PRIVACY POLICY

This policy is designed to inform all users of Aena airport facilities and users of our corporate website.

What is the purpose of this document?

The purpose of this document is to notify you that your personal details are processed in accordance with Personal Data Protection laws, in particular, those of Regulation (EU) 679/2016 of the European Parliament and Council of 27 April 2016, relating to the protection of individuals with regards to the processing of personal data and free circulation of those data (GDPR) and Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights.

Who is the Data Controller?

How does this Policy affect me if I am a user of the airport facilities?

What types of data will be processed?

Why do we process your personal data?

How does this Policy affect me if I am a user of the website?

How does this Policy affect me if I am also an employee of a company that works at the airport, or if I work for a company that provides services for one of the companies in the Aena Group?

How does this Policy affect me if I am either a sole proprietor or a supplier to Aena?

Who can we receive your personal data from?

How long will we store your data for?

Who receives your data?

What security measures are guaranteed with regards to your data?

How do I go about exercising my rights?

How do I contact the Data Protection Officer?

Pivacy Policy for the Facial Biometric Pilot Project at Adolfo Suárez Madrid-Barajas Airport

Pivacy Policy for the Facial Biometric Pilot Project at Menorca Airport

 

Who is the Data Controller?

The data controller will be:

Aena SME, S.A. (AENA)
Address: Peonías, 12. 28042 Madrid.
Tax ID Number: A86212420
Companies Registry of Madrid, Volume 28.806, Folio 211, Section 8, Sheet M-518648.

In the event that you enjoy services provided at the Región de Murcia International Airport, the data controller will be:

Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, S.A. (AIRM)
Address: Avenida de España, 101, Valladolises y Lo Jurado, 30154 Murcia.
Tax ID Number: A73988313
Companies Registry of Murcia, Volume 3.294, Folio 63, Sheet M-U93208.

 

How does this Policy affect me if I am a user of the airport facilities?

We inform all users of our airport facilities of the following:

 

What types of data will be processed?

The following types of personal data are processed:

  • Identification and contact data, such as image, voice, recordings, etc.
  • Data relating to personal and health characteristics (e.g. PRM).
  • Curricular and selection data, along with academic and professional data.
  • Data on personal circumstances, loyalty cards with companies, data on complaints or claims.
  • Financial data, relating to payment methods.
  • Data on your flight.

 

Why do we process your personal data?

The personal data that you provide to us or that will be provided at the time you start your relationship with us and those that may be collected or generated throughout that relationship, will be processed for the purposes indicated in each fact sheet, personal data collection form or by any other means that is made available to you at the airport itself, and are summarised below:

  • Videosurveillance for the purposes of control and monitoring of airport operation (operation and maintenance) and security, protection of persons and goods at airport facilities. In some airports, your image as a driver, captured on entry to and exit from the car park for security purposes, may be processed. All of this is based on the Public Interest (airport security regulations, operational security and private security). Your data (images) are kept for a maximum of one month from the date of capture. Your data will be communicated to the customs authorities for the provision of customs and tax services (legal obligations), to the Security Forces for the purpose of preventing a real and serious danger to public safety or for the repression of criminal offences, following the formal requirements of the Spanish Data Protection Agency, and for the fulfilment of legal obligations (National Security Programme and Regulation (EU) 2015/1998). There is also provision for possible communication to third parties on the basis of their legitimate interest, after weighing up the rights and freedoms affected (Article 6.1.f GDPR). No international data transfers are planned.
  • Managing and handling airport claims, as well as managing and processing all types of claims/complaints/suggestions/requests for information, basing such processing on the consent given. You can withdraw your consent at any time, by sending an email to ocpd@aena.es, indicating “Withdrawal of Consent” + Type of Request + Airport, attaching information proving your identity. The data will be kept during processing, as well as during the period in which a complaint may arise. The data shall be communicated, where appropriate, to the airline, company or body involved in processing the claim, complaint, request or suggestion; to Judges and Courts in the event that your complaint leads to legal action, as well as to the authorities established by law. No international transfers are planned.

    This service includes the management, control and processing of claims, complaints and suggestions sent to both Aena S.M.E., S.A. and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A. or to Aena Desarrollo Internacional S.M.E., S.A., where appropriate, as well as all types of complaint, claim or suggestion services through the Online Services Portal on the Aena website.

