London Luton Airport Operations Limited ("LLA") is committed to protecting the privacy and security of your personal data. Your “personal data” means any information about you, so long as you can be identified directly by that information or indirectly by that information if it is combined with other information. It does not include data which cannot be connected to you (such as anonymous data).
LLA is a "data controller". This means that we are responsible for deciding how we hold and use personal data we collect about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. This privacy notice describes how we collect and use your personal data in accordance with the EU General Data Protection Regulation 2016/679 and the Data Protection Act 2018.
We may update and change the content of this notice at any time.
You have the right to:
Request access to your personal data (commonly known as a “data subject access request”). You can get a copy of the personal data we hold about you and check that we are processing it lawfully.
Request correction of the personal data that we hold about you. You can have any incomplete or inaccurate data we hold about you corrected, though we may need to check that any new data you provide to us is accurate.
Request erasure of your personal data (commonly known as “the right to be forgotten”). You can ask us to delete or remove personal data where there is no good reason for us to still be processing it. There are sometimes legal reasons why we can’t comply with your request of erasure, which we will explain at the time if they apply.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which means that the processing impacts on your fundamental rights and freedoms. Sometimes we will have a reason for processing which overrides your objection, but if that is the case we will explain what that is. You also have the right to object without giving a reason, where we are processing your personal data for direct marketing purposes.
Request restriction of processing of your personal data. You can ask us to stop processing your personal data if:
- you want us to check that it’s accurate;
- our use of the data is unlawful but you don’t want us to erase it;
- you need us to hold the data for longer than normal, to help you to bring or defend legal claims; or
- you have made an objection to our use of your data which we are looking into.
Request the transfer of your personal data to you or to a third party. You can ask for us to provide your personal data in a structured, commonly used, machine-readable format if it’s being processed automatically on the basis of your consent or to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If that has an impact on the services we can offer to you, we will explain that at the time.
Complain to the ICO if you are not satisfied with any aspect of our handling of your personal data. Contact details for the ICO can be found here: https://ico.org.uk/make-a-complaint/ or by calling their helpline (0303 123 1113), but we would always appreciate being given a chance to resolve the problem first, if we can.
LLA is the controller for the personal information we process, unless otherwise stated. You can contact us by email at
[email protected] or via our postal address: London Luton Airport, Percival House, 134 Percival Way, Luton, Bedfordshire LU2 9NU. If you write to us at our postal address, please mark your envelope ‘Customer Services Department’.
Our Data Protection Officer is John Williams. You can contact him at
[email protected] or via our postal address: London Luton Airport, Percival House, 134 Percival Way, Luton, Bedfordshire, LU2 9NU. If you write to us at our postal address, please mark your envelope ‘Data Protection Officer’.
This section of this notice applies to you if you access or use our website (if you purchase any services using our website, please see the relevant section below).
How we collect your data
We collect your personal data by collecting ‘cookies’ when you visit our website or when you submit any information to us using our website (including if you subscribe to our newsletter, enter a competition, complete any form, create a user account,
submit feedback or register for an event on our website). For more information on which types of cookies we use, please see our cookies policy
here.
What data will we collect
When you access our website, we may collect anonymised usage data recording how you use and navigate our website, your preferences/settings for our website, your IP address and details of the device, browser and operating system you use to access our website.
If you complete a form, submit feedback, register for an event or enter a competition on our website we may collect your name, address, postcode, telephone number, email address, vehicle registration, flight information and payment details.
If you create a user account with us on our website, we will collect you title, name, gender, date of birth, nationality, details of any special assistance requirements you may have, your country of residence, contact telephone number, postcode, intended travel dates and flight numbers.
If you subscribe to our newsletter we will collect your email address.
