PRIVACY NOTICE
Prepared by: AerFin Limited
Last updated: 27 October 2026
1. PURPOSE OF THIS PRIVACY NOTICE
AerFin Limited, together with its subsidiaries and affiliates listed in Appendix I ("AerFin", "we" and "us") is required by Data Protection Law to provide you with this privacy notice.
Read and retain this notice so that you understand how we collect, store and use your Personal Data so that you are aware of your rights under applicable Data Protection Law.
We may update this notice at any time. If we do, we will provide you with an updated copy, summarising the changes where relevant. We may also notify you in other ways from time to time about the Processing of your Personal Data.
2. RELEVANT DEFINITIONS
In this notice:
“Controller” means an entity that determines the purposes (i.e., the ‘why’) and means (i.e., the ‘how’) of the Processing of Personal Data under the UK/EU GDPR (note that this is referred to as an ‘Organisation’ under the PDPA);
“Criminal Offence Data” means any Personal Data that relates to criminal convictions and offences, including information relating to the alleged commission of offences, proceedings for an offence committed (or alleged to have been committed) and the disposal of those proceedings, including sentencing;
“Data Protection Law” means any data protection laws applicable to us, including but not limited to: (i) the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025 (collectively referred in this privacy notice as the “UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”) and the Singapore Personal Data Protection Act 2012 (“PDPA”);
“Personal Data” means any information that can be used to identify you. It does not include information from which the person's identity has been removed (anonymous information);
“Processing, Process, or Processed” means anything we do with your Personal Data, such as collecting it, storing it, using it, sharing it or deleting it; and
“Special Category Data” means any Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data and biometric data (if used for the purposes of uniquely identifying an individual), health data and data relating to an individual’s sex life or sexual orientation.
3. WHO THIS NOTICE APPLIES TO
This notice applies to:
• Candidates at all stages of the recruitment Process, including individuals who visit our career site, connect with us, apply for positions, are sourced or referred to us;
• Current and former Employees, Workers and Contractors; and
• Individuals who act as References for other Candidates.
It does not form part of any contract of employment, contract of service or contract to provide services.
When we use the following terms in this notice, we mean:
• “Visitor” means a person who visits our career site.
• “Connecting Candidate” means a person who connects with us via our career site to create a profile and receive information about current or future vacancies.
• “Applying Candidate” means a person who applies for a position with us, via our career site or a third-party service.
• “Sourced Candidate” means a person about whom we collect information from other parties, sites and services because we believe their profile is of interest for our current or future vacancies.
• “Referred Candidate” means a person about whom we receive information from our employees or partners because they believe the person's profile is of interest for our current or future vacancies.
• “Reference” means a person about whom we receive information from a Candidate who lists them as their reference.
• “Employee / Worker / Contractor” means a person in a current or former employment, worker or contractor relationship with AerFin.
When we use the term "Candidate" in this notice, we are referring to each of Visitors, Connecting Candidates, Applying Candidates, Sourced Candidates, and Referred Candidates, unless stated otherwise.
4. SOURCES OF PERSONAL DATA
4.1 Candidates
If you visit our career site, we collect technical and statistical information about how you use the career site, and information from your device.
Most of your Personal Data we Process we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some Personal Data is necessary in order for us to Process your application or provide you with the information you request.
We may collect Personal Data about you from public sources, such as LinkedIn or the website of your current employer.
We may Process your Personal Data collected from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
If you provide us with references, we may collect information about you from them. Information about your application and profile may also be created by us, or by us in cooperation with you, during the recruitment Process, for example, notes from interviews with you, and assessments and tests made.
4.2 Employees, Workers and Contractors
We collect Personal Data relating to you through our recruitment Processes, either directly from you or sometimes from third parties such as recruitment agencies, headhunters, background check providers and referees.
We may sometimes collect additional Personal Data from third parties including former employers, credit reference agencies and relevant tax authorities. We may also collect Personal Data from the trustees or managers of pension arrangements operated by us.
We will collect additional Personal Data during the course of your work for us including from our customers and suppliers.
4.3 References
If a Candidate lists you as their reference, we will collect your contact details from the Candidate in order to be able to contact you.
