MyTraining Users:

 

In order to use the requested service, you are required to provide all useful personal data to the Company. The Company undertakes to process the information provided in accordance with the Applicable Privacy Law. Therefore, the Company provides you with the following notice and requests your prior consent for the processing of your personal data for the purposes listed here below.

Notice for Leonardo Helicopters' Customers, Suppliers, Authorised Service Centres and Aeronautical Authorities

Subject: Data Protection Notice

Leonardo SpA, an Italian company having its registered office at Piazza Monte Grappa 4 - 00195 Rome, Italy, issued and paid in share capital of Euro 2.543.861.738,00, registered with the Companies' Registrar of Rome, Italy, at No. 00401990585, VAT Identification Number (IT) 00881841001, acting through its division Leonardo Helicopters having its head office at Via G. Agusta, 520, 21017 Cascina Costa di Samarate (VA), Italy (hereinafter the "Company"), represented by its legal representative pro tempore, provides you with the following notice according to Article 13 of EU Regulation No. 679/2016, as amended and integrated from time to time (the "GDPR"), and its implementing EU and Italian laws, as amended and integrated from time to time ("Applicable Privacy Law") (the "Data Protection Notice").

1. Data Controller

1.1 - The Company, with registered office in Piazza Monte Grappa, 4 - 00195 Roma Italy, email dpo.leonardo@leonardocompany.com will be the Data Controller of your personal data ("Data Controller" or "Company").

1.2 - The Data Controller appointed some Data Processors of personal data. An updated list of such Data Processors, pursuant to and for the purposes of Article 28 of the GDPR, may be obtained by the persons concerned sending a request at the following email address: dpo.leonardo@leonardocompany.com

1.3 - The Data Controller appointed a Data Protection Officer (DPO), as set forth by the GDPR, which supervises, monitors, and provides for specialized consultancy in the field of the data protection. The DPO may be contacted for any assistance to the following email address: DPO.leonardo@leonardocompany.com.

2. Persons concerned and personal data processed

2.1 - The following individuals are involved in the processing of personal data by the Data Controller (jointly, the "Data Subjects"): the pilots and the technicians (which are customers of the Company or which have been designated by the customers of the Company) which provide personal data to the Company before and at the time of the registration process on the Company's website under the section "My Training", as well as at the time of the application for training.

 

2.2 - The processing shall involve the following non-exhausting list of personal data: Name, Surname, Title, Department, Address, E-Mail address, Flight Crew License ("Personal Data").

 

2.3 - The Data Controller might process, according to the Applicable Privacy Law, special categories of personal data pursuant to Article 9 of the GDPR (e.g. particular data which may result from the Flight Crew License, biodata, data disclosing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, or organizations of a religious, philosophical or trade-unionist character and any data disclosing health and sex life) for the purposes set forth under paragraph 3.1 below, with the specific prior consent of the Data Subject, pursuant to Article 9, paragraph 2, letter a) of the GDPR, and in order to comply with any legal obligation to which the Data Controller is subject and for any right by the Data Subject under the Applicable Privacy Law.

 

3. Purposes and legal basis of the personal data processing

3.1 - Personal data related to the Data Subject will be processed for the following purposes:

(i) for purposes strictly connected and instrumental to the assessment of the flight license and the fitness to fly of the Data Subject and to the registration process on the Company's website under the section "My Training";

(ii) in order to provide the Data Subject with the following services and assistance performed by the Company: Customer Support & Training Services and for any purposes related to such support and services..

3.2 - The Personal Data will be processed for the purposes set forth under paragraph 3.1 above with the prior consent of the Data Subject pursuant to Articles 6, letter a), 7 and 9, paragraph 2, letter a) of the GDPR, depending on the personal data belong, or not, to any special category.

3.3 - The processing of the Data Subject's Personal Data shall be performed in accordance with the rules set forth by the Applicable Privacy Law, and it shall be carried out with automated and/or manual systems, suitable to ensure the security of the processing.

3.4 - The prior consent to the processing of the Data Subject's Personal Data for the purposes under paragraph 3.1 above is not mandatory. However, if the Data Subject does not provide the prior consent to the processing of its Personal Data, the Data Controller might not to provide those service and assistance under paragraph 3.1 above.