  • If you are an Authority , your data will be processed to manage and control the services provided to Authorities: managing visits, managing authority lounges, recording and maintaining institutional contacts, based on compliance with a legal obligation. We also inform you of the origin of the data; sometimes they may come from the public body or administration to which you belong. The data will be kept for the duration of your relationship with our company, and for as long as a complaint may persist. No communication to third parties or international transfer of data is foreseen.
  • Sending comercial comunications where appropriate, based on your consent. You can withdraw your consent given at any time, by sending an email to ocpd@aena.es indicating “Withdrawal of Consent Commercial Communications”, attaching information proving your identity.
  • Managing airport users: visits, ccc based on your consent. We will also manage your temporary accreditation for the visit (as a visitor and/or for operational or professional reasons), access control and security of the facilities; and we shall monitor visits to the airport or centre, basing this processing on a legal obligation (private security regulations) and public interest (airport security). The data will be kept during the management of the visit and for a period of one month, as well as during the period in which a complaint may arise. Your data may be communicated to the Security Forces, in accordance with legal obligations, and no further transmissions or international transfers are foreseen, other than where there is a legal obligation to do so.
  • Managing your request for assistance to People with Reduced Mobility (PRM). The company will also carry out a satisfaction survey in order to improve the service, basing these processing on the correct performance of the contract. To access the service, you go to the designated areas in the airport or book the service in advance through the Aena website or your airline. Your data may arrive at Aena from the airline company if you make the reservation through your company's website or travel on an arrival flight to an airport in the Aena network from other airports. Your data will be kept for as long as necessary to fulfil the purpose, as well as for as long as a complaint may arise. There is no provision for transmissions (except by law) or international transfer of data.

    Processed data: Identification, contact, health data (type of disability or special needs) and flight details.

  • When appropriate, recording your telephone calls to certain telephones (operational, incident investigation, emergencies), based on your consent, fulfilment of contract, vital interest, public interest, exercise of claims, as appropriate (depending on the type of call made).

    The period of retention of the recordings will be that necessary for the end or purpose for which they were made; however, they will be blocked only at the discretion of judges and courts for the rest of the period before their destruction. The period before the recordings are destroyed will be determined by the purpose of the recording. No international transmissions or transfers are envisaged, unless legally required.

  • Management and handling of complaints from the car park: We inform you that the images captured by the car park access cameras, which include cameras that capture the vehicle's data (front and/or rear licence plate recognition and reading system), will be used to comply with legal obligations including those derived from the legislation regulating the parking contract, such as the obligation to identify the vehicle. In some airports, your image as a driver, captured on entry to and exit from the car park for security purposes, may be processed, based on the public interest (see Video Surveillance). Likewise, your entry and exit details, registration number and details of your reservation, if applicable (see information regarding the processing “Aena's Parking Reservation”), will be processed for the management of the car park. This processing is based on the fulfilment of the contract. Your data may be processed for the processing and resolution of claims, in compliance with legal obligations.

    In the case of parking of subscribers or staff, additionally, we will process your data (identification and contact details and, where appropriate, your company’s data), which may be provided by your company, for the management of your subscription. This processing is based on the fulfilment of a contract (and where appropriate, the contract between your company and Aena. In this case, your data may be communicated to your company for the development of this contract), which will be kept for the duration of your subscription and, subsequently, for the legal periods in the event of any complaint. Processed data: Images of the vehicle (front and/or rear licence plate recognition), entry and exit time, licence plate obtained and your reservation details if applicable, means of payment.

    The images captured will be kept for the duration of the stay in the car park and will subsequently be kept for a maximum of one month. The car park management data will be kept for the duration of your stay and/or your contract (in the cases indicated above), as well as for the period that a complaint may arise.

    The data may be communicated to your bank to charge the service provided (if applicable), to your company, if necessary for the performance of your contract (if applicable) and the transfer of the data is foreseen to the State Security Forces for the purpose of preventing a real danger to public safety or for the repression of criminal offences, and to Judges and Courts in the event of a court order. No international transfers are envisaged.

  • Controlling passengers passing through security checkpoints to the boarding area and, where appropriate, recording incidents in such access (in compliance with a legal obligation) and make statistics (based on legitimate interest). The processing consists of checking that the boarding pass read corresponds to a flight on the day that has not yet taken place. If everything is correct, it allows it to pass through the checkpoint. In any case, you will have the opportunity to challenge the decision taken and to request that these checks be repeated by a security operator.

    Fast LaneFast pass checkpoint for VIP airline passengers . Legitimation: necessary for the fulfilment of the contract. The system allows the passenger to pass through the Fast Lane checkpoint if she/he has acquired this VIP right from the airline or has acquired this right on the Aena website.

    Data processed: the data read from your Boarding Pass, using the boarding pass readers located before the security checkpoint and Fast Lane checkpoint step..

    The data will be communicated to the operating company of your flight or the handling company that operates your flight and that operates on behalf of the airline, in order to speed up boarding to the scheduled flight and to verify the authenticity of the identification document in case it is detected that your pass has been previously registered (based on contract fulfilment), to the State Security Forces for the purpose of preventing a real and serious danger to public security or for the repression of criminal offences, in accordance with the formal requirements demanded by the Spanish Data Protection Agency, and for the fulfilment of legal obligations (National Security Programme and Regulation (EU) 2015/1998), and to Customs Authorities (for the fulfilment of legal obligations). In the case of Fast Lane, your details will be provided to the carrier for monitoring and, where appropriate, billing by the carrier for the service provided, based on the fulfilment of the contract between the carrier and you.

