Current Data Protection Lead: Kevin Russell
Data Protection Lead Contact Address: legal@clearjet.com
Version Date: 03 Apr 2024
Changes since last version: N/A
Capitalized terms other than those defined after the sentence in which they first appear are defined at the end of this document.
We reserve the right to change this Privacy Policy at any time without explicit notice to you, so please check this document or with the Data Protection Lead to ensure you are up-to-date.
This Privacy Policy does not override any applicable Data Protection Legislation in any territory in which Clearjet operates, though is intended to be generally applicable with reference to EU individuals.
This document lays out how we, Clearjet (referred to in this document as “we”, “us” or “our”), handle all Personal Data. It applies to every aspect of our processing for every individual whose Personal Data we hold, and must be observed by every employee, worker or contractor of Clearjet (referred to as “you” or “your”).
Alongside this Privacy Policy, we have various other policies to help you understand what is expected of you when handling Personal Data in certain ways. These policies, and the relating processes must also always be complied with. If you believe that any of our policies conflict with each other, or with Data Protection Legislation, you must notify our Data Protection Lead.
This document and all associated policies are internal and confidential documents that cannot be shared with any party, including any regulatory authority, without authorization from Data Protection Lead.
The good and proper handling of Personal Data is important to Clearjet as we recognize the importance of maintaining the trust and confidence of all of our stakeholders, and perpetuating strong ethical business practices.
Failure in our legal obligations can also have regulatory and financial implications for Clearjet, with fines of up to the greater of €20m or 4% of our global turnover.
Senior management holds ultimate responsibility for ensuring that every part of the business has proper practices, processes, controls and training to ensure company-wide compliance.
The Data Protection Lead is responsible for this Privacy Policy and any relating policy documents or guidelines issued to you.
If you have any questions about this Privacy Policy or Data Protection Legislation, or if you have concerns that this Privacy Policy is not being properly observed anywhere within the business, you should contact our Data Protection Lead. In particular, you should contact the Data Protection Lead if:
We will always follow, and you must reflect during your work for Clearjet, the principles for processing Personal Data set out in Data Protection Legislation. Those principles are:
We must demonstrate compliance with these principles (“Accountability”).
Personal Data must be processed lawfully, fairly and in a transparent manner in relation to the individual.
You may only collect, process or share Personal Data fairly and lawfully and for a specified purpose. Data Protection Legislation does place restrictions on when we can process Personal Data. However, these restrictions are intended to ensure that we process Personal Data fairly and without adversely affecting individuals, rather than prevent processing.
This means that we must identify a lawful basis for our processing from the following list:
If you are unsure that your processing fits with any of the lawful bases, or that you are not operating under the most appropriate lawful basis, please contact the Data Protection Lead. The Data Controller is ultimately responsible for determining the appropriate lawful basis for your processing. Where we are Data Controller, the Data Protection Lead shall be responsible for determining the appropriate lawful basis.
1. Consent
We should only rely upon Consent where no other lawful basis would be appropriate as Consent should not be replaced by another basis if an individual withdraws their Consent. This would mislead individuals as to the level of control that they have over their Personal Data and put us in breach of the requirement to be fair and transparent.
If Consent is appropriate, individuals must clearly indicate it to us by a statement or other positive action. Opt-outs, pre-ticked boxes or similar are no longer permitted for use in Clearjet business relating to Personal Data.
Where Consent is our lawful basis for processing, the right to withdraw consent is unqualified, and processing for the purposes for which Consent has been withdrawn must end promptly. Consent applies only to purposes disclosed at the time Consent was gathered and must be renewed at appropriate intervals (these intervals to be determined by the Data Protection Lead) or if it is required for another purpose.
Unless you have been made specifically aware of another lawful basis being appropriate through our policies or by the Data Protection Lead, Explicit Consent will be required for any processing of Special Categories of Personal Data, automated decision making and overseas transfers. Explicit Consent requires the use of a Fair Processing Notice issued by the Data Protection Lead.
All Consents given must be evidenced by recording:
2. Transparency
Data Protection Legislation requires us to provide individuals with detailed and specific information about how we use their Personal Data. This applies even where we might be processing the Personal Data on behalf of another Data Controller.
Some of this information is already provided to individuals by our Privacy Notices and Fair Processing Notices. These are, and must be, clear, concise, intelligible and easy to access.
Where we collect Personal Data directly, we must inform an individual (including employees, workers and contractors) of who the Data Controller is, how and why we use, processor, disclose, protect and retain their Personal Data at the time of, or before collection.