Why we need your data
We need to know your personal data for the purposes of:
- identifying and resolving any errors with our website’s performance;
- analysing visitor information (including browser information and returning visitor numbers) to help improve the performance of the website and tailor adverts and information to you appropriately (including travel information for your planned journeys);
- to permit your access and use of a user account, if you register for one on our website;
- to provide you with offers and discounts from us and third parties;
- to permit your participation in competitions we offer;
- to ensure certain features of our website work correctly;
- to monitor the effectiveness of our advertising;
- to contact you with marketing materials (if you have provided your consent for us to do so); and
- to contact you to seek your feedback on our website or your experience at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is:
- in respect of any marketing materials we may send you, based on your consent for us to do so;
- in respect of any competition or event you register for, our legitimate interest in running the competition or event;
-
in respect of any our discounts or offers which you seek to use, our legitimate interest in providing such discount or offer to you correctly or permitting a third party to do so;
- in respect of forms and feedback you submit in relation to the airport, based on our legitimate interest in dealing with your comments and queries and the administration of the airport; and
- in all other cases, including in connection with any user account your register with us, based on our legitimate interest in providing a functioning, secure, relevant and easy to navigate website to you.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors for the purposes of improving and maintaining our website;
- our sub-contractors (including Zeus Enterprise Limited trading as Yieldify and Google) for the purposes of analysing your browsing behaviour when you visit our website and tailoring adverts and information to you;
- our cookie suppliers/third party developers for the purpose of monitoring and improving the performance of our website; and
- our sub-contractors (including Zeus Enterprise Limited trading as Yieldify) for the purposes of sending marketing materials to you (provided you have consented for us to send marketing materials to you);
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data which we use for marketing purposes will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. We will keep all data you have provided in connection with a user account you have registered with us, until either you or we close that user account (except if we are communicating with you in connection with your account, in which case, we will keep such data until we have completed the purpose of our communications).
We will keep all other data we collect about you for 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
Any bookings you make for flights, holidays or train services using our website are directed to, and processed by, the airline or operator who will provide the service to you. We do not collect your personal data in connection with the sale of flights, holidays or train bookings. Please refer to the privacy policy or notices of the relevant airline or operator if you wish to know how they handle your personal data.
This section of this notice applies to you if you purchase car parking at the airport online using our website, the website of one of our sales agents, or from one of our ticket machines at the airport.
How we collect your data
We collect your personal data by asking you to submit information to us during our (or our sales agent's) online order process or whilst using one of our ticket machines at the airport.
What data will we collect
We may collect your name, address, flight information, contact telephone number, email address, payment details and car registration number.
Why we need your data
We need to know your personal data for the purposes of:
1. providing you with access to our car parks;
2. charging you the correct amount for using our car parks;
3. maintaining security within the airport;
4. ensuring the orderly administration and operation of the airport;
5. investigating incidents occurring at the airport;
6. to contact you with information in respect of your booking;
7. to contact you with marketing materials (if you have provided your consent for us to do so);
8. to tailor our adverts to you on third-party websites;
9. dealing with any complaints or enquiries you make; and
10. to contact you to seek your feedback on our car parking services or your experience at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone
The lawful basis for our processing of your personal data is based on our performance of our contract with you to provide car parking at the airport except:
1. where we utilise your data to investigate incidents occurring at the airport, ensure the orderly administration of the airport or deal with any complaints or enquiries you may have (which shall be based on our legitimate interest in correctly maintaining and administering airport operations);
2. where we send marketing materials to you (which shall be based on your consent for us to do so); and
3. where we tailor adverts on third party websites to you (which shall be based on our legitimate interests in improving the efficacy of our third party advertising).
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your personal data to:
1. our subcontractors for the purposes of managing our car parks and access to the airport;
2. our subcontractors for the purposes of processing and taking payment;
3. our subcontractors for the purposes of sending marketing materials to you (provided you have consented for us to send marketing materials to you);
4. our subcontractors (including Google and 8 Million Stories Limited) for the purposes of analysing your browsing behaviour when you visit our website and tailoring advertisements and information to you;
5. our subcontractors (including Ethos Farm Limited) for the purposes of contacting you to seek your feedback on our car parking services or your experience at the airport;
6. our regulators for the purpose of demonstrating compliance with our legal obligations; and
7. law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties (except where we transfer data to Google, in which case the data may be transferred to servers located outside of the UK). Where we transfer data outside of the UK we will only do so if we are satisfied the transfer complies with data protection law, appropriate safeguards are in place, and that enforceable rights and effective legal remedies are available for data subjects. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data which we use for marketing purposes will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. We will keep all other data we collect about you for 24 months following the date on which your car park booking is due to end. After that 24 month period, we will retain anonymised data relating to your car park booking, but will delete all data from which you can be identified (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you purchase a Fast Track Security pass online using our website, the website of one of our sales agents, or when you visit our airport terminal building.
