Data protection notice: websites

Cargolux International Airlines S.A. Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “We”) is committed to protecting the personal data of customers, prospects, users of our website and, more generally, of any data subject concerned by Cargolux processing activities (hereafter referred to as “You”).

The management of “www.cargolux.com”, “anniversary.cargolux.com”, “www.cargolux-italia.com” and “kids.cargolux.com” websites (hereinafter referred to as “Websites”) require the processing of personal data by Cargolux. This Data Protection Notice explains how Cargolux processes your personal data in accordance with data protection legislation, especially the EU General Data Protection Regulation 2016/679 (known as “GDPR”), California Privacy Rights Act of 2020 (known as “CPRA”), the California Consumer Privacy Act of 2018 (known as “CCPA”), Personal Information Protection and Electronic Documents Act from Canada (“PIPEDA”), and the Brazilian General Data Protection law (“LGPD”).

 

Where links to websites of other organizations are provided on Cargolux Websites, this privacy notice does not cover how these organizations process personal data.

 

Who is the controller of your personal data?

Cargolux is responsible for collecting and processing your personal data in relation to your use of the Websites.

 

What personal data will Cargolux process and why do we process it?

When You use Cargolux Websites, we may process the following types of personal data about You:

  • Data relating to navigation on Websites,
  • Domain and host from which You access the internet,
  • Browser software and operating system of your computer,
  • The IP address of your computer,
  • The internet address of the site from which You linked directly to the Website,
  • Search queries and results,

Other categories of personal data may be processed when You chose to identify yourself and provide data in order for Cargolux to reply, follow-up and manage your requests:

  • Name and surname,
  • Job title and Company location You are associated with,
  • Business email address,
  • Other information You choose to share with Cargolux through remarks/comment boxes,

 

How do we collect your personal data?

We may collect the categories of personal data mentioned above by various channels:

  • When You provide data directly to Cargolux via the online forms available on Websites or when You decide to contact Cargolux via the contact email addresses available on our Websites.
  • Through third-party service providers tasked with managing parts of Cargolux Websites.
  • Through the use of cookies or similar technologies (For more information, please read our Cookie Policy).

 

What are the purposes and the legal basis for Cargolux's processing activities?

The information we request from You is considered as the minimum necessary data enabling Cargolux to pursue the purposes described below:

  • To generate audience and usage statistics of Websites and improve our online services.
  • To manage the operation and security of Websites with event logging.
  • To ensure the technical administration in connection with service providers (e.g. Third-party application maintenance, hosting, domain name registrar, certification, etc.).
  • To provide and give You access to online services to which You have adhered to (e.g. Fuel surcharge information page, CO2 emissions calculation page, etc.).
  • To prepare and publish content and provide You with downloadable files on the Website (e.g. Conditions of Contract, Single Process Brochures, etc.).
  • To guarantee the availability of online forms and Cargolux contact details.
  • To answer your questions.

 

The legal basis for the processing of your personal data is legitimate interest, to improve the Cargolux Website user experience, to finetune Websites content according to usage.

 

The processing does not involve automated decision-making.

 

Who do we share your personal data with?

We may disclose your personal data:

  • to members of Cargolux and its subsidiaries on a need-to-know basis.
  • to third parties providing services to Cargolux, namely, website hosting, IT services and other similar services to enable them to provide their services.
  • to other third parties, if obliged by competent authorities as per the applicable laws.

 

How do we protect your personal data?

We have implemented technical and organizational security measures to protect your personal data from unauthorized access, improper use, alteration, unlawful or accidental destruction and loss.

Nevertheless, no data transmission or storage over the internet can be guaranteed to be 100% secured. If You feel that the security of any account You might have with Cargolux has been compromised, please immediately notify Cargolux via the "Contacting Us" section below.

 

Where do we transfer your data to?

Your personal data are processed by Cargolux within the European Union.

 

In case of international transfers originating from the EU/EEA to a country outside the EU/EEA, the transfer of your personal data may occur where the European Commission has determined that the country outside the EU/EEA ensures an adequate level of data protection. For transfers to countries outside the EU/EEA for which the level of protection has not been recognized as adequate by the European Commission, Cargolux will implement appropriate safeguards provided for by current data protection law (e.g. the entry into standard data protection clauses) or rely on a derogation applicable to specific situations.

 

For how long do we keep your data?

Cargolux does not keep your personal data for longer than what is necessary to achieve the purposes above. The duration of retention depends on the purposes for which data are processed as described below:

  • Data relating to cookies and website usage is stored in accordance with the information available in the Cookie Policy.

After this retention period, the data will be erased from Cargolux’s system.

 

What are your rights?

In accordance with the applicable data protection laws (and subject to conditions and restrictions set forth therein), You may exercise at any time the following rights in relation to your personal data:

  • Right to Know/to be Informed: You have a right to know what personal data we collect about you, including: the categories of (sensitive) personal data, the categories of sources from which the personal data is collected, the business purpose for such collection, sharing or selling, the categories of third parties to whom the personal data is disclosed to, and your rights specific to personal data processing.
  • Right to Access: You have the right to question us about any data we have regarding you, and to request access to it. Examples of information that you have access to include the purpose of the processing, and the categories of the data collected.
  • Right to Data Portability: You have the right to ask that we transmit some of your data to another business.
  • Right to Rectification: If you believe that any of your personal data is incorrect or inaccurate, you have a right to ask that we correct it.
  • Right to Deletion: You have a right to request us to erase any personal data concerning you. Please keep in mind that this is not an absolute right, as we may be required by law to process certain personal data from you.
  • Right to not to be subject to Discrimination: You have a right to not be subject to discrimination because you exercised any of the rights under the CCPA, CPRA or LGPD.
  • Objecting to Processing: You have a right to object to the processing of certain types of your personal data collected by us.
  • Right to limit the use and disclosure of Sensitive personal data / information: Under CPRA, You have a right to request not to sell or share your personal data / information with a third party.
  • Right to lodge a Complaint:  You have the right to file a complaint with your relevant country’s Data Protection Authority in case you are dissatisfied with the handling of a request or a complaint.
  • Right to Anonymization, Blocking or Deletion: Under the LGPD, You have the right to anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of LGPD.

 

To exercise any of these rights, You may contact Cargolux by email [email protected] or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg
Luxembourg

 

You have the right to lodge a formal complaint with the relevant Data Protection Authority (in Luxembourg, Commission Nationale pour la Protection des Données “CNPD”; in California, California Privacy Protection Agency through this form; in Canada, Office of the Privacy Commissioner of Canada; in Brazil, Autoridade Nacional de Proteção de Dados).”

This Data Protection Notice may be modified to reflect changes on the Websites or on Cargolux processing activities, to comply with legal amendments, or to integrate best practices. Updates of the Data Protection Notice will be published on Websites once available.