Fliteline offers its employees a safe workplace and all data subjects a safe environment for the processing of their personal data. To achieve this, correct and careful handling of personal data within Fliteline is a prerequisite.
This is the ‘Privacy Policy for Fliteline B.V.’ brochure (hereinafter referred to as: ‘Privacy Policy’). With this brochure Fliteline aims to ensure that Fliteline processes personal data in accordance with the General Data Protection Regulation (hereinafter referred to as: GDPR or Regulation) and organization-specific (internal) regulations. This means, among other things, that the privacy of the data subject is protected against unlawful processing and/or misuse of this data, against loss and against the processing of incorrect data, that the processing of personal data for a purpose other than that for which it was collected is prevented, and that the processing operations do not result in a high risk to the data subjects.
The Management Board of Fliteline will draw up procedures in consultation with the Privacy Officer.
1. Definitions of terms
For the purposes of this policy and the attachments, the following definitions shall apply:
- —General Data Protection Regulation (GDPR): the Regulation.
- —Personal Data Authority: supervisory authority, as referred to in Article 51 of the GDPR.
- —File: any structured set of personal data accessible according to specific criteria, whether centralized, decentralized or disseminated on functional or geographical grounds.
- —Data subject: the person to whom the personal data relates (a job applicant, a current or former Fliteline employee, all other persons working for or on behalf of Fliteline, including members of supervisory bodies, customers, suppliers and service providers, tenants, and finally, visitors to Fliteline premises).
- —Third party: the person, not being the processor or the person working under the authority of the controller, who has been authorized by the data processor to process personal data (the company doctor, for example).
- —Management Board: the board of management of Fliteline B.V. which is represented by Mr. J.E. Plaisier.
- —Group: an economic entity in which legal entities are organizationally affiliated (Section 2:24 of the Dutch Civil Code).
- —Staff: an employee who is employed or hired by Fliteline in any way whatsoever.
- —Staff number: a unique number used for the efficient processing of personal data.
- —Personal data: any information about an identified or identifiable natural person (‘the data subject’).
- —Privacy impact assessment: an assessment of the impact of the envisaged processing on the protection of personal data.
- —Fliteline: all operating companies belonging to Fliteline B.V., hereinafter referred to as Fliteline.
- —Consent of the data subject: any free, specific, informed and unambiguous expression of will by means of a statement or active unequivocal act, by which the data subject accepts the processing of personal data relating to themselves.
- —Regulation: EU 2016/679 regulation from April 27, 2016 concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
- —Processing of personal data: any operation or set of operations which is performed upon personal data or a set of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment, interconnection, blocking, erasure or destruction of data.
- —Data processor: the person who, on the basis of an agreement, processes personal data on behalf of the data controller, without being subject to their direct authority.
- —Data controller: Fliteline.
2. Responsibilities
Fliteline is responsible for determining the purpose, content and use of the processing of personal data and for compliance with the GDPR, the provisions of these regulations and the policy established within the organization.
Fliteline takes measures to ensure that personal data is correct and accurate with respect to the purposes for which it is processed.
Fliteline ensures that its employees are aware of their responsibilities and obligations in the processing of personal data.
Fliteline informs the administrators and users periodically to ensure that they understand the personal data processing operations, the applicable rules and their own role in this.
Fliteline provides a privacy impact assessment for the processing of special or sensitive personal data that is processed with a view to, for example, sick leave and reintegration of personnel.
Fliteline has a register of processing activities for the data processing it carries out for the different categories of data subjects.
Fliteline is advised by the Privacy Officer on the above tasks.
3. Privacy Officer
The Privacy Officer performs their duties and obligations independently of the Management.
The Privacy Officer monitors internal compliance with laws and regulations and Fliteline’ or the data processor’s policies regarding the protection of personal data.
The Privacy Officer advises on processing operations and supervises their implementation and evaluation.
The Privacy Officer advises on the appropriate level of security for information management within the organization and on measures aimed at limiting the processing of personal data.
The Privacy Officer works together with the supervisory authority (Personal Data Authority).
Data subjects may contact the Privacy Officer on all matters relating to the processing of their data and the exercise of their rights under this policy and under the Regulation. Data leaks, as referred to in Article 9, must also be reported to the Privacy Officer.
