Privacy policy

This policy aims to support your right to be informed. The document covers how we process the data of individuals who are clients, prospects, staff or suppliers.

Identity and contact details

Please click here to find out more about IWA (IWA). Our postal address is 55 Station Road, Beaconsfield, United Kingdom, HP9 1QL.  Our telephone number is +44 (0) 800 368 9090.  You can contact us by email using privacy@iwaviation.com. We are registered at Companies House as I&W LIMITED with a company number of 09699098.

Our designated supervisory authority under the UK's General Data Protection Regulation (GDPR) is the Information Commissioner’s Office (ICO). We are based in the United Kingdom.

Please contact our Data Protection Manager, using the details above, on for more information.

What data we process

IWA processes data on:

• Customers

• Prospects (including ex-clients)

• Staff

• Suppliers

Customers

IWA captures information on individuals who are customers and prospective customers who are using or interested in using our services. We process this data so that we can engage with the individuals to provide them or their organisations with our services, or we process the data as we are taking steps to enter into a contract to provide these services.

We capture this information either directly, through the ‘Contact us’ form on our website, or where the prospective customers get in touch with us on email or telephone. We update the data on these individuals in the course of our regular contact with the customer as we provide them with our services.

The information we capture on these individuals will include basic contact details such as name, telephone number, email address and postal address.

We can capture special category data on these individuals in the course of providing our services where we capture information on the aspects of health which are directly relevant for the aviation services that we provide. We can capture information on children, as in some cases, children use the services that we provide when travelling with adults.  We restrict what we capture to ‘information necessary for the performance of a contract’. We use a reason of ‘contract’ to process this data as we are taking steps towards providing products and services to these individuals, or are providing our services, when we capture and process this data.   

Prospects

IWA captures information on individuals who we believe could have a need for our services. We use this data to keep the individuals up to date with our service offerings.

We either capture this data when the individuals provide this data through our website, or we can get passed their details as referrals from our existing customers.

The information we capture on these people will include basic contact details such as name, telephone number, email address and postal address. We do not process special category data on these individuals. We process this data using the basis of ‘consent'. This lawful basis of consent can include the use of a 'soft opt-in' where the individuals we are targeting have engaged with our services within the past 2 years.

Staff

We process information on staff in several ways. 

For the execution of the contract

We process data for the purposes of engaging in a contract of employment or other work for IWA, or if individuals are taking steps to enter into a contract (for example for recruitment).  We capture this information in the course of recruiting and ‘on-boarding’ an individual to work with us.

The information we capture for this reason will include basic contact details such as name, telephone number, email address, postal address and details needed to process payments under the contracts such as bank account details and national insurance numbers. We will also capture information that relates to the appraisal of performance and timekeeping.

We can also capture special category information as the processing of this data is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.  We have completed an appropriate policy to cover the use of this special category data. 

We use a lawful basis of ‘contract’ to process this data. 

Staff benefits

We process information on staff and can pass data on to specific parties because we are acting as an intermediary to a contract between the member of staff and the third party.  For example, where we organise pension payments for staff. We capture this information as a part of the employee ‘on-boarding’ process and we update the data at regular intervals.

The information we capture for this reason will include basic contact details such as name, telephone number, email address and postal address. We do not capture special category information on this data. We use a lawful basis of contract to process this data. 

Operational reasons

We process information on staff and their next of kin where it is in IWA's interest to do so for operational purposes.  For example, to keep staff up to date with IWA news, to maintain a list of the staff's next of kin for communication in the event of an emergency, or to create business cards for staff. We capture this information as a part of the employee ‘on-boarding’ process and we update the data at regular intervals.

The type of data that we process for this need includes name, email address, telephone number. We do not capture special category information on this data. We use the lawful basis of legitimate interests to process this data.  We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on this data.

Suppliers and partners

We process information on suppliers and partners so that we can purchase goods and services from them.  We capture this information either from recommendations or by using data provided by the suppliers on their web sites or directories. 

The type of data that we process for this need includes name, email address, telephone number. We do not capture special category information on this data. We use a lawful basis of contract to process this data.

Other processing

We anonymise data on individuals so that we can retain information for analytical purposes.

Any recipient or categories of recipients of the personal data

IWA pass data on to other data controllers for the following purposes:

• We provide information on our clients to other providers where it is necessary for the performance of the contract between us.

• We share data with third parties on members of staff to obtain and provide references if requested or needed.

• As the data controller of data, we may provide data to processors. We maintain a list of data processors and ensure that we have data processing agreements between IWA and the data processor.

• We share data with organisations with which we have a legal obligation to share data (for example HMRC and Companies House).

Details of transfers to third country and safeguards

We may transfer data to other controllers in other countries so that we can carry out the aviation services that we offer. We maintain a list of these controllers, and evaluate what safeguards are required for data transfer on a case-by-case basis.

We will not transfer data on individuals to countries outside the UK to destinations that are not considered 'adequate' by relevant legislation without additional safeguards. Where this does happen, we obtain commitment from the data processors that additional safeguards are in place and complete International Transfer Assessments.  These are documented in our data protection policy.

Retention period or criteria used to determine the retention period

• We will retain information on customers for 7 years after the latest purchase as we will need to retain this information for financial purposes.

• We will retain information that we use on prospective customers for the purposes of direct marketing for 2 years after the latest interaction with the individual where we use legitimate interests as a lawful basis for processing the data.

• We will retain information that we use on prospective customers for the purposes of direct marketing for 2 years after the latest interaction with the individual where we use consent as a lawful basis for processing the data.

• We will retain information on staff members for 7 years after their employment with us ends, as we need to retain information on staff members for legal reasons.

