Privacy policy and personal data protection

The personal data processing carried out via this ENAIRE website is regulated according to the provisions of the European data protection regulation, Regulation (EU) 2016/679, General Data protection Regulation (GDPR), and other application regulations, for the purpose of guaranteeing at all times the fundamental right to data protection for users of the website.

This privacy and data protection notification is applied to the pages of this website, it is not guaranteed for accesses through links leading to this site, nor through links from this site to other websites.

Collected personal data

Personal data collected through this ENAIRE website will be processed for the correct management of available procedures. Some of this data is provided directly, for example, when an application form is filled out and other data is obtained indirectly with technology such as cookies.

The means used by ENAIRE to collect and then process personal data are:

  • Forms: Via both digital and electronic forms, ENAIRE collects personal data for the correct management of the available procedures.
  • Emails: The email addresses provided to the ENAIRE website will be considered as potential means to collect personal data.
  • Cookies: ENAIRE may use technical cookies (small information files that the server sends to the system of the person who has accessed the page) to carry out certain functions that are considered essential for the correct functioning and visualisation of this website. For more information see: Cookies Policy.

Limitations in processing

ENAIRE does not authorise people under 16 years of age to provide their personal data via the means provided on this website (via any existing means on the website). Therefore, those that provide personal data using these means formally state to be over 16 years old leaving ENAIRE exempt of any responsibility for the non-compliance of this requirement.

In the cases in which the existing procedures on the ENAIRE website are aimed at people under 16 years of age the means will be provided to obtain the authorisation of the minor's parents or legal guardians.

Information on data collection

Provided that the data collection occurs via a form (online or downloadable) or other communication channels established on the website, the affected person will be informed according to the current data protection legislation.

The information to the affected persons will be provided according to the means used:

  • Forms (online and downloadable): the information will be included in the form itself.
  • Emails: the information will be indicated in the webspace where it refers to the email address.
  • Cookies: the information is available in the Cookies Policy.

The user is responsible for the truthfulness and accuracy of the personal data provided. In the event of modification of the user's data, these changes should be communicated to ENAIRE in order to keep them up-to-date.

Security measures

ENAIRE adopts suitable security measures in accordance with current data protection legislation in order to guarantee the fundamental right to the protection of the personal data of the website's users.

ENAIRE applies appropriate technical and organisational measures to guarantee a suitable level of security to the risk at which the personal data processed on this website are exposed to.

Rights

Those affected have the right to access, rectify and delete their data, as well as other rights, before the ENAIRE Central Data Protection Unit (DPCU), Avda. de Aragon 330 Building B - 28022 MADRID (Madrid) or via the ENAIRE Electronic Administration (sede.enaire.gob.es).

The rights of the affected persons are:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • Access their personal data, as well as request the rectification of inaccurate data or, where applicable to request the removal when, among others reasons, the data is no longer needed for the purposes it was collected for.

 

  • Request under certain circumstances:
  • The limitation of the processing of their data, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • The opposition to the processing of their data, in which case, ENAIRE will stop processing the data, except for compelling legitimate grounds, or to exercise or defend possible complaints. Including the processing of their data for automated individual decisions.

If in the exercise of their rights they have not been properly met, they can present a complaint to the Spanish Data Protection Agency – Address: C/Jorge Juan, 6 - 28001 MADRID (Madrid) – Website: sedeagpd.gob.es.

ADDITIONAL INFORMATION ON DATA PROTECTION

(Please, find below the treatment for the additional information requested)

1.- Video surveillance systems

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing
Video surveillance system designed to preserve the security of ENAIRE’s personnel, property and installations.
Storage periods: Images captured by the video surveillance systems will be kept for a maximum period of 1 month after being recorded.

Legality
Its processing is based on ENAIRE’s legitimate interest in ensuring security of personnel, property and installations at ENAIRE, except in the case of aeronautical infrastructure and equipment where such processing is in public interests.

Recipients
Recordings will be made available to law enforcement agencies and judicial entities. No data transfer to third countries or international organisations is contemplated.

Rights
Those interested have a right to:

  • Be informed if their personal data is being processed by ENAIRE
  • Access their personal data, as well as have it deleted.

Request under certain circumstances:

  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.

Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

In order to handle applicants’ requests to exercise their rights correctly, a recent photograph shall be submitted with the application.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001, Madrid – E-Office: sedeagpd.gob.es.

2.- Data access control

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: Data access control is intended to preserve the security of ENAIRE’s personnel, property and installations.

Storage periods: Data regarding access to recordings will be kept for a maximum period of 1 month after such recordings.

Legality

Record-keeping legality is based on article 6.1.e in the General Data Protection Regulations (GDPR): a public interest mission in compliance with the rules granting powers to the National Civil Aviation Security Programme and Law 8/2011, 28 April, which stipulates measures to protect critical infrastructures.

Recipients

Recordings will be made available to law enforcement agencies and judicial entities. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

3.- Online flight plan

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: personal data collected by the present form will be treated in order to process and manage the presented flight plan.
Storage periods: those established by applicable law in regard to liability limitation.

Legitimate interest

Data processing is based on article 6.1.c in the GDPR: air navigation regulations (Law 48/1960, 21 July, on air navigation and Royal Decree 57/2002, 18 January, approving Air Traffic Regulations and Royal Decree 552/2014, 27 June, which extends air Regulations and common operational provisions for air navigation services and procedures and modifies Royal Decree 57/2002, 18 January, which approves Regulations for Air Navigation). Fields marked with an * are obligatory, the refusal to fill them in will impede the processing of your request.