The Privacy Officer reports their activities and findings to the data controller annually.
The investigative powers of the Privacy Officer are specified in the job description and include the authority to enter rooms, the authority to request information and access and to investigate matters, and the facilities made available to the Privacy Officer to enable them to exercise their powers properly.
The Privacy Officer is bound to secrecy and confidentiality in relation to their duties.
4. Information and access to personal data
Fliteline informs data subjects prior to or during the collection of the personal data or, if the data originates from third parties, within a reasonable period of time after receipt, about the personal data that is processed, for what purpose, on what basis, with whom the data is shared (internally and externally), how long and where the data is stored, a general description of the technical and organizational measures as prescribed in the GDPR, information about possible transfer of data to countries outside the EU, and about the rights of data subjects under the GDPR.
Anyone who is involved in the implementation of this policy and who is aware of or can reasonably suspect the confidential nature of the personal data to which they have access, and not already subject to a duty of confidentiality with regard to personal data by virtue of their profession, position or statutory regulation, shall be obliged to keep this confidential and shall sign a non-disclosure agreement if not already apparent from their employment contract or other agreement. This shall not apply if any statutory provision requires their disclosure or if disclosure is necessitated by their task in implementing this policy.
5. Categories of stakeholders
Fliteline processes personal data for five categories of data subjects: staff, job applicants, customers, visitors, and suppliers or service providers. For each category, processing is limited to what is necessary for the purposes below, and no other personal data is processed.
- —Staff: processing serves entering into an employment contract, determining salary and other employment conditions, payment of salary, taxes and contributions, communication about employment conditions, collection of claims, termination of employment, transfer within the group, management and supervision including emergency contact with family, provision of company medical care and reintegration, granting access to the company network, settlement of claims to benefits, election of members of a representative body, resolution of disputes, financial audits, securing and monitoring of persons, property and buildings, and publication of information about the organization on its website. Data processed is limited to identification and contact details, bank account number, social security number, copy of ID or passport, personnel number, nationality and place of birth, education and placement records, working conditions, salary and tax data, employment history, attendance and leave data (excluding the nature of any illness), safety-related data, family member data needed for duty of care, performance and career data, network login data, and photos, videos and camera images of the organization's premises.
- —Job applicants: processing serves assessing suitability for a current or future vacancy, processing expenses incurred by the applicant, securing and monitoring of persons, property and buildings, and implementation of legislation. Data processed is limited to identification and contact details, bank account number, nationality and place of birth, education and placement records, the position applied for, current and previous employment history, other data needed to fulfil the position (including assessments, psychological or medical examination results with consent), data obtained through internet research, photos, videos and camera images.
- —Customers: processing serves issuing quotations and receiving consignments or orders, execution of agreements, calculation and recording of income and payments, collection of claims, maintaining contact between Fliteline and the customer, resolution of disputes and financial audits, implementation of legislation, and securing and monitoring of persons, property and buildings. Data processed is limited to identification and contact details, bank account number, order and consignment data, agreement data, an administration code, and camera images of the premises.
- —Visitors: processing serves internal management and securing and monitoring of persons, property and buildings. Data processed is limited to identification and contact details, the person and department being visited, the reason for the visit, arrival and departure times, identity document data, and camera images of the premises. When visiting the Fliteline website(s), visitors are informed about the data processed and its purpose by means of a privacy statement posted on the website.
- —Suppliers and service providers: processing serves placement of orders or instructions, calculation and recording of income and expenditure and making payments, collection of claims, maintaining contact between Fliteline and the supplier, resolution of disputes and financial audits, implementation of legislation, and securing and monitoring of persons, property and buildings. Data processed is limited to identification and contact details, order and contract data, and camera images of the premises.
6. Rights of data subjects
Fliteline has privacy statements available which inform data subjects in clear, comprehensible and easily accessible form about which data of theirs are processed, by which means and for which reasons.
Data subjects whose personal data are being processed, or, if they have not yet reached the age of sixteen, their legal representatives, have the right to inspect and have a copy of the data recorded about them, including the processing purposes and legal basis, the categories of data concerned, the recipients the data has been or will be disclosed to, how long the data will be stored, the origin of the data if it does not come from the data subject, and the existence and impact of any automated decision-making.
