Legal / GDPR

Data Inventory

We conduct regular reviews of all personal data held on file, including what is retained, why, how and for how long. We do not share personal data.

Employee preparation

We have an employee data privacy policy controlling working practices, informing employees of the nature of data held and implimenting remote working data protection.

Customers and third parties

When collecting personal data we supply data protection notices and / or privacy policy notices and terms and conditions. These include notification of the transfer of data outside of the EU and retention periods. We have contractual agreements with all third parties that handle our data, such as for payroll and accountancy services.

Capturing consent

We seek positive consent to allow data processing. This contractual process is subject to a regular review of terms and conditions. We do not use direct marketing mailing lists.

Governance

We have conducted a review of our data policies to demonstrate that Air Pelagic complies with the principles of accountablity set out by GDPR, including the following:

1. Clearly identifying who in the business is responsible for personal data held.

2. We record individual consent to hold personal data.

3. Breaches are recorded and reported to the ICO within 72h.

4. We reply to individual requests for data within 30 days.

5. We delete personal data on request.

Security

Our data is encrypted and our electronic media are protected by Firewalls installed by ESET Cyber Security. Sophisticated passwords are generated by 1Password.