5. IF YOU FAIL TO PROVIDE PERSONAL DATA
In some cases, providing your Personal Data to us is a statutory or contractual requirement. Where we ask you for Personal Data for these purposes, we will make clear why we need it. If you do not provide it, we may be unable to carry out our legal or contractual obligations which may affect you. For example, we will need to Process your Personal Data to pay your salary, make any tax deductions or consider your application to us.
Where providing Personal Data is voluntary, we will tell you this and explain any consequences of not doing so.
6. THE TYPES OF PERSONAL DATA WE HOLD ABOUT YOU
There are certain types of Personal Data that reveal more sensitive personal details, such as health information or criminal convictions. Special Category Data and Criminal Offence Data are treated with additional care and are addressed separately in this notice.
If any of the following information changes, contact us using the contact details in Appendix I so that we can ensure that all the information we hold about you is accurate and up to date.
6.1 Information collected from all individuals listed in this privacy notice
Contact details: first name, last name, email address, telephone number and physical address.
Communications data: we will collect and store your communications with us, including the information you provided in those communications. This may include the content of emails, video recordings, messages on social media, information you add to your account with us, and surveys.
6.2 Additional information collected from Candidates
Device information: if you visit our career site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
Technical and statistical data: if you visit our career site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit and your activity on the site.
Data from interviews, assessments and other recruitment information: such as notes from interviews with you, assessments and tests made, and salary requirements.
Information in your application: such as your CV, cover letter, work samples, references, letters of recommendation, education and compensation expectations.
Information from your public profile: the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
Information provided by references: the information we receive from our employees or partners who refer you to us, or from the persons you have listed as your references.
Health and medical information: information about and connected with your health, including any adjustments made to support you in the application process and, if and when permitted by applicable law and for the purposes of workforce demographic reporting, information about your race or ethnicity, gender, veteran status (if you are in the US) or similar characteristics. We collect this information only where you provide it voluntarily or where applicable law requires or permits us to do so.
Recruitment and identity information: where we are required or permitted to collect it, copies of right to work documentation, passport or other photo ID, date of birth, and your National Insurance number, Social Security number or other national identification or taxpayer identification number.
Background check information: where required, with your prior written authorisation, information from pre-employment checks, such as verification of your employment and education history and professional qualifications and, where required or permitted for your role, criminal records information. All criminal records checks will be conducted in compliance with applicable laws.
Interview recordings and survey responses: Recordings of interviews with you (where permitted and consented to, as described in this notice) and the responses you provide when we ask you to participate in surveys.
6.3 Additional Information Collected from Employees, Workers and Contractors
Identity information: first name, last name, any previous names, marital status, title, date of birth and gender.
Contact information: addresses, telephone numbers, personal email addresses and emergency contact information.
Family information: family members, dependants and next of kin.
Recruitment information: copies of right to work documentation, copy passport or other photo ID, copy proof of address documentation (for example, bank statement or utility bill), copy driving licence, references and information included in a CV or cover letter or as part of the application Process.
Employment status check information: results of public authority employment status check and details of your interest in and connection with the intermediary through which your services are supplied.
Financial and tax information: National Insurance number, bank account details, payroll records and tax status information, salary, pension and benefits information, compensation history and conflict of interest or gift declarations.
Employment information: start date (and, if different, start date of continuous employment), location of employment or workplace, leaving date and reason for leaving, employment records (including contracts, photographs, job titles, work history, working hours, working arrangements (office-based, hybrid, remote), opinions on the workplace, holidays and other types of leave, training records and professional memberships), performance information and disciplinary and grievance information.
Genetic and biometric information: information on your fingerprints or face identification in case you provide them for account login purposes.
Monitoring information: CCTV footage, information obtained through electronic means (for example, swipe card records) and information about your use of our information and communications systems.
Health and medical information: information about and connected with your health, any medical condition or disability, including sickness absence records, accident at work records, tailored adjustment records, and correspondence with and information provided to and received from medical health professionals.
Miscellaneous Special Category Data: information about your race or ethnicity, religious or philosophical beliefs, sexual orientation, trade union membership and political opinions.
7. HOW WE USE YOUR PERSONAL DATA
7.1a Lawful basis: UK and EU
We will only Process your Personal Data when we have a lawful basis to do so. We will Process your Personal Data under the following lawful bases:
• Contract performance: where we need to Process your Personal Data to perform the contract we have entered into with you.