  • Management of airport medical services provided by Aena or any external collaborating entity contracted for this purpose, with the aim of providing a first aid service (emergency primary care and emergency medical transfer) at the airport, as well as to produce statistics. Your data will be processed on the basis of legitimate interest (to obtain statistics), and on the basis of compliance with legal obligations (health regulations), or to protect your vital interests in the event of inability to provide it.

    Processed data: Identification and health details.

    Your data will be kept for the time necessary to comply with the purpose for which they are collected and to determine any responsibilities that may arise from that purpose and their processing, taking the health regulations that apply as a reference. Your data may be communicated to hospitals or other medical centres if the service provided is deemed necessary for the same purpose. In any other case, no data will be communicated, unless legally obliged or required by a court. No international transfers are planned.

  • Legal defende and legal advice: in cases in which it is part of a legal file of Aena S.M.E., S.A. or Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., based on compliance with a legal obligation.
  • In the event thar you find lost property, or you wish to claim lost property, your details (identification and contact details, documentation proving ownership of the property) will be processed for the management of lost and found objects, monitoring their storage, registration of entry and exit, returns, identification of finders and claimants of lost property, based on the fulfilment of a legal obligation. The data will be kept for 2 years, as well as for the period of time that a complaint may arise, and will be communicated to the Lost Property Office of the City Council, if it has such a service, in order to comply with Articles 615 and 616 of the Civil Code, and, if applicable, to other authorities established by law. There are no plans for international data transfers.
  • Statistical purposes, based on legitimate interest or compliance with a legal obligation, as appropriate.
  • Record of entry/exit of documentation and archiving thereof (in case of presenting or being part of the documentation), based on the processing required to process your request. The data shall be kept for the time necessary to comply with the management of the register and documentation, as well as for the period during which a complaint may arise. Personal data may be communicated to those entities or individuals to whom the request is addressed. International data transfers may be performed in cases where the request is addressed to a country outside the European Economic Area (EEA) and is necessary for the processing or fulfilment of the contract.
  • In the event that you are requesting authorisation to carry out air activities, with remotely-piloted aircraft (drones or RPAS) or any other air activity, we will process your personal data (identification and contact data, types of operations, details of the aircraft and details of the operations to be carried out on the aircraft) based on legal obligations (aviation safety regulations) in order to manage the authorisation with the relevant bodies. The data will be kept for the duration of the proceedings, as well as for the time that a complaint may arise and will be communicated to AESA and the Air Traffic Service Providers of the airports involved and of the airspace concerned, in accordance with legal obligations (aviation safety regulations).
  • Free Aena Wifi Service: In order to offer the Wifi service, AENA may obtain personal contact details that have been provided by the USER at the time of accessing or registering for the Wifi service. In particular we inform you that:

    • If the access registration is made through Facebook or another social network, we can use the data provided through the social networks.
    • If the registration is made through our Aena Club Cliente service, we may use the login details (username and password) that the USER already has as a member of Aena Club Cliente.
    • If the registration is made directly through the Wifi access portal we may use the personal data provided at the time of registration for access.

    The legal basis for the processing of USER data is the fulfilment of the contract for the provision of Wifi services according to the Terms and Conditions of Use, as well as the fulfilment of legal obligations related to Article 31 bis of the Criminal Code and the obligation of Law 25/2007, on the retention of data in electronic communications.

    At the same time, if the USER explicitly accepts by checking this acceptance option, Aena may use the data provided in registration to this Wifi service, as well as the data obtained from navigation and geolocation to provide a customised experience by sending commercial and advertising communications by electronic means, sent by Aena itself, such as newsletters with information of interest to passengers or promotions and discount coupons from the Aena Airport shops or from third parties on the following areas or sectors: Automotive and car rental, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, financial and insurance, press and magazines, gambling, betting.

    This processing is based on your consent. AENA hereby informs you that consent given to this effect can be revoked at any time by sending an email to serviciowifi@aena.es or ocpd@aena.es entering “REMOVAL OF WIFI CONSENT” in the subject. In the event that the USER requests the revocation and/or cancellation of the sending of commercial and advertising communications and/or information by electronic means indicated, AENA will process the data associated with the device and the data of the USER's login credentials in order to be able to process the cancellation request. In no case does the withdrawal of consent condition the fulfilment of the contract for the provision of the Wifi service. The sending of commercial and advertising communications and/or information by electronic means indicated, the prospective offer of products and services for commercial, advertising or general information purposes, as well as statistical and segmentation purposes is based on the consent requested from the USER.

    Processed data: Identification details such as email address (if access is by email), password and username (if access is by Aena Club Cliente) or other equivalent data if access is by social networks. There are also other data that are recorded in the system and are also mandatory for the purposes mentioned, such as: name of the device that connects to the Wifi, MAC address, IP address, telephone number and IMEI (if the access is via a telephone) and connection and navigation data, geolocation.

    Your data will be kept for the time necessary to comply with the purpose for which they were collected, as well as the period established by legal obligation in Law 25/2007. They will also be stored for as long as claims and responsibilities may arise as a result of the processing of your data for the purpose for which they were collected.

    No data will be passed on to third parties except for the obligations provided for by law. If necessary for the development of the activity or the provision of the service, the data may be transferred internationally, for which Aena will take the appropriate measures.

