfers of data are foreseen, except where there is a legal obligation.

What security measures are guaranteed with regards to your data?

Aena and Aena Concesionaria del Aeropuerto Internacional de la Región de Murcia, as the data controllers, will adopt the technical and organisational measures required to guarantee the security of the personal data provided, preventing their unauthorised alteration, loss, processing or access.

How can I exercise my rights?

Any data subject is entitled to receive confirmation as to whether or not his or her personal data are being processed. The General Data Protection Regulation also stipulates the following rights for the data subject:

  • Access to his or her data.
  • Requests for rectification or deletion of his or her data.
  • Requests for limitation of data processing.
  • Portability of his or her data.
  • Objection to his or her data being processed.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and also withdraw your consent, with either AENA, S.M.E., S.A. or Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., by sending an email to ocpd@aena.es or by writing to Calle Peonías, 12, 28042, Madrid, as well as on the Procedures and Claims Portal at https://tramitesyreclamaciones.aena.es/en/procedures-and-claims.html.

You may also request additional information about internal analyses weighing up your right to data protection and our legitimate interest, for the processing described in this policy based on legitimate interest, by contacting our data protection officer as explained below.

How can you contact the Data Protection Officer?

If you have any doubts, please contact our Data Protection Officer at the following email address: dpd@aena.es

You are also entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD- https://www.aepd.es/es), the supervisory and control authority for data protection in Spain.