Privacy Notice

Left Item Service & Luggage Deposit Service

Version 1 | Last updated: 12 September 2019

This Policy applies where we, Malta International Airport p.l.c (hereinafter referred to as the “Company” “we”, “us” or “our”), are acting as data controllers with respect to your personal data when you make use of the Left Item Services and/or Luggage Deposit Service (hereinafter, individually or collectively as the context may require, referred to as the “Services”).  This privacy policy is limited to the processing of personal data by the Company with respect to the Services.  We at Malta International Airport p.l.c. are committed to protecting your privacy and we will not collect any personal information about you unless we are required to do so. We consider that we have a legal duty to respect and protect any personal information you provide to us and we will abide by such duty. We take all safeguards necessary to prevent unauthorised access to your personal data and we do not pass on your details to any third party, other than as provided in this notice.

Any personal information you communicate to us is kept within our own records in accordance with the relevant data protection and privacy laws including but not limited to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act, Chapter 586 of the Laws of Malta and subsidiary legislation thereto, as may be amended from time to time.

In the following sections, we provide you with details on the points mentioned above. In particular, we want you to know what personal information we gather, for which purpose we use it and for how long we keep it.

Our Contact Details

Malta International Airport p.l.c., a company registered under the laws of Malta with registration number C12663 and having its registered address at Malta International Airport, Luqa, LQA 4000, Malta, is the data controller and is responsible for your personal data collected in connection with the Services. We have appointed a Data Protection Officer (hereinafter referred to as the “DPO”) who is responsible for overseeing questions in relation to this Policy. If you have any questions about this Policy, including concerns about your personal data or our data collection practices, please contact our DPO via e-mail at dataprotection@maltairport.com or via telephone on (+356) 2369 6268 during office hours.

Personal Data

The terms “personal data” or “personal information” mean any information about an individual which can render that individual identifiable. Personal data or personal information does not include data that does not permit the identification of a natural person (anonymous data).

We only collect and process personal data that you provide us with when you make use of the Services.  When you make use of our Services, we will collect certain types of personal information, including:

• Name and surname;
• Telephone number(s); and
• I.D. Card or Passport number.

How we use your personal data

We may use the personal data we collect and process about you:

• To provide you with the Services that you have requested from us;
• To process your information for the purposes of providing you with the Services;
• To manage our relationship with you for collection purposes ancillary to the Services;
• To process any personal data lawfully generated by us in the course of executing your instructions;
• For safety and security purposes, including (amongst others) safety of our premises, property and employees, and the establishment, exercise or defence of legal claims;
• Where required for compliance with a legal obligation to which we are subject; and/or
• For purposes of a legitimate interest pursued by us or by a third party, provided such interest is not overridden by your interests, fundamental rights and freedom.

Legal Bases of Processing Personal Data

The legal bases of processing your personal data are the following:

• Entering into and performing the obligations under the terms and conditions of the Services, in particular to provide the Services requested and to manage our relationship with you. Providing such personal data is necessary for our performance of the Services. The consequence of not providing us with your personal data would be that we would be unable to provide you with the Services that you request from us and you would not be able to enter into the terms of service with us;
• Our legitimate interests, in particular legitimate interests that may arise directly or indirectly in relation to your instructions, to communicate with you and keep you updated with information in relation to the Services that you requested from us. We also have a legitimate interest to process your personal data for safety and security when using the Services. When we process your personal data on the basis of our legitimate interests, we ensure that the legitimate interests pursued by us are not overridden by your interests, rights and freedoms. We may also process your personal data for the purposes of establishing, exercising or defending legal proceedings;
• In compliance with legal obligations, as applicable; and
• Your explicit consent (if ever required), in which case, our processing shall be limited to the purposes specifically indicated when your consent was requested.

Where Your Provide Us with Personal Data Related to Third Party Data Subjects

If you supply personal data of third parties to us, you shall be solely responsible to ensure that:

• you bring this policy to the attention of such third parties;
• the provision of such personal data to us fully complies with applicable laws;
• any information notices, approval, consents or other requirements that may be required before the provision of such third-party personal data to us shall be collected and fulfilled solely by you;
• you remain responsible for making sure the information you give us is accurate and up to date, and you must tell us if anything changes as soon as possible.

You hereby fully indemnify us and shall render us completely harmless against all costs, damages or liability of whatsoever nature resulting from any claims or litigation (instituted or threatened) against us as a result of your provision of such third-party personal data to us.

Disclosures of your Personal Data

We do not share any of your personal information with any third-party, except if we are required to do so as a result of legal obligations imposed on us.

If we or our processors are required to transfer your personal data to non-EEA countries, we shall ensure the lawful processing of your personal data by putting in place the appropriate safeguards in accordance with the applicable privacy laws, and/or any other applicable legislation. These appropriate safeguards include the EU Model Clauses entered into by us and our processors/controllers; or ensuring that our data processors located in the United States of America subscribe to the Privacy Shield. MIA shall provide you with a copy of these EU model clauses upon reasonable request which may be submitted on dataprotection@maltairport.com.

Your Rights at Law

Your principal rights under the GDPR are the following:

• Access your personal data by making a Data Subject Access Request;
• Rectification, erasure or restriction of processing of your personal data in certain circumstances;
• Object to the processing of your information in certain circumstances;
• Data portability to other data controllers, where technically feasible;
• Right to be informed of the source – where the personal data we hold about you was not provided to us directly by you, you may also have the right to be informed of the source from which your personal data originates.

You can access your personal data by filing a Data Subject Access Request Form online or sending it to our Data Protection Officer. Both the online and offline form together with contact details can be accessed via this link.

To exercise other rights, please contact our Data Protection Officer on dataprotection@maltairport.com or via telephone on (+356) 2369 6268 during office hours.

To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

If you consider that our processing of your personal information infringes data protection laws, you can contact us on dataprotection@maltairport.com or via our website. You also have a legal right to lodge a complaint with a supervisory authority responsible for data protection. In Malta the supervisory authority is the Information and Data Protection Commissioner (IDPC).

Data Security

We guarantee to have in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have an operational need to know in order to satisfy the above outlined purposes of processing. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Data Retention

We will normally retain your personal data for the duration of our relationship with you. In all cases, we will only keep your personal data for as long as it is needed for the purposes for which it was collected. Where it is no longer required, your personal data shall be immediately and irrevocably destroyed.

In any case, we will not retain your personal data for more than six (6) months once you have collected your left item and/or deposited luggage unless we have a statutory obligation imposed on us, a business need to retain the personal data, and/or require the personal data to exercise or defend legal claims. Any personal data which we may hold on the basis of your consent shall be retained exclusively until when you withdraw your consent.

Changes to this Privacy Policy

We will keep this privacy notice under regular review. If there are any changes to this Policy, we will replace this page with an updated version on the website. At the start of this page, we will tell you when it was last updated.

We suggest that you check on the Policy any time you access our website so as to be aware of any changes which may occur from time to time. We may also notify you of changes to this Policy by email or other means, where such data is available.