How we collect your data
We collect your personal data by asking you to submit information to us during our (or our sales agent's) order process (either online through our website or using one of our ticket machines located in our airport terminal building).
What data will we collect
We will collect your flight number, name, email and postal address, contact telephone number and payment details.
Why we need your data
We need to know your personal data for the purposes of:
1. providing you with access to our Fast Track Security lane;
2. charging you the correct amount for using our Fast Track Security lane;
3. maintaining security within the airport;
4. ensuring the orderly administration and operation of the airport;
5. investigating incidents occurring at the airport;
6. to contact you with information in respect of your booking;
7. to contact you with marketing materials (if you have provided your consent for us to do so);
8. dealing with any complaints or enquiries you make; and
9. to contact you to seek your feedback on our Fast Track Security lane or your experience at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is:
1. in respect of any marketing materials we may send you, based on your consent for us to do so; and
2. in all other cases, based on our performance of our contract with you to provide access to the Fast Track Security lane at the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your personal data to:
1. our subcontractors for the purposes of managing security at the airport;
2. to our subcontractors and sales agents for the purposes of processing your orders and collecting your payment;
3. our subcontractors for the purposes of sending marketing materials to you (provided you have consented for us to send marketing materials to you);
4. our regulators for the purpose of demonstrating compliance with our legal obligations; and
5. law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data which we use for marketing purposes will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. We will keep all other data we collect about you for 24 months following the date you are due to use the Fast Track Security lane after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you purchase executive lounge access online using our website.
How we collect your data
We collect your personal data by asking you to submit information to us during our online order process.
What data will we collect
We will collect your flight number, name, email and postal address, contact telephone number and payment details.
Why we need your data
We need to know your personal data for the purposes of:
1. booking your access to the executive lounge (which is provided by our executive lounge provider);
2. charging you the correct amount for access to the executive lounge (on behalf of the executive lounge provider);
3. maintaining security within the airport;
4. ensuring the orderly administration and operation of the airport;
5. investigating incidents occurring at the airport;
6. to contact you with information in respect of your booking;
7. to contact you with marketing materials (if you have provided your consent for us to do so);
8. dealing with any complaints or enquiries you make; and
9. to contact you to seek your feedback on the executive lounge you use or your experience at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our performance of the contract between you and the executive lounge provider to provide access to the executive lounge.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your personal data to:
1. our executive lounge provider for the purpose of providing the executive lounge service;
2. our subcontractors for the purposes of managing security at the airport;
3. to our subcontractors or sales agents for the purposes of processing your order and collecting your payment;
4. our subcontractors for the purposes of sending marketing materials to you (provided you have consented for us to send marketing materials to you);
5. our regulators for the purpose of demonstrating compliance with our legal obligations; and
6. law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data which we use for marketing purposes will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. We will keep all other data we collect about you for up to 24 months following the date you are due to use the executive lounge after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency)
This section of this notice applies to you if you register to use our WiFi at the airport
How we collect your data
We collect your personal data when you complete our WiFi registration form if you connect to our wireless internet connection through your mobile phone, laptop computer or other electronic device at the airport.
