Emirates Flight Catering Company LLC ("we" "us" or "our", as the context may be) respects your privacy and is committed to protecting your personal data. This Privacy Policy (together with our Terms of Use) describes how we look after your personal data when you visit our website https://www.emiratesflightcatering.com/ and our mobile websites (“Platforms”) and tells you about your privacy rights and how the law protects you.

We keep our Privacy Policy under regular review. This version was last updated on 24 August 2020. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us on privacy@ekfc.ae

The Platforms are owned and operated by Emirates Flight Catering Company, a limited liability company incorporated in Dubai, whose principal office is at Airport Road, PO Box 22525, Dubai, United Arab Emirates. We are part of a wider group called the Emirates Group ("Emirates Group"), which includes (but is not limited to) the following entities and/or divisions: Emirates, dnata, dnata World Travel, Emirates Skycargo, Emirates Skywards, Emirates Business Rewards, Emirates Holidays, dnata Travel Arabian Adventures, Wolgan Valley Resort & Spa and associated brands and/or companies from time to time. A list is available here, and a list of our controlled subsidiaries is in our Annual Report here.

You can contact us:

• By post, to PO Box 22525, Dubai International Airport Road, Dubai, UAE;
• Using our website contact form;
• By telephone, on the contact number published on our website from time to time; or
• By email, using the email address published on our website from time to time.

This Privacy Policy applies where we are acting as a data controller with respect to your personal data as a visitor of our website and/or user of our products or services; in other words, where we determine the purposes and means of the processing of your personal data.

We will only process your personal data in the manner set out in this Privacy Policy if you have specifically agreed or consented to us doing so (for example through your explicit acceptance of this Privacy Policy or via an electronic tick-box or other similar measures as required by applicable data protection laws) or if we have legitimate grounds to do so.

Our Platforms may contain links, plug-ins and applications to third-party websites. Please be aware that we are not responsible for the privacy statements and privacy practices of websites not operated by us or an entity in the Emirates Group. We encourage you to read the privacy statements of each and every website you visit. This Privacy Policy applies solely to information collected by our Platforms.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes title, first name, last name, username, profession, function, educational attainment, nationality and gender.
• Contact Data includes address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address used to connect your computer to the internet, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website, information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs)and methods used to browse away from the page.
• Profile Data includes your username and password, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data in order to analyse patterns and improve our marketing and promotional efforts, to analyse Platform use, to improve our content and product offerings, and to customize our Platforms’ content, layout, products and services, and we may appoint third parties to do this on our behalf. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

If you use buttons on our Platforms linked to social media or similar sites (for example "Like" and/or "Share" buttons), content from our Platforms may be sent back to that other website or service and, depending on your privacy settings, may be privately or publicly visible (for example to friends, followers or generally to anyone who has access to your profile page).

Where we process special categories of personal data relating to your health such as information on allergies, we will always obtain your explicit consent to those activities unless this is not required by law or the information is required to protect your health in an emergency.

Where we are processing data based on your consent, you have the right to withdraw that consent at any time.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

We use different methods to collect data from and about you including through:

• Direct interactions: You may give us your Identity and Contact Data by filling in forms on the Platforms or by corresponding with us by phone, e-mail or otherwise. This includes personal data you provide when you:
  1. Apply for a vacancy
  2. Register on our website
  3. Give us feedback or contact us
• Automated technologies or interactions: As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy below for further details.
• Third parties or publicly available sources: This is information we receive about you if you use any of the other sites we operate or the other services we provide. We may work closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies).

From time to time we may update the methods of collection and data fields above. Where there are significant changes we will endeavour to notify you in accordance with the section "Notification of changes to this Privacy Policy" below.

For operational reasons, insofar as reasonably necessary for the purposes, and on the legal bases, set out in this Privacy Policy, we may share your personal data with:

• Other companies in the Emirates Group who provide airport ground handling services or catering services.
• External third-party service providers who administer our Platforms and provide internet services and host our facilities, provide data warehousing services, customer relationship management services, marketing services, car services or customer survey services.
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

We have implemented safeguards to ensure that our service providers treat personal data in a way that is consistent with the terms of this Privacy Policy and applicable laws, and that it is not used except to fulfil products or services to us or where we believe it is necessary for a legitimate reason connected with the products or services we offer.

These service providers and group companies may be located in your country, countries in the European Economic Area, in the United Arab Emirates or elsewhere in the world. Different privacy laws may apply in these countries. See further detail in our "International Transfers" section below.

Some parties that process or store personal data in accordance with this privacy policy may be located in jurisdictions outside your country of residence or our country of incorporation. therefore, data processing outside UAE may be governed by any of the below or in combination such as

• Consent
• Contract as in a data processing agreement
• An adequacy decision
• Binding corporate rules or
• Derogations

as may be applicable. Your information may be processed and stored in jurisdictions with different privacy laws which may not ensure the same level of data protection as granted in your country of residence.

