Privacy Policy

At CAVU Group Limited, safeguarding your personal information and handling your information in a compliant way is important to us. We understand and respect the importance of guarding your privacy and are committed to protecting your personal information.

This privacy notice covers the way we handle your personal information that we receive from both from yourself and from our trusted third parties, what your rights are and our contact details if you need some additional information or wish to make a complaint.

From time to time, we will update this privacy notice as we undertake new personal data practices or adopt new privacy policies. We will always document when the privacy notice was last updated.

CAVU Group Limited has appointed an internal data protection officer for you to contact if you have any questions or concerns about our data policies or practices. You can contact the data protection officer here:

Charlotte Lewendon-Jones

Head of Data Protection and Privacy
MAG Airport Limited
Olympic House
Manchester Airport
M90 1QX
E: DPO@ca.vu

Please note that your request will be handled by MAG Airport Limited who reside in the UK.

We collect your personal information to enable us to provide you with our goods and services. This includes, among others, information you provide when you use our websites and/or our services. The lawful basis to process your information for the use of our goods and/or our services is for the legitimate interests.

Upon completion of a purchase of goods and/or services, at a minimum, we may collect your first name and email address for the purposes of conducting an interview with you to gather feedback about your use of our products and services. The interview will be recorded, or alternatively, notes will be taken. Any optional information you provide such as your age bracket, gender or income will be used for the purposes of research analysis. We will not use your information for the purpose of direct marketing. The lawful basis to process your information for the purposes of an interview and research analysis is consent.

We will collect your personal data such as contact information to resolve your enquiry. At a minimum, we will collect your name, email address and job title. All the personal information collected will depend on the information that you provide us. On a few occasions, we may request for further information to help us deal with your query. to respond to your enquiry. All the personal information collected will depend on the information that you provide us.

We will collect statistics about your use of our services, such as what sections of the website you visit. We may also collect information about how our website and services are performing. For example, each time you use our website we may automatically collect the following information:

• technical information, including the type of mobile device you use, a unique device identifier, mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting,
• details of your use of our website including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access.

We use Google Analytics to track customer behaviour on our websites.

We will not share your information with any third parties for the purposes of direct marketing.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

In some circumstances we are legally obliged to share information. For example, under a court order. We might also share information with regulatory bodies or statutory agencies for their own purposes to safeguard national security and prevent and detect crime. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit. Where we share your personal data with third parties, they will only use it in compliance with data protection legislation. These third parties may transfer your personal data overseas, but we will always ensure the disclosure is legitimate and proportionate for processing.

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries. For more information about our group of companies please click here to visit our corporate website.

CAVU is committed to providing a world-class cyber security posture and will continue to take its cyber security responsibilities with the utmost seriousness. CAVU has adopted a defence in depth approach to cyber security protection and has developed an embedded security culture through awareness, education, and empowerment to ensure we keep MAGs operational, customers, employees, and stakeholders’ information safe from cyber threats.

CAVU operates an Information Security Management System (ISMS) based on the recommendations of ISO 27001:2017, and a Privacy Information Management System (PIMS) based on the recommendations of ISO 27701:2019. These recommendations include risk management, business continuity, incident management, physical security, security, and privacy awareness training and more.

CAVU has a detailed Data Retention, Archive and Destruction Standard which sets the requirements to store and retain information in line with regulatory obligations and business requirements and to destroy the data securely when it is no longer required.

Specific retention periods for information will be available on request.

Data Privacy legislation gives you certain rights relating to the personal data that is processed by CAVU Group Limited. Find below the list of rights and what they mean. If you wish to exercise any of these rights (or make a complaint regarding data protection), you can email us at DPO@ca.vu or by using our online webform here.

The California Consumer Privacy Act (CCPA);

Right of Disclosure – You have the right to disclosure of all the personal information and supplementary information that we hold about you. This will allow you to be aware of and verify the lawfulness of us processing your information.

Right to Erasure –You have the right to request for your information to be deleted and have your personal information erased from our records, if there is no compelling reason for us to hold your information.

Right to Object – You have the right to object to us selling your personal information for the use of marketing or analytics. This right can be exercised at any point in time, whether at the point where we collect your personal information, or after we already have already collected your personal information.

The General Data Protection Regulation (GDPR);

Right of Access – You have the right to access all the personal information and supplementary information that we hold about you. This will allow you to be aware of and verify the lawfulness of us processing your information. We would respond to your subject access request within twenty-eight days.

Right to Rectify – You have the right to request for your inaccurate personal information to be rectified or completed if it is incomplete.

Right to Erasure – We automatically delete your information from our records when the retention period has lapsed. Prior to us automatically deleting your information, you have the right to request for your information to be deleted and have your personal information erased from our records, if there is no reason for us to hold your information.

Right to Restrict Processing – You have the right to object to the processing of your information if it causes unwarranted and substantial damage or distress. If it does, you have the right to require us to stop (or not to begin) the processing in question. This right does not automatically trigger the right to erasure. You will have to request for your information to be fully deleted from our records if you wish to exercise your right to erasure.

Right to Data Portability – You have the right to obtain and reuse your personal information which we hold. This compelling will allow you to move, copy or transfer personal information easily from one IT environment to another in a safe and secure way.

Right to Object – You have the right to object to us using your personal information for direct marketing and profiling. This right can be exercised at any point in time, whether at the point where we collect your personal information, or after we already have already collected your personal information. If you want to object to us processing your personal information, please contact the Data Protection Officer at our address at the end of this notice. Alternatively, you can also exercise the right at any time by clicking ‘unsubscribe’ in any marketing email.

Right to Lodge a Complaint – You have the right to lodge a complaint with the Information Commissioner’s Office here, if you feel that our processing of your personal information infringes on your rights per the requirements of the General Data Protection Regulation. We advise that you contact our Data Protection Officer at our address at the end of this notice to attempt to resolve it before escalating your complaint to the regulators.

Right to Withdraw Consent – You have the right to withdraw your consent at any time. Your withdrawal of consent shall not affect the lawfulness of processing of your data before the withdrawal. You can withdraw consent by contacting our Data Protection Officer at the address below, or alternatively, you can click ‘unsubscribe’ in any marketing email to withdraw consent in relation to marketing.

We may change our privacy notice at any time and without notice, so we recommend that you visit this page occasionally to check what has changed. This policy was published in March 2022. Revisions since then are listed below:

• March 2022 Version One of the Privacy Notice was published.
• December 2022 Review of the Privacy Notice.
• September 2023 Entire Review of the Privacy Notice.

Our Data Protection and Privacy Team is located at our Head Office, Olympic House, Manchester Airport, Manchester, M90 1QX.

You can contact us at DPO@ca.vu. Please be aware this email address is not monitored 24/7, you will receive a reply within standard working hours.

If you wish to exercise any of your rights under the General Data Protection Regulation, please use our online form.

You can also complain to the ICO if you are unhappy with how we have used your data in accordance with the process set out in the Right to Lodge a complaint section above.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk