Privacy Policy

1. INTRODUCTION

TARMAC AEROSAVE and its wholly owned subsidiary TARMAC ARAGÓN (together, “TARMAC”, “we”, “us” or “our”) are committed to protecting Personal Data and to processing such data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), as well as applicable national data protection laws and regulations (“Data Protection Laws”)

This Privacy Policy explains how Personal Data are collected and processed when you visit our Website, contact us, subscribe to our newsletter or otherwise interact with us through the Website.

Depending on the circumstances, TARMAC AEROSAVE or TARMAC ARAGÓN acts as the data controller in respect of the Personal Data processed for the purposes it determines. Where both entities jointly determine the purposes and means of a specific processing activity, they may act as joint controllers in accordance with applicable Data Protection Laws.

For any questions regarding the processing of your Personal Data, you may contact us at: data.protection@tarmacaerosave.aero

2. DEFINITIONS

For the purposes of this Privacy Policy:

“Cookies” means small text files or similar technologies stored on or accessed from a user’s device when visiting a website.

“Data Subject” means an identified or identifiable natural person.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, consultation, use, disclosure, restriction, erasure or destruction.

“Website” means the website accessible at www.tarmacaerosave.aero and, where applicable, related TARMAC webpages covered by this Privacy Policy.

3. DATA PROTECTION PRINCIPLES

TARMAC processes Personal Data in accordance with the principles set out in Article 5 of the GDPR.

Personal Data must be processed lawfully, fairly and transparently. They must be collected for specified, explicit and legitimate purposes and must not be further processed in a manner incompatible with those purposes.

Personal Data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed.

They must be accurate and, where necessary, kept up to date. Personal Data must not be retained in identifiable form for longer than necessary for the purposes for which they are processed, subject to applicable legal retention requirements.

Finally, Personal Data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful

Processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures.

4. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to Personal Data processed in connection with the use of our Website and the services and functionalities described below.

It does not constitute terms and conditions of use, and the mere use of the Website does not constitute consent to all Processing described in this Privacy Policy.

Where consent is required for a particular Processing activity, such consent will be requested separately in accordance with applicable Data Protection Laws.

Our Website may contain links to websites, platforms or services operated by third parties. Those third parties may process Personal Data in accordance with their own privacy policies and practices.

TARMAC is not responsible for the privacy practices of independent third-party websites or platforms.

5. PERSONAL DATA WE MAY COLLECT

Depending on how you interact with us, we may process the following categories of Personal Data:

Identification and contact information: first name, last name, email address, telephone number and any other information you voluntarily provide when contacting us.
Professional information: company name, professional function or position, professional email address and other professional contact information.
Communication data: the content of messages, enquiries or other communications you send to us.
Newsletter data: your email address and information relating to your subscription, consent and unsubscribed preferences.
Technical and browsing data: depending on the technologies used on the Website, this may include IP address, browser type, device information, operating system, connection logs, cookie identifiers, pages visited and information concerning your interaction with the Website.

We seek to limit the Personal Data collected to what is adequate, relevant and necessary for the purposes described in this Privacy Policy.

6. HOW WE COLLECT PERSONAL DATA

We may collect Personal Data directly from you when you contact us through a Website form, send us an email or other communication, or subscribe to our newsletter.

Certain technical information may also be collected automatically when you browse the Website through cookies and similar technologies.

Where applicable, non-essential cookies and similar technologies are used only after obtaining your consent in accordance with applicable law.

Personal Data relating to recruitment are collected separately through our dedicated Teamtailor Career Site, as explained in Section 11 below.

7. PURPOSES AND LEGAL BASES OF PROCESSING

We process Personal Data only where there is an appropriate legal basis under the GDPR.

Managing and responding to requests or enquiries submitted through the Website
- Data: Identification, contact, professional and communication data.
- Legal basis: Our legitimate interest in responding to enquiries and managing communications, pursuant to Article 6(1)(f) GDPR; where the request concerns steps prior to entering into a contract, Article 6(1)(b) GDPR may also apply.

Sending newsletters and other communications to subscribers
- Data: Email address and subscription information.
- Legal basis: Consent pursuant to Article 6(1)(a) GDPR.