We only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect any information held in that country or that the service provider acts at all times in compliance with applicable privacy laws. Where required under applicable laws we will take measures to ensure that personal data handled in other countries will receive at least the same level of protection as it is given in your home country.

Transfers will be protected by appropriate safeguards, namely the use of standard data protection clauses, a copy of which can be obtained from our legal team.

In the event your personal data is transferred to a foreign jurisdiction, it may be subject to the laws of that jurisdiction and we may be required to disclose it to the courts, law enforcement or governmental authorities in those jurisdictions but we will only do so where required by applicable laws.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Protecting your details and protecting yourself against internet fraud

Here are some simple steps you can take to ensure your information is kept securely.

• Verify website legitimacy
• Avoid sharing personal information more than necessary
• Be cautious about online transactions
• Be vigilant about online scams such as phishing, social engineering, website spoofing etc.
• Use strong passwords and regularly update them
• Use a secure network to access the internet
• Do not connect to public networks.

Above are a few steps to keep yourself internet safe however it is not limited to the above.

Under the applicable data protection regulation of UAE, you have specific rights in relation to your personal data.  You may exercise any of your rights if these rights are available to you in relation to your personal data by writing to us. In particular, and subject to the statutory requirements as per the Law, you may be entitled to:

• Right of Access to Information
• Right to Request Personal Data Portability
• Right to Rectification or Erasure of Personal Data
• Right to Restriction of Processing
• Right of Processing and Automated Processing

You have the right to confirm as to whether or not we process your personal data and, where we do, receive information as to the types of personal data that is processed, the purposes of processing, the decisions made based on automated processing, including profiling, the targeted sectors or establishments with which your personal data is shared whether inside or outside the UAE, the controls and standards for the periods of storing and keeping your personal data, the procedures for correcting, erasing or limiting the processing and objection to your personal data; the protection measures for cross-border processing; the procedures to be taken in the event of a breach or infringement of your personal data and the process of filing complaints with the UAE Data Office. We will endeavour to provide the information you require within a reasonable time.

Data Portability

If your personal data changes or is inaccurate, we will provide a way to correct, update or suppress your personal data provided to us. If you are concerned that any of the information, we hold about you is incorrect please contact us.

Unless processing is necessary for compliance with a legal obligation, required by the public interest or for the establishment, exercise or defence of legal claims, you may have the right to the erasure of your personal data without undue delay when (i) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent to consent-based processing; (iii) you object to the processing or if there are no legitimate reasons for us to continue the processing and (iv) the personal data have been unlawfully processed, and the legislation in force, and the erasure process is necessary to comply with the applicable legislation and approved standards in this regard.

You have the right to oblige us to restrict and stop the processing of your personal data when (i) you contest the accuracy of the personal data in which case the processing shall be restricted to a specific period allowing us to verify the accuracy of the data; (ii) where you object to the processing of your personal data in violation of the agreed purposes; (iii) we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and (iv) if the processing is made in violation of the provisions of the  PDP Law.

Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.

You have the right to object to and stop our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.

You have the right to object to our processing of your personal data for the purposes of conducting statistical surveys, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You may have the right to object to decisions issued with respect to automated processing that have legal consequences or seriously affect you, including profiling.

Automated processing

At present, the UAE data office takes the role of a supervisory authority for the applicable data protection laws within the UAE. If you consider that our processing of your personal data infringes the  PDP Law, you have a legal right to lodge a complaint with the UAE Data Office: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws.

Where we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

You do not have to provide us with your personal data. However, if you choose not to provide certain personal data we request and/or require, or consent to its use and disclosure, you will still be able to visit our Platforms but you may be unable to access certain options, products or services.

You also have the ability to change your cookie settings to block certain types of cookie - this is explained in more detail in our Cookie Policy.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate. Occasionally, it could take us longer than a month if your request is particularly complex or involves dependency on internal or external stakeholders, or you have made a number of requests. In this case, we will notify you and keep you updated.

Privacy incident or breach

If we decide to change our Privacy Policy, we will post those changes on our Platforms. If at any point we decide to use personal data in a manner materially different from that stated at the time it was collected (and/or where we are required under applicable law) we will notify you. You will have a choice as to whether or not we use your personal data in this different manner. We will use personal data in accordance with the Privacy Policy under which the personal data was collected until you agree otherwise, but if you do not accept the amended Privacy Policy please stop using our Platforms. Each version has a version number and date so you can check this easily.

We may disclose your personal data to competent police or judicial authorities or other official government authorities in the vital interest or public interest if we deem this useful or necessary, in our sole discretion, for the investigation of fraud, intellectual property infringement or any other harmful activity, or if we reasonably suspect that such activity may expose us or you to any liability.

If you have queries regarding this Privacy Policy, please contact privacy@ekfc.ae