Privacy Policy

1.   ABOUT THIS PRIVACY NOTICE

Norwich Aviation Centre Ltd (NAC) complies with applicable Data Protection Law and is committed to protecting the privacy and security of Personal Data. This Privacy Notice applies to all Norwich Aviation Centre Ltd (NAC) Personnel whose Personal Data we Process, regardless of the media on which that data is stored. It describes how we may Process Personal Data about you before, during and after your relationship with us.

Norwich Aviation Centre Ltd (NAC) is classified as a Data Controller under Data Protection Law. This means that we are responsible for deciding how we hold and use Personal Data about you. This Privacy & GDPR Policy informs you of the ways in which we may hold and use your Personal Data. While it is not an exhaustive account of every situation, we have tried to outline as many situations that may arise in order to be as transparent as possible with you. 

 As Norwich Aviation Centre Ltd (NAC) operates in several jurisdictions, there may be circumstances where there is a conflict in the Data Protection Law and where this occurs, Norwich Aviation Centre Ltd (NAC) shall apply the requirement that is most protective and applicable to you. We have created a glossary in section 20 of this Privacy Notice to help you understand the meaning of some of the terms that are used and capitalised in this Privacy Notice. If you have any questions, please contact the company Compliance Manager at: CMM@NorwichAviationCentre.co.uk

2.   WHAT ARE THE DATA PROTECTION PRINCIPLES?
   
   

Data Protection Law generally requires Personal Data to be:

• Processed lawfully, fairly, and in a transparent manner.
• Collected only for specified, explicit, and legitimate purposes.
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is Processed.
• Accurate and where necessary kept up to date.
• Not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes

for which the Personal Data is Processed.

• Processed in a manner that ensures its security using appropriate technical and organisational measures to

protect against unauthorised or unlawful Processing and against accidental loss, destruction, or damage.

• Not transferred to another country without appropriate safeguards being in place.
• Made available to Data Subjects when they exercise certain rights in relation to their Personal Data.

 

Norwich Aviation Centre Ltd (NAC) demonstrates compliance with the data protection principles listed above through its data protection compliance program which includes policies, procedures, and controls.

 

3.   WHAT KIND OF INFORMATION DO WE HOLD ABOUT YOU?

We collect, store, and use the following Personal Data about you when you join us (subject to your circumstances and role):

•       Personal contact details such as name, maiden name, title, job title, addresses, email addresses, telephone numbers, and nationality.
•       Date of birth
•       Certification relating to your travel, medical and medical conditions and aviation qualifications,
•       Next of kin and emergency contact information.
•       National Insurance or social security number.
•       Bank account details, payroll records, and tax status information.
•       Salary, annual leave, pension, and benefits information.
•       Start date and end date of your working relationship with Norwich Aviation Centre Ltd (NAC).
•       Training records including your performance throughout.
•       Location of employment or workplace.
•       Copy of identity documents such as a passport, including the photo.
•       Recruitment information (including copies of right to work documentation, references and other information included in your resume/CV such as employment and education history, skills etc).
•       Professional memberships.
•       Employment records (including previous employment, job titles, pay, work history, working hours).
•       Information about your use of our information and communications systems to include computers and mobile telephones.
•       Photographs.
•       Meeting recordings, notes, letters, reports, and decisions resulting from internal processes for performance, conduct and work-related complaints and/or grievances.
•       Absence/leave records and related documentation (such as letters and return to work interview notes).

 

We may also collect, store, and use Special Category Data including information about your health, including any medical condition, health and sickness records, and medical reports. We may also collect Criminal Convictions Data.