• Legitimate interests: where we need to use your Personal Data for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We consider any potential impact on you and your rights when determining whether we can Process your Personal Data for our legitimate interests.
• Recognised legitimate interests (RLIs): we may sometimes use your Personal Data because we (or a third party) have a recognised legitimate interest. RLIs are defined under Data Protection Law and apply to our Processing where there are public interest reasons for Processing (such as preventing or detecting crime, safeguarding individuals, responding to emergencies, or sharing information with public bodies). Where we rely on an RLI, we will ensure the use is strictly necessary and only use or share the minimum Personal Data required.
• Legal obligation: where we need to use your Personal Data to comply with a legal or regulatory obligation.
• Vital interests: less commonly, we may need to Process your Personal Data in emergency situations when it is in your vital interests or those of another person.
When we Process your Personal Data for the purposes of recruitment, the legal basis we rely on is normally that the Processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence. We have assessed these interests against your fundamental rights and freedoms and have concluded that this is an appropriate lawful basis.
There may be specific circumstances when the Processing is only performed if and when you provide your consent. This is, for example, the case if we propose to record an interview with you.
Where we Process any Special Category Data and/or Criminal Offence Data, we will ensure we have the appropriate lawful basis and are able to rely on an additional ground identified under Data Protection Law to do so.
7.1b Lawful basis: Singapore
In respect of individuals engaged by our Singapore branch, the PDPA requires that we obtain your consent (or rely on deemed consent or an applicable exception under the PDPA) before collecting, using or disclosing your Personal Data. You may be deemed to have consented to the collection, use or disclosure of your Personal Data where you voluntarily provide it to us for a purpose and it is reasonable that you would do so, or where deemed consent by notification applies. Where we rely on deemed consent by notification, we will conduct an assessment to determine that the proposed collection, use or disclosure is not likely to have an adverse effect on you, and will take reasonable steps to bring to your attention our intention to collect, use or disclose the Personal Data, the purpose for which the Personal Data will be collected, used or disclosed and a reasonable period within which you may notify us that you do not consent. Where we collect, use or disclose your Personal Data without consent, we will do so only in accordance with the exceptions permitted under the PDPA, including where it is necessary for evaluative purposes, entering into, managing or terminating the employment relationship with you, or for any investigation or proceedings.
We will make reasonable efforts to ensure that Personal Data collected by or on behalf of us is accurate and complete where such Personal Data is likely to be used by us to make a decision that affects you or is likely to be disclosed by us to another Organisation, in accordance with the PDPA.
7.1c Lawful basis: US
If you are located in the United States, the legal bases described in this notice are not required and are set out for transparency only, and we Process your personal data for the purposes described in this notice to the extent permitted by applicable law and in compliance with Data Protection Law.
7.2 Processing your Personal Data for new purposes
In the UK and EU, before we Process your Personal Data for any new purpose, we will ensure the Processing is fair and lawful. In particular, we will confirm that an appropriate lawful basis applies to the new purpose and (where relevant) that any additional requirements for Special Category Data and Criminal Offence Data are met. We will carefully consider whether any new use is compatible with the original purpose for which your information was collected, taking into account:
• How closely connected the new purpose is to the original one.
• The context in which your information was collected, including your reasonable expectations at the time.
• The nature and sensitivity of the information involved.
• The potential impact on you.
• The safeguards we have in place to protect your information.
We will not use your Personal Data in ways that are unexpected, unfair, or that could have an unjustified negative impact on you.
Where we do intend to use your Personal Data for a new purpose, we will inform you and provide any relevant information before doing so. In some cases, you will have the right to object to that use, and we will make you aware of this right whenever it applies.
In respect of individuals engaged by our Singapore branch, we will inform you of the purposes for which we collect, use or disclose your Personal Data on or before collecting such data, in accordance with the PDPA. We will only collect, use or disclose your Personal Data for purposes that a reasonable person would consider appropriate in the circumstances. Where we intend to use or disclose your Personal Data for a purpose of which you have not previously been informed, we will notify you of that purpose before such use or disclosure. On request, we will provide you with the business contact information of a person who is able to answer your questions about the collection, use or disclosure of your Personal Data on our behalf.
