PRIVACY POLICY

This is a description of how your personal data is collected, used and deleted while you visit the website www.flymarabu.com ("Website") and use Marabu Airlines OÜ ("Marabu", "us", "our") services.

By visiting the Website and using Marabu services you also agree to our collection, use, and disclosure practices, as well as any other activities described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, you should immediately discontinue the use of the services and refrain from accessing the Website.

Marabu is an airline which provides air transport services for passengers.

The Controller of your personal data described in this Privacy Policy is legal entity Marabu Airlines OÜ, registered number 16621081 and registered address at Lõõtsa 5, Tallinn, 11415, Estonia

HOW WE RECEIVE THE PERSONAL INFORMATION?

The personal information we process is provided to us directly by you in order to use our service or provided us by our business partners when you provide the required data to them in order to use our services.

Please consider that we use online booking service provided by Condor. You will be directed to Condor website when you start booking your flight on our Website. While Condor acts as independent data controller, its privacy policy applies to your personal data processing.

When visiting our Website, we collect certain device data using web-cookies which are small encrypted text files, located in browser directories. They are used to help website visitors to navigate efficiently on the websites and to perform certain functions. Use of our web-cookies are described on our Website's cookie banner.

WHAT KIND OF DATA IS PROCESSED AND WHY?

SHARING YOUR PERSONAL DATA

The processing of your personal data is lawful pursuant to Art. 6 para. 1 lit. a. DSGVO lawful, as you have given your consent to the processing of your personal data for one or more specific purposes before completing the application.

We and our online booking service partner are required by law to provide booking information to national law enforcement authorities (Booking Information System BRIIS for Estonia, national reporting systems for other relevant jurisdictions). More information on these obligations can be read on Police and Border Guard website.

Public authorities may request us to provide information that we process. If such request is legally binding, we may disclose requested data to authorities.

We also use third party processors to help us provide our Website and services.

Use of service providers

International transfers

Please be aware that information processed by us may be transferred to, processed, stored, and used in the European Economic Area („EEA“) and also other jurisdictions if the service provided by us requires such transfer. Data protection laws (mainly General Data Protection Regulation „GDPR“) in the EEA may be different from those of other jurisdictions. Your use of our services or provision of any information therefore constitutes your consent to the transfer to and from, processing, usage, sharing, and storage of information about you in the EEA and other jurisdictions as set out in this Privacy Policy. We do our best to ensure that the transfer of your personal data is carried out in accordance with applicable privacy laws and, in particular, that appropriate contractual, technical, and organisational measures are in place.

ENSURING THE SECURITY OF PERSONAL DATA

We have taken necessary technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss or alteration and against the unauthorized disclosure, abuse or other processing in violation of applicable law. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the full security of information about you.

RETENTION AND DELETION OF PERSONAL DATA

The storage period of personal data depends on the purpose of the processing of the data.

YOUR RIGHTS AND PREFERENCES

Under data protection law, you have rights including:

1. Right to be informed and to access. You may get information regarding your personal data processed by us.
2. Right to data portability. You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and to independently transmit those data to a third party.
3. Right to erasure. You have the right to have personal data we process about you erased from our systems if the personal data are no longer necessary for the related purposes.
4. Right to object and restrict. You have the right to object to the processing of your personal data and restrict it in certain cases.
5. Right to rectification. You have the right to make corrections to your personal data.
6. Right to withdraw consent. When you have provided us consent to process your personal data, you may withdraw said consent at any time.

To exercise any of the abovementioned rights, please contact [email protected]. We will respond to your requests within 30 days.

CHILDREN'S DATA

We do not provide services directly to children. We do not collect children's personal data from children. When we process children's personal data, we will do it in accordance with the wishes of the parent or guardian or under an obligation arising from the law.

COMPLAINTS

If you have questions or concerns about our use of your personal information, please feel free to contact our Data Protection Officer at [email protected]. Data Protection Officer function is appointed for monitoring the implementation of the personal data processing principles in Marabu.

You may also lodge a complaint to the supervisory authority, the Estonian Data Protection Inspectorate: [email protected].

INFORMATION ABOUT THE JOINT PROCESSING OF YOUR DATA

We, Marabu and Condor Flugdienst GmbH, work closely together in the sale of flight tickets for Marabu's flights. As a result of this cooperation, we also process your personal data jointly.

To guarantee your rights and taking into account the requirements of the EU General Data Protection Regulation (GDPR), we have concluded an agreement that sets out rules on the processing of your personal data. As so-called joint controllers (according to Art. 26 GDPR), we are jointly responsible for the processing of your data.

Below, we answer the questions that are particularly important for you before we provide you with more detailed information about our agreement.

Who are the data controllers and data protection officers?

The persons responsible in accordance with Art. 4 para. 7 GDPR are:

Marabu Airlines OÜ
Lõõtsa 5, Tallinn
Tallinn 11415
Estonia

and

Condor Flugdienst GmbH
An der Gehespitz 50
63263 Neu-Isenburg
Germany

You can contact our data protection officers at

[email protected] or [email protected], or at the respective postal addresses with the addition of "the Data Protection Officer" or "Data Protection Officer".

Who is my contact for rights such as access or deletion?

We have jointly agreed on how we will ensure your rights and specified in more detail which obligations each party will fulfil to comply with the obligations of the GDPR. This relates to the exercise of data subjects' rights and the fulfilment of the information obligations under Articles 13 and 14 of the GDPR.

You can address each company involved individually regarding the processing of your data and assert your rights.

How can I get more information on data processing?

You can obtain more information about the processing of your personal data in our data protection declarations, which are available at

https://www.condor.com/de/hilfe-kontakt/datenschutzerklaerung.jsp

https://flymarabu.com/en/privacy

ADDITIONAL PROVISIONS FOR JOB APPLICANTS

Marabu Privacy Policy applies fully also in the situations where you act as applicant to our open positions. This means that you and we have all the rights and obligations described in the Privacy Policy related to personal data processing, if not described differently in this section.

Personal data collected in applying process

• Personal master data (applicant name, address, date of birth).
• Communication data (telephone, e-mail)
• Data of the applicant's curriculum vitae (e.g. professional career, education, sideline activities, leisure activities etc.)
• Results of selection procedures (e.g. assesments, tests, interviews)
• Process data (e.g. status, appointments)

Your personal data will be electronically stored and used exclusively for the purpose of processing your application.

We use Career.aero platform as a service provider for job vacancy advertisements in Marabu. Please read Career.aero privacy policy for more detailed information of their personal data processing principles.

Data retention and deletion

The general statutory retention and deletion periods apply. We will delete your data in accordance with the relevant legal provisions after the relevant recruitment process has been completed. In Estonia, the claims arising from equal treatment can be filed during one year period according to Equal Treatment Act. For this reason we keep the application data for 1 year.

We may ask your consent for further data storage for possible future vacancies. In such case we will provide you with the consent form in writing.

03.04.2023