Privacy and data policy - One Sky One Plan

1. Introduction

When you use the Airspace Change and Organising Group (owned by and hereby referred to as ACOG) website or services, you are trusting us with your information. This privacy notice is to let you know how NATS will look after your personal information. This includes what you tell us about yourself and what we learn from you as a website user. This privacy notice explains how NATS will use your information, who we share your information with and informs you about your privacy rights.

NATS will;

Keep your personal information safe and secure
Not use or share your personal information other than as set out in this privacy notice
Allow you to have access to your personal information upon request at all times

NATS wants to ensure that you are fully informed about your rights and how NATS uses your personal information.

We hope this privacy notice will answer any questions you may have, but if not then please contact us at [email protected].

2. Who is ACOG and NATS?

ACOG is a fully independent organisation within NATS.

NATS means any of the companies which is within the NATS Holdings Limited group.

NATS Holdings Limited is made up of a number of related businesses that provides air traffic control (ATC) services through two principle subsidiaries:

NATS (En Route) plc – Provides ATC services for aircraft flying ‘en route’ in UK airspace and eastern part of the North Atlantic

NATS (Services) Limited – Provides ATC and engineering services to a number of UK airports. It provides defence services to the UK Ministry of Defence through Aquila, a joint venture with Thales. It also provides design and data services to airlines and airspace users and international services to customers in Asia Pacific, Middle East and a joint venture with Ferrovial Servicios in Spain known as FerroNATS

3. When do we collect your personal information?

NATS may collect personal information from you when;

You visit our website
You register your CV with us for recruitment purposes
You register an account with us to use our products or services
You engage with us through the use of Social Media or webchat services
You download or install one of our apps
You contact us by any means with queries, complaints or requests
You comment on a story on our website
You enter a competition
You fill in forms
You fill in surveys
You engage with us through webchat services
You attend an event which NATS is hosting or in attendance at

4. What personal information do we collect?

NATS may collect the following types of information;

Personal information such as full name, date of birth, contact information such as home or work address (dependant on services requested) telephone numbers, email addresses, financial information such as your payment details
Cookie information such as details of your visits to our website or our apps, any interactions with us through our website, forms or other channels of communication in accordance with our Privacy and Data Policy. View what cookies we use on this website.
Digital personal information such as your social media username (if you interact with us through this medium which enables us to respond to your comments, questions or feedback), technical information about your internet connection / browser type as well as the country and telephone code you are in
Photos or videos if you attend NATS sites or attend an event that NATS is hosting or in attendance at
CCTV images or vehicle registration number if you visit one of our sites
Information you provide through the NATS recruitment process (i.e. CV)
Information from third parties who support our services

5. Legal basis for collecting and using your personal information

Data Protection Law states that NATS is only allowed to collect and process your personal information if it has a lawful reason to do so. NATS may collect and use your personal information for the following reasons;

When you provide your consent
To provide you with the information or services you request and fulfil a contract with you
To comply with our legal and regulatory obligations
To publicise information which is of interest to the public
When it is in our legitimate interest to do so, such as;
- To ensure you receive the best possible experience when using our website, products or services
- To enable NATS to monitor and promote aviation safety
- To monitor, measure or understand the effectiveness of the website in facilitating NATS’s communications to users such as you, including troubleshooting, data analysis, testing, research, statistical and survey purposes
- For management and audit of our business operations including accounting
- To carry out monitoring and to keep records of our communications with you
- For market research and analysis and developing statistics
- To provide you with information about other tools and services we offer that are similar to those that you have already purchased or enquired about
- To notify you about changes to the website, our tools and our service
- For direct marketing communications and related profiling to help us to offer you relevant products and services, including deciding whether or not to offer you certain products and services. We may send marketing to you by SMS, email, phone, post and social media and digital channel
- Subject to the appropriate controls, to provide insight and analysis of our customers to business partners either as part of providing products or services, helping us improve products or services, or to assess or to improve the operating of our businesses
- For some of our profiling and other automated decision making
- Where we need to share your personal information with people or organisations in order to run our business or comply with any legal and/or regulatory obligations
- To write articles, publicise or promote our services through the use of online media, news broadcasters or other reporting channels
- To enable other NATS -grouped companies to perform any of the above purposes

6. How NATS protects your personal information

Keeping your personal information that you have entrusted with us, safe and secure is of paramount importance to NATS. We secure access to our website using ‘https’ technology. We monitor our system for possible vulnerabilities, attacks and we also carry out independent penetration testing to identify opportunities to strengthen our security infrastructure.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using Security Sockets Layer (SSL) technology.