Ensuring the security, integrity and proper functioning of the Website, including protection against spam, fraud and automated abuse
- Data: Technical and browsing data.
- Legal basis: Our legitimate interest in protecting our Website and information systems, pursuant to Article 6(1)(f) GDPR.

Measuring Website audience and analysing Website use through non-essential analytics technologies
- Data: Technical, browsing and cookie data.
- Legal basis: Consent pursuant to Article 6(1)(a) GDPR, where required.

Complying with legal and regulatory obligations
- Data: Relevant Personal Data depending on the obligation concerned.
- Legal basis: Compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

Establishing, exercising or defending legal claims
- Data: Relevant Personal Data depending on the circumstances.
- Legal basis: Our legitimate interest in protecting our legal rights and interests, pursuant to Article 6(1)(f) GDPR.

Where Processing is based on our legitimate interests, we take into account the nature of the Personal Data concerned, the reasonable expectations of Data Subjects and the potential impact of the Processing on their rights and freedoms.

8. RECIPIENTS OF PERSONAL DATA

Access to Personal Data is restricted to persons who require such access for legitimate professional purposes.

Depending on the Processing concerned, Personal Data may be accessed or received by authorised personnel within TARMAC AEROSAVE or TARMAC ARAGÓN.

Personal Data may also be processed by service providers acting on our behalf, including providers of Website hosting, IT infrastructure, Website maintenance, security, analytics, cookie management, communications or newsletter services.

Where such providers act as processors, they process Personal Data only on our documented instructions and subject to appropriate contractual and security requirements.

Personal Data may also be disclosed to public, judicial, regulatory or administrative authorities where required by applicable law.

Where necessary for the establishment, exercise or defence of legal claims, relevant Personal Data may also be disclosed to professional advisers, lawyers, auditors or insurers.

We do not sell Personal Data.

9. INTERNATIONAL DATA TRANSFERS

TARMAC does not transfer Personal Data collected through the Website to countries outside the European Economic Area (“EEA”).

Should such transfers become necessary in the future, TARMAC will ensure that they are carried out in compliance with the GDPR and subject to an appropriate transfer mechanism and safeguards, where required by applicable Data Protection Laws.

10. DATA RETENTION

TARMAC retains Personal Data only for as long as necessary for the purposes for which they were collected, taking into account applicable legal, regulatory, contractual and evidentiary requirements.

Contact requests and general enquiries: Personal Data are retained for the time necessary to process and respond to the request. Where necessary, certain information may subsequently be retained for a limited period for evidentiary purposes, to comply with legal obligations or to establish, exercise or defend legal claims.

Newsletter subscriptions: Personal Data used to send the newsletter are retained for as long as you remain subscribed. If you withdraw your consent or unsubscribe, your information will no longer be used to send newsletters, subject to the limited retention of information necessary to demonstrate compliance with your unsubscribe request or applicable legal requirements.

Cookie and analytics data: retention periods depend on the relevant cookie or technology and are indicated, where applicable, through our cookie management tool or Cookie Policy.

Security and technical logs: such information is retained only for the period necessary for Website security, troubleshooting, fraud prevention and the protection of our information systems.

At the end of the applicable retention period, Personal Data are deleted or anonymised, unless further retention is required or permitted by law.

11. CAREER AND RECRUITMENT

The “Career” section of our Website redirects users to our dedicated recruitment platform operated through Teamtailor.

Personal Data submitted in connection with a job application, candidate profile or recruitment process are collected and processed through the Teamtailor platform rather than through the general contact functionalities of this Website.

For detailed information concerning the processing of Personal Data in connection with recruitment, including the relevant purposes, legal bases, retention periods and rights applicable to candidates, please refer to the privacy information available directly on our Teamtailor Career Site.

12. SOCIAL MEDIA

TARMAC maintains official pages or accounts on third-party social media platforms, including LinkedIn, Instagram and YouTube.

When you visit or interact with these platforms, the relevant social media provider may process Personal Data in accordance with its own privacy policy and data processing practices.

If you communicate directly with TARMAC through a social media platform, for example by sending us a private message, we may process the information contained in that communication for the purpose of responding to your request.

Social media providers may act as independent data controllers for certain Processing operations carried out through their platforms. We encourage users to review the privacy information provided by the relevant social media provider before using or interacting with those services.