Data subjects have the right to have inaccurate personal data corrected, and are entitled to erasure of data (the ‘right to be forgotten’) where the data is no longer needed, consent is withdrawn and there is no other legal basis, the data subject objects and there is no overriding ground for processing, the data has been unlawfully processed, or there is a legal obligation to delete it. Where such data has been made public, Fliteline will take reasonable technical measures to inform other controllers processing it that erasure has been requested. This right does not apply where processing is necessary for freedom of expression, a legal obligation, a task in the public interest, public health, or archiving, scientific or historical research, insofar as erasure would seriously jeopardize those aims.
Data subjects have a right to restrict the processing of their data in certain specified situations: Fliteline will then only process the data, aside from storage, with the data subject's consent or for the establishment, exercise or defence of a legal claim or to protect the rights of another person.
Data subjects have the right to receive personal data they have provided to Fliteline in a structured, common and machine-readable format, and to transfer that data to another controller, where the data was provided on the basis of consent or an agreement and processing is carried out by automated means. Where technically possible, the data subject has the right to have this done directly from one controller to another. This right does not apply to processing necessary for a task carried out in the public interest or in the exercise of official authority.
A request under this article is addressed to Fliteline for the attention of the Privacy Officer, and is free of charge, except that Fliteline may charge a reasonable fee or refuse manifestly unfounded or excessive, repetitive requests. Fliteline will inform the data subject of the action taken within one month of receipt, extendable by a further two months where necessary given the complexity or number of requests, with the data subject notified of any extension within the first month. Where a request concerns incorrect, incomplete or unnecessary data, the Privacy Officer will take a written decision within one month. If Fliteline has doubts about the identity of the requester, it may ask for further proof of identity, which suspends the time limit until it is provided. If Fliteline does not wish to comply with a request, it will inform the data subject in writing, giving reasons, within one month of receipt.
The scope of Fliteline's obligations and data subjects' rights under this article may be limited by laws and regulations applicable to Fliteline and/or its data processors.
A data subject who does not agree with the rejection of their request can contact Fliteline's Privacy Officer via privacy.officer@nl.rhenus.com.
7. Security
Fliteline shall provide appropriate security measures and an appropriate level of security, taking into account the state of the art and the costs of implementation, in view of the risks involved in the processing and the nature of the data to be protected. The measures are also aimed at preventing unnecessary collection and further processing of personal data.
8. The data processor
The data processors are those who process data on the basis of an agreement for or on behalf of Fliteline. The data processor shall process the data in the manner agreed in a data processor's agreement, and is responsible for the proper use of the necessary facilities to adequately guarantee the protection of the privacy of the persons whose data is included in the personal data registration, as indicated and described in that agreement. The Privacy Officer shall ensure that these provisions are made and observed.
9. Data leaks
If a data leak occurs within Fliteline's organization or with a data processor employed by Fliteline, with a significant risk of loss or unlawful processing of personal data processed by Fliteline, or such loss or unlawful processing actually occurs, the Privacy Officer will notify the Personal Data Authority, unless it can be demonstrated that such a breach is unlikely to pose a risk to the rights and freedoms of individuals.
The Privacy Officer shall document any breach of security, whether or not it is reported to the Personal Data Authority.
If the breach poses a high risk to the rights and freedoms of the data subject, Fliteline shall also notify the data subject of the infringement without delay. This communication may be omitted if the personal data is encrypted and not accessible to third parties, if measures have been taken to eliminate the high risk, or if the communication would require disproportionate effort, in which case public communication will suffice instead.
In determining whether there is a breach of security and whether a notification thereof should be made to the Personal Data Authority, Fliteline shall use the procedures set out in the Data Leaks Manual.
10. Complaints
If the data subject is of the opinion that the provisions of the GDPR and/or other laws and regulations and/or codes of conduct are not being complied with by Fliteline, they should contact the Privacy Officer.
If the complaint submitted does not lead to a result acceptable to the data subject, they may apply to the Personal Data Authority or to the court.
11. Entry into force, amendment and citation title
This policy may be referred to as the ‘Fliteline Privacy Regulations’. The policy is established by Fliteline and replaces any previous versions. It shall be evaluated periodically and can be changed if this is desired or necessary to properly comply with the GDPR.