 

4.   HOW IS YOUR PERSONAL INFORMATION COLLECTED?
   
   

We collect Personal Data about Norwich Aviation Centre Ltd (NAC) Personnel through the application, recruitment, enrolment and onboarding process, both directly from staff, clients, customers, Airports, and other training schools and from:

•       Employment/recruitment agencies.
•       Referrals from Norwich Aviation Centre Ltd (NAC) employees or other third-parties.
•       Background check providers/agencies.
•       Government authorities.
•       3rd party flight schools

 

During your employment, training and whilst receiving services with us, we may collect additional Personal Data in the course of activities related to you, other Norwich Aviation Centre Ltd (NAC) Personnel (e.g., your line-manager or team members), from third-parties, including those set out above, and from our clients. We may also record telephone calls and/or video-conferences in certain situations, when it is legally permissible to do so.

 

5.   WHAT’S THE LEGAL BASIS FOR USING YOUR PERSONAL DATA?
   
   

When a legal basis is required, we rely on one or more of the following grounds to Process Personal Data:

•       Necessary for entering into, or performing, a contract – We will obtain and review your Personal Data in order to determine whether to enter into a contract with you (including our contract of employment), or to perform obligations that we undertake in any contract which concerns you.
•       Necessary for compliance with a legal obligation – We are subject to certain legal requirements which may require us to Process Personal Data. We may also be obliged by law to disclose Personal Data to a regulatory
•       body or law enforcement agency.
•       Necessary for the purposes of our legitimate interests or that of a third-party – We will Process Personal

 

Data for the purposes of our legitimate interests (or that of a third-party such as our clients), provided we have established that those interests are not overridden by your rights and freedoms, including your right to have your Personal Data protected. Our legitimate interests include responding to requests and enquiries from the you or a third-party, optimising our processes and business, uncovering illegal or unsafe practices in the workplace, providing a safe system of work for you and other Norwich Aviation Centre Ltd (NAC) Personnel and to take reasonable care of your health and safety and that of other Norwich Aviation Centre Ltd (NAC) Personnel, the public and aircraft passengers and people on the ground.

On rare occasions we may need to Process your Personal Data on the following legal grounds:

•       Consent – In some circumstances, we may specifically ask for your Consent before Processing Personal Data.
  
  

Any Consent we ask for will be explicit and specific.

•       Necessary to protect the vital interests – This is in respect of you or another Data Subject.

 

6.   IN WHAT SITUATIONS WOULD WE USE YOUR PERSONAL DATA?
   
   

We need the categories of Personal Data listed in section 3 above primarily to allow us to perform our contract with you and to pursue the legitimate interests of Norwich Aviation Centre Ltd (NAC) or those of third-parties, provided your interests and fundamental rights do not override those interests, for example, to perform our contracts with our clients/customers, or to enable us or our clients to comply with our/their legal obligations.

The situations in which we may Process your Personal Data are as follows:

•       Making decisions about your employment with or engagement by us.
•       Determining the terms on which you work for us.
•       Checking you are legally entitled to work.
•       Paying you and, if you are an employee, deducting tax and social security contributions as required by law.
•       Liaising with a relevant payroll, pension or benefits provider, if you are an employee.
•       Administering the contract we have entered into with you.
•       Business management and planning, including accounting and auditing.
•       Conducting performance reviews, managing performance, and determining performance requirements.
•       Making decisions about salary reviews and compensation, including decisions about promotions, if you are
•       an employee.
•       Making decisions about your continued employment by or engagement with us.
•       Making arrangements for or on the termination of our working relationship.
•       Dealing with conduct issues or work-related complaints and/or grievances concerning or involving you.
•       Dealing with legal disputes concerning or involving you, including accidents at work.
•       To ensure your compliance with policies, processes, and training requirements.
•       Complying with laws and/or regulations which apply to Norwich Aviation Centre Ltd (NAC). Some of the above grounds in section 5 for Processing will overlap and there may be several grounds which justify our use of your Personal Data.
•       Engaging in safety reviews or occurrence investigations.

 

7.   WHAT HAPPENS IF YOU FAIL TO PROVIDE YOUR PERSONAL DATA?
   
   

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered with you (such as paying you or providing a benefit, service, training, or contracted obligation), or we may be prevented from complying with our legal obligations (such as to ensure the remittance of tax, the payment of social security contributions, the health and safety of our workers, the health and safety of people on the ground). If you fail to provide date when requested and that failure to provide means we are unable to provide a contracted service to you then there is no refund available for that service you have paid for.