Where we receive Personal Data indirectly (for example, from a third party or public source), you must inform the individual in the same away as above, as soon as possible upon receipt, and no later than at the time it is first used or within thirty (30) days. You must also be satisfied that the third party has collected the Personal Data legitimately and in a way that allows us to use it for our purpose. This could be guaranteed by contractual arrangements, but such guarantees will not protect us if you or we become aware or should have been aware that those guarantees are being breached.
You must use the notices and information that we provide in order to inform individuals in a way we can be confident is compliant. If you have any doubts as to a notice’s compliance, or do not believe you have the material necessary to inform individuals appropriately, you must contact the Data Protection Lead.
Personal Data must only be collected, used or retained for specific, explicit and legitimate purposes that an individual is made aware of at the time of collection. Any further processing must not be in addition to or incompatible with those purposes.
You must inform an individual of any new purposes you wish to use that Personal Data for and obtain Consent where necessary.
Personal Data must be adequate, relevant and limited to what is necessary to achieve the purposes for which it was collected.
You may only process Personal Data when it is required for your role. Processing unrelated to your role is strictly prohibited.
You must ensure that the Personal Data you collect is adequate for the intended purposes, and not excessive for achieving those purposes in pursuit of your duties.
If any Personal Data, including specific elements of Personal Data, is no longer required for the specified purposes, you must ensure it is deleted or (where possible) anonymized. All Personal Data must be handled in accordance with our data retention guidelines (see 9).
Personal Data must be accurate and, where appropriate, kept up-to-date. It must be corrected or deleted without delay if it is found to be inaccurate (including out-of-date).
You must check the accuracy of Personal Data at the point of collection and at regular intervals afterwards, as determined by the Data Protection Lead. You must take reasonable steps to delete or fix inaccurate Personal Data upon discovery.
Personal Data must be removed or, where possible, anonymized after the purpose for which it is being processed has expired.
This section applies to Personal Data that might be held to satisfy legal, accounting or reporting requirements, which you should anonymize where permitted.
Clearjet maintains a retention policy, and you should act upon the corresponding processes (as applicable) that it dictates.
You will take all reasonable steps to destroy or delete Personal Data from systems where either the Personal Data or the system is no longer required. This could require you to oblige third parties to destroy/delete Personal Data, where applicable.
You must inform individuals of how long their information is to be held, and how that period has been determined. You should only use notices provided by us or approved by the Data Protection Lead.
Protecting Personal Data
Personal Data must be secured using appropriate technical and organizational measures to protect it from unauthorized or unlawful processing, accidental loss, destruction or damage.
We have implemented and maintain safeguards appropriate to our size, scope, resources, use of Personal Data and the associated risks. These safeguards are periodically tested in order to evaluate their effectiveness.
You also play a key role in safeguarding Personal Data by following all procedures and using all technologies that we have implemented to maintain security at all times, including abiding by our Information Security Policy. You must also make sure that the way you conduct yourself in your role does not compromise the integrity of our systems, procedures or technologies.
You must maintain security by protecting the confidentiality, integrity and availability of the Personal Data, defined as follows:
Reporting a Personal Data Breach
We must report any breach of Personal Data (defined as being an inability to guarantee compliance with 10.1a-c).
If you know or suspect that a Personal Data Breach has occurred, do not attempt to investigate the matter yourself. Immediately contact the Data Protection Lead and follow the procedure set-out in our Data Breach Policy. You should preserve all evidence relating to the potential Personal Data Breach.
Data Protection Legislation restricts data transfers to countries outside the EEA to maintain the integrity of the regulatory scheme. You can transfer Personal Data across borders when you transmit, send, view or access that data in or to a different country, typically over the internet. This can easily be done inadvertently, as services belonging to international organizations and utilizing foreign servers are not immediately obvious. Therefore, you must only use systems approved by Clearjet to guarantee compliance with this policy.
You may only transfer Personal Data outside the EEA if one of the following conditions applies:
Individuals have the following rights when it comes to how we handle their Personal Data:
You must verify the identity of an individual requesting data under any of the rights listed above and you must not allow third parties to persuade you into disclosing Personal Data without proper, verifiable authorization.
You must immediately forward the details of any ‘subject access request’ request you receive to Data Protection Lead.
We are required to ensure you have undergone adequate training to enable you to comply with Data Protection Legislation. We must also regularly test our systems and processes to assess compliance.