  • In the event that you are designated as a beneficiary of the life and accident insurance by any employee of Aena, we inform you that the companies of the Aena Group (depending on which company of the group our employee works for) will process your personal data (name and surname and ID card) for the management of the insurance and its communication to the insurance broker and the insurance, all in compliance with legal obligations applicable to our companies. Your data will be kept for as long as they are necessary for the purpose and subsequently for 3 years ( Royal Legislative Decree 5/2000 of 4 August, approving the consolidated text of the Law on Social Order Offences and Sanctions ).

If there is a specific Privacy Policy for any service, the provisions thereof will apply.

 

How does this Policy affect me if I am a user of the website?

We inform all users of our website of the following means of processing:

  • As regards the Contact methods and data provided via our website, the purpose is to provide a response to your requests for contact, services, information, queries, suggestions or complaints of any nature that we may receive by making use of the contact methods provided, based on legitimate interest, legal obligation, performance of contract and/or consent, as appropriate in each case.
  • Regarding the Aena Employment section: There are two types of processing:

    • “Interested parties” section: The data collected in the registration (email address) will be processed in order to keep you informed by email of future calls for employment, the processing being based on the consent given. You can unsubscribe from this processing yourself, by re-entering your email address on the form (as though you wanted to register again). The system detects that you are already included in the distribution list and will offer you the option to unsubscribe.
    • Manage the job applications and the information that you provide us with (identification data, contact data, curriculum vitae and information provided for the selection process) through our website, related to the selection processes that are being carried out within the Aena Group, as well as keeping you informed, through AENA S.M.E., S.A., of future calls for permanent positions in these group companies, all based on your consent, a legal obligation (Law 19/2013 on Transparency. Your data is also communicated to trade union representatives as required by labour legislation and the Organic Law on Trade Union Freedom (Law 11/1985)) or public interest (certain information is requested from candidates for security reasons), as appropriate in each case.

    You can withdraw your consent given at any time, by sending an email to ocpd@aena.es indicating only “Withdrawal of Consent Interested Parties”; or “Withdrawal of Consent Selection”, attaching information proving your identity.

    Aena, Aena Desarrollo Internacional and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia will be responsible for the processing of your personal data that will be used to manage job applications and selection processes managed through the website.

    The data will be kept for the duration of the selection process, as well as for the period during which a complaint may arise.

    Interested parties: we inform you that once you have registered as an interested party, your email address will be saved for the three years immediately following, after which it will be deleted from our database, and you will have to register again if you are still interested in future selection processes.

    Your data relating to your applications for employment, as indicated above, may be communicated to the trade union representatives if necessary in accordance with the applicable regulations. In addition, we inform you that by legal obligation of the Law 19/2013, of 9 December, on Transparency, Access to Public Information and Good Government, for participation in any of the processes, the results of candidates may be published on the web, previously dissociated from other personal data.

    For certain job applications, your data may be provided to the State Security Forces for criminal records checks, based on public interest (National Civil Aviation Security Programme).

    To the entities of the Aena Group that are beneficiaries of the selection processes, operating in airport management, based on your consent, in the event that you apply for a post for these entities and no further international transfers or transmissions are envisaged, except under legal obligation.

  • With regard to our Aena Club Cliente service, the purposes are:

    • When you register with our Club Cliente, the data you have provided will be processed with the aim of informing you of the benefits of the services provided by Aena regarding VIP Services, Parking, Flights and other services belonging to Aena's airport management, as well as communicating information about them (processing based on acceptance of the terms and conditions of the service).
    • Likewise, and provided that you have expressly authorised us to do so (processing based on your consent), Aena will send you commercial and advertising communications by electronic means, such as promotions and discount coupons from Aena Airport shops or from third parties, on the following areas or sectors: automotive and car rental, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, financial and insurance, press and magazines, gambling and betting.
    • If you access our Market Place at any time, your Aena Club Cliente member data will be processed to allow you to log on to the service, as well as to manage, process and monitor the products and/or services that you acquire (based on the fulfilment of a contract by accepting the terms and conditions of the service) and to send you commercial communications based on the consent given (by means of a request for explicit consent in the Market Place itself).
    • Aena is promoting a biometrics project at the Adolfo Suárez Madrid-Barajas Airport. If, voluntarily, you decide to use this new service (processing based on your consent), you will be able to access it in your capacity as a member of Aena Club Cliente, notwithstanding the additional information required for the provision of the service.

      Given the special nature of biometric data, Aena guarantees compliance with all the legal obligations that relate to it in terms of data protection.

      More information is available at the end of this policy.

    • Finally, in the event of contracting a product with an associated obligation to pay, if payment is not made within the period stipulated and the requirements set out in the regulations are not met, the data relating to non-payment may be transferred to files relating to the failure to comply with monetary obligations.

    Aena Club Cliente is a service that Aena offers to the group of users registered as members of the club, access to discounts, promotions, offers, news and advantages in certain services or benefits of Aena, and sends members of the group precise and updated information about these and related to your condition as a member.

