CAE CREW ACCESS PRIVACY STATEMENT

CAE CREW ACCESS PRIVACY STATEMENT

CAE Inc. and its affiliates (collectively “CAE”, “we” or “our”) take privacy seriously. We are committed to conducting business in a way that complies with applicable privacy and data protection laws and regulations in every country in which CAE operates.

This Crew Access Privacy Statement describes how we process Personal Information in connection with your use of the application. It also provides information about your rights and how you can contact us if you have questions about how we handle your Personal Information.

Please refer to the headings below to explore topics that are of interest to you.

At CAE, we equip people in critical roles with the expertise and solutions to create a safer world. As a technology company, we digitalize the physical world, deploying software-based simulation training and critical operations support solutions. Above all else, we empower pilots, cabin crew, maintenance technicians, airlines, business aviation operators, and defence and security forces to perform at their best every day and when the stakes are the highest. Around the globe, we’re everywhere customers need us to be with approximately 13,000 employees in more than 240 sites and training locations in over 40 countries. CAE represents more than 75 years of industry firsts—the highest-fidelity flight and mission simulators as well as training programs powered by digital technologies. We embed sustainability in everything we do. Today and tomorrow, we’ll make sure our customers are ready for the moments that matter.

This Crew Access Privacy Statement applies to our processing of your Personal Information in preparation for, during and after your use of the Crew Access web and mobile application.

Ordinarily, CAE processes your Personal Information as an independent Data Controller or Business Owner.

In business relationships with B2B customers, CAE is in the responsibility of a processor on behalf of our B2B customers (third-party controller), that licensed the application for the benefit of you - their employees. In such case it is the responsibility of the third-party controller to provide you with all privacy relevant information and this Crew Access Privacy Statement does not apply. Please contact the third-party controller for the applicable Privacy Statement.

This Crew Access Privacy Statement describes CAE’s privacy and data protection practices with respect to the collection, use, disclosure or otherwise processing of Personal Information about Crew Access application users ("you" or "your"). It also provides information about your rights and how you can contact us if you have questions about how we handle your Personal Information.

Because we are a company with a worldwide presence, we are subject to the varying requirements of applicable privacy and data protection laws within the jurisdictions where we operate.

Please do not use our application or provide us with any Personal Information if you do not agree with this Privacy Statement.

We may collect and process Personal Information when you register for an account with us and when you are using our application. We only collect and process Personal Information for specified purposes that are reasonable and appropriate.

We have described, in the table below, the main categories of Personal Information we collect throughout your usage of the Crew Access application and the business purposes (reasons) for which such information is processed.

Categories of Personal Information
Business purpose for processing
Contact information such as your name, address, telephone number and email
 We process this information to communicate with you in the context of your application usage.
Identity and user-profile information such as your company user ID, name, position, airline name, avatar, home base, flight statistics
 We process this information for user identification and providing a personalized experience of the application.
User content such as chat data, chat participants and messages
We process this information to facilitate the respective chat services.
Duty Data such as your aircraft, airfields, start-, end- and duration of duty, duty type, duty codes, pairing, Crew on flight
 We process this information to provide the overall functionality and features of the application such as roster on the go, share roster, export duties, meetup suggestions, context communications.
Geolocation information such as the current location of user
 We process this information to restrict the place you can check in from if the airline requires so. We only check your geolocation at the moment of checking in, and we do not store this data anywhere.
Computer access and authentication information such as Identification codes, passwords, certificates, PINs, credential information and access records
 We process this information for the purposes of authorizing, granting, administering, monitoring, and terminating access to or use of the application.
Monitoring information, network information such as electronic log files, internet protocol (IP) address or unique device identifier from computers, phones, and mobile devices; monitoring information about your usage of application (to the extent permitted by law).
We process this information to ensure network and information security and to monitor and improve the performance of our services, applications and systems. Device id is needed to send you push notifications.
Photographs of you
We process this information in connection with your profile information to provide a personalized experience of the application.
Other Personal Information you provide to us such as when you submit feedback, make inquiries, contact us for support or complete surveys.
 We process this information to respond to any inquiry or complaint made by you

We may also process your Personal Information to perform various analyses and dashboards to provide insights into user engagement and satisfaction, improve existing and develop new application services and identify usage trends. When doing so, we rely on the legal basis as mentioned below. Otherwise, we ensure that data is anonymized or aggregated so that it is not possible to identify you.

Finally, CAE may process Personal Information to perform audits and defend legal claims. Such processing will be in accordance with applicable laws.

We do not knowingly collect Personal Information from anyone under the age of eighteen.

Further information regarding the legal basis relied upon to process your Personal Information can be found below.

Most of the Personal Information we collect and process is the information you provide to your employer – our B2B customers (third-party controller), that licensed the application for the benefit of you. In such case it is the responsibility of the third-party controller to provide you with all privacy relevant information and this Crew Access Privacy Statement does not apply.

Some additional information (like your profile picture, for example) is provided directly by you when you submit this information to us with your account creation or when you use our application.

We also automatically collect information from you through tracking technologies and logs.

Subject to applicable data privacy laws and regulations, the processing of your Personal Information is generally conducted on the following legal grounds:

  • Consent: In general, under applicable data privacy laws and regulations, the processing of your Personal Information for application purposes is based on your consent. CAE will obtain consent directly from you, either implicit or explicit, as the case may maybe. Before any consent can be given, you will be properly informed of the purpose and means of the processing, as well as your privacy rights.    
  • Compliance with Legal or Regulatory Requirements: Your Personal Information may be processed when such processing is necessary to comply with applicable laws and regulations. For example, we consider that the processing of your Personal Information is required to fulfill our legal obligations pertaining comply with sanction law and regulations or any other laws or regulations that apply.
  • Contract performance: Your Personal Information will be processed when such processing is necessary to perform our services that you requested us to provide by using our application in line with the terms of use.