What data will we collect
When you submit your details on our WiFi registration form, we collect your name, email address, flight number, the MAC address of your electronic device and details of the browser you use to access our website,
Why we need your data
We need to know your personal data for the purposes of
- providing access to our WiFi connection;
- preventing misuse of our WiFi connection;
- analysing visitor information (including browser information) to help improve the performance of our WiFi and to tailor adverts and information we provide to you appropriately;
- to contact you with marketing materials (if you have provided your consent for us to do so); and
- to contact you to seek your feedback on our WiFi or your experience at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is:
- in respect of any marketing materials we may send you, based on your consent for us to do so; and
- in all other cases, based on our legitimate interest in providing a functioning, relevant and easy to use WiFi connection which is not misused.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors (including Virgin Media Business Limited) for the purposes of operating, improving and maintaining our WiFi; and
- our subcontractors for the purposes of sending marketing materials to you (provided you have consented for us to send marketing materials to you);
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data which we use for marketing purposes will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. We, and Virgin Media Business Limited, will keep all other data we collect about you for 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you use submit any complaint or enquiry to us, or you correspond with us or meet with us.
How we collect your data
We collect the personal data you submit to us when you write to us, speak with us, meet with us or submit a noise complaint using our flight tracking system on our website.
What data will we collect
We may collect your name, date of birth, telephone numbers, email address, address, signature, photographic images, vehicle registration numbers, dates of attending the airport, flight number, payment details, proofs of identification (including passports, driving licences etc), medical records, details of incidents you are involved in or witness, your correspondence history with us.
Why we need your data
We need to know your personal data for the purposes of
- corresponding with you;
- arranging and administering meetings;
- investigating and recording incidents, enquiries or complaints;
- safeguarding our staff, you and other persons;
- maintaining the safe and secure ongoing operation of the airport; and
- demonstrating compliance with our legal obligations to our regulators.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in dealing with your complaint or correspondence.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors for the purposes of investigating an incident, enquiry or complaint;
- our sub-contractors for the purposes of arranging and administering meetings;
- our sub-contractors, law enforcement agencies, public bodies and charitable organisations for the purposes of safeguarding our staff, you and other persons;
- our sub-contractors, law enforcement agencies and public bodies for the purposes of maintaining the safe and secure operation of the airport.
- airlines, concessionaires or any other party operating at the airport to which a complaint or enquiry relates for the purposes of their answering or addressing such complaint or enquiry;
- our regulators for the purpose of demonstrating compliance with our legal obligations;
- our insurers or solicitors for the purpose of dealing with any potential legal claims; and
- law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We may keep the data we collect about you for up to 12 months unless:
- we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency;
- the data relates to a potential legal claim in respect of personal injury, in which case we may keep such data for up to 3 years;
- the data relates to any other legal claim; in which case we may keep such data for up to 6 years;
- the data relates to noise complaints, in which case we may keep such data for up to 4 years; or
- there are ongoing legal proceedings in respect of which the data is relevant, in which case we may keep the data for the duration of such legal proceedings.
After the applicable time period set out above the data will be destroyed.
This section of this notice applies to you if you are involved in a security or safety incident, or accident, at the airport which relates to:
- personal injury;
- breach of any health and safety requirements;
- breach of any security requirements;
- loss, damage or theft of property; or
- breach of any laws (including the airport byelaws).
How we collect your data
We collect your personal data by asking you to provide your details following a security or safety incident, or accident, by asking you to fill out a written form. We may also collect your data from CCTV footage, images, or data about you we may hold in relation to your travel, or from other people such as airport staff or witnesses to any safety incident, or accident, at the airport.
What data will we collect
We may collect your name, address, occupation, contact telephone number, email address, age, date of birth, medical conditions, details of any injuries, a physical description of you, photographs of you, CCTV images of you, and a description of your activities whilst at the airport.