    In accordance with the Terms and Conditions, sending communications with information regarding these discounts, promotions, offers, news and benefits of the Aena services is a necessary requirement for subscription to the agreement between yourself as a registered member and user of the Club, and Aena, and to have access to these benefits. Therefore, by unsubscribing from these communications you will also cancel your Club membership, meaning you will not be informed of the discounts, promotions, offers, news and benefits applicable at any time to the services offered through the Club.

    Consequently, if you do not wish to receive these communications with information on these benefits you may request to be removed from the communications at any time through the relevant channels.

    If you request a service for the Región de Murcia International Airport, your details will be sent to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., a subsidiary of Aena which manages the airport, for the provision of the service.

    No further communication or international transfer of data is envisaged unless legally required.

    The data will be kept for as long as you remain a member of the Club, as well as for the appropriate legal periods of time to deal with any claims and responsibilities arising from the processing.

    You can withdraw your consent at any time.

    Club Cliente members may also use the following services (based on the fulfilment of a contract):

    1. Payment by mobile. You are hereby informed that Aena will store the last four digits of your credit card in order to identify the card used for payment of the contracted service.

      When using the Parking services, your car registration number will be stored to allow us to determine how long you have used the parking services, so that we can bill you accordingly.

      If you pay for access to one of the VIP Lounges managed by Aena using your mobile device, your ID information will be collected for identification purposes.

      In the event that the member associates the payment made through our mobile application with his or her status as a member of the “Club Cliente”, please note that Aena will process the information collected to create a commercial profile as a member of “Club Cliente”, to segment the customers who are members of the Club, to send personalised commercial offers, and to improve their experience as a user of our mobile application.

    2. Pago por Registration. This new stay management and payment system for stays in the car park offered by Aena will entail processing the vehicle registration and credit card details provided by the user in his or her Aena Club Cliente profile.

      The Payment by Registration service involves reading and identifying the vehicle registration number when entering and leaving the car park. It will therefore not be necessary to issue a ticket when entering and leaving. Once you have entered the car park, the reader will recognise your registered number plate, and this will be associated with the user with the Payment by Registration service enabled, which will automatically raise the barrier and allow you to enter and park your vehicle. This service is only intended for vehicles. This means that motorcycles are excluded from using the Payment by Registration system, in light of complexities arising when reading their registration numbers.

      In order to enjoy club discounts, you will need to scan your return boarding pass so that the new balance can be calculated and automatically saved.

  • The purpose of the Publications Shop is to manage orders placed via the Publications Shop. This processing is based on the fulfilment of the purchase contract. At the same time, and with your permission, we will inform you of ways in which you might benefit, and will also provide you with information that may be of interest to you relating to services provided by Aena regarding Sale of Publications. We would also like to email you commercial and advertising correspondence, such as offers and discount coupons on specific dates, including World Book Day, the Book Fair, Black Friday etc. This processing is based on your consent. Aena informs you that the consent given to this effect can be revoked at any time by sending an email to ocpd@aena.es entering “REMOVAL OF SHOP CONSENT” in the subject. Your data will be kept for the time necessary to fulfil the purpose for which they were collected, as well as for the time during which claims may arise. Your details will be given to the bank for payment of the service provided. Likewise, in the case of contracting a product that has a payment obligation associated with it, if payment is not made within the term established for it and the requirements set out in the regulations are not met, the data relating to the non-payment may be communicated to files relating to the non-fulfilment of monetary obligations. No further data will be passed on to third parties except for the obligations provided for by law. There are no international transfers of the data.
  • As regards the Aena Car Park Bookings, the data you have provided will be processed for the purpose of managing car parking space bookings that you make through our website. This processing is based on the fulfilment of a contract. At the same time, and with your permission, we will email you commercial and advertising correspondence, such as newsletters with information of interest to passengers, offers and discount coupons for Aena Airport shops or for third parties concerning the following areas or sectors: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling (processing based on your consent).

    The interested party has the right to withdraw consent for commercial communications at any time, without this affecting the management of the contracted service.

    The data from your reservation will be processed later for the management of the car park itself (for more information, see previous section “Management and handling of complaints from the car park”).

    The data will be kept for as long as you remain a customer, as well as for the legal periods of time required to deal with any claims and responsibilities arising from the processing.

    Your data may be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., in the event that you make a reservation through the Aena website for a car park for the airport; to your bank, in order to make the payment for the service provided, and, if applicable, to your company or carrier, if the entity is the contracting party of the service you receive; the legal basis of the processing is the fulfilment of the signed contract. Likewise, if payment is not made within the term established for it and the requirements set out in the regulations are not met, the data relating to the non-payment may be communicated to files relating to the non-fulfilment of monetary obligations.