3.5 - The processing of the Data Subject's Personal Data will be carried out according to the principles of proportionality and necessity, so that no unnecessary personal data will be collected or processed. The processing of the Data Subject Personal Data will be fair and transparent, and therefore it will always be given adequate communication to the Data Subject on the processing activities carried out, and in compliance with the adequacy requirement of the security measures.

4. Communication and dissemination of personal data and other subjects authorised to process them

4.1    - In carrying out our activity and pursuing the purposes described under paragraph 3 above, the Data Subject's Personal Data can be communicated and/or shared with third parties, including public bodies or private companies, which are authorized to receive them by any applicable law, as well as public and/or private entities which provide for assistance or consulting services to the Data Controller.

 

4.2    The Data Subject's Personal Data will not be disseminated.

4.3  - The Data Controller shall process the Data Subject's Personal Data through its staff duly authorized, only as necessary and on the basis of the specific instructions provided by the Data Controller, with guarantee of confidentiality.

4.4  In pursuing the purposes described under paragraph 3 above, Data Subject's personal data can not be transferred to Countries outside the European Union or to international organizations.

5. Data retention period

The Data Subject's Personal Data transmitted on a voluntary basis or collected at the Data Controller's request will be retained for at least 10 years after they have been provided for the first time to the Company. Pursuant to Annex (IV) Part 147- SUB PART B- Article 147.A. 125 of the COMMISSION REGULATION (EU) No 1321/2014 of 26 November 2014, and its subsequent amendments, on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organizations and personnel involved in these tasks, the Company shall keep all student training, examination and assessment records for an unlimited period.

For all the Others Applicable Authorities (e.g. EASA Part-FCL, CAAC, etc.) the Company shall keep all Student training, examination and assessment records for a period of time as specified on the relevant Regulations.

6. Rights of the Data Subjects

6.1 - With respect to the Data Subject's Personal Data held by the Data Controller, the Data Subject can exercise all rights set forth by the Applicable Privacy Law. In particular, the Data Subject may:

a)             request the Data Controller to confirm the existence of his/her personal data, the origin of such data, the reason and purpose of their processing, the categories of subjects to whom the data may be transmitted, as well as the identification details of the Data Controller and of its Data Processors;

b)      request access to personal data, transformation into anonymous form, blocking, rectification, updating, integration.

c)             object to the processing of personal data, for any reason connected to its particular situation, within the limits set forth by the Applicable Privacy Law and, in particular, object, at any time, to the delivery of communications and/or informative material by the Data Controller (opt-out right) pursuant to Article 17 of the GDPR, through the "Unsubscribe" function contained at the bottom of each electronic communication received from the Data Controller or by sending an express request to the e-mail address dpo.leonardo@leonardocompany.com;

d)             exercise the right to portability, within the limits provided for by Article 20 of the GDPR;

e)             withdraw his/her consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

f)              lodge a complaint with the Italian Data Protection Authority, following the procedures and the instructions published on its official website (www.garanteprivacy.it).

6.2 - Any amendment or erasure or limitation on processing carried out upon Data Subject's request - unless this proves impossible or involves a disproportionate effort - will be communicated by the Data Controller to each of the recipients to whom the relevant personal data have been transmitted. The Data Controller may inform the Data Subject of these recipients upon request.

 

6.3 - For the purpose of exercising the rights listed in paragraph 6.1 above, as well as for any clarification, you can directly contact the Data Controller by sending an email to the following email address: dpo.leonardo@leonardocompany.com.

 

Others Application:

 

Law on Privacy 196/2003
PRIVACY POLICY STATEMENT - USE OF PERSONAL AND IDENTIFICATION DATA

For personnel recruitment, Leonardo (hereinafter "the Company") with registered offices at Rome, Piazza Monte Grappa, 4, offers you the possibility of applying for the vacancies published on its site and also of inserting your spontaneous applications.
To do this, you are asked to provide all useful data for checking your eligibility for positions at the Company.
The Company undertakes to use the information provided in accordance with current legislation, in particular with regulations regarding the privacy of personal data. Therefore, as specifically required by Legislative Decree 196/03, please note the following.