Why we need your data
We need to know your personal data for the purposes of:
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport;
- ensuring the orderly administration and operation of the airport;
- investigating accidents and incidents occurring at the airport;
- dealing with any complaints or enquiries you make;
- dealing with any legal claims which arise following an accident or incident at the airport;
- to fulfil our regulatory reporting requirements to our regulators; and
- undertaking safety training of persons working at, or visiting, the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors for the purposes of investigating an accident or incident;
- airlines, concessionaires, groundhandlers or any other party operating at the airport for the purposes of:
- investigating the accident or incident; or
- dealing with the accident or incident if they are responsible for the accident or incident;
- our insurers or solicitors for the purpose of dealing with any potential legal claims;
- our regulators for the purpose of demonstrating compliance with our legal obligations;
- law enforcement agencies for the purposes of their investigations; and
- persons working at, or visiting, the airport for the purpose of undertaking safety training.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We may keep the data we collect about you for up to 12 months unless:
- we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency; or
- the data relates to a potential legal claim in respect of personal injury, in which case we may keep such data for up to 3 years; or
- the data relates to any other legal claim; in which case we may keep such data for up to 6 years; or
- there are ongoing legal proceedings in respect of which the data is relevant, in which case we may keep the data for the duration of such legal proceedings.
After the applicable time period set out above the data will be destroyed.
This section of this notice applies to you if you visit the airport.
How we collect your data
We collect your personal data by using closed circuit television cameras, body worn cameras and other video surveillance equipment.
What data will we collect
We will collect moving and still images of you whilst you are present at the airport.
Why we need your data
We need to know your personal data for the purposes of:
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport;
- ensuring the orderly administration and operation of the airport;
- investigating incidents occurring at the airport;
- dealing with any complaints or enquiries you make; and
- undertaking safety training of persons working at, or visiting, the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors for the purpose of operating parts of the airport (including APCOA Parking (UK) Limited);
- our sub-contractors for the purposes of investigating an accident or incident;
- airlines, concessionaires or any other party operating at the airport for the purposes of:
- investigating the accident or incident; or
- dealing with the accident or incident if they are responsible for the accident or incident;
- our insurers or solicitors for the purpose of dealing with any potential legal claims;
- our regulators for the purpose of demonstrating compliance with our legal obligations;
- law enforcement agencies for the purposes of their investigations; and
- persons working at, or visiting, the airport for the purpose of undertaking safety training.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We may keep the data we collect about you for up to 3 months unless:
- we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency; or
- the data relates to a potential legal claim in respect of personal injury, in which case we may keep such data for up to 3 years; or
- the data relates to any other legal claim; in which case we may keep such data for up to 6 years; or
- there are ongoing legal proceedings in respect of which the data is relevant, in which case we may keep the data for the duration of such legal proceedings.
After the applicable time period set out above the data will be destroyed.
This section of this notice applies to you if you visit the airport by vehicle.
How we collect your data
We collect your personal data by using video surveillance equipment which records registration numbers of vehicles at the airport.
What data will we collect
We will collect still images of your number plate and record the registration number of your vehicle.
Why we need your data
We need to know your personal data for the purposes of:
- charging for entry and exit to certain parts of the airport (including to car parks and passenger collection and drop off points);
- permitting or restricting access to certain parts of the airport;
- maintaining security within the airport;
- ensuring the orderly administration and operation of the airport;
- investigating incidents occurring at the airport;
- dealing with any complaints or enquiries you make.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on it being necessary to perform our contract with you permitting the use of a vehicle at the airport (as set out in the terms and conditions displayed at the airport).
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your personal data to our subcontractors for the purposes of managing access to the airport and car parking. We may if requested provide your personal data to law enforcement agencies for the purposes of their investigations or our regulators for the purpose of demonstrating compliance with our legal obligations. Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep the data we collect about you for 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you use our security lanes at the airport.
How we collect your data
We collect your personal data by:
- asking you to present your boarding pass to our security officers;
- tracking your movement using facial and body recognition systems;
- taking a photograph and x-ray scan of items you place in our x-ray scanners; and
- undertaking a body scan.
What data will we collect
We may collect your name, access date and time, gate number, flight number, destination, assign you a unique identifying number, boarding pass, a photograph of your face and body, a photograph and x-ray image of items in your possession (which may include photographic images of baggage tags which may contain names, addresses, email addresses and telephone numbers and other personal information you have included), and a scan of your body (although please note that no image of your body is created; software processes the scan data automatically and indicates the areas that need to be checked by highlighting them on a generic mannequin diagram).
