Mach 1 Aviation Adjusting Ltd (company number 17244342) of 39 Mountbatten Court, Belmont Street, Bognor Regis, England, PO21 1JW (the Company, we, us, our) is an independent specialist aviation consultancy and claims handling business providing services to insurers, brokers and law firms.
We are registered as a data controller with the Information Commissioner's Office (ICO). Our ICO registration number is ZC196513. This privacy notice explains how we collect, use, store and share personal data in connection with the provision of our services. It applies to:
1. Personnel at our clients (insurers, brokers, law firms and other organisations who instruct us);
2. Third parties whose personal data we process in connection with aviation claims or incidents, including claimants, insured parties, aviation personnel and witnesses; and
3. external experts, consultants and other professionals we engage to assist with our services.
Our role in relation to your personal data
Depending on the context, we may act as:
1. Data controller: where we determine the purposes and means of processing personal data - for example, when managing our client relationships, maintaining our own business records or engaging external experts.
2. Data processor: where we process personal data on behalf of and under the instructions of a client (for example, when handling an aviation claim on behalf of an insurer or broker). In those cases, our client is the data controller and we process personal data only in accordance with their instructions and the terms of our engagement.
The personal data we collect and process
In connection with our services, we may collect and process the following categories of personal data:
1. Identity and contact data, such as names, job titles, email addresses, telephone number and postal addresses of client personnel, insured parties, claimants, witnesses and other individuals connected with a claim or matter.
2. Professional and employment data, such as pilot licences, aircraft type ratings, training records, flight hours and professional qualifications of aviation personnel involved in incidents under review.
3. Financial and insurance data, such as insurance policy details, claim values, loss figures and payment information relevant to an aviation claim.
4. Incident and operational data, including details of aviation accidents, incidents, survey findings and related operational information.
5. Special category health data: medical certificates and medical fitness records of pilots and crew members, processed where required as part of due diligence to verify that the relevant individual held valid medical certification at the material time. This data is handled with additional care and is processed only where necessary for the purposes described in section 5 below.
6. Business contact and correspondence data, including names and contact details of individuals at organisations we work with, and the content of emails and other communications received and sent in connection with a claim or matter.
How we collect personal data
We collect personal data in the following ways:
1. Directly from our clients, who provide us with personal data when instructing us to handle a claim or matter.
2. From insured parties, claimants and other individuals directly involved in the claim or matter.
3. From third parties such as aviation authorities, regulatory bodies, accident investigation boards, maintenance facilities, aircraft operators and legal representatives.
4. From publicly available sources such as aviation registries, Companies House and regulatory publications.
Why we use your personal data and our lawful basis
We use personal data only for the purposes for which it was collected. Those purposes, and the lawful bases on which we rely, are as follows.
1. Providing aviation consultancy and claims handling services. We process personal data to perform the services we have been instructed to provide. Our lawful basis is the performance of a contract and our legitimate interests in providing professional services.
2. Carrying out due diligence on aviation personnel. Where a claim or matter requires us to verify the qualifications and medical certification of pilots or crew members, we may process special category health data (medical certificates and fitness records). Our lawful basis for this processing is Article 9(2)(f) of the UK GDPR, namely that it is necessary for the establishment, exercise or defence of legal claims.
3. Managing our client relationships and administering our business. We process contact details and correspondence to manage our day-to-day business relationships. Our lawful basis is our legitimate interests in running and managing our business.
4. Complying with legal and regulatory obligations. We may process personal data where required to do so by law. Our lawful basis is compliance with a legal obligation.
Who we share your personal data with
We may share personal data with the following categories of recipients where necessary for the performance of our services:
1. Our clients (insurers, brokers, law firms and other organisations who have instructed us), including co-insurers, reinsurers and their legal advisers where relevant to the claim.
2. External experts, specialist consultants, engineers, legal representatives and local correspondents engaged to assist with a claim or matter.
3. Aviation authorities, accident investigation bodies and other regulators where required in connection with a claim or by law.
4. Courts, tribunals and legal proceedings, where required.
5. The ICO or other regulatory authority, where required by law.
We do not sell personal data to third parties or use it for marketing purposes.
International transfers
Aviation claims are by their nature international, and we may occasionally need to share personal data with parties located outside the UK (for example, overseas aviation authorities, foreign legal representatives or international experts). Where we transfer personal data outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.
How long we keep your personal data
We retain personal data for a minimum of six years following the closure of the relevant claim or matter. This reflects the limitation period for contractual claims under the Limitation Act 1980 and ensures that we hold records that may be needed to defend any claim brought against us or our clients within that period. All files and documents are held electronically. At the end of the retention period, files are securely deleted. Where a longer retention period is agreed with a client or required by law, we will retain the relevant data for that longer period.
How we keep your personal data secure
We take the security of personal data seriously. Our security measures include:
1. Password-protected and encrypted devices using Microsoft 365.
2. Two-factor authentication on all business systems and email accounts.
3. Secure business email via Microsoft 365.
4. Anti-virus and malware protection via Microsoft Defender.
5. Client files stored on encrypted external drives with at least one copy kept at a separate location as an offsite backup.
6. Access to files and systems restricted to authorised personnel only. In the event of a personal data breach, we will notify the ICO and any affected individuals as required by law.
Your rights
Under UK data protection law, you have the following rights in relation to your personal data:
1. You have the right to request access to the personal data we hold about you;
2. To request correction of inaccurate or incomplete data
3. To request erasure of your data in certain circumstances
4. To object to our processing where we rely on legitimate interests
5. To request restriction of processing, and to request that your data be provided to you in a portable format where applicable.
Please note that some rights are subject to exceptions and may not apply in all circumstances, in particular where we are processing personal data in connection with legal claims.
To exercise any of these rights, please contact us using the details in section 11 below.
How to contact us
If you have any questions about this privacy notice, wish to exercise any of your rights, or have a concern about how we have handled your personal data, please contact us:
Stephen Hill
Mach 1 Aviation Adjusting Ltd
Email: stephen.hill@mach1aviation.co.uk
Address: 39 Mountbatten Court, Belmont Street, Bognor Regis, England, PO21 1JW
Complaints
If you are not satisfied with how we have handled your personal data, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would, however, always appreciate the opportunity to address your concerns directly before you approach the ICO, so please contact us in the first instance.
Changes to this notice
We may update this privacy notice from time to time. Any updated version will be provided to our clients and relevant contacts directly. The date at the top of this notice indicates when it was last reviewed.
We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.