In accordance with the applicable regulations on the protection of personal data, in particular the provisions of the law “informatique et libertés” of 6 January 1978 as amended and the General Data Protection Regulation (Regulation EU 2016/679 known as “GDPR”), AIR FRANCE, acting as data controller, whose registered office is located at 45, rue de Paris - 95747 Roissy CDG Cedex, informs you that the information collected in Community of Doctors on Board (hereinafter, the “Community”) is the subject of personal data processing.

The categories of personal data that are collected under this Community are: • Identity (last name, first name(s), email address) • Information about your Flying Blue account • Medical specialty/specialties • Language(s) spoken • RPPS number, BIG or License + Expiry Date* • Copy of your diploma ^{* Expiry date is optional}

Data is collected and processed in order to allow you to voluntarily join a community of doctors and be identifiable on board in case of a passenger incident requiring a doctor. The data collected under the Community, as well as the documents to be attached, are necessary for the validation of your application to join the Community of Doctors on Board. In the absence of this data your request will be rejected.

The legal basis for the processing is your consent to be included in the list of voluntary doctors under the Community (Article 6.1.a of the GDPR).

AIR FRANCE retains the personal data of the members of the Community only for the time necessary for the fulfilment of the purposes pursued. The data is kept for the period of registration with the Community, (5 years), and up to 2 years after an intervention on board for insurance reasons.

The data collected by AIR FRANCE under the Community will only be accessible to AIR FRANCE and its authorised personnel. The data collected will also be shared with KLM (Koninklijke Luchtvaart Maatschappij N.V., whose registered office is Amsterdamseweg 55 Amstelveen, 1182 GP, Netherlands), member of the AIR FRANCE KLM group, to allow the pooling of data collected under the Community and to increase the number of doctors who can intervene in case of emergency on flights operated by the AIR FRANCE KLM group. AIR FRANCE may also provide data in order to respond to legal or regulatory requests, court decisions, subpoenas or legal proceedings, if compliance with the regulations in force requires it. Under no circumstances does AIR FRANCE sell or rent your personal data to third parties for their own activities.

In cases where transfers of personal data outside the European Union may take place, AIR FRANCE undertakes to ensure that the recipient is located in a country benefiting from an adequacy decision of the European Commission or that measures are put in place to ensure that the transferred data is adequately protected, in accordance with the provisions of the GDPR.

In accordance with the applicable regulations on the protection of personal data, you have the right to (a) access, (b) rectification, (c) erasure, (d) restriction of processing and (e) the right to data portability and (f) right to object. In addition, you have the right to define guidelines for the retention, deletion and provision of your personal data postmortem. a) The right of access You have the right to request confirmation that we are processing your personal data and, in this case, receive a copy of it. b) The right of rectification You have the right to request rectification of your personal data if you find that it is inaccurate. c) The right to erasure You have the right to request the erasure of your personal data. This right may only be exercised in certain cases where one of the grounds provided for in Article 17 of the GDPR applies. This may include, for example, personal data that would no longer be necessary for the purposes for which we collected it or that would have been the subject of unlawful processing. If you exercise this right and if one of the grounds is applicable at its request, we will erase your personal data as soon as possible. d) The right to restriction of processing You have the right to restrict the processing of your personal data. This means that we mark this data, if we do keep it, in order to temporarily suspend its processing. This right may be exercised for the reasons set out in Article 18 of the GDPR. This right does not give rise to its deletion and we are obliged to inform you before the limitation of the corresponding processing is lifted. e) The right to data portability You have the right to request the provision of personal data that you have directly communicated to us in a structured, commonly used and machine-readable format, if its processing is automated and based on the reception of your consent. This right does not apply to other legal bases for processing. Where appropriate and where technically possible, you may also request the transfer of this data directly to another data controller. f) The right to object You have the right to object to the processing of your personal data when the processing (i) has for legal basis the legitimate interest of AIR FRANCE or (ii) is carried out for prospecting purposes. If you wish to assert your rights, you can send a request to the AIR FRANCE Data Protection Department: AIR FRANCE Data Protection Officer/Délégué à la Protection des Données - ST.AJ IL 45, rue de Paris 95747 Roissy CDG Cedex France Email address:mail.data.protection@airfrance.frIn order to best process your request, we kindly ask you to accompany your request with the necessary elements for your identification (surname, first name, email) as well as any other information necessary to confirm your identity. In case of doubt about the identity of the applicant, a proof of identity may be requested. Applications shall be processed as soon as possible and in any case within one month of receipt of your application. If necessary, this period may be extended by two months, given the complexity and the number of requests we receive. In this case, you will be informed of this extension and the reasons for the postponement. If, after contacting AIR FRANCE and despite its efforts, you feel that your rights are not respected, you can also file a complaint with the French Data Protection Authority, the “Commission Nationale de l'Informatique et des Libertés” (CNIL).

AIR FRANCE reserves the right to modify or update this Privacy Policy. Any changes or updates will be effective immediately as soon as they are published on the Community's website.

This Privacy Policy is subject to French law, except as required by the law of any other country in which the data subject to the processing of personal data implemented within the framework of the Community resides.