  

8.   WHAT IF WE NEED TO CHANGE PURPOSE FOR USING YOUR PEROSNAL DATA?

 

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider what we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the Processing for the new purpose is compatible with the original purpose, please contact us at compliance@NorwichAviationCentre.co.uk. If we need to use your Personal Data for an unrelated purpose, we will notify you when required, and we will explain the legal basis which allows us to do so, or we will seek your Consent beforehand. We will only Process your Personal Data without your knowledge or Consent where this is required or permitted by law.

  

9.   HOW DO WE USE SPECIAL CATEGORY DATA AND CRIMINAL CONVICTION DATA?

 

Special Category Data and Criminal Convictions Data requires higher levels of protection. We need to have a further justification for collecting, storing, and using this type of Personal Data. We may Process Special Category

Data and Criminal Convictions Data in the following circumstances:

•       Where we have obtained your explicit written Consent.
•       Where we need to carry out our legal obligations or for exercising employment contract rights.
•       Where it is needed in the public interest.
•       Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.
•       Where it is needed in relation to legal claims.
•       Where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your Consent.
•       Where you have already made the information public and we have a legitimate business reason only for Processing it.

 

Example of how we will use your Special Category Data (as relevant to your employment status) include:

•       We will use information relating to leaves of absence, which may include sickness absence or family or maternity related leaves, to comply with employment law and other laws in accordance with our absence management processes.
•       We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to obtain medical reports, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
•       We will use information about your gender, race or national or ethnic identity, sexual orientation, to ensure meaningful equal opportunity monitoring and diversity reporting where applicable. We only collect this information from you, and you have the option to decline to provide us with such information, unless we are required by law to collect it.

  

10.       HOW WOULD WE USE CRIMINAL CONVICTION DATA
    
    

We will only collect and use Criminal Convictions Data if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will source Criminal Convictions Data as part of the recruitment process or we may be notified of such information directly by you in the course of you working for us or through our appointed vetting agencies.

We will use Criminal Convictions Data in the following ways (as applicable to your role):

•       To ensure you are suitable to gain access to our systems and confidential information.
•       To ensure we are meeting our duty of care towards other Norwich Aviation Centre Ltd (NAC) Personnel.
•       To ensure the protection of protected characteristics people
•       To ensure child safety or the safety of vulnerable people

 

We will not store any documentation concerning Criminal Convictions Data but may hold information about whether an individual does or does not have a criminal conviction. We may use Criminal Convictions Data where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your Consent, or where you have already made the information public.

We will hold and store Criminal Convictions Data securely and confidentially and shall destroy such information when we have no further lawful basis to Process it.

 

11.       DO WE NEED YOUR CONSENT?
    
    

Norwich Aviation Centre Ltd (NAC) does not need Consent to use Special Category Data if we need it to carry out our legal obligations, or exercise specific rights in the field of employment law and the laws and regulations that apply to you, permit us to do so.

In certain circumstances, we may approach you for your written Consent to allow us to Process Special Category Data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to Consent. It is not a condition of your contract with us that you agree to any request for Consent from us.

  

12.       WHATS NAC’S POSITION ON AUTOMATED DECISION MAKING?
    
    

Automated Decision-Making takes place when an electronic system uses Personal Data to make a decision without human intervention. We do not envisage that any decisions will be taken about you using automated means, however we will notify you if this position changes.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

13.       WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We share your Personal Data with other entities within Norwich Aviation Centre Ltd (NAC) acting each as Data Controllers. We may also have to share your Personal Data with third parties including clients, service providers, professional advisers and government authorities.

