Policy Statement

This Job Applicant Privacy Notice documents your privacy rights and explains how Edinburgh Airport Limited (EAL) (“we”, “us”, “our”) collects, uses and stores personal data about individuals who apply for roles with us. EAL is the data controller for any personal data processed during the recruitment process. We may amend this notice at any time. This notice was last updated in May 2026.

Scope

This notice applies to all job applicants including temporary staff, agency staff, subcontractors and interns, whether applications are submitted directly or via recruitment agencies. It covers all recruitment activities undertaken by EAL, including those undertaken on behalf of our third-party business partners.

What personal data we collect about you

EAL collects a range of information about you during the recruitment process. This may include:

  • Identity and contact details: Your name, date of birth, address, email address and telephone number.
  • Recruitment information: Your CV, application forms, qualifications, skills, experience, employment and education history, references as well as interview notes and assessment results.
  • Remuneration and benefits information: Your current salary, salary expectations and benefit entitlements.
  • Security and vetting information: Background checks, criminal records checks, counter terrorism checks and aviation security vetting outcomes (where legally required).
  • Health information (where provided by you): Whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process.
  • Right to work information: Your nationality, immigration status, copies of identity documents (where required) and information about your entitlement to work in the UK; and
  • Equal opportunities monitoring information (where provided by you): Information about your gender, ethnicity, sexual orientation, health and religion or belief.

How we collect personal data about you

We collect your personal data in a variety of ways. For example, data might be contained in application forms, CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

If you are successful and where your job role requires it, we may collect personal data about you from third parties, such as:

  • References supplied by former employers.
  • Information from employment and education verification providers.
  • Information from criminal records checks from the UK and overseas.
  • Counter-terrorism checks from official vetting services.
  • Results from any medical or fitness assessments from occupational health medical providers.

Automated Decision Making

EAL’s recruitment processes are not based solely on automated decision-making. We do however use online testing when screening for x-ray competence for applicants joining the Security team. If this test is failed, your application for employment will be rejected. Online testing may also be used as part of the shortlisting process for technical roles.

How we use your personal data

We use your personal data to:

  • Assess your suitability for employment.
  • Communicate with you throughout the recruitment process.
  • Carry out right to work checks.
  • Meet aviation security, safeguarding and regulatory requirements.
  • Make reasonable adjustments for applicants with disabilities.
  • Keep records relating to our recruitment decisions.

Why we process your personal data

EAL processes your personal data for the following reasons:

Contractual necessity: To take steps at your request prior to entering into a contract with you. We also need to process your data to enter into a contract with you if your application is successful.

Legal obligation: To comply with employment law, right to work and aviation security regulations.

Legitimate interest: To manage and run a fair recruitment process and keep records of the recruitment process. We may also need to process your personal data in order to respond to or defend a legal claim.

Special category data: Where we process special category data, such as information about ethnicity, sexual orientation, health, religion or belief this will be based on:

  • Employment, social security and social protection law.
  • Substantial public interest (e.g. equality of opportunity and aviation security).
  • Your explicit consent (where required).

Criminal records data is processed in accordance with Schedule 1 of the Data Protection Act 2018 and only where legally permitted.

Who we share your personal data with

During the recruitment process we may share your personal data with:

  • Internal teams involved in recruitment and onboarding.
  • Managers in the business area with a vacancy.
  • IT staff or maintenance personnel who maintain our IT systems.
  • Third-party business partners, where EAL has undertaken recruitment activities on their behalf.
  • Recruitment agencies acting on our behalf.

If your application is successful, we may share your personal data with:

  • Background checking and vetting providers, including Disclosure Scotland or Disclosure Barring Service.
  • Former employers to obtain references from you.
  • Employment and/or education background check providers to verify your periods of employment and/or education for the necessary background checks.
  • Occupational health or medical providers who conduct medical or fitness tests on our behalf.
  • Relevant regulatory, government or law enforcement bodies, such as the Department for Transport (DfT), Civil Aviation Authority (CAA), UKSV (UK Security Vetting Agency) or Police (e.g. for aviation security vetting).

International data transfers

Your data may be transferred outside the UK and the European Economic Area (EEA), for example to enable receipt of an overseas criminal records check. Data is transferred outside the UK in compliance with data protection laws.

How long we keep your data for

Unsuccessful applications: We will retain your data for 12 months after the last date you accessed your candidate profile. At the end of that period or once you withdraw your consent, your data will be deleted or destroyed. You may at any time request that your data is held for longer than 12 months.

Successful applications: Personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in our Employee Privacy Notice.

Where EAL has undertaken recruitment activities on behalf of any third-party business partners, please refer to their Privacy Notice for details about how long your data will be retained for.

Your rights and how to exercise them

Under the UK data protection laws, you have a number of rights in relation to the personal data we process about you during the recruitment process. These rights are not absolute and may only apply in certain circumstances:

  • Right of access: You have the right to ask us to confirm we are processing your personal data and obtain a copy of it. We will not normally disclose confidential references provided to us (or given by us) about you, as these are generally exempt from disclosure under the UK data protection laws.
  • Right to rectification: You have the right to ask us to correct personal data that is inaccurate or incomplete.
  • Right to erasure: In limited circumstances, you may request the deletion of your personal data, such as where the data is no longer necessary for the purpose it was collected, processing is based on consent and that consent is withdrawn or where the data has been unlawfully processed.
  • Right to restrict processing: You have the right to request that we limit how your personal data is used, for example where you contest the accuracy of the data.
  • Right to object: You have the right to object to the processing of your data where we rely on legitimate interests as the legal ground for processing.
  • Right to data portability: In limited circumstances you have the right to request a copy of your personal data in a structured, commonly used and machine-readable format or that we transfer your data directly to another organisation.
  • Right to withdraw consent: Where we rely on your consent to process personal data you have the right to withdraw that consent at any time.

If you would like to exercise any of these rights, you can complete our online form available here. Alternatively, you can contact our Data Protection Officer (DPO) by emailing  DPO@edinburghairport.com .

Your right to complain

If you have any concerns about how we handle your personal data, we encourage you to contact us in the first instanceso that we can understand and seek to resolve your concerns promptly and fairly.

You can raise a concern or complaint by completing our online form available here. Alternatively, you can email our DPO at DPO@edinburghairport.com.

You also have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO). Their details can be found here.

This policy documents your privacy rights and how we gather, use and share personal data about you during the recruitment process, in accordance with the General Data Protection Regulation (EU) 2016/679, as well as other data protection and privacy laws and separate UK data protection law as may be updated or replaced from time to time. This Privacy Notice was last updated on 20 July 2023.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information. This notice shall not form part of any employment contract which you may enter into with us, and we reserve the right to amend this notice at any time.