NOTICE OF PRIVACY FOR REFERENCE PROVIDERS OF FLIGHT CREW CANDIDATES
1. WHO ARE WE AND HOW YOU CAN CONTACT US
UAB “Avion Express”, company code 300087830, address: Dariaus ir Girėno g. 38A, 02188 Vilnius, Lithuania, and / or Avion Express Malta Ltd, company code C 87300, address: NuBis Centre, Mosta Road, Lija LJA 9012, Malta.
When processing your data UAB “Avion Express” and Avion Express Malta Ltd each acts separately or both act together as joint controllers (hereinafter “We”, “Ours”, “Company”, “Avion Express”).
This Privacy Notice (hereinafter referred to as the “Privacy Notice”) outlines how we comply with applicable privacy requirements and how we deal with reference provider’s personal data and data provided to us.
If you have any questions regarding this Privacy Notice or requests regarding the processing of your personal data, please contact our Data Protection Team by email: [email protected].
In processing the personal data, we responsibly comply to the regulation No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), and other directly applicable legal acts regulating the protection of personal data, as well as instructions from competent authorities. The Company applies the highest technical and legal standards of protection and taking all necessary measures to prevent possible breaches of personal data protection.
UAB “Avion Express” and Avion Express Malta Ltd are the part of companies’ group of AVIA SOLUTIONS GROUP (ASG) PLC, legal entity code: 727348, address (as may be changed from time to time): Building 9, Vantage West, Central Park, Dublin, D18 FT0C, Ireland. In certain cases, Company, AVIA SOLUTIONS GROUP (ASG) PLC and its subsidiaries may jointly act as controllers of your personal data. The contact details of each Avia Solutions Group company can be found here.
2. WHAT PERSONAL DATA WE PROCESS?
For reference verification purposes, we collect and process personal data to assess a candidate’s suitability for professional engagement. This includes obtaining feedback from referees, such as former employers, regarding the candidate’s professional performance, qualifications, and conduct.
2.1. Personal Data of the Reference Provider
We collect and process personal data relating to the reference provider in order to obtain and document their feedback. This may include their name, contact details, job title, organization, professional relationship to the candidate, and the content of the reference they provide. This data is used to verify the credibility of the reference, ensure the relevance of the feedback, and maintain records of the recruitment/onboarding process. The information may also be used to contact the reference provider for clarification or follow-up, where necessary.
2.2. Personal Data Person the Reference Concerns
We collect and process personal data relating to the candidate as part of the reference-checking process. This includes information shared with the reference provider, such as the candidate’s name, the position applied for, and relevant professional background. Additionally, we process the feedback received about the candidate, which may include assessments of their qualifications, work performance, skills, reliability, conduct, and other job-related attributes. Where permitted by law and necessary for the role. This information is used solely for evaluating the candidate’s suitability.
2.3. On what legal basis do we process personal data?
Reference Provider
• Article 6(1)(f) of the GDPR (legitimate interest) allows processing when necessary for the legitimate interests of the controller or a third party. These interests consist of verifying the candidate’s suitability for professional engagement, ensuring the reliability of recruitment decisions, and maintaining safety and regulatory compliance standards. The personal data processed may include the reference provider’s name, contact details, professional role, professional relationship to the candidate, and the content of the reference provided.
Person the Reference Concerns
• Article 6 (1) (b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract).
• Article 6(1)(c) of the GDPR (processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject) as established by the Civil Aviation Directorate Flight Operations Inspectorate of Transport Malta in its Operations Advisory Notice (OAN), which requires the mandatory collection of references for flight crew members.
2.4. Retention period
Personal data related to reference checks, including personal data of the reference provider, will be retained for the duration of the professional engagement of the candidate and, thereafter, no longer than is necessary to comply with applicable legal and regulatory obligations.
3. THE SOURCES WE COLLECT PERSONAL DATA FROM
The reference provider’s contact details have been provided to us by the candidate for the purpose of conducting a reference check. In this step, we collect and process personal data solely for the purpose of obtaining a reference from the reference provider regarding the candidate and for recording the reference provider’s response. We do not collect any additional personal data about the reference provider from any other sources.
4. DATA SHARING INSIDE EEE/EU
We may disclose reference provider’s personal information to the following third parties for the purposes of this process:
• Third-party service providers acting on our behalf (e.g., systems providers).
• AVIA SOLUTIONS GROUP (ASG) PLC.
• Government authorities, courts, and law enforcement agencies.
• Professional advisors, auditors, lawyers, advisers.
5. DO WE APPLY AUTOMATED DECISION-MAKING OR PROFILING?
We do not use automated decision-making processes, including profiling. We value your privacy and ensure that no automated systems are used to analyse or evaluate your personal data in a way that would result in legal consequences or similarly significant effects.
6. YOUR RIGHTS IN CONNECTION WITH PERSONAL INFORMATION
We guarantee the implementation of these rights and the provision of any related information at your request or in case of your query:
• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion of personal data if there is no valid reason to retain it.
• Object to Processing: object to processing based on legitimate interests.
• Restriction of Processing: request to suspend processing while we verify its accuracy.
• Data Portability: request your data be transferred to another organization or to you.
• Withdraw Consent: you can withdraw consent and application at any time without affecting the lawfulness of processing based on consent before its withdrawal. Upon withdrawal, the Company will delete your personal data promptly.
To exercise these rights, contact the Company at [email protected]. Each request will be assessed on a case-by-case basis. The Company may not be legally required to comply with your request due to applicable data protection legislation exemptions.
7. COMPLAINTS
If you disagree with our actions or the response to your request, you have the right to file a complaint with the relevant supervisory authority. A list of supervisory authorities in each EU country can be found here: https://edpb.europa.eu/about-edpb/board/members_en.
However, we recommend that you contact us first to allow us the opportunity to resolve the issue before you submit a formal complaint.
For any questions about your personal data, please contact us at [email protected].
