This Privacy Statement applies to all personal information collected by daa plc for the purposes specified below. The purpose of this statement is to let you know what to expect when daa collects personal information about you via our websites, telephone, email, mobile devices, manual forms, or in person.

With this Privacy Statement, we want to provide transparency on how we treat personal information and the purposes for which we collect data.

This Privacy Statement applies to individuals that:

▪ Purchase goods at one of The Loop stores or online through The Loop website
▪ Sign up to receive information such as newsletters and offers
▪ Enter any competition or participate in any promotion which we may offer from time to time
▪ Participate in any events at The Loop stores
▪ Submit a query via email, phone, online form or postal correspondence
▪ Visit our website, domains or use one of our apps

We may collect information about you via this website, telephone, email, mobile devices, forms, or in person. We may collect the following personal information from you:

▪ Purchases for collection - for purchases made in store for collection at a later date or online for collection, we may collect your name, email address, contact number, flight information and credit card billing address. We collect this information to enable us to complete the transaction for the product you have purchased. Your information is processed in this respect for the performance of the contract between daa, as data controller, and you, the data subject.

▪ Duty-free purchases - for duty free purchases, we collect flight details as provided on your boarding card. The information collected is limited to the item purchased and flight information such as the airline and destination details. We collect this information to comply with legal and regulatory obligations.

▪ Passport information – your passport may be requested in retail outlets that are past US Preclearance, officially known as US Customs & Border Patrol (USCBP) to verify your age and residency status. We collect this data under the terms of the treaty to implement USCBP agreed between Ireland and the USA.

▪ Competitions – we may collect information such as your name, contact details and address when you enter competitions we run in-store or via our social media channels. We process this information to select competition winners and fulfil delivery of any such prizes, in line with our competition terms and conditions. We will ask for your consent to process this information for the purposes of administering the competition when you enter and for the purposes of publicity in relation to the competition.

▪ Staff purchases – if you are a member of staff at daa or its associated affiliates, we may also collect information such as your Airport ID number and daa associated affiliate, if applicable. This information is required to enable us to complete the transaction for the product you have purchased. We collect this data as part of the fulfilment of a sales contract with you as a person eligible for a discounted price.

▪ Security - we may also collect personal information via Closed Circuit Television (CCTV) located in The Loop stores. Please refer to the daa Privacy Policy for further information.

▪ Direct Marketing Communications and Permissions – if we wish to gather information to contact you, e.g. for marketing purposes, we will ask for your consent to do so in advance. If you have purchased products or services from us, we may offer you reminders or information to assist us in delivering those services unless you have asked us not to contact you in relation to products or services purchased. If you have provided consent, you can unsubscribe at any time to remove that consent.

This Privacy Statement applies to individuals that have given their consent to avail of direct marketing communications from daa plc regarding promotions, products or services electronically via email, SMS and / or push notifications.

We would like to provide you with information about new products, promotions, special offers, services and other information that we feel you may be interested in. As part of a purchase on our digital channels, we offer you the opportunity to opt in to our marketing communications. You will always be given the opportunity to withdraw that consent on every electronic communication you receive from daa plc by unsubscribing at any time.

When you sign up to marketing communications, we’ll normally contact you by email, but we may also send you marketing texts if you have given us your mobile number for this purpose.

Information you provide may also be used to conduct statistical analysis of our products or services, analyse future trends and build customer profiles. This processing is carried out in daa’s legitimate interests and allows us to ensure customers continue to find our products valuable and so that we can continue to invest in the infrastructure to meet customers’ future needs at Dublin Airport and Cork Airport. This does not affect your rights as a data subject. See the section below entitled “Your Rights in relation to Your Information” for more details.

At times, we engage third parties, such as software providers, to assist us in providing our products and services. Your personal information may be shared with these organisations to allow us to provide you with the product or service you have requested.

All personal information collected for the purposes specified in this statement is processed inside the European Union (EU) or the European Economic Area (EEA) and, if transferred to countries located outside the EU or the EEA, will only be transferred to countries that ensure an adequate level of protection or where there are appropriate safeguards in place in compliance with EU data protection laws.

Any personal information that you provide to daa or its subsidiaries will be treated with the highest standards of security and confidentiality and handled in accordance with Data Protection laws and the General Data Protection Regulation.

Security of your personal data is very important to us. We take all reasonable technical and organisational measures to prevent the loss, misuse, unauthorised access, disclosure, or alteration of your personal data. These measures include:

▪ We apply various levels of access control to restrict access to your personal information to daa employees and contractors who require a level of access as part of their role

▪ We work with experienced, specialised vendors to develop and maintain our platforms

▪ We regularly review and audit our security and data protection policies and procedures to ensure a high level of operational security is maintained.

When you provide us with personal information, we delete this information in line with our data retention policy. We will retain the following personal data you have provided for the following time periods;

▪ Order information – we retain your name, email address, contact number and transaction history for six (6) years

▪ Credit card information – with your permission, we will store a hash of your card number for identification purposes and ease of future check out. A ‘hash’ is a secure representation of your card number that can be used to identify your card but cannot be used to recreate your card number. We retain the card number hash for six (6) years post the last transaction (you may remove your stored credit card hash reference at any time via ‘My Account’).

Your rights as a data subject are as follows:

▪ Right of access – you have the right to find out if we hold any personal information relating to you. You also have the right to obtain a copy of any such personal information we hold on you. The request is referred to as a ‘Data Access Request’. Please refer to the daa Privacy Policy for further information.

▪ Right to rectification - you have the right to request we rectify any information we hold about you that is inaccurate.

▪ Right to erasure – you have the right to request we erase any information we hold on you, provided there are valid grounds for doing so and that we may continue to process your personal data if we have a legal basis to do so.

▪ Right to restriction of processing – you have the right to request we temporarily restrict the processing of your personal information, provided there are valid grounds for doing so.

▪ Right to data portability – you have the right to obtain a machine-readable copy of the information we hold on you, and have it transferred to another controller if required.

▪ Right to object - you have the right to object to the processing of your personal information, namely in the case processing is carried out in the legitimate interests of daa.

▪ Right to lodge a complaint – if you are unhappy with how we have acted in handling your personal information, you have the right to lodge a complaint with the supervisory authority in your EEA country of residence, place of work, or with the Office of the Data Protection Commissioner in Ireland.

▪ Right to withdraw consent – where you have previously provided your consent, you have the right to withdraw consent to our processing of your information at any time. In certain cases, we may continue to process your information after you have withdrawn consent if we have a legal basis to do so or if your withdrawal of consent was limited to certain processing activities.

If you have any questions or comments about this Privacy Statement, please contact our Data Protection Officer by email at dataprotection@daa.ie or in writing at:

Data Protection Officer
Cargo Building 6, Corballis Park,
Dublin Airport,
Co. Dublin