• We will retain information on individuals who we have details on for recruitment purposes, but who have not gone on to be employees, for 1 years after the job role that they were being considered for has been filled.  If we believe that their details may be suitable for future roles, we will obtain their consent to retain their CVs for longer periods. 

•  We will retain the details of the suppliers or partners for as long as we might have a need for the services that the supplier or partner offer.   

If these data retention timescales clash with legal or contractual obligations then these other obligations will override the retention timescales outlined. For example, UK limited companies are required to retain records on tax paid for 6 years. 

All records are disposed of securely when deleted. 

How we look after data

We take reasonable technical and procedural precautions to prevent the loss, misuse or unauthorised alteration of personal data. We store the personal data that we collect securely. We do not publish the details of the safeguards we use to protect the personal data that we control as this could reduce the effectiveness of those safeguards.

Cookies

Cookies are text files placed on your computer to collect information about which pages you visit, and how long for. This information is used to track use of the website and to compile statistical reports on website activity.

When you visit our website you will be presented with a choice which will allow you to decide whether cookies are used or not. In a few cases some of our website features may not function if you choose not to allow cookies on our website.

Personal data may be shared with third parties to enable us to conduct web analytics to monitor use of our website. We use Google Analytics and you can opt out of Google Analytics by using this link: https://tools.google.com/dlpage/gaoptout?hl+en=GB.

Other websites

Our website contains links to other websites. This privacy policy only applies to this website, so when you link to other websites you should read their own privacy policies.

Artificial Intelligence (AI)

Our use of AI tools is covered in a separate policy.

Your rights

IWA recognises the rights of data subjects as defined in the General Data Protection Regulation (GDPR).

We will always seek to uphold those rights and the links provided will enable you to communicate with us to exercise those rights, where relevant.

IWA recognises your right to lodge a complaint with a supervisory authority. You can access the ICO's website from this link.

Please click on the button below to send us an instruction to collate the data that we are a controller of that relates to you and send it to you.

Please note that clicking on the button should populate the correct email address and details into your email client. We use this approach rather than a web form so that we can confirm that you are the individual that is instructing us to send them the data that we control on you. This is so that we can avoid other individuals using your details fraudulently.

If you do not want to use the button, or have problems with it, please send us an email to privacy@iwaviation.com describing what data you would like access to.

When we have collated all the data that we hold on you, we will securely send you the data, at most within 30 days. If there is any reason for a delay in providing you with your data, we will notify you as soon as possible. When we send you your data, we will inform you of the other rights that you have that relate to your data.

Please click on the button below to send us an instruction to correct data that we control that relates to you. Clicking on the button should open your email client and populate the relevant information into the email.

Please note that clicking on the button should populate the correct email address and details into your email client. We use this approach, rather than a web form, so that we can confirm that you are the individual that relates to the data rectification instruction. We do this so that we can avoid other individuals using your details fraudulently.

If the button doesn't work for you, or you would prefer to send us an email separately, please send an email to privacy@iwaviation.com, outlining what data you need changing.

When we have updated all the data that we hold on you according to your instructions, we will securely send you a copy of the rectified data, at most within 30 days.

Please click on the button below to send us an instruction to erase data that we control that relates to you. Clicking on the button should open your email client and populate the relevant information into the email.

Please note that clicking on the button should populate the correct email address and details into your email client.  We use this approach, rather than a web form, so that we can confirm that you are the individual that is sending us the instruction. We do this so that we can avoid other individuals using your details fraudulently.

If the button doesn't work for you, or you would prefer to send us an email with your instruction, please contact us using the privacy@iwaviation.com email address.

We will confirm to you that we have erased the data within 30 days of receipt of your instruction. We will retain the information that we need for legal purposes, which includes information that we need to register any opt outs or unsubscribes.

Please click on the button below to send us an instruction to restrict the processing of data that we control that relates to you. Note that if you have sent us an instruction to exercise your rights under the GDPR or other Data Protection regulations, we will restrict the processing of any data that we hold on you automatically while we carry out your instructions.

Please note that clicking on the button should populate the correct email address and details into your email client.  We take this approach, rather than a web form, so that we can confirm that you are the individual that relates to the instruction and avoid confusion if other individuals use your details fraudulently.

If the button does not work for you, or you want to send us an email separately to instruct us to restrict the processing of your data, please use the privacy@iwaviation.com email address.

We will send an email to you to confirm that we will stop processing your data and also keep your data securely stored, at most within 30 days of receiving your instruction.

If you would like to permanently stop any communications from us, please click here to unsubscribe from IWA’s communications.

Please click on the button below to send us an instruction to provide you with data that we hold that relates to you so that you can transfer this to another organisation.

Please note that clicking on the button should populate the correct email address and details into your email client.  We use this approach, rather than a web form, so that we can confirm that you are the individual that is sending us the instruction. We do this so that we can avoid other individuals using your details fraudulently.

If the button doesn't work for you, or you want to send us an email with your instruction, please sent an email to privacy@iwaviation.com.

We will send an email to you that gives you secure access to the data that we hold on you, at most within 30 days of your instruction.

If you do not want IWA to process your data, please click on the button below to send us an instruction to opt out of all processing and communications. 

Please note that clicking on the button should populate the correct email address and details into your email client. We use this approach rather than a web form so that we can confirm that you are the individual that is instructing us to opt out of processing. We do this so that we can avoid other individuals using your details fraudulently. 

If you only wish to opt out of a certain type of communication, please note that in the email body.

Within 30 days at most, we will then suppress any communications to you that IWA is a controller of. We will not confirm that we have opted you out of processing.

Alternatively, if you have received an email communication from us, please click on the opt out/unsubscribe link, or send an email to privacy@iwaviation.com with whatever form of words you consider appropriate.