7.3 Candidates and References: Purposes of Processing
Purpose/Use
Type of Personal Data
Lawful Basis
Collect information about use of the career site using cookies and other tracking technologies, as described in our Cookie Policy
(Candidates only)
Device information
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Maintain, develop, test, and ensure the security of the career site
(Candidates only)
Device information; Technical and statistical data
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Analyse how the career site and its content is being used to improve operational performance
(Candidates only)
Device information; Technical and statistical data
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Provide updates about vacancies with us
(Candidates only)
Contact details; Communications data
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Review profiles and applications sent to us, and communicate with you about your application
(Candidates only)
All categories listed above
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Collect and evaluate your professional profile on our own initiative and communicate with you regarding your profile
(Candidates only)
All categories listed above
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Contact you directly about specific future vacancies
(Candidates only)
All categories listed above
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Record interviews with you[PM1] [JV2]
(Candidates only)
Communications data
UK/EU GDPR: Consent; Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Contact you to ask for your participation in surveys
(Candidates only)
All categories listed above
UK/EU GDPR: Consent; Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Comply with applicable laws and regulatory requirements, such as employment, anti-discrimination, immigration and right-to-work laws, and respond to lawful requests from courts, regulators and other authorities
(Candidates only)
All categories listed above
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Contact you to ask you to provide information about a Candidate, and evaluate the information you provide
(References only)
Contact details; Communications data
UK/EU GDPR: Consent; Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
Protect and enforce our rights, interests and the interests of others, including in connection with legal claims
All categories listed above
UK/EU GDPR: Legitimate Interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA
7.4 Purposes of Processing — Employees, Workers and Contractors
Starting Work
Purpose/Use
Type of Personal Data
Lawful Basis
HR records: setting up your record in the People Team
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Right to work: confirming entitlement to work in the relevant jurisdiction
Identity; Contact; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Employment status: determining whether your engagement is deemed employment for tax purposes and providing a status determination statement
Identity; Contact; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Managing Your Contractual Entitlements (Pay, Pensions, Benefits and Leave)
Purpose/Use
Type of Personal Data
Lawful Basis
Pay / salary and compensation: paying you and, where required, deducting tax and applicable withholdings including National Insurance Contributions; making decisions in salary reviews
Identity; Contact; Recruitment; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Pension enrolment and arrangements: enrolling you in our pension scheme, retirement savings, and liaising with trustees, administrators or managers
Identity; Contact; Recruitment; Financial and tax; Employment; Beneficiaries' information; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Share plans: inviting you to participate in, administering your participation in, and granting awards under any share plans
Identity; Contact; Recruitment; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Benefits: providing and administering benefits and liaising with benefit providers
Identity; Contact; Family; Recruitment; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Annual leave: administering your annual leave entitlement (or any paid time off) and any other forms of leave
Identity; Contact; Family; Recruitment; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Managing Our Working Relationship with You
Purpose/Use
Type of Personal Data
Lawful Basis
Contract, policies and procedures: administering the contract and our policies and procedures as they apply to you
Identity; Contact; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Qualifications, education, training, skills and development: assessing qualifications and skills, including decisions about promotions
Identity; Contact; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Performance and working arrangements: conducting performance reviews, managing performance, and making decisions about working arrangements and continued employment
Identity; Contact; Employment; Performance; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Grievance and disciplinary: investigating and conducting proceedings in relation to grievance or disciplinary issues
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Performance; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Termination: making arrangements for the termination of our working relationship
Identity; Contact; Recruitment; Employment status check; Financial and tax; Employment; Performance; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Legal disputes: dealing with any actual or anticipated legal disputes we have with you or others (which include your Personal Data)
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Performance; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Monitoring
Purpose/Use
Type of Personal Data
Lawful Basis
Network and information security: ensuring network and information security, including prevention of unauthorised access and malicious software distribution
Identity; Contact; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Communication systems: monitoring use of our information and communication systems to ensure compliance with our IT policies
Identity; Contact; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Physical access: monitoring and controlling access to office premises
Identity; Contact; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Wider Workforce Management
Purpose/Use
Type of Personal Data
Lawful Basis
Business management and planning, including accounting and auditing
Identity; Contact; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Reorganisations, sales, mergers and acquisitions
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Data analytics: reviewing and better understanding employee satisfaction, retention and attrition rates
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Workforce demographic reporting
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Health and safety: compliance with health and safety obligations
Identity; Contact; Family; Recruitment; Financial and tax; Employment; Health; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Workplace incidents: dealing with workplace accidents and emergencies
Identity; Contact; Family; Recruitment; Financial and tax; Employment; Health; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Fraud or crime prevention
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
Legal disputes: dealing with legal disputes involving other employees, contractors or clients
Identity; Contact; Family; Recruitment; Employment status check; Financial and tax; Employment; Monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
8. HOW WE PROCESS YOUR SPECIAL CATEGORY DATA
In the UK/EU, we only use your Special Category Data when, in addition to having a lawful basis that is required to Process Personal Data (referred to previously in this notice), there is an additional ground recognised under Data Protection Law that allows us to do so. Those additional grounds include:
• Employment law: when using your Special Category Data is necessary to carry out rights and obligations in connection with employment law.