We also share your Personal Data with certain third parties to administer our working relationship with you and/or we have a legitimate interest in doing so. For example, we provide your Personal Data to the following third-party organisations:

•       technology and software companies which provide desktop and cloud-based products that are used for various purposes etc. These third-party suppliers have your personal details as their services were used by you and/or members of staff at Norwich Aviation Centre Ltd (NAC) in respect of your Personal Data (e.g., Microsoft, Flight Scheduler Pro).
•       professional advisers such as law firms, banks, accountancy and payroll providers. These third-party suppliers have your Personal Data as Norwich Aviation Centre Ltd (NAC) is required to engage with them for its business purposes and in certain instances when it was performing the contract of employment with you (e.g. Solicitors and accountancy firms)
•       regulators and governmental authorities in order to comply with laws and regulations to which Norwich Aviation Centre Ltd (NAC) is subject to (e.g., HMRC for tax purposes).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

14.       DO WE SEND OR SHARE YOUR DATA ACROSS INTERNATIONAL BORDERS?

We share Personal Data within Norwich Aviation Centre Ltd (NAC) and with third parties. We transfer the Personal Data we collect to countries outside of the country in which the information originally was collected. As those countries may not have the same Data Protection Law as the country in which you initially provided the information, we will ensure that when we transfer your Personal Data, we will protect it by using the appropriate contractual and technical controls applicable.

For example, we may transfer Personal Data outside of the United Kingdom (“UK”) and European Economic Area (“EEA”), and whenever we do, we ensure a similar degree of protection is afforded to it by ensuring that safeguards are implemented.

For example, we ensure that we have entering into an international data transfer agreement, or an adequacy decision has been issued by the Information Commissioner’s Office (or in the case of the EEA, the standard contractual clauses have been entered into or that an adequacy decision by the European Commission has been made to allow for such a data transfer to a certain jurisdiction).

Please contact us at compliance@NorwichAviationCentre.co.uk if you want further information on the specific mechanism we use when transferring your Personal Data across borders.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

15.       HOW SECURE IS YOUR PERSONAL DATA?

Norwich Aviation Centre Ltd (NAC) uses industry standard physical, technical, and administrative controls to protect your Personal Data by:

• Not collecting or retaining excessive amounts of data.
• Protecting Personal Data from loss, misuse, unauthorised access and disclosure. Any employees, workers, contractors or third parties who are so authorised act on our instructions and are subject to a duty of confidentiality.
• Keeping Personal Data up to date.
• Storing and destroying it securely.
• Having measures in place to deal with any suspected Personal Data breach.
• Regularly reviewing our information collection, storage and processing practices, including physical security measures.

We require all third-party service providers and other entities that we engage with to respect the security of your Personal Data and to treat it in accordance with applicable laws. We do not allow them to use your Personal Data for their own purposes under any circumstances. We only permit them to Process your Personal Data for specified purposes and in accordance with our instructions.

 

16.       HOW LONG DO WE RETAIN DATA FOR?

Where we collect your Personal Data, the length of time for which we retain it depends on the type of data, the purpose for which we use that Personal Data and our accounting, regulatory and legal data retention obligations. We do not retain Personal Data in an identifiable format for longer than is necessary. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we Process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your Personal Data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

 

 

 

 

17.       WHAT ARE YOUR RIGHTS AND OBLIGATIONS?

Your duty to inform us of changes

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your

Personal Data changes during your working relationship with us by emailing compliance@NorwichAviationCentre.co.uk or by updating it in our systems where you are capable of doing so.

17.1.              Your rights in connection with Personal Data

 

Under certain circumstances, you have the right to:

•       Request access to your Personal Data – This enables you to receive information and certain copies of the Personal Data that we hold about you in order to check that we are lawfully Processing it.
•       Request correction of the Personal Data that we hold about you – This enables you to have any incomplete or inaccurate Personal Data we hold about you corrected.
•       Request erasure of your Personal Data – This enables you to ask us to delete or remove Personal Data where you believe that there is no good reason for us continuing to Process it. You also have the right to ask us to  delete or remove your Personal Data where you have exercised your right to object to Processing. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
•       Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a thirdparty) and there is something about your particular situation which makes you want to object to processing  on this ground. You also have the right to object where we are Processing your Personal Data for direct marketing purposes.
•       Request the restriction of Processing of your Personal Data – This enables you to ask us to suspend the Processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for Processing it.
•       Request the transfer of your Personal Data to another party. If you want to review, verify, correct or request erasure of your Personal Data, object to the Processing of your Personal Data, or request that we transfer a copy of your Personal Data to another party, please contact us by email at compliance@NorwichAviationCentre.co.uk.