Why we need your data
We need to know your personal data for the purposes of:
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport;
- ensuring the orderly administration and operation of the airport;
- investigating incidents occurring at the airport;
- analysing passenger flows through our security lanes for the purpose of forecasting future passenger numbers to ensure sufficient resources are available to cope with demand;
- monitoring and improving queue times in our security lanes;
- demonstrating compliance with our legal obligations to our regulators;
- dealing with any complaints or enquiries you make.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our regulators for the purpose of demonstrating compliance with our legal obligations; and
- law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep the data we collect about you for up to 12 months following your use of the security lane except in respect of:
- facial and body recognition photographs which are retained only for a short period (whilst being processed by software) before being deleted;
- photographs and x-rays of items you place in our x-ray scanners, which are stored for up to 30 days; and
- the results of body scans, which are retained only for a short period (usually no longer than 10 minutes) during which a security officer checks the results.
Except that if we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency.
After the applicable time period set out above the data will be destroyed.
This section of this notice applies to you if you apply for or are provided with an ID card by us.
How we collect your data
We collect your personal data by asking you to submit information to us during your application for an ID card.
What data will we collect
We may collect your name, telephone numbers, date of birth, email address, address, signature, photographic images, vehicle registration numbers, national insurance number, nationality, place of birth, work history (including employer/business details, dates of engagements, periods of unemployment and job titles), proofs of identification (including passports, driving licences etc), criminal records, current job title and employer/business details; and names of educational establishments and years of attendance.
Why we need your data
We need to know your personal data for the purposes of:
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport;
- ensuring the orderly administration and operation of the airport;
- investigating incidents occurring at the airport; and
- demonstrating compliance with our legal obligations to our regulators.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our subcontractors (including IDGateway Limited) for the purpose of administering our identification pass application system;
- our regulators for the purpose of demonstrating compliance with our legal obligations; and
- law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep the data we collect about you for 12 months following the date of your application for an ID card, or if an ID card is issued to you, 12 months after the expiry date printed on your ID card at which time it will be destroyed unless:
- we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or any law enforcement agency; or
- the information would permit or require us to refuse an application submitted by you for an ID card in the future, in which case we will keep it for the duration of your lifetime.
After the applicable time period set out above the data will be destroyed.
This section of this notice applies to you if you use an ID card to access any secure areas at the airport.
How we collect your data
We collect your personal data by recording when you use your ID card to access a secure area at the airport.
What data will we collect
We collect your name and access date and time.
Why we need your data
We need to know your personal data for the purposes of:
- maintaining security within the airport; and
- investigating incidents occurring at the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may if requested provide your personal data to law enforcement agencies for the purposes of their investigations or our regulators for the purpose of demonstrating compliance with our legal obligations. Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep the data we collect about you for up to 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you use our chaplaincy services or volunteer to assist with our chaplaincy services.
How we collect your data
We collect the personal data you submit to us when you write to us or speak with us.
What data will we collect
We may collect your name, religious faith, occupation, telephone numbers, email address, address or post code, signature and details of your personal circumstances, bank account details and payment details.
Why we need your data
We need to know your personal data for the purposes of
- corresponding with you;
- organising volunteer assistance in connection with our chaplaincy services;
- accepting any financial donations or facilitating assistance you agree to provide to us;
- providing you with any financial assistance we have agreed to provide you;
- to ensure you are treated appropriately and safely by us;
- to contact you with marketing materials (if you have provided your consent for us to do so); and
- dealing with any complaints or enquiries you make.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in providing our chaplaincy services to you and to other persons (and, in respect of any marketing materials we may send you, your consent for us to do so)
What we do with your data
All the personal data we process is processed by our staff in the UK. We may if requested provide your personal data to law enforcement agencies for the purposes of their investigations or our regulators for the purpose of demonstrating compliance with our legal obligations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
Your personal data that we use for marketing purposes or in connection with volunteering will be kept with us securely until you notify us that you no longer wish to receive marketing material from us. If you are a vulnerable adult or a child, we will keep written records of our assistance to you for a period of 75 years. If you have volunteered to assist the Chaplaincy, we will retain your contact details until you inform us you no longer wish to provide volunteer assistance to the Chaplaincy. We will keep all other data we collect about you for 2 years after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you work for an organisation other than LLA and are a stakeholder in the operation of the airport (such as representatives of the police, fire service, concessionaires, airlines, contractors etc).