1. Data processing methods and purposes

Method:

Your data will be processed by the Company using hard-copy, computerised or telematic means.
The Company will ensure that the data provided:

• Are correctly recorded so that they correspond precisely to what the data subject has declared;
• Are updated according to changes notified by the data subject;
• Kept in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data were collected.

Purposes:

For the purpose of staff recruitment, the Company may ask you to insert your CV on its site, and also any identification and personal data useful for checking whether your professional profile complies with Company requirements.
The Company will erase your data from its database if they are found to be inaccurate, incomplete or not up-to-date.
You may also be asked to provide other data necessary to inform you of Company initiatives and activities and also data regarding your opinion of the services provided in order to improve their quality and accessibility. Preserving the anonymity of the data subject, the Company may use all the data furnished for statistical purposes.
Communication of the data requested is optional. However, if you do not communicate your data, you will not be able to apply for the Vacancies published on the Company' site or insert your spontaneous application. You must be aware that in furnishing the data requested, you explicitly authorised processing of these by the Company for the above purposes.

2. Sensitive data

If the information furnished to the Company contains sensitive data (i.e. data disclosing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, or organisations of a religious, philosophical or trade-unionist character and any data disclosing health and sex life), the Company may process such data only with your explicit written consent. In the case of communication of sensitive data, you must authorise processing thereof sending the Company a specific e-mail stating: "Within the meaning of art. 23 of Legislative Decree 196/03, I, the undersigned, authorise Leonardo to process and disclose my sensitive data to third parties for the purposes specified in the Privacy Policy Statement."

3. Disclosure and transfer of the data

Disclosure:

The Company may disclose the personal data furnished to third parties only to the extent necessary to carry out its business and to achieve the purposes indicated in point 1 and also when required by law. Therefore, personal and identification data will be disclosed, amongst others, to:

• companies linked to the Company;
• public bodies or private companies for compliance with legal obligations;
• companies engaged in statistical research.

Transfer:

Within the meaning of art. 43 of Legislative Decree 196/03, in order recruit personnel to be inserted in its staff, the Company may transfer the data subject's personal data to foreign countries also outside the EU.
The data subject may ask the Company at any time to erase his/her data from its databases.

4. Data subject's rights

Anyone who notifies his/her data to the Company has the right to obtain:

• confirmation as to whether or not his/her personal data exist, even if not yet recorded, and communication thereof in intelligible form;
• indication (i) of the source of the personal data, of the purposes and methods of processing, (ii) of the logic applied to the processing if this is carried out with electronic means, (iii) of the identification data of the data controller, data processors and designated representative, (iv) of the entities or categories of entities to whom or which the personal data may be communicated or which may get to know said data in their capacity as designated representative(s) in the territory of the State, data processor(s) or person(s) in charge of processing.

A data subject also has the right to obtain:

• updating, rectification or where interested therein integration of the data;
• erasure, transformation into anonymous form or blocking of the data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collated or subsequently processed;
• certification to the effect that the operations as per letters a) and b) have been notified, as also as regards their contents, to the entities to whom or which the data were communicated or disseminated except when the provision of such information is impossible or involves a manifestly disproportionate effort compared with the right to be protected.

A data subject also has the right to obtain:

• updating, rectification or where interested therein integration of the data;
• erasure, transformation into anonymous form or blocking of the data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collated or subsequently processed;
• certification to the effect that the operations as per letters a) and b) have been notified, as also as regards their contents, to the entities to whom or which the data were communicated or disseminated except when the provision of such information is impossible or involves a manifestly disproportionate effort compared with the right to be protected.

A data subject has the right to object, in whole or in part:

• on legitimate grounds, to the processing of his/her personal data even if relevant to the purposes for which they have been collected;
• to the processing of his/her personal data where it is carried out for the purpose of sending advertising materials or direct marketing or for the performance of market or interactive commercial communication surveys. The data subject can transmit all the above requests to the Company via registered letter, fax or e-mail.

5. Data controller

The Data Controller and Data Processor is Leonardo, with registered offices at Rome, Piazza Monte Grappa, 4. An updated list of Data Processors can be obtained from Company HQ.