Recipients

Data will not be transferred to third parties, unless legally mandated. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

4.- Email

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: Process and manage the submitted request according to the email address used.

Storage periods: Those established by applicable law regarding liability limitation.

Legitimate interest

Data processing is based on the consent of the person concerned.

Recipients

Data will not be transferred to third parties, unless legally mandated. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

5.- User data access

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: Manage the user's access to information on their participation in ENAIRE’s calls for job applications.

Storage periods: Those established by applicable law regarding liability limitation.

Legitimate interest

Data processing is based on the consent of the person concerned.

Recipients

Data will not be transferred to third parties, unless legally mandated. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

6.- User data access

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: Manage the user's access to information on their participation in ENAIRE’s calls for job applications.

Storage periods: Those established by applicable law regarding liability limitation.

Legitimate interest

Data processing is based on the consent of the person concerned.

Recipients

Data will not be transferred to third parties, unless legally mandated. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

7.- New Record – Suppliers

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: Personal data collected by this form will be treated to process and manage the registration of suppliers on ENAIRE’s contracting platform.

Storage periods: Those established by applicable law regarding liability limitation.

Legitimate interest

Data processing is based on article 6.1.c in the GDPR: Law 9/2017, 8 November, on public sector contracts transposing European Parliament and Council Directives into Spanish law - 2014/24/EU 25 February 2014 (articles 138 and 139 on information and submission of tenders). Law 31/2007, 30 October, on procurement procedures in water, energy, transport and postal services sectors, in the case of contracts affected by this law.

Recipients

Data will not be transferred to third parties, unless legally mandated. No data transfer to third countries or international organisations is contemplated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

8.- Aeronautical Security Study Coordination for RPAS operations

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: The data collected, as well as the provided documentation, will be processed for the purpose of analysing and coordinating the Aeronautical Security Study presented in accordance with Royal Decree 1036/2017 of 15 December, which governs the civil use of aircraft piloted via remote control.

Storage periods: The data will be stored for a maximum period of 1 year.

Legitimate interest

The legal basis for ENAIRE processing the data is based on article 6.1.c) of the GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject:

Royal Decree 1036/2017 of 15 December, which governs the civil use of aircraft piloted via remote control

Recipients

The transfer of data to the State Air Safety Agency (Agencia Estatal de Seguridad Aérea, AESA) has been planned, but no other transfer of data to third parties has been considered, except when legally mandated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

9.- Operations with Remotely Piloted Aircraft Systems (RPAS)

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

Purpose: The data collected, as well as the provided documentation, will be processed for the purpose of processing operations conducted by Drones or RPAS (Remotely Piloted Aircraft Systems) and managed by ENAIRE in accordance with Royal Decrees 1036/2017 and 552/2014.

Storage periods: The data will be stored for a maximum period of 3 years, and it will be subsequently anonymised and stored for statistical and auditory purposes.

  • Legitimate interest
  • The legal basis for ENAIRE processing the data is based on article 6.1.c) of the GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject:

    Royal Decree 1036/2017 of 15 December, which governs the civil use of aircraft piloted via remote control

  • Royal Decree 552/2014 of 27 June, which extends air Regulations and common operational provisions for air navigation services and procedures

Recipients

Data will not be transferred to third parties, unless legally mandated.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.

 

  • Request under certain circumstances:
  • Data processing restriction, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • Data processing objection, in which case ENAIRE will stop data processing, except for compelling legitimate grounds, or to exercise or defend possible claims. Including the processing of their data for automated individual decisions.

 

  • Rights may be exercised through ENAIRE’s Central Data Protection Unit (known as UCPD from its Spanish acronym) - Avda. de Aragón 330 - Edificio B - 28022, Madrid or via the Electronic Office (sede.enaire.gob.es).

You are informed that you have the right to withdraw your data processing consent at any time.

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency - Address: C/Jorge Juan, 6 - 28001 MADRID – e-Office: sedeagpd.gob.es

10.- Competence assessment prior to the start of Unit Training

Controller

Identity: ENAIRE – Tax ID number: Q2822001J
Postal address: Avda. de Aragón, 330 - Edificio 2 - 28022 Madrid
Telephone: 913 21 02 11
Email: info@enaire.es
Data Protection Officer (DPO): ucpd@enaire.es

Purpose of the processing

  • Aim: Processing and Management of competence assessment prior to the start of Unit Training.
  • Storage time: The data shall be retained for as long as necessary in compliance with applicable regulations regarding the assessment's relevance and accessibility on filling an existing work post.

Legitimate interest

The legal basis for data processing is laid down in Article 6(b) and (c) in Community Regulation 679/2016 dated 27 April 2006. That is to say, the existing, legal obligation to be complied with by the interested party when entering into a contract.

Recipients

Data shall be transferred to: SENASA.

Rights

Those interested have a right to:

  • Obtain confirmation on if ENAIRE is processing their personal data.
  • To consult their personal data, as well as  request amendment of inaccurate data, or, where appropriate, request its deletion in the case that, among other reasons, such data is no longer needed for the purposes for which it was collected.
  • Request under certain circumstances:
  •  
  • The limitation of the processing of their data, in which case it will only be stored by ENAIRE to exercise or defend claims.
  • The opposition to the processing of their data, in which case, ENAIRE will stop processing the data, except for compelling legitimate grounds, or to exercise or defend possible complaints.

Your rights may be exercised through ENAIRE’s Central Data Protection Unit - Avda. de Aragón 330, Edificio 2, 28022 Madrid or via the Electronic Headquarters (sede.enaire.gob.es).

If you have not been duly attended to in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).