• Legal claims: when using your Special Category Data is necessary to establish, exercise or defend legal claims.
• Substantial public interest: when using your Special Category Data is necessary to undertake matters deemed to be of substantial public interest, including equal opportunities monitoring, preventing or detecting unlawful acts, protecting the public against dishonesty, compliance with regulatory requirements about unlawful acts, provision of confidential counselling and about our occupational pension scheme.
• Vital interests (incapacity): in rare cases, when using your Special Category Data is necessary to protect your vital interests, or someone else's vital interests, in circumstances in which you may be physically or legally incapable of giving consent.
Race or Ethnicity, Religious or Philosophical Beliefs, Sexual Orientation, Political Opinions
Purpose/Use
Lawful Basis
Additional Ground
Equal opportunities monitoring
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests (ensuring equal opportunities)
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims; Substantial public interest
Equalities reporting
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests (ensuring equal opportunities)
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims; Substantial public interest
Disciplinary and grievance issues, legal disputes
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests (protecting our interests and fair resolution of issues)
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims; Substantial public interest
Trade Union Membership
Purpose/Use
Lawful Basis
Additional Ground
Communications with your trade union, its officials and representatives, in connection with your statutory employment rights
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests (fulfilling obligations)
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Disciplinary and grievance issues, legal disputes
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests (fulfilling obligations and resolving issues)
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Health and Medical Information
Purpose/Use
Lawful Basis
Additional Ground
Assessment of fitness to work
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Sickness absence management
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Reasonable adjustments
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Benefit administration: administering benefits relating to your health, medical condition or disability
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims;
Health and safety: ensuring health and safety at work
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Well-being: protecting your physical, mental or emotional well-being
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Health-related departures: making any applications for pensions, life assurance, and health insurance on your departure for health-related reasons
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Pension entitlement and ill-health pension entitlement
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Disciplinary and grievance issues, legal disputes
UK/EU GDPR: Contract performance; Legal obligation
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment law; Legal claims
Please note that, in respect of individuals engaged by our Singapore branch, the PDPA does not distinguish between categories of Personal Data in the manner described above. All Personal Data collected, used or disclosed by our Singapore branch is subject to the consent, purpose limitation and other requirements of the PDPA as set out in this notice.
9. HOW WE USE YOUR CRIMINAL OFFENCE INFORMATION
You will have been given information about whether any criminal records checks were required for your role when you applied to work for us. If any further checks become or are required, for example due to a change in the law or a change in your role, we will advise you.
We only use your Criminal Offence Data in the UK/EU when, in addition to one of the grounds required to Process Personal Data (referred to previously in this notice), there is a further ground that permits us to do so. The further grounds include:
• Employment: when Processing Criminal Offence Data is necessary to perform or exercise obligations or rights which are imposed or conferred by law either on us or on you in connection with employment.
• Legal claims: when Processing Criminal Offence Data is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), for the purpose of obtaining legal advice, or is otherwise necessary for establishing, exercising or defending legal rights.
• Substantial public interest: when Processing Criminal Offence Data is deemed to be of substantial public interest because it concerns preventing or detecting unlawful acts, protecting the public against dishonesty, or because it concerns compliance with regulatory requirements in relation to unlawful acts.
Please note that these grounds are not required under applicable Data Protection Law in Singapore and the US, and we may Process your Criminal Offence Data in these jurisdictions in a manner consistent with our business while ensuring it is compliant with applicable laws.
Purpose/Use
Lawful Basis
Additional Ground
Necessary for your role
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment; Legal claims; Substantial public interest
Criminal offences during employment: where Criminal Offence Data is brought to our attention during the course of your work for us
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment; Legal claims; Substantial public interest
Disciplinary and grievance issues, legal disputes
UK/EU GDPR: Contract performance; Legal obligation; Legitimate interests
PDPA: Consent, deemed consent, or exceptions under the First and Second Schedules to the PDPA (including for managing the employment relationship)
UK/EU GDPR: Employment; Legal claims; Substantial public interest
10. AUTOMATED DECISION-MAKING[PM3] [JV4]
Automated decision-making is the Process of making decisions by automated means with or without any human involvement. We do not make decisions about you based solely on automated Processing that would have legal, or similarly significant, effects for you. We will notify you if this position changes.
11. MONITORING AND TRACKING TECHNOLOGY
We do not set out in full our approach to monitoring and tracking technologies in this privacy notice.
For Employees, Workers and Contractors, information about how we monitor you, including the use of cookies, device monitoring, email and internet usage monitoring, is set out in our Privacy Policy and applicable IT policies.
For Candidates, we collect information about your use of the career site using cookies and other tracking technologies, as described in our Cookie Policy.
12. USE OF AI TOOLS
We may use AI tools or AI services to support employment and recruitment Processes, workflows or other business-related purposes. Where we deploy AI tools or services that change the way in which your Personal Data is Processed, we will provide you with further information at the relevant time. Where AI tools or services are provided by suppliers, those suppliers are required to Process your Personal Data only in accordance with our instructions and are not permitted to use it for their own purposes, including to train AI models, without our authorisation.
13. [PM5] [JV6] [PM7] DATA SHARING
In certain circumstances, we need to share your Personal Data across our group of entities, or with other third parties, including partners and service providers. Where we jointly Process your Personal Data with another Controller, we will provide you with further information about that arrangement in a separate notice.
Any disclosures or data sharing will be done in accordance with the law or relevant contractual arrangements. All the entities in our group and other third parties are required to take appropriate security measures to protect your Personal Data. We only permit them to Process your Personal Data for specified purposes and in accordance with our instructions.
We share your Personal Data with the following categories of recipients:
• Other group entities and service providers (including contractors and designated agents) who carry out the following functions: payroll, pension administration, benefits provision and administration, professional services, legal, tax, immigration (if applicable), insurance, aviation partners, learning and development, research, business management, travel, financial, entertainment, translation, and IT services.
• Third-party administrators, nominees, registrars and trustees in connection with your participation in any share plans operated by us or any group company.
• Trustees or scheme managers of any pension arrangement operated by us or any group company in connection with the administration of the arrangements.
• Other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.
• Background check and verification providers who carry out pre-employment background, reference, qualification and right-to-work checks on our behalf.
• Our service providers who support our employer branding and recruitment Process, including recruitment service providers and the supplier of our career site and related applicant tracking system.
• Companies providing cookies on the career site, where you have consented to this. Those companies will use the data collected by their cookies in accordance with their own privacy policy.
• Regulators and public authorities where we are required to comply with the law: including making returns to relevant tax authorities, disclosures to stock exchange regulators, disclosures to shareholders such as directors' remuneration reporting requirements, and aviation authorities.
• Parties involved in legal proceedings: if needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding.
• Other parties in connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business.
14. CROSS-BORDER DATA TRANSFERS
14.1 UK/EU/Singapore
All transfers between our group companies are governed by our intra-group data sharing and transfer agreements which ensures the recipient of transferred Personal Data is bound by legally enforceable obligations to provide a standard of protection that is comparable to the protection afforded under the relevant Data Protection Law and/or incorporates the relevant standard contractual clauses as required under Data Protection Law. A list of our group companies is available in Appendix I.