  • The purpose or airport VIP Services is to manage VIP Lounge access purchases that you make via our website, as well as to send you information that may be of interest to you. The services are as follows:

    • When you register with Meet & Assist, the data you have provided will be processed for the purpose of managing the reservation of the service you make through our website. The processing is based on the fulfilment of a contract, as well as communicating information of interest to you in the contracted service.
    • When you carry out the “Right to Priority Access -Fast Lane-”, process, the data you provide us with will be processed for the purpose of managing priority access bookings that you make through our website, based on the fulfilment of a contract, as well as sending you information of interest regarding the contracted service. For further information, please refer to the previous section “ Control and management of passenger passing through safety checkpoints to the boarding area and Fast Lane”.
    • When purchasing Access to “VIP Lounges”, the data you have provided will be processed in order to manage the purchase of access to these VIP Services that you have requested, based on the fulfilment of a contract, as well as communicating information of interest to you in the contracted service.
    • At the same time, and with your express permission (consent), we will inform you of ways in which you might benefit, and will provide you with information that may be of interest to you relating to services provided by Aena. We will also email you commercial and advertising correspondence, such as newsletters with information of interest to passengers, offers and discount coupons for Aena Airport shops or for third parties concerning the following areas or sectors: cars and vehicle hire, leisure, travel agencies, tourism, transport, airlines, catering, the textile industry, fashion, beauty and cosmetics, finance and insurance, press and magazines, and gambling. The sending of communications may be based on your tastes and preferences.

    Likewise, surveys will be carried out on the quality of the service provided, with processing based on legitimate interest.

    The interested party has the right to withdraw consent for commercial communications at any time, without this affecting the management of the contracted service.

    Processed data: Identification and contact details, request made, means of payment, documentation justifying the request (if applicable). For Meet & Assist: name, surname, email, telephone, date and time of service, airport and terminal.

    The data will be kept for as long as you remain a customer, as well as for the legal periods of time required to deal with any claims and responsibilities arising from the processing.

    Your data may be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., if you request a service for the Región de Murcia International Airport, a subsidiary company of Aena which manages the Airport, for the provision of the service; to your bank, for the payment of the service provided; if appropriate, your personal details may be communicated by Aena to the companies contracting the VIP space (your company or airline) in order to manage access to it, this processing being legally authorised by the fulfilment of the signed contract. Likewise, in the case of contracting a product that has a payment obligation associated with it, if payment is not made within the term established for it and the requirements set out in the regulations are not met, the data relating to the non-payment may be communicated to files relating to the non-fulfilment of monetary obligations. No international transfers are planned.

  • As regards the PRM Services request, we hereby inform you that the data you provide via the form provided for this purpose on the Aena website will be used to manage the services requested by you for assistance for persons with reduced mobility (based on the fulfilment of a contract), as well as to carry out a satisfaction survey to improve the service (based on legitimate interest). For more information, see the previous section “ Managing the service you request for assistance to People with Reduced Mobility (PRM) “.
  • The purpose of the Corporate Responsibility blog is to manage subscriptions for receiving information via email on news from the blog, newsletter, projects and initiatives from Aena’s Corporate Social Responsibility department. This processing is based on the consent given when you subscribe. Aena informs you that the consent given for this purpose can be revoked at any time by sending an email to ocpd@aena.es entering "REMOVAL OF RC CONSENT" in the subject. The data will be kept for the duration of your subscription to this service. No data will be passed on to third parties except for the obligations provided for by law. There are no international transfers of the data.
  • In cases where you present a complaint through the Reporting Channel, your data will be processed by the different companies of the Aena Group (depending on to whom the complaint is addressed) to prevent, detect and correct breaches of the regulations in force or internal regulations of the Aena Group, as well as to process and investigate the complaint in accordance with the provisions of the Code of Conduct of the Aena Group, based on the public interest (Organic Law 3/2018, on Data Protection and Guarantee of Digital Rights) and in compliance with legal obligations (Art. 31 bis of the Criminal Code and Law 10/2010 of 28 April on the prevention of money laundering and the financing of terrorism). Your data will be kept for the time necessary to determine whether or not the complaint is upheld and, if it is upheld, to process the complaint and carry out the appropriate investigations, as well as for the periods during which a complaint may arise. No communication of data is envisaged, unless this is necessary for the investigation or by legal obligation, such as court and administrative authorities, where appropriate. Furthermore, no international transfer of the data is envisaged, unless legally required.
  • In the event that you, on behalf of your company, request a service addressed to companies (e.g. Companies portal), your personal data, as representative thereof, will be processed for the performance of the necessary steps for the service requested, such as the billing portal (consultation of invoices and fleet of aircraft). This processing is based on the fulfilment of a contract. We will also use your contact details to establish a relationship with your company. Processing is based on legitimate interest (in accordance with Law 3/2018, on Personal Data Protection and Guarantee of Digital Rights). There is no provision for transmissions (except by law) or international transfer of data.
  • If, on behalf of your company, you request a service aimed at companies (for example, Suppliers’ portal), your personal data, as a representative of the company, will be processed to carry out the necessary steps to provide the services requested and offered by the Suppliers' portal (consultation and downloading of Contract Specifications, and subscription to receive alerts on new tenders from Aena).