You will be free to withhold requested Personal Information from us even if you started the use of the application, already. However, if you withhold specific information, we may not be able to provide the relevant functionality in the application, if we require the relevant information to support the functionality. For example, your employer may require checking your whereabouts when you check in to a flight, which requires us to access your geolocation information. If this is not provided to us, the functionality is not available.

We do not currently use any automatic decision making or profiling in support of the application services.

Because we are a global business, we may process your Personal Information within the CAE group of companies (including our controlled subsidiaries and joint ventures) which are in different geographic locations. Also, some functionalities require the transfer of specific Personal Information. Your information may be shared internally and transferred externally if the conditions below are met.

Export your schedule

Crew Access provides you with the option to download your schedule as a PDF file or as a standardized ICS file to import into your own calendar at your discretion.

Within CAE

Your Personal Information may be shared internally with certain members of the application and technical support team, customer services team and other individuals who have a “need to know” your information for their official duties.

Given that some CAE employees who need access to your Personal Information may not be based in the same country as you, any such transfers within the CAE group of companies will be covered by an intra-group agreement which gives specific contractual protections to ensure that your Personal Information receives an adequate and consistent level of protection wherever it is shared or transferred within CAE.

Third-party service providers, insurers and professional advisors

We may also transfer your Personal Information to third-parties who process information on our behalf, such as IT service providers that store data on our behalf. If this is necessary for our exercise or defense of legal claims, we may also share your Personal Information with our insurers or professional advisors. Any such transfer is based on appropriate contracts to protect your Personal Information in compliance with applicable laws.

We may also share or disclose aggregated and anonymous data, (that is, not tied to individual users), to third-parties, for analytical purposes.

Public authorities

We may also share your Personal Information to the extent that we are required by law, with certain public authorities such as law enforcement or professional or regulatory authorities.

International data transfers

Given that some parties we share your Personal Information with may not be in the same jurisdiction as you, all such transfers are subject to the following conditions:

  • we will transfer Personal Information to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights; or
  • transfers to service providers and other third parties we will be (1) subject to a Privacy Impact Assessment, Transfer Risk Assessment, Vendor Security Risk Assessment or other risk assessment designed to mitigate risks and (2) protected by contractual commitments (such as the European Commission-approved Standard Contractual Clauses) or other legally acceptable mechanisms that ensure an adequate level of protection.

Any requests for information we receive from foreign law enforcement or regulators will be carefully checked before Personal Information is disclosed.

Consent

Except as otherwise mentioned herein, CAE will not transfer, sell or disclose your Personal Information to any third-party without your consent.

CAE is committed to ensuring that your Personal Information is processed securely and accessible only by authorized persons. We have internal policies and controls in place to prevent your Personal Information from being lost, accidentally destroyed, misused, unintentionally disclosed, or accessed other than by our employees or third parties contracted by CAE. We also provide mandatory training to CAE employees to raise awareness of our policies and procedures designed to manage information security threats. CAE has in place cybersecurity and privacy incident response plans.

Nonetheless, some third parties may try to access our systems or intercept transmissions or communications unlawfully. CAE continuously uses reasonable measures in line with recognized security standards to protect your Personal Information, but we cannot absolutely guarantee that unlawful actions will not occur.

The longer that Personal Information is retained, the higher the likelihood is of accidental disclosure, loss, theft and/or information growing stale (rendering it inaccurate). At CAE, your Personal Information is retained for no longer than necessary to support the business purpose for which it was collected or to comply with applicable laws. Afterwards all Personal Information will be deleted or anonymized as applicable. CAE periodically reviews the need for certain Personal Information processed.

Crew Access allows you to access the information linked to your account for the purpose of viewing, updating that information and ensuring that it is accurate and complete.

Under certain circumstances and in accordance with applicable privacy and data protection laws, you may have the right to require us to:

  • provide you with further details on the use we make of your information;
  • provide you with a copy of information that we hold about you;
  • update any inaccuracies in the Personal Information we hold;
  • delete any Personal Information that we no longer have a lawful ground to use;
  • where processing is based on consent, to withdraw your consent so that we stop that particular processing;
  • object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and
  • restrict how we use your information whilst a complaint is being investigated.

If you believe that the processing of your Personal Information is not compliant with applicable privacy and data protection laws or if CAE does not respond to your requests in a timely or adequate manner and in compliance with applicable laws, you have the right to lodge a complaint with the data protection authority or court. We ask that you attempt to resolve any issues with us before lodging a complaint with any data protection authority. Please refer to “How to contact CAE” for more details.

If you have any questions about this Crew Access Privacy Statement or if you have questions or enquiries about how we handle your Personal Information, please contact us at:

CAE Inc.

Attention: Global Ethics, Compliance and Privacy Office

8585 Cote-de-Liesse

Saint-Laurent, Québec

H4T 1G6 Canada

Telephone: 1-(514) 341-6780 (Extension 3824)

Email: [email protected]

EU/EEA representative

In the event that Personal Information is processed by a CAE entity which is not established in the European Economic Area (EEA) covered by the EU General Data Protection Regulation, our EU/EEA representative is:

CAE GmbH

Steinfurt 11

52222 Stolberg

Germany

UK representative

In the event that Personal Information is processed by a CAE entity which is not established in the United Kingdom is covered by the UK General Data Protection Regulation and the Data Protection Act 2018, our UK representative is:

CAE STS Ltd.

Innovation Drive, West Sussex

Burgess Hill RH15 9TW United Kingdom

The laws and regulations governing Personal Information are frequently changing. CAE may update and amend this Privacy Statement from time to time.

This Privacy Statement was last updated on February 10, 2025.