For transfers to third party companies, where available, we rely on adequacy decisions made under Data Protection Law. For all other transfers to third party companies, we ensure the recipient of transferred Personal Data is bound by legally enforceable obligations to provide a standard of protection that is comparable to the protection afforded under the relevant Data Protection Law, including, where appropriate, executing the relevant standard contractual clauses as required under Data Protection Law.
You can request copies of executed standard contractual clauses by reaching out to your relevant contact in Appendix I. Please note we may redact some information that we deem confidential or may negatively impact the data protection rights of others.
14.2 US
If you are in the US, your Personal Data may be transferred to and Processed in other countries where our group companies and service providers operate. The safeguards described above apply to transfers of Personal Data out of the UK, EU and/or Singapore and are not applicable to transfers of Personal Data out of the US. We nonetheless take appropriate measures to protect your Personal Data wherever it is Processed, as described in this notice.
15. DATA SECURITY
We have implemented appropriate security measures to protect your Personal Data against accidental loss and unauthorised access, use, alteration, disclosure, collection, copying, modification, disposal or similar risks, and against the loss of any storage medium or device on which Personal Data is stored, in accordance with Data Protection Law.
We impose controls for access to Personal Data based on business requirements and in accordance with the relevant lawful bases for Processing. Any party with access rights will only Process your Personal Data in accordance with applicable IT policies and procedures, relevant obligations or third-party contractual terms.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are required to do so and in the prescribed timeframe under Data Protection Law.
16. DATA RETENTION
We will only retain your Personal Data in accordance with Data Protection Laws, regulatory requirements or for as long as necessary to fulfil the purposes for which we collected it, as set out in our Document Retention / Destruction Policy.
If you are an Employee, Worker or Contractor, we will retain and securely destroy your Personal Data in accordance with our Document Retention / Destruction Policy and any applicable legal requirements, including Data Protection Law. For example, in respect of our Singapore branch, we will cease to retain your Personal Data where we deem it is reasonable to assume that the purpose for which the Personal Data was collected is no longer being served by its retention and retention is no longer necessary for legal or business purposes.
If you are a Candidate:
• If we Process your personal data for the purpose of protecting and enforcing our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
• We keep Visitors' personal data for one (1) year for security purposes. Retention periods for cookies are set out in our Cookie Policy.
• If you are a Connecting Candidate only, we keep your personal data for as long as you remain connected with us.
• For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy or vacancies. If you do not succeed in the initial recruitment Process, we keep your personal data for as long as needed to consider, and potentially contact you for, relevant future job openings.
• If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, of which you will be informed.
• For References, we keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
17. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
You have rights under Data Protection Law set out in this section below. These rights may differ depending on your jurisdiction of residence and the relevant Data Protection Law applicable to you as we have identified below. Please note that, if you are in Florida, none of the rights described in this section apply.
• Right to access: If you are in the UK/EU, you may request access to your Personal Data (commonly known as making a data subject access request). If you are in Singapore, you may also request for information about the ways in which such Personal Data has been or may have been used or disclosed by us within the year preceding your request.
• Right to rectification: If you are in the UK/EU, you may request rectification of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. If you are in Singapore, we will also send the corrected Personal Data to every other Organisation to which the Personal Data was disclosed by us within the year preceding the date the correction was made, unless that other Organisation does not need the corrected personal data for any legal or business purpose.
• Right to erasure: If you are in the UK/EU, you may request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to Process it. Please note that if you are in Singapore, there is no equivalent right to erasure or to be forgotten and we will retain your Personal Data in accordance with section 16 of this notice.
• Right to restriction: If you are in the UK/EU, you may request the restriction of Processing of your Personal Data. This enables you to ask us to suspend the Processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for Processing it.
• Right to data portability: If you are in the UK/EU, you can request a copy of the personal data relating to you that we Process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
• Right to object: If you are in the UK/EU, you may object to Processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object. You also have the right to object where we are Processing your Personal Data for direct marketing purposes.