    Processing is based on your consent, and your contact details are used to establish relations with your company. Processing is based on legitimate interest, in accordance with Law 3/2018, on Personal Data Protection and Guarantee of Digital Rights. AENA informs you that the consent given to this effect can be revoked at any time by sending an email to ocpd@aena.es indicating "REMOVAL OF PROVIDERS CONSENT" in the subject and attaching your identification information. Your data will be kept for as long as you do not ask for it to be removed, as well as for the period that a complaint may arise. There is no provision for transmissions (except by law) or international transfer of data.

  • Management of our social network: In this sense, the information collected through our social networks is used, based on Aena's legitimate interest, to:

    • Manage and respond to the questions and incidents that you send to us through social networks about the services offered by Aena.
    • Analyse the received messages and produce anonymised reports. This helps us to understand our customers better, to find out what they like and how they react to our services, which means we can generally improve Aena's services.

    The data processed are data identifying your profile on the social network, comments made, as well as the personal data you provide us with to resolve your issue: Name and surname, telephone number, email address, data required for the specific service (registration, reservation locator, bank details, PRM, VIP rooms, Fast Track, Fast Lane, etc.), as well as the content you generate or provide us with via private messages on our social networks.

    Your data will be kept for the time necessary to comply with the purposes provided and, subsequently, will be kept duly locked, while responsibilities may arise from the fulfilment of our contractual or pre-contractual relationship, as well as for compliance with other legal obligations incumbent on Aena.

    Your data may be communicated to the concessionary companies related to the services offered by Aena or even provided by them, in cases where such communication is necessary to deal with your request or incident. There are no plans for international data transfers.

  • Request for Public Information: To address your request for access to public information, in accordance with Law 19/2013 on Transparency, Access to Public Information and Good Governance. The processing is based on a legal obligation. The data will be kept for the duration of the processing, as well as for the time that a complaint may arise. Your data will not be passed on to third parties unless we are legally obliged to do so. No international transfers are planned.
  • Management, control and processing of the exercise of data protection rights (where applicable), based on the fulfilment of a legal obligation. The data will be kept for 3 years from the resolution of the application (period of limitation of responsibilities of the Organic Law 3/2018, on Data Protection and Guarantee of Digital Rights). Your data will be communicated to the entities involved in the processing of your application (where applicable), as well as to the authorities established by law. No international transfers are planned.

 

How does this Policy affect me if I am also an employee of a company that works at the airport, or if I work for a company that provides services for one of the companies in the Aena Group?

If you are an employee of an external company, you can consult the specific privacy policy at the following link Privacy policy of collaborating company personnel (only in Spanish).

 

How does this Policy affect me if I am either a sole proprietor or a supplier to Aena?

In this case, the companies of the Aena Group will process your data for the purpose of managing the services provided by the suppliers and customers (management of the service contracted, use of telephone and other contact means provided by the supplier for the notification of matters related to the service provided and the administrative management thereof, obligations for complying with tax regulations and management of the payment or charging of the services carried out.

 

Who can we receive your personal data from?

In general, Aena collects personal data directly from the interested party through the application or registration forms of the different services it offers, as reported in this policy.

Sometimes, personal data may come from third parties, such as airlines, clients and collaborating companies, when it is necessary for the execution of a contract in which the interested party or their company are parties, or when there is a legal obligation to do so.

 

How long will we store your data for?

Your data will be retained while necessary to comply with the purpose for which they were collected.

They are subsequently stored for as long as claims and responsibilities may arise as a result of the processing of your data for the purpose for which they were collected.

 

Who receives your data?

In addition to those already listed above, it is anticipated that the following parties will receive your data:

  • To entities involved in Administrative and Legal Proceedings (where appropriate).
  • To Courts and Tribunals (where appropriate).
  • To Security Forces and Customs Authorities (for compliance with legal obligations).
  • To the State Security Forces for the purpose of preventing a real and serious danger to public security or for the repression of criminal offences, in response to the formal requirements demanded by the Spanish Data Protection Agency, and for the fulfilment of legal obligations (National Security Programme and Regulation (EU) 2015/1998).
  • To your bank or savings bank to pay for the services provided.
  • To the State Air Security Agency (AESA) for inspections.
  • To your airline, in the event that we provide a service related to your airline (for example, VIP Lounges) for check-in purposes.
  • To other entities involved in processing your requests, claims or complaints.
  • To Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., in the event that you make a reservation through the Aena website for a service for said airport.
  • Likewise, in the case of contracting a product that has a payment obligation associated with it, if payment is not made within the term established for it and the requirements set out in the regulations are not met, the data relating to the non-payment may be communicated to files relating to the non-fulfilment of monetary obligations.
  • To Aena Desarrollo Internacional S.M.E., S.A., in the event that you present any request, claim, complaint, or request any service addressed to that entity.
  • To persons, institutions or authorities that may require them by law.
  • To the entities of the Aena Group that will benefit from the selection processes, in the event of applying for a position for said entities, that is:

    • Aena S.M.E., S.A., registered in the Companies Registry of Madrid, Volume 28.806, Folio 211, Section 8, Sheet M-518648, with Tax ID Number (CIF) A86212420, and with registered office at Calle Peonías 12, Madrid 28042.
    • Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., registered in the Companies Registry of Murcia, Volume 3294, Folio 63, Sheet MU93208, with Tax ID Number (CIF) A-73988313 and registered address at Avenida España No.101, Valladolises y Lo Jurado CP 30154 Murcia.
    • Aena Desarrollo Internacional S.M.E., S.A., registered in the Companies Registry of Madrid in Volume 11.288, Folio 153, Section 8, Sheet M-177.425, Entry 4, with Tax ID Number (CIF) A37250883 and registered address at Calle Peonías, 12, 28042 Madrid.