7. How long do we keep personal information for?

We will only keep your personal information as long as is necessary for the purpose for which it was collected.

Where you have provided personal information for us to provide a service to you, we will hold onto the personal information you provide to be able to provide the services to you and in some cases for a limited period to meet our legal and regulatory requirements.

Once it is no longer necessary for us to hold your personal information it will be deleted completely or anonymised. An example of this would be to anonymise data so that it is no longer personally identifiable and to use it for purely statistical analysis.

8. Who do we share your personal information with?

We may share your personal information with any member of NATS and a small number of selected third parties including:

The Civil Aviation Authority (CAA) for regulatory functions and other government bodies and agencies
Business partners, suppliers and sub-contractors for the performance of a contract, recruitment or to provide services to you
Legal and other professional advisors
Credit reference agencies for the purpose of assessing your credit score and is required as a condition of entering into a contract with NATS
Cifas – The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected, you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by https://www.cifas.org.uk/fpn
IT companies and search engine providers who support our website and other business systems
Police, Courts or other enforcement agencies, in the UK or in other European Member States, to meet our legal requirements or upon a valid request to do so. These types of requests will be dealt with on a case-by-case basis and take the privacy of you as an individual into consideration

9. Where is your personal information processed?

Sometimes NATS may process or store your personal information outside of the UK or the European Economic Area (EEA). It may be processed by NATS operating outside of the UK or the EEA and who may work for suppliers or third-party contracts, in locations such as Asia Pacific or the Middle East.

If we do process or store your personal information outside of the UK or the EEA we have procedures in place to ensure your personal information is protected by appropriate safeguards. To find out more about how your personal information is protected when it is transferred outside of the EEA (and if you wish to obtain a copy of the appropriate and suitable safeguards), please contact the [email protected].

10. Your rights over your personal information

We understand that you trust us with your personal information and we are committed to ensuring you can manage the privacy and security of your personal information yourself. Under Data Protection Laws you have a number of rights:

Right of access to your personal data
Right of rectification. If your personal information is incorrect, out of date or incomplete you can request that it is updated
You have the right to withdraw your consent where consent has been used to collect your personal information. You can unsubscribe from receiving marketing emails from us by clicking the “unsubscribe” link. Once you do this, we will cease to process your personal information for this purpose and you will no longer receive any marketing emails from us
You have the right to object in cases where we use legitimate interests as a reason to process your personal information. We must then stop using your information unless we believe we have an overriding reason to continue to process your personal information. In that case we would notify you what the reason is
You have the right to the erasure of your personal information where you withdraw your consent, or it is no longer necessary for us to hold your personal information
You have the right to request that we restrict the processing of your personal information

If you decide that you would like a copy of the personal information that we hold on record about you, you can do this at any time. To request your personal information please contact the Data Protection Officer by email at [email protected] or by using our GDPR enquiry form.

Checking your identity

To ensure we send personal information out to the correct person, we will ask you to verify your identity before we proceed with any request. If you have requested a 3rd party to submit a request on your behalf, we will ask them to prove that they have the correct permissions in place before we act.

11. Contacting the Information Commissioners Office

You have the right to be assured that NATS will handle your personal information responsibly and in line with best practice and compliance with the General Data Protection Regulation.

If you have a concern about the way NATS is handling your personal information, you should alert the NATS Data Protection Officer immediately.

If you are still unhappy with our response you can lodge a concern with the Information Commissioner’s Office through their helpline ‘0303 123 1113’’ or via their website at www.ico.org.uk/make-a-complaint.

12. Questions?

This privacy notice sets out how we manage your personal information and the controls around them. So we hope this privacy notice has been helpful.

If you have any questions that haven’t been covered or you require a bit more information, then please contact our Data Protection Officer who will be happy to help.

Email us at [email protected].

This privacy notice was last updated 6th July 2021.