You must undergo all mandatory data privacy related training and ensure your team undergo similar mandatory training.
You must regularly review all the systems and processes under your control to ensure they comply with this Privacy Policy and check that adequate governance controls and resources are in place to ensure proper use and protection of Personal Data.
We are required to implement Privacy by Design measures when processing Personal Data by implementing appropriate technical and organizational measures in an effective manner, to ensure compliance with data privacy principles.
You must assess what Privacy by Design measures can be implemented on all programs/systems/processes that process Personal Data by taking into account the following:
Data controllers must also conduct DPIAs in respect to high risk processing.
You should conduct a DPIA (and discuss your findings with the Data Protection Lead) when implementing major system or business changes involving the processing of Personal Data including:
A DPIA must include:
Generally, ADM is prohibited when a decision has a legal or similarly significant effect on an individual unless:
If certain types of Special Categories of Personal Data are being processed, then grounds b or c will not be allowed but such Special Categories can be processed where it is necessary (unless less intrusive means can be used) for substantial public interest like fraud prevention.
If a decision is to be based solely on automated processing (including profiling), then individuals must be informed when you first communicate with them of their right to object. This right must be explicitly brought to their attention and presented clearly and separately from other information. Further, suitable measures must be put in place to safeguard the individual’s rights and freedoms and legitimate interests.
We must also inform an individual of the logic involved in the decision making or profiling, the significance and envisaged consequences and give the individual the right to request human intervention, express their point of view or challenge the decision.
A DPIA must be carried out before any automated processing (including profiling) or ADM activities are undertaken.
We are subject to certain rules and privacy laws when marketing to our customers.
For example, a consumer’s prior consent is required for electronic direct marketing (for example, by email, text or automated calls). The limited exception for existing consumer customers known as "soft opt in" allows us to send marketing texts or emails if we have obtained contact details in the course of a sale to that person, we are marketing similar products or services, and we gave the person an opportunity to opt out of marketing when first collecting the details and in every subsequent message.
The right to object to direct marketing must be explicitly offered to consumers or business contacts whose Personal Data is used (typically their name) in an intelligible manner so that it is clearly distinguishable from other information.
An individual’s objection to direct marketing must be promptly honored. If a consumer customer or named business contact opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.
Generally we are not allowed to share Personal Data with third parties unless certain safeguards and contractual arrangements have been put in place.
You may only share the Personal Data we hold with another employee, agent or representative of our group (which includes our subsidiaries and our ultimate holding company along with its subsidiaries) if the recipient has a job-related need to know the information and the transfer complies with any applicable cross-border transfer restrictions.
You may only share the Personal Data we hold with third parties, such as our service providers if:
Consent: agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject's wishes by which they, by a statement or by a clear positive action, signifies agreement to the processing of Personal Data relating to them.
Data Privacy Impact Assessment (DPIA): tools and assessments used to identify and reduce risks of a data processing activity. DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programs involving the processing of Personal Data.
Data Protection Legislation: all applicable laws and regulations relating to the processing of Personal Data and privacy including the Data Protection Act 1998, the General Data Protection Regulation 2016/679, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any statutory instrument, order, rule or regulation made thereunder, as from time to time amended, extended, re-enacted or consolidated. The terms “Personal Data”, “Personal Data Breach”, “Data Protection Officer”, “Data Controller”, “Data Processor”, “Data Subject”, “Special Categories of Personal Data” and “process” (in the context of usage of Personal Data) shall have the meanings given to them in the Data Protection Legislation. “Data Protection Lead” is the title given to the member of staff leading our data protection compliance program in lieu of a requirement for a Data Protection Officer.
EEA: the 28 countries in the EU, and Iceland, Liechtenstein and Norway.
Explicit Consent: consent which requires a very clear and specific statement (that is, not just action).
Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data includes Sensitive Personal Data and Pseudonymized Personal Data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person's actions or behavior.
Privacy by Design: implementing appropriate technical and organizational measures in an effective manner to ensure compliance with the GDPR.
Privacy Notices (also referred to as Fair Processing Notices) or Privacy Policies: separate notices setting out information that may be provided to Data Subjects when the Company collects information about them. These notices may take the form of general privacy statements applicable to a specific group of individuals (for example, employee privacy notices or the website privacy policy) or they may be stand-alone, one-time privacy statements covering processing related to a specific purpose.
Pseudonymization or Pseudonymized: replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom the data relates, cannot be identified without the use of additional information which is meant to be kept separately and secure.