How we collect your data
We collect your personal data by requesting it from you or your organisation you are engaged by.
What data will we collect
We may collect your name, email address, contact number and job title.
Why we need your data
We need to know your personal data for the purposes of:
- maintaining an up to date crisis communication plan;
- responding to emergencies at the airport;
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport; and
- ensuring the orderly administration and operation of the airport.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may if requested provide your personal data to:
- our regulators to demonstrate compliance with our legal obligations;
- law enforcement agencies for the purposes of their investigations; or
- other stakeholders for the purpose of coordinating action in the event of an emergency or other incident at the airport.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep the data we collect about you for the period you continue to be a stakeholder at the airport which is usually your period of engagement with the organisation you work for at the airport (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency). After the applicable time period your data will be destroyed.
This section of this notice applies to you if you arrange to attend any events, meetings or training at the airport run by us.
How we collect your data
We collect the personal data you submit to us when you write to us or speak with us in connection with, or participate in, an event, meeting or training run by us at the airport.
What data will we collect
We may collect your name, occupation, date of birth, telephone numbers, email address, address, signature, medical and dietary requirements, vehicle registration numbers, dates of attending the airport, payment details and proofs of identification (including passports, driving licences etc). If you participate in a public entertainment event at the airport, we may collect video and audio recordings of you, or still images of you, during your participation in the public entertainment event.
Why we need your data
We need to know your personal data for the purposes of
- corresponding with you;
- permitting you access to certain areas within the airport;
- running the event, meeting or training you attend or participate in;
- demonstrating compliance with our legal obligations to our regulators;
- maintaining security within the airport;
- maintaining the health and safety of persons at the airport;
- ensuring the orderly administration and operation of the airport; and
- if you have participated in a public entertainment event at the airport, to undertake that event and publicise it (including on our social media feeds, in our advertising and marketing materials and on displays within the airport).
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is:
- in respect of any marketing materials we may send you, your consent for us to do so; and
- in all other circumstances, based on our legitimate interest in (i) running the event, meeting or training you are attending, and, (ii) in respect of a public entertainment event, publicising it.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors or affiliate charitable organisations for the purposes of running on our behalf the event, meeting or training you are attending;
- our regulators for the purpose of demonstrating compliance with our legal obligations;
- law enforcement agencies for the purposes of their investigations; or
- if you have participated in a public entertainment event at the airport, our sub-contractors for the purpose of running that event and publicising it.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
If you participate in a public entertainment event at the airport, we will keep the data we collect about you no longer than 12 months after that public entertainment event. We will keep all other data we collect about you until you have attended the relevant event, meeting or training at the airport (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency). After the applicable time period your data will be destroyed.
This section of this notice applies to you if you enter any competitions or prize draws run by us.
How we collect your data
We collect the personal data you submit to us when you enter any competition or prize draw run by us.
What data will we collect
We may collect your name, date of birth, gender, personal interests and preferences, images or recordings of you, address, postcode, telephone number, personal identification document details, email address, social media account usernames, vehicle registration, flight information and/or payment details.
Why we need your data
We need to know your personal data for the purposes of
- corresponding with you;
- running the competition or prize draw;
- providing any prizes to the winner(s) of the competition or prize draw; and
- publicisizing the winner(s) of the competition or prize draw on LLA’s website, through LLA’s social media channels, through third party media outlets and in LLA’s advertising materials.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The legal basis we rely on to process this data is article 6 (1) (f) of the GDPR, which allows us to process your personal data:
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our sub-contractors for the purposes of running on our behalf the competition or prize draw;
- our third party affiliates who we inform you are providing prize(s) for the competition or prize draw for the purposes of providing those prize(s); and
- law enforcement agencies for the purposes of their investigations.
- Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep all other data we collect about you until the competition prize(s) have been allocated to the winner(s) of the competition or prize draw you have entered (unless we are asked to retain such information for a longer period by any law enforcement agency, in which case we will keep it for such period as is required by the relevant law enforcement agency). After the applicable time period your data will be destroyed.
This section of this notice applies to you if you are the operator of a Hackney Carriage and apply for a Hackney Carriage Access Licence from us.
How we collect your data
We collect your personal data when you submit an application for a Hackney Carriage Access Licence to us.
What data will we collect
When you submit an application for a Hackney Carriage Access Licence to us we may collect your name, address, email address, telephone number, email address, vehicle registration and signature.
Why we need your data
We need to know your personal data for the purposes of
- processing your application for a Hackney Carriage Licence and maintaining records of the persons authorised to operate Hackney Carriages at the Airport;
- permitting or denying access to and from the Hackney Carriage taxi cartridge and rank at the Airport (and charging for such use);
- maintaining security within the airport;
- ensuring the orderly administration and operation of the airport;
- investigating incidents occurring at the airport; and
- dealing with any complaints or enquiries you make (or others make about you).
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in safely and securely administering the airport (including in connection with ensuring a functioning Hackney Carriage licensing scheme).
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our regulators to demonstrate compliance with our legal obligations;
- law enforcement agencies for the purposes of their investigations; or
- our subcontractors (including APCOA Parking (UK) Limited) for the purpose of administering our Hackney Carriage licensing scheme.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We will keep all data we collect about you for the 12 months after which time it will be destroyed (unless we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency).
This section of this notice applies to you if you submit an application for a job vacancy with us.
How we collect your data
We collect the personal data you submit to us when you write to us or speak with us.
What data will we collect
We may collect your name, telephone numbers, date of birth, email address, addresses, periods of residence, signature, national insurance number, nationality, place of birth, work history (including employer/business details, dates of engagements, periods of unemployment and job titles and descriptions), qualifications, proofs of identification (including passports, driving licences etc), criminal records, court judgments, financial history, current job title and employer/business details; and names of educational establishments and years of attendance.
Why we need your data
We need to know your personal data for the purposes of
- corresponding with you;
- processing your job application;
- determining whether you are likely to pass the security vetting checks necessary to work at the airport;
- arranging the security vetting checks necessary for you to work at the airport;
- maintaining personnel records for our employees (if your job application is successful); and
- demonstrating compliance with our legal obligations to our regulators.
If we do not collect your personal data, we may not be able to fulfil these purposes. We will only collect the personal data about you which we need for these purposes alone.
The lawful basis for our processing of your personal data is based on our legitimate interest in processing your job application.
What we do with your data
All the personal data we process is processed by our staff in the UK. We may provide your data to:
- our subcontractors and government agencies (including Staffvetting.com Limited and the United Kingdom Security Vetting) for the purpose of commencing security clearance vetting;
- our regulators for the purpose of demonstrating compliance with our legal obligations;
- our insurers or solicitors for the purpose of dealing with any potential legal claims; and
- law enforcement agencies for the purposes of their investigations.
Your data will not be transferred outside of the UK by us or any 3rd parties. We do not use personal data in connection with any automated decision making.
How long we keep your data
We may keep the data we collect about you for up to 12 months unless:
- you are employed or engaged by LLA, in which case the data will be kept throughout the duration of your employment or services contract with LLA and for a period of 6 years after your employment or services contract has come to an end;
- we are asked to retain such information for a longer period by our regulators or any law enforcement agency, in which case we will keep it for such period as is required by the relevant regulator or law enforcement agency;
- the data relates to any legal claim; in which case we may keep such data for up to 6 years; or
- there are ongoing legal proceedings in respect of which the data is relevant, in which case we may keep the data for the duration of such legal proceedings.
After the applicable time period set out above the data will be destroyed