Data Protection Policy

SIA Baltic Business Aviation Center (registration No. 40003752570, Dzirnieku iela 15, Riga International Airport, Marupe, Marupe district, LV-1053, Latvia — BBAC, we, us, our) is committed to protecting the privacy of everyone whose personal data we handle. This Policy explains, in general terms, how BBAC collects, uses, shares, and protects personal data, and what rights individuals have in relation to it.

This Policy is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR), the Latvian Personal Data Processing Law, and other applicable data protection legislation, as well as any data-protection terms agreed between BBAC and its customers.

1. Definitions

• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• Personal Data — any information relating to an identified or identifiable natural person (a Data Subject).
• Data Subject — an identified or identifiable natural person.
• Customer — the natural or legal person to whom BBAC provides Services, or who otherwise provides BBAC with Personal Data.
• Processing — any operation performed on Personal Data, such as collection, storage, use, disclosure, or erasure.
• Controller / Processor — as defined in the GDPR.
• Personal Data Breach — as defined in the GDPR.
• Services — the aircraft handling, ground handling, and related services provided by BBAC under a contract with, or on the documented instructions of, a Customer.
• Supervisory Authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija).
• Responsible Person — BBAC's contact for data protection matters: privacy@bbac.aero

2. Data Protection Principles

BBAC processes Personal Data in line with the principles set out in Article 5 of the GDPR. Personal Data must be:

• processed lawfully, fairly, and in a transparent manner;
• collected for specified, explicit, and legitimate purposes, and not further processed in an incompatible manner;
• adequate, relevant, and limited to what is necessary;
• accurate and kept up to date where necessary;
• kept in identifiable form for no longer than necessary; and
• processed securely, using appropriate technical and organisational measures.

3. Our Role: Controller and Processor

• BBAC's role depends on the context in which Personal Data is processed:
• As a Processor — when BBAC performs Services for a Customer under a contract or the Customer's documented instructions, the Customer is the Controller of the Personal Data involved and BBAC processes it only as, and to the extent, instructed.
• As a Controller — when BBAC determines the purposes and means of processing itself — for example, managing its own customer and supplier relationships, operating its website, ensuring safety and security at its premises, meeting legal and regulatory obligations, or sending news and marketing communications — BBAC acts as Controller and is responsible for complying with the GDPR in that capacity.

4. Personal Data We Collect

Depending on the context, BBAC may collect and process categories of Personal Data such as: identification and contact details; flight, booking, and travel-document details; billing and payment information; CCTV and access-control records at BBAC premises; and correspondence and other information a Customer or Data Subject chooses to share with BBAC. BBAC collects only the Personal Data that is adequate and relevant for the purpose in question.

5. Purposes and Legal Bases for Processing

• BBAC processes Personal Data only where a lawful basis under Article 6 of the GDPR applies, in particular:
• Performance of a contract — to provide the Services requested by, or agreed with, a Customer.
• Legal obligation — to comply with aviation-safety, customs, tax, and other statutory requirements.
• Legitimate interests — to operate and secure BBAC's business and premises (for example, CCTV, IT security, and fraud prevention), provided these interests are not overridden by the interests or fundamental rights of the Data Subject.
• Consent — where the Data Subject has given specific consent, such as for certain marketing communications, which may be withdrawn at any time.

6. News, Publications, and Events

Where a Customer's contact details are provided to BBAC, BBAC may use them to send information about BBAC's news, events, and Services, on the basis of the Customer's consent or BBAC's legitimate interest in maintaining its business relationships. Such communications will continue until the recipient asks BBAC to stop, which can be done at any time free of charge by contacting privacy@bbac.aero or using the unsubscribe option provided in the communication.

7. Sharing Personal Data and International Transfers

BBAC may share Personal Data with third parties where necessary to provide the Services or to comply with the law, including: airport authorities, customs, border control, and other public authorities; ground-handling agents, fuel suppliers, and other operational subcontractors acting as Processors on BBAC's behalf; and professional advisers or IT service providers. BBAC discloses only the minimum Personal Data necessary for the relevant purpose.

BBAC primarily processes Personal Data within the European Economic Area. Where Personal Data must be transferred outside the EEA — for example, because a flight or Customer instruction requires it — BBAC ensures the transfer is carried out on a valid legal basis under the GDPR (such as the European Commission's Standard Contractual Clauses or another approved safeguard) and that appropriate security measures are applied.

8. Data Retention

BBAC keeps Personal Data only for as long as necessary for the purposes described in this Policy, or as required by applicable law (including aviation, tax, and accounting regulations). Retention periods are set out in BBAC's internal data-retention rules and reviewed regularly; Personal Data that is no longer needed is securely deleted or anonymised.

9. Your Rights

Subject to the conditions and exceptions set out in the GDPR, Data Subjects have the right to:

• Access — obtain confirmation of, and a copy of, the Personal Data BBAC holds about them.
• Rectification — request correction of inaccurate or incomplete Personal Data.
• Erasure — request deletion of Personal Data in certain circumstances.
• Restriction — request that processing of their Personal Data be limited.
• Portability — receive certain Personal Data in a structured, commonly used format, or have it transmitted to another controller.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint — lodge a complaint with the Latvian Data State Inspectorate (www.dvi.gov.lv) or another competent supervisory authority.

Where BBAC acts as Processor on behalf of a Customer, requests relating to that Customer's data are generally directed to the Customer as Controller; BBAC will assist the Customer in responding as required by law. To exercise any of these rights in relation to data BBAC controls itself, contact privacy@bbac.aero.

10. Security of Personal Data

BBAC applies appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, and requires the same of any third party processing Personal Data on its behalf. In the event of a Personal Data Breach affecting a Customer's data, BBAC will notify the affected Customer without undue delay and provide reasonable assistance in addressing the breach.

11. BBAC's Obligations as a Processor

When acting as a Processor, BBAC will:

• process Personal Data only on the Customer's documented instructions;
• ensure staff with access to Personal Data are bound by confidentiality;
• assist the Customer, as reasonably required, with data-protection obligations and requests from Data Subjects; and
• on completion of the Services, delete or return the Personal Data processed, unless retention is required by law.

12. Customer Responsibilities

Where the Customer is the Controller, the Customer is responsible for:

• having a valid legal basis for the Personal Data it provides to BBAC;
• obtaining any necessary consents from Data Subjects;
• complying with applicable data-protection and confidentiality laws; and
• where relevant, notifying or obtaining approval from any regulatory body for the data-transfer arrangements involved.

13. Changes to this Policy

BBAC may update this Policy from time to time to reflect changes in its practices or in applicable law. The current version, with its Last Revised date, is published on BBAC's website. Continued use of BBAC's Services after an update constitutes acceptance of the revised Policy.

14. Contact Us

Questions, requests, or concerns about this Policy or BBAC's handling of Personal Data can be sent to BBAC's Responsible Person at info@bbac.aero.

15. Governing Law

This Policy is governed by the laws of Latvia. Any dispute arising from or related to this Policy shall be submitted to the exclusive jurisdiction of the competent courts of Latvia.