This COVID-19 Privacy Notice (this “Notice”) serves as an addendum to the VistaJet Privacy Policy available here (the “Privacy Policy”) and shall be deemed incorporated into the Privacy Policy up until further notice issued by us. All terms and expressions used in this Notice shall have the same meaning as in the Privacy Policy, unless otherwise stated herein. Except as otherwise expressly modified herein, all other terms and conditions of the Privacy Policy shall remain in full force and effect. In the event of any conflict between this Notice and the Privacy Policy, this Notice shall prevail.
Data Controller: VistaJet Limited, Sky Parks Business Centre Malta International Airport, Ħal Luqa LQA 4000, Malta
Email: privacy@vistajet.com
Tel: +356 2092 8000
Group Data Protection Officer: privacy@vistajet.com
This Notice is designed to advise you about how we may seek to collect and hold additional personal data about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).
We may seek to collect and process your personal data in response to the outbreak of Coronavirus, which is above and beyond what would ordinarily be collected from you, to ensure the safety of our assets (incl. our aircraft) and the well-being of our customers, passengers, employees, agents, contractors and representatives.
Such personal data processed will be limited to what is proportionate and necessary, taking into account, applicable laws and regulations, and the latest requirements and guidance issued by relevant Governments, Agencies, International Organisations and Public Authorities, including without limitation World Health Organisation (WHO), to manage and contain the virus.
We have issued this Notice so that you understand exactly why and how and your personal data is processed in these circumstances.
In addition to the personal data we may collect about you as outlined in detail in our Privacy Policy, additional personal data may be collected by us to determine whether individuals have experienced or are experiencing Covid-19 symptoms or are in any of the high-risk categories which are most vulnerable to become infected and seriously ill – this may include health or other special category data. We may:
Collect from you information related to, your health, your previous travels, locations you have visited, and your contacts, via a declaration or questionnaire which we require in order to assess risk to our customers, passengers, employees, representatives, agents, contractors and other relevant third parties, in our efforts to prevent the spread of the virus;
Request that you submit to a thermal and symptom screening taken by any of our representatives or agents. This screening shall consist of non-invasive temperature checks to check for symptoms of Coronavirus and record any symptoms if displayed by you.
Any sharing of your personal data will be strictly in adherence with our Privacy Policy.
The GDPR and UK Data Protection Act 2018 (the “UK DPA 18”) require specific conditions to be met to ensure that the processing of personal data is lawful. The relevant GDPR conditions that cover our lawful basis for processing your personal data under this Notice are the following:
Article 6(1)(d) – processing is necessary in order to protect the vital interests of the data subject or another natural person. GDPR Recital 46 adds that: “Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread … ”.
Article 6(1)(f) – our Legitimate Interest(s) – (i) to provide the safest possible COVID-19 aware environment to provide our services (including without limitation, the operation of flights) safely for our customers, passengers and employees; (ii) to take all reasonable and proactive deterrent measures to prevent enabling the spread of infection by our services and ensure we have appropriate and effective health screening measures in place.
Personal data provided by you and collected by us will be processed by us pursuant to the following:
Article 9(2)(i) GDPR – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.
We will only keep your personal data related to this Notice for as long as it necessary. In this respect we will consider any and all applicable laws and regulations, and the latest requirements and guidance issued by relevant Governments, Agencies, International Organisations and Public Authorities, including without limitation World Health Organisation (WHO).
As a minimum the personal data outlined in this Notice will be kept for the duration of the Coronavirus response and will be kept securely by us.
When your personal data outlined in this Notice is no longer needed as set out in this Notice we will either delete it or anonymise for statistical purposes.
The GDPR and UK DPA 18 gives individuals eight data subject rights, which are explained for you below:
Right to be informed: organisations must tell individuals what data of theirs is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties.
Right of access: individuals have the right to request a copy of the information that an organisation holds on them.
Right of rectification: individuals have the right to correct data that is inaccurate or incomplete.
Right to be forgotten: in certain circumstances, individuals can ask organisations to erase any personal data that’s stored on them.
Right of portability: individuals can request that organisation transfer any data that it holds on them to another company.
Right to restrict processing: individuals can request that an organisation limits the way it uses personal data.
Right to object: individuals have the right to challenge certain types of processing, such as direct marketing.
Rights related to automated decision making including profiling: individuals can ask organisations to provide a copy of its automated processing activities if they believe the data is being processed unlawfully.
You are free to exercise any of these rights at any time – you can do this by writing to us at privacy@vistajet.com or requesting to exercise these orally.
We are required to verify your Identity before considering your request and our preferred method of access for data subjects to make a request can be found here where you will also find further explanatory information.
| Date | Version | Description |
|---|---|---|
| 9th June, 2020 | 1 | Effective date |