Data Processing Notice for Courier Applicants

What data we collect

When you apply to work as a freelance onboard courier, we may collect:

• your name
• contact details
• base location
• airport availability
• travel document information
• passport copy
• information related to your courier availability and previous experience

Why we collect this data

We use this information to review courier applications, check whether a courier profile matches future OBC assignments and contact applicants about possible courier work.

Passport data may be used only when it is needed for identity verification or for booking international or domestic flight tickets for confirmed assignments.

Legal basis for processing

We process courier applicant data on the following legal bases:

• Article 6(1)(b) GDPR — processing needed before entering into or performing a contract
• Article 6(1)(f) GDPR — Nova OBC's legitimate interest in reviewing and managing courier applications and assigning suitable couriers to confirmed OBC jobs

Data sharing

For confirmed assignments, relevant courier data (such as name and travel document details) may be shared with airlines, ticketing agents and other travel service providers where this is necessary to book flights or arrange travel.

We may also share data with trusted service providers who support our IT systems and business operations, and with professional advisers or public authorities where required by law or for the protection of legal rights.

We do not sell personal data.

Data storage and access

Courier applicant data is stored with restricted access. Only authorised Nova OBC team members may access this data when it is needed for courier selection, assignment planning, communication or ticket booking.

Passport copies are used only where necessary for confirmed courier work or related travel arrangements.

How long we keep the data

We keep courier applicant data while the courier profile remains active or while there is a practical reason to contact the applicant about future assignments.

If there is no activity for 12 months, the data may be deleted unless there is a legal or operational reason to keep it for longer.

You may also request deletion of your personal data at any time. Some data may need to be kept where required by law or for the protection of legal rights.

Your rights

You have the right to:

• access your personal data
• correct inaccurate personal data
• request deletion of your personal data
• object to processing based on legitimate interest
• request restriction of processing
• request data portability, where applicable
• lodge a complaint with a data protection authority