Privacy Statement – FlowControl

In this Privacy Statement, we explain how we handle the processing of your personal data and what rights you have.

A. Who are we?

FlowControl is an internally developed tool of Koninklijke Luchtvaart Maatschappij N.V. (“KLM”), having its registered office at Amsterdamseweg 55, 1182 GP Amstelveen, the Netherlands. FlowControl is used for the management of freight invoices and rates.

KLM acts as the data controller for the personal data processed within FlowControl.

B. Personal data we collect

We may collect and process the following personal data of you:

(i) Information we collect in order to use FlowControl

When you use FlowControl, we process personal data necessary to provide you with access to the system and to enable you to review and manage freight invoices and rates. This includes your first name, last name, email address, company and region. These data are retained for the duration of your account. This information is used to create and manage your accounts and to determine the appropriate access to FlowControl. After your account has ended, this data may be retained where necessary to comply with applicable legal obligations, statutory retention periods or applicable limitation periods.

(ii) Your actions within FlowControl

When you use FlowControl, we record your actions, approvals and rejections in an audit trail. This may include information about which user performed an action, submitted or reviewed an item, or approved or rejected a freight invoice or rate. This data is retained for as long as necessary to maintain an accurate and complete record of the actions taken within FlowControl. Following the end of your user account, this audit trail information continues to be retained where necessary to comply with applicable legal obligations or to establish, exercise or defend legal claims.

C. The legal basis for which we process your personal data

We may only process your personal data if there is a valid reason for doing so. This is referred to as the ‘legal basis’. These are the legal bases on which we process personal data within FlowControl:

• the processing is necessary for the purposes of KLM’s legitimate interests, including managing and performing its commercial agreements, accurately reviewing and managing freight invoices and rates, and maintaining a reliable audit trail of actions taken by users; and
• the processing of personal data is necessary to comply with a legal obligation to which we are subject, such as financial recordkeeping and audit requirements.

D. Purpose for what we process personal data

We use the information you have provided to us to:

• Manage and audit freight invoices and rates, including ad hoc rates;
• Ensure accurate billing and payments;
• Maintain a reliable audit trail of your actions, submissions, approvals and rejections within FlowControl.

E. Transfer of personal data outside the EEA

FlowControl is hosted on Google Cloud using services configured to store data within the European Union. Where Google or another service provider may access personal data from outside the EEA, KLM has implemented appropriate safeguards in accordance with the GDPR, which may include the European Commission’s Standard Contractual Clauses.

F. Retention period of the personal data

We do not retain your personal data longer than necessary. When a user leaves, their FlowControl account is deactivated, and the account can also be removed from the database. However, information showing who performed an action, submitted an item, or approved or rejected something may need to be retained in the audit trail, even after the related account has been deleted, where necessary for audit, compliance, financial administration or the establishment, exercise or defence of legal claims.

G. Your rights

In accordance with the applicable regulations, in particular the GDPR, you can contact KLM (see section below) to exercise their rights to (a) access, (b) rectification, (c) erasure, (d) restriction of processing, (e) data portability and (f) object.

a) Right to access

You have the right to request confirmation that KLM processes their personal data and, if so, to receive a copy of it, together with additional information such as the purposes of the processing and the categories of personal data concerned.

b) Right to rectification

You have the right to request the rectification of their personal data if it is inaccurate, or to have incomplete personal data completed.

c) Right to erasure

You have the right to request the erasure of their personal data. This right can only be exercised in certain cases, such as where the personal data is no longer necessary for the purposes for which it was collected. Where applicable, KLM may retain certain information, such as audit trail information, where this is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

d) Right to data portability

Where the processing is automated and based on consent or on the performance of a contract, you have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, and, where technically feasible, to have it transmitted directly to another controller.

e) Right to restriction of processing

You have the right to obtain the restriction of processing of their personal data in certain cases, for example where they dispute the accuracy of their personal data. This right does not result in erasure of the data. KLM will inform you before any restriction is lifted.

f) Right to object

You have the right to object to the processing of their personal data where this processing is based on KLM’s legitimate interest. If you exercise this right, KLM will no longer process their personal data for the relevant purpose, unless KLM demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Contact for the exercise of rights

You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

H. Protection of your information

KLM implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure or other forms of unlawful processing, taking into account the nature of the data and the risks associated with its processing.

I. Updating this privacy statement

This privacy statement is reviewed and updated from time to time. We will inform you of any changes before they take effect. This privacy statement takes effect on 23 September 2026.