Under the data protection laws in the European Union, you have certain rights in relation to the processing of your personal, including (1) the right to access your data, (2) to rectify them, (3) to erase them, (4) to restrict the processing of your data, (5) the right to data portability and (6) the right to object to processing.
- Right to access - You may ask us whether or not we process any of your personal data and, if so, receive access to that data in the form of a copy. When complying with an access request, we will also provide you with additional information, such as the purposes of the processing, the categories of personal data concerned as well as any other information necessary for you to exercise the essence of this right.
- Right to rectification - You have the right to have your data rectified in case of inaccuracy or incompleteness. Upon request, we will correct inaccurate personal data about you and, taking into account the purposes of the processing, complete incomplete personal data, which may include the provision of a supplementary statement.
- Right to erasure - You also have the right to have your personal data erased, which means the deletion of your data by us and, where possible, any other controller to whom your data has previously been made public by us. Erasure of your personal data only finds place in certain cases, prescribed by law and listed under article 17 of the General Data Protection Regulation (GDPR). This includes situations where your personal data are no longer necessary in relation to the initial purposes for which they were processed as well as situations where they were processed unlawfully. Due to the way we maintain certain services, it may take some time before backup copies are erased.
- Right to restriction of processing - You have the right to obtain the restriction of the processing of your personal data, which means that we suspend the processing of your data for a certain period of time. Circumstances which may give rise to this right include situations where the accuracy of your personal data was contested but some time is needed for us to verify their (in)accuracy. This right does not prevent us from continuing to store your personal data. We will inform you before the restriction is lifted.
- Right to data portability - Your right to data portability entails that you may request us to provide you with your personal data in a structured, commonly used and machine-readable format and to have such data transmitted directly to another controller, where technically feasible. Upon request and where this is technically feasible we will transmit your personal data directly to the other controller.
- Right to object - You also have the right to object to the processing of your personal data, which means you may request us to no longer process your personal data. This only applies in case the “legitimate interests” ground (including profiling) constitutes the legal basis for processing. At any time and free of charge you can object to direct marketing purposes in case your personal data are processed for such purposes, which includes profiling purposes to the extent that it is related to such direct marketing. In case you exercise this right, we will no longer process your personal data for such purposes. For direct marketing, please also refer to ‘How can you change what marketing & service communications you receive?´ below.
You may withdraw your consent
at any time by following the specific instructions in relation to the processing for which you provided your consent. You may also contact our Privacy Offices (please see below).
When you would like to exercise your rights, all you have to do is send your request by email or postal mail to the Privacy Office of Air France or KLM:Air France
Délégué à la Protection des Données / Data Protection Officer - ST.AJ IL
45, rue de Paris 95747 Roissy CDG Cedex
KLM Royal Dutch Airlines
Privacy Office - AMSPI
PO Box 7700
1117 ZL Luchthaven Schiphol
Responses to exercise your rights will be provided within one month and generally there is no fee for making these requests. If your request is particularly complicated we may extend the deadline for responding to three months, but we will let you know if this is the case. We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. We may, for example, deny your request for access when necessary to protect the rights and freedoms of other individuals or refuse to delete your personal data in case the processing of such data is necessary for compliance with legal obligations. The right to data portability, for example, does not apply in case the personal data was not provided by you or if we process the data not on the basis of your consent or for the performance of a contract.