• Right to withdraw consent: If you are in the UK/EU, where we Process your Personal Data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop Processing your data for the purposes for which you have withdrawn your consent. Withdrawal of consent does not affect the lawfulness of Processing carried out before the withdrawal. If you are in Singapore, you may at any time withdraw any consent given or deemed to have been given under the PDPA for the collection, use or disclosure of your Personal Data, by giving us reasonable notice. Upon receipt of your notice of withdrawal, we will inform you of the likely consequences of such withdrawal. Following your withdrawal of consent, we will cease (and cause our data intermediaries and agents to cease) collecting, using or disclosing your Personal Data for the relevant purpose, unless such collection, use or disclosure without your consent is required or authorised under the PDPA or other written law. We will not prohibit you from withdrawing your consent, although such withdrawal will not affect any legal consequences arising therefrom.
If you want to exercise these rights, please contact the relevant contact in your region as set out in Appendix I. Ordinarily you will not have to pay a fee to exercise any of these rights. However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request where permissible under Data Protection Law. For example, in respect of individuals engaged by our Singapore branch, where we are unable to provide you with access to your Personal Data or decline to make a correction, we will notify you of the reasons for our decision within the prescribed time and in accordance with the prescribed requirements under the PDPA.
Candidates may also exercise their rights by:
• Visiting the Data & Privacy page on our career site, where we offer features to let you exercise your rights.
• Logging in to your account with us, where you can use the settings in the account to exercise your rights.
• Contacting us directly at privacyenquiries@aerfin.com with copy to naomi.mattock@aerfin.com.
18. QUESTIONS OR COMPLAINTS
If you have any queries or complaints about our use of personal data, please contact us as follows:
• privacyenquiries@aerfin.com (with copy to):
• Naomi Mattock, DPO, Newton Road, Crawley RH10 9TS; Tel: +44 1293 583244; Email: naomi.mattock@aerfin.com
For our complaints procedure please refer to our Privacy Policy available on our website www.aerfin.com.
If you are dissatisfied with the outcome, or if no response is received within the stated timeframe:
• if you are in the UK, you have the right to lodge a complaint directly with the Information Commissioner's Office (ICO) via website: https://ico.org.uk/make-a-complaint or via phone 03031231113;
• if you are in the EU, you have the right to lodge a complaint directly with the supervisory authority responsible for your member state;
• if you are in Singapore, you may lodge a complaint with the Personal Data Protection Commission (PDPC) in Singapore. Further information is available at www.pdpc.gov.sg; and
• if you are in the US, you may lodge a complaint with the relevant data protection authority in your state.
19. UPDATES TO THIS NOTICE
We update this privacy notice when necessary, for example, because we start Processing your Personal Data in a new way, because we want to make the information even clearer to you, or if it is necessary to do so in order to comply with Data Protection Law.
We will provide you with an updated copy, summarising the changes where relevant, and may also notify you in other ways from time to time about the Processing of your Personal Data.
APPENDIX I: LIST OF ALL AERFIN ENTITIES
Name
Registered Address
Country of Establishment
Contact Details for Privacy-Related Queries
AerFin Limited
Unit 8, Indurent Park, Queens Way, Newport, Wales, NP19 4RJ, United Kingdom
United Kingdom (England & Wales)
privacyenquiries@aerfin.com
Naomi Mattock, VP Legal, DPO, Newton Road, Crawley RH10 9TS; Tel: +44 1293 583244;
naomi.mattock@aerfin.com
AerFin US, LLC
3740 West 104th Street, Hialeah, FL, 33018
Florida, United States
privacyenquiries@aerfin.com
Naomi Mattock, VP Legal, DPO, Newton Road, Crawley RH10 9TS; Tel: +44 1293 583244;
naomi.mattock@aerfin.com
AerFin Limited (Singapore branch)
105 Cecil Street, #18-18, The Octagon, Singapore
Singapore
privacyenquiries@aerfin.com
Jo Rival, Chief People Officer, DPO, 105 Cecil Street, #18-18, The Octagon, Singapore, 069534; Tel: +44 7867 336617;
jo.rival@aerfin.com
AerFin (Ireland Branch)
38 Baggot Street Lower, Dublin, Ireland, D02 Y793
Dublin, Ireland
privacyenquiries@aerfin.com
Naomi Mattock, VP Legal, DPO, Newton Road, Crawley RH10 9TS; Tel: +44 1293 583244;
naomi.mattock@aerfin.com