 

 

17.2.              Right to withdraw consent

In the limited circumstances where you may have provided your Consent to the Processing of your Personal Data for a specific purpose, you have the right to withdraw your Consent for that specific Processing at any time. To withdraw your Consent, please send us an email at compliance@NorwichAviationCentre.co.uk

 

Once we have received notification that you have withdrawn your Consent, we will no longer Process your Personal Data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law and have notified of you this accordingly.

 

17.3.              Do you need to pay fees?

 

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

17.4.              What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.

 

18.       HOW CAN YOU CONTACT US

Our Legal & Compliance Team is responsible for overseeing questions in relation to this Privacy & GDPR Notice. If you have any questions about this Privacy Notice, including any requests to exercise any of your legal rights, please email compliance@NorwichAviationCentre.co.uk.

 

Alternatively you can contact NAC’s CEO by email CEO@NorwichAviationCentre.co.uk

 

 

 

 

 

19.       HOW OFTEN IS THE PRIVACY NOTICE UPDATED?

Norwich Aviation Centre Ltd (NAC) will review and update this Privacy Notice as necessary, so please check back regularly to review the latest version. Norwich Aviation Centre Ltd (NAC) has the right to update this Privacy Notice at any time and we will notify staff when we make substantial changes. This Privacy Notice was last updated in January 2023

 

20.       GLOSSERY

 

Automated Decision-Making: when a decision is made which is based solely on Automated Processing (including profiling) which produces legal effects or significantly affects an individual. The EU GDPR and UK GDPR prohibits Automated Decision-Making (unless certain conditions are met) but not Automated Processing.

 

Automated Processing: any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling is an example of Automated Processing.

 

Consent: agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear positive action, signifies agreement to the Processing of Personal Data relating to them.

 

Criminal Convictions Data: refers to Personal Data relating to criminal convictions and offences and includes Personal Data relating to criminal allegations and proceedings.

 

Data Controller: refers to an organisation that determines when, why and how to Process Personal Data. It is responsible for establishing practices and policies in line with Data Protection Law.

 

Data Protection Law: all applicable privacy and data protection laws including the EU GDPR, UK GDPR, and any applicable national implementing laws, regulations and secondary Law relating to the processing of Personal Data and the privacy of electronic communications, as amended, replaced or updated from time to time.

 

Data Subject: a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.

 

EEA: the 27 countries in the EU, and Iceland, Liechtenstein and Norway. General Data Protection Regulation (“GDPR”): refers to the European Union’s General Data Protection Regulation 2016/679. Personal Data is subject to the legal safeguards specified in the EU GDPR.

 

Norwich Aviation Centre or NAC: refers to all Norwich Aviation Centres legal entities.

 

Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data includes Special Category Data and Criminal Convictions Data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.

 

Privacy Notices: separate notices setting out information that may be provided to Data Subjects when Norwich Aviation Centre Ltd (NAC) collects information about them. These notices may take the form of general privacy statements applicable to a specific group of individuals (for example, employee privacy notices or the website privacy notices) or they may be stand-alone, one-time privacy statements covering Processing related to a specific purpose.

 

Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.

 

Special Category Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation and biometric or genetic data.

 

Norwich Aviation Centre Ltd (NAC) Personnel: refers to all employees, workers, contractors, consultants; customers, clients, suppliers and vendors etc.

 

UK GDPR: refers to the UK’s version of the EU GDPR which has been amended and transposed into the UK lawby way of the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).