Aena, Aena Desarrollo Internacional and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia will be responsible for the processing of your personal data that will be used to manage job applications and selection processes managed through the website. In this way, no further international transmissions or transfers of data are foreseen, except where there is a legal obligation.

 

What security measures are guaranteed with regards to your data?

Aena and Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia, as the data controllers, will adopt the technical and organisational measures required to guarantee the security of the personal data provided, preventing their unauthorised alteration, loss, processing or access.

 

How do I go about exercising my rights?

Any data subject is entitled to receive confirmation as to whether or not his or her personal data are being processed. The General Data Protection Regulation 2016/679 also stipulates the following rights for the data subject:

  • Access to his or her data.
  • Requests for rectification or erasure of his or her data.
  • Requests for militation of data processing.
  • Portability of his or her data.
  • Objection to his or her data being processed.

You may exercise your rights of access, rectification, erasure, objection, limitation of processing and portability, as well as withdraw your consent, both against Aena, S.M.E., S.A. and against Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia S.M.E., S.A., by sending an email to ocpd@aena.es or by writing to Calle Peonías, 12, 28042, Madrid, as well as through the Online Services Portal (https://serviciostelematicos.aena.es).

 

How do I contact the Data Protection Officer?

If you have any doubts relating to data protection, please contact our Data Protection Officer at the following email address: dpd@aena.es.

Furthermore, you are entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD); the control and supervisory body for data protection in Spain.

 

Privacy Policy for the Facial Biometric Pilot at Adolfo Suárez Madrid-Barajas Airport

You can consult the detailed policy of this project at the following link:: Biometrics Privacy Policy.

 

Privacy Policy for the Facial Biometric project at Menorca Airport

In the event that, as a passenger, you have voluntarily chosen to use the biometric system on the devices located at the airport, we inform you that the data collected by this system (image of your face, ID card/Passport data, boarding pass) will be used by Aena, S.M.E. S.A., with business address at C/Peonías 12, 28042 Madrid (Tax ID Number: A86212420) as data controller, in order to facilitate your transit through the airport, speed up movement through the checkpoints, security and make your identification at boarding.

This biometric system is only active for national flights of the Air Europa Airline Company, originating from Menorca Airport.

The processing is based on your consent (which can be withdrawn at any time by emailing ocpd@aena.es with a copy of your ID card/Passport, as the database is encrypted and we need this information to locate it) and in the public interest of Aena to ensure airport security.

Your data will be stored for the duration of the biometric identification service provided by Aena, and you may cancel this at any time (withdrawing your consent, as indicated above, or exercising your right to erasure).

Automated decision-making process, logic used and effects: The choice to carry out identification operations using facial recognition technology means that verification of your identity will be fully automatic. In particular, the validity of your identity document, the correspondence with the data shown on the boarding pass and the correspondence between the image of your identity document and your face will be fully evaluated. If the identification procedure is not successful, you may be delayed or denied passage through security turnstiles, passage through turnstiles to board your flight. In any case, you will have the opportunity to challenge the decision taken and to request that these checks be repeated by a security operator or by an airline operator, or to carry out this transit by traditional non-biometric means, by showing the relevant documents at each checkpoint established at each airport.

This biometric identification service is voluntary, so if you do not want to use it you can transit the airport in the traditional way presenting the corresponding documentation at the checkpoints of each airport.

Boarding Pass and ID card/Passport details have been provided to Aena by the airline company (Air Europa).

Your data may be sent to the State Security Forces for public security purposes and to the airlines to facilitate their security obligations regarding the identification of passengers and the development of transport contracts, as well as to any of the public authorities established by law. No data is expected to be transferred to another country unless required by law.

Aena S.M.E., S.A., as the data controller, will adopt the necessary technical and organisational measures to guarantee the security of the personal data you provide, avoiding its alteration, loss or unauthorised processing.

You can exercise your rights of access, rectification, erasure, objection, portability and limitation of processing, through the following email address ocpd@aena.es. The data can be accessed through the Online Services Portal on the Aena website (www.aena.es), or by writing to the Central Data Protection Office, Calle Peonías, 12 - 28042 Madrid. If you have any doubts relating to data protection, please contact our Data Protection Officer at the following email address: dpd@aena.es.

A complaint may also be lodged with the Spanish Data Protection Agency at any time (www.aepd.es).