Data processing: Baggage

Schiphol Nederland B.V. ('Schiphol') is committed to protecting your privacy. In this privacy statement, we explain how we handle your data that we process in the baggage process.

What personal data do we process?

If you are travelling at Schiphol with checked baggage, we process information about your baggage. Your piece of luggage will receive a unique barcode. This is linked to your name, your flight details, and possibly your frequent flyer number. We scan this barcode during the process with (manual) scanners and AI cameras.

Why do we process your personal data?

Flow
We process your data on behalf of the airline with which you have an agreement. Your data is processed to ensure a smooth flow of baggage. This is done, among other things, when forwarding (routing), sorting and (if necessary) temporarily storing the baggage.

Legal basis: necessary for the performance of the contract with your airline.

Screening
We also have a legal obligation to screen baggage. In this way, we ensure that no hazardous substances or prohibited substances end up on board the aircraft. For this screening, we process personal data if it is necessary to link your suitcase to you.

Legal basis: necessary to comply with our legal obligation.

How long do we retain your personal data?

Your personal data will be deleted within three days of the departure of your flight.

Who do we share your personal data with?

To enable a smooth flow of your baggage, we may share data about the progress of your baggage with the airline you are flying with.

In addition, suppliers of the baggage systems (hardware and software) process personal data on our behalf to ensure that the systems continue to work properly.

In case the Royal Netherlands Marechaussee or Dutch Customs wants to know who owns a piece of baggage, they will contact the airline you are flying with. Schiphol does not provide this information.

What are your rights?

Access to and deletion of your personal data
You have the right to know what personal data Schiphol processes about you.

You can also request that we delete personal data and stop using it.

Restriction of processing. If you feel that we are not processing your data correctly, you can request that the processing be restricted.

Right to transfer your data. You can also ask us to transmit your digital personal data to you or to another party in a readable and usable form.

Your request and our response.
Do you have a question or request? Please email our Data Protection Officer (DPO) via dpo@schiphol.nl. We strive to respond to your request in a timely manner.

If necessary to confirm your identity, we may ask you to send a copy of a valid proof of identity. You can find out how to make a safe copy on the website of the Dutch government.

If we do not find your request clear, we may ask you to specify and/or supplement your request so that we can provide you with the best possible service.

Filing a complaint with the Dutch Data Protection Authority?

If you are not satisfied with the way we handle your privacy or the handling of your request, you can file a complaint with the Dutch Data Protection Authority.

Who is the data controller?

Schiphol Nederland B.V. is responsible for the security screening via the baggage screening.

Schiphol Nederland B.V. is the processor on behalf of the airlines for sorting, routing and storing your baggage to ensure that the baggage reaches you again after your flight.

This privacy statement is from Schiphol Nederland B.V. Our contact details:
Schiphol Nederland B.V.
P.O. Box 7501
1118 ZG Schiphol

How can you contact us?
Do you have any questions or requests regarding your data? Then email the DPO via dpo@schiphol.nl or send a letter to our postal address, for the attention of the Data Protection Officer. Please provide your name, address, e-mail address and telephone number with your request.

Where can you find the latest version of this privacy statement?

If necessary, we will update this privacy statement. This may be due to changes in policies, changes in data processing operations or changes in the systems we use to process personal data.

This version is from January 2025.