13. NEWSLETTER

Where you choose to subscribe to our newsletter, we process your email address for the purpose of sending you TARMAC news, updates and information concerning our activities, products or services.

Newsletter communications are sent on the basis of your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time by using the unsubscribe link included in each newsletter or by contacting us directly.

Withdrawal of consent does not affect the lawfulness of Processing carried out before consent was withdrawn.

Your email address is not sold or disclosed to third parties for their own independent marketing purposes.

Where a service provider is used to distribute the newsletter, that provider may process your Personal Data on our behalf subject to appropriate contractual safeguards.

14. COOKIES AND SIMILAR TECHNOLOGIES

Cookies and similar technologies may be used on the Website for technical, security, functional and, subject to your preferences, analytics purposes.

Strictly necessary cookies are used where required for the operation, security or essential functionality of the Website. Where permitted by applicable law, these cookies do not require your consent.

Analytics cookies may be used to understand how visitors interact with our Website and to measure Website performance. Where required by applicable law, such cookies are activated only after obtaining your consent.

Security technologies may be used to prevent spam, fraud, abuse and automated attacks against Website forms and services.

When you first visit the Website, you may be presented with a cookie management tool enabling you to accept or refuse non-essential cookies.

You may change or withdraw your cookie preferences at any time through the cookie settings made available on the Website.

Refusing non-essential cookies will not prevent you from accessing the essential functions of the Website.

For more detailed information concerning cookies and similar technologies used on the Website, including their purposes and retention periods, please refer to the cookie settings or Cookie Policy available on the Website.

15. reCAPTCHA AND WEBSITE SECURITY

Our Website may use Google reCAPTCHA to protect forms and Website functionalities against spam, fraud and automated abuse.

In connection with this security service, certain technical information relating to your device or interaction with the Website may be processed for the purpose of distinguishing legitimate users from automated or malicious activity.

TARMAC relies on its legitimate interest in ensuring the security and integrity of the Website and protecting its services against fraud, spam and automated abuse pursuant to Article 6(1)(f) GDPR.

Google processes relevant reCAPTCHA Customer Data on behalf of its customers in accordance with the applicable contractual data protection framework.

16. SECURITY OF PERSONAL DATA

TARMAC implements appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the nature of the Processing and the risks involved, these measures may include access controls, authentication mechanisms, network protection, security monitoring, encryption or other appropriate technical measures.

Access to Personal Data is limited to authorised persons who require such access for legitimate professional purposes.

Our security measures are reviewed and adapted where appropriate to reflect changes in technology, risks and our Processing activities.

17. YOUR DATA PROTECTION RIGHTS

Subject to the conditions provided for under the GDPR, you may exercise the following rights in relation to your Personal Data.

You have the right of access, allowing you to obtain confirmation as to whether Personal Data concerning you are being processed and, where applicable, access to that data.

You have the right to rectification of inaccurate Personal Data and the right to have incomplete Personal Data completed.

You may have the right to erase your Personal Data in the circumstances provided for under Article 17 GDPR.

You may have the right to restriction of Processing in the circumstances provided for under Article 18 GDPR.

Where Processing is based on our legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such Processing on grounds relating to your particular situation.

Where Personal Data are processed for direct marketing purposes, you have the right to object to such Processing at any time.

Where Processing is based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of Processing carried out before such withdrawal.

Where the conditions of Article 20 GDPR are met, you may have the right to data portability.

Where applicable, you also have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions provided by Article 22 GDPR.

To exercise your rights, please contact:

Email: data.protection@tarmacaerosave.aero

Postal address:

TARMAC AEROSAVE

Ref. Data Protection

L’Aérodrome

65380 Azereix

France

We may request reasonable information necessary to verify your identity before responding to a request where appropriate.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In France, you may contact the Commission Nationale de l’Informatique et des Libertés (CNIL).

Where Spanish data protection law or the competence of the Spanish supervisory authority is applicable, you may contact the Agencia Española de Protección de Datos (AEPD).

More generally, under the GDPR you may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement, subject to the applicable rules governing supervisory authority competence.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in applicable law, our services, technologies or Personal Data Processing activities.

The most recent version will be made available on the Website.

Where appropriate, material changes may be brought to users’ attention through the Website or by another appropriate means.

Last updated: September 2026

19. CONTACT US