Recruitment Data Protection Notice

Aquarius Aerial Firefighting S.à.r.l., Luxembourg Airport, Luxembourg, a fully owned subsidiary of Cargolux Airlines International S.A. (hereafter referred to as “Aquarius” or “we”) is committed to the
protection of Your personal data in accordance with data protection legislation, especially the General Data Protection Regulation EU 2016/679 (the “GDPR”).

This Data Protection Notice is intended to inform candidates who apply for a pilot position at Aquarius, and following such application, might participate in selection and training procedures (“You”), regarding the
processing of their personal data.

Who is the controller of Your personal data?
Aquarius is responsible as a data controller, for collecting and processing Your personal data in relation to Your application for a position at Aquarius and our recruitment process.

What personal data do we process?
We collect and use Your personal data to the extent necessary in relation to our recruitment process and to ensure that Your application can be considered by the relevant internal department(s).

We may collect various types of personal data that You decide to or are requested to submit in relation to Your application, including:

• Identification data: name, date and place of birth, nationality, ID and passport information, contact
  details, address, telephone, email, country, or other contact information;
• Job application data: application form, Curriculum Vitae, cover letter, previous work experience, career gaps with supporting documents, education, training certificates, additional qualification, logbook, or other information regarding Your professional qualification and experience, additional skills and abilities, professional interest, details of Your rights to work in the concerned countries, type of employment sought, desired salary, job preferences, etc.;
• Qualification data: level of formal qualification, licenses and medical certificates data, language skills, test and assessment results data, certificate of conduct;
• Content data: text submissions, images, videos;
• Results of our recruitment process, such as Your performance during assessment, interview, simulator screening and information provided by Your referees for selection process;
• Meta or communication data: device information, IP addresses;
• Names and contact details of referees and knowledge of a person among our staff or management (relative or contact person). Prior to providing personal data of any data subjects, You must inform them about the content of this note and ensure that they do not object to the processing of their personal data by Aquarius.

Aquarius may also process Your judicial data (e.g., criminal record certificates) and health data for the purposes of assessing Your working capacity. The processing of such categories of data takes place in accordance with the applicable laws and regulations.

Why do we process Your personal data (purpose and legal basis)?

We process Your personal data for the following purposes:
To assess Your skills and qualifications for the position for which You are applying;

• To manage the recruiting process;
• To maintain our relationship during the recruitment process, namely, to communicate with You;
• To verify Your information, to run our internal compliance and conflict of interest checks and to conduct reference/background checks;
• To improve our recruitment process;
• To defend ourselves in any legal or court proceedings;
• To comply with applicable laws and regulations; or
• To secure and protect our organization, IT networks and Aquarius’s information.

Aquarius will only process Your personal information where we have a legal basis for doing so. In the frame of the recruitment process, we process Your personal data on the following basis:

• As per article 6.1 b) GDPR: Taking pre-contractual measures necessary for the recruiting process, assess job applications and candidates, and to decide whether Aquarius intends to enter into an employment agreement with You;
• As per article 9.2 h) GDPR: For the assessment of Your working capacity pursuant to a contract with a health professional;
• As per article 6.1 c) GDPR: Complying with legal obligations (namely but not limited to Commission Regulations (EU) 1178/2011, (EU) 2015/1998, (EU) 2018/1139, (EU) 2018/1042, and (EU) 2020/745 and associated implementing rules, standards, and guidance as published by EASA) and
  provide the required information to authorities of countries in which our operations takes place.
• As per article 6.1 f) GDPR: Pursuing our legitimate interests, namely, including to manage our recruitment process, to conduct background checks to keep records of the recruitment process; to prevent conflicts of interests and confidentiality issues; to protect our interest and rights in the event of investigations; to assess and improve our recruitment processes, and/or to ensure that our company’s IT networks and information are secure.

Who do we share Your personal data with?

or the purposes of the recruitment process, Your personal data may be shared internally, on a strict need to know basis, with Cargolux selection board members, human resources department and personnel
involved in the recruitment process and/or training activities.

We may also communicate Your personal data to:

• Service providers/vendors that perform services or trainings on our behalf, including health
  professionals appointed by Aquarius.
• Certain software that enable You to apply and transfer documentation to us.
• Law enforcement or other government and regulatory bodies or agencies, upon request and to the
  extent permitted by law.
• Certain regulated professionals such as lawyers or auditors mandated by Aquarius.

Where do we transfer Your personal data?

Your personal data are processed within the EU and no transfer of Your personal data occurs outside of the EU/EEA. In case of international transfers to a country outside the EU/EEA, the transfer may occur
where the European Commission has decided that the receiving country ensures an adequate level of data protection. For transfers to countries for which the level of protection has not been recognized as adequate by the European Commission, we will implement appropriate safeguards provided for by data protection law (e.g. entry into standard data protection clauses) or rely on a derogation applicable to specific situations.

How do we protect Your personal data?
The processing of Your personal data is carried out through IT, electronic and manual tools, with logics strictly related to the aforementioned purposes and, in any event, in compliance with the appropriate technical and organisational measures required by law to ensure a level of security that is adequate to the risk, in order to avoid unauthorized loss or access to Your data.

How long do we keep Your personal data?
Unless a longer retention period is required (e.g., as necessary to defend our rights in the scope of investigations, disputes or legal claims), we will retain Your personal data for 2 (two) years upon conclusion of the relevant or latest step of the selection process. At the end of that period, or once You opposed to Your personal data being processed, Your personal data will be anonymized, deleted or destroyed. If required by applicable laws and regulations, or if strictly necessary in view of pursuing any of the purposes mentioned above (which may vary depending on the selection step(s) You have undergone) Aquarius may retain some limited categories of personal data for a longer period.

Note that in case You are selected for the job position You have applied for, the above categories of personal data will continue being processed as part of Your employment.

What are You rights regarding Your personal data?

In accordance with the applicable data protection legislation (and subject to conditions and restrictions set forth therein), You may exercise at any time the following rights in relation to Your personal data:

• Right to access: which enables You to obtain from us confirmation of whether Your personal
  data are being processed or not and, if so, obtain access to such data; considering that we
  process a large quantity of information, You must specify the information or processing activities to
  which Your request relates;
• Right to rectification: which enables You to obtain from us the correction and/or integration of any
  of Your personal data that are incorrect and/or incomplete; and
• Right to erasure: which enables You, in specific cases provided for by art. 17 GDPR, to obtain
  from us the erasure of Your personal data;
• Right to restriction of processing: which enables You, in specific cases provided for by art. 18
  GDPR, to restrict the processing of Your personal data by us;
• Right to object: which enables You to object to the processing of Your personal data in specific
  cases provided for by art. 21 GDPR;
• Right to data portability: which enables You, in certain cases (subject, in particular, to technical
  feasibility) and with regard only to the data You have provided to us, to request receipt of Your
  personal data in a structured and commonly machine-readable format.

If You have provided Your consent to the processing of Your personal data, You can withdraw such consent at any time, without affecting the lawfulness of processing based on consent before Your withdrawal.

To exercise any of these rights, You may contact us by email Cargolux dataprotection[@]cargolux.com or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
L-2990 Luxembourg Airport
Luxembourg

You have the right to lodge a formal complaint with the Commission Nationale pour la Protection des Données (CNPD).

Changes to this Notice
Changes may occur in the way we process personal data. In case these changes oblige us to update this Notice, we will clearly communicate it to You through the appropriate means. The latest applicable version will always be available on our website.