Privacy Policy 

Introduction

The Gerald R. Ford International Airport Authority (the "Authority" or "We") respects your privacy and is committed to protecting it through our compliance with this policy.

This policy describes the types of personal information we may collect from you or that you may provide when you visit the website https://www.grr.org/ and www.flyford.org (our "Website") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to personal information we collect:

• On this Website.
• In email, text, and other electronic messages between you and this Website.
• Through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website.
• When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this policy.

It does not apply to information collected by:

• Us, offline or through any other means, including on any other website operated by the Authority or any third party (including our affiliates and subsidiaries); or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or on the Website.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not wish to have your information processed as described in this policy, your choice is not to use our Website. This policy may change from time to time (see Changes to Our Privacy Policy). We encourage you to check the policy periodically for updates.

Children Under the Age of 13

Our Website is not intended for children under 13 years of age. No one under age 13 may provide any personal information to or on the Website. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Website or through any of its features, or provide any information about yourself to us, including your name, address, telephone number, email address. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at gfiainfo@grr.org.

Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Website, including information:

• By which you may be personally identified, such as name, postal address, e-mail address, telephone number, or any other identifier by which you may be contacted online or offline ("personal information");
• That is about you but individually does not identify you, and/or
• About your internet connection, the equipment you use to access our Website, and usage details.

We collect this information:

• Directly from you when you provide it to us.
• Automatically as you navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
• From third parties, for example, our business partners.

Information You Provide to Us

The information we collect on or through our Website may include:

• Information that you provide by filling in forms on our Website. We may also ask you for information when you report a problem with our Website.
• Your email address, when you subscribe to our email newsletters.
• Records and copies of your correspondence (including email addresses), if you contact us.
• Your responses to surveys that we might ask you to complete for research purposes.
• Your search queries on the Website.
• If you are a Gerald R. Ford International Airport employee or contractor, when you make an appointment to obtain an ID badge.
• Information you provide to our third-party vendor when you report a lost item.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
• Information about your computer and internet connection, including your IP address, operating system, browser type, device identifiers, and unique user IDs assigned by analytics or advertising services.
• Behavioral interaction data, such as clicks, page scrolls, time on page, conversion events, and referring URLs.

We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). The information we collect automatically may include personal information, or we may maintain it or associate it with personal information we collect in other ways or receive from third parties. This helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to:

• Analyze Website traffic and user engagement.
• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Website according to your individual interests, e.g., by enabling advertising retargeting through Google Analytics.
• Speed up your searches.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. We use both essential cookies (which are necessary for the Website to function properly) and non-essential cookies (which are used for analytics and advertising purposes, such as Google Analytics). We will only place non-essential cookies on your device after you have provided your consent through our cookie consent banner. You may refuse to accept non-essential cookies by declining cookie placement via the cookie consent banner shown to you on your first visit to the Website. You may also activate the appropriate setting on your browser to refuse all or some cookies. However, if you refuse all cookies, some parts of our Website may be inaccessible or not function properly. You may update your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our Website.
• Web Beacons. Pages of our Website, and our e-mails, may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Authority, for example, to count users who have visited those pages, or opened an email, and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Do Not Track Signals and Global Privacy Control

Some web browsers have a “Do Not Track” feature that lets you tell websites you visit that you do not want to have your online activities tracked. Our Website does not currently respond to “Do Not Track” signals. We do, however, honor Global Privacy Control (“GPC”) signals, which we process as a request to opt out of our disclosure of your personal information for the purpose of targeted advertising. You may also disable certain tracking as discussed in the Choices About How We Use and Disclose Your Information section below.

Third-Party Collections, Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on the Website are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. For instance, our Website incorporates third-party analytics and advertising technologies, including Google Analytics, that may transmit certain personal information to such third parties.

Certain third-party technologies used on our Website may enable tracking of your activity across multiple devices when you are logged into associated services. This cross-device tracking allows advertisers to deliver more relevant advertising based on your combined activity across devices.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can manage your cookie and advertising preferences, see Choices About How We Use and Disclose Your Information.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”), provided by Google, Inc. ("Google"), on certain portions of our Website. The purpose of reCAPTCHA is to keep our Website as secure as possible by checking whether data that enters our system – for example, through a web form – is provided by a human individual as opposed to spamming software or other robot. To make this determination for this purpose, reCAPTCHA collects and reviews various aspects of the Website user's activity. This assessment automatically begins when a user enters the Website. For the purpose of confirming human activity, reCAPTCHA assesses various information that it collects – including, without limitation, IP address, browser information cursor activity, and time spent on the Site. reCAPTCHA will also place an additional cookie in your browser upon its assessment of your activity and take a snapshot of your browser window. Data collected during the analysis is forwarded to Google.

Please note that the reCAPTCHA collection, assessment, and other processing runs completely in the background. While reCAPTCHA processing is noted for our users here, Website users are not informed that an analysis is taking place when it occurs. As opposed to former CAPTCHA versions, which required website visitors to identify images, solve puzzles, or check a box, reCAPTCHA assesses and scores user input for human origin without any such affirmative behavior from the user.

Our goal in using the reCAPTCHA tool on the Website is to protect it and our services from bots, spam, and other such unapproved and potentially malicious activity. If you want to prevent any data about you and your behavior to be transmitted to Google, you must log out of Google and delete all Google cookies before visiting our Website or using the reCAPTCHA software. Please visit the following page to obtain more information about reCAPTCHA: https://developers.google.com/recaptcha/. Additional information on Google reCAPTCHA appears at https://cloud.google.com/security/products/recaptcha. Google's general privacy policy is here: https://policies.google.com/privacy?hl=en-US.

Parking Information

We offer a parking reservation service through a third-party vendor, Aero Parker. We do not collect your personal information through this service, but our vendor does. For more information on Aero Parker and its privacy practices, see https://www.aeroparker.com/ and its posted privacy policy here.

Badging Information

In the event that you use our Website to make an appointment for ID badging purposes, your associated information will be collected through a third-party vendor, acuity:scheduling. For more information about acuity:scheduling and its privacy practices, see https://www.acuityscheduling.com/ and its posted privacy policy here.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Website and its contents to you.
• To provide you with information or services that you request from us, including our email newsletters, in addition to correspondence about other products or services in which you may be interested.
• To analyze website traffic and user engagement through analytics services, including Google Analytics.
• To facilitate digital advertising, including targeted advertising, using services such as HubSpot and Google Analytics.
• To fulfill any other purpose for which you provide it.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us.
• To notify you about changes to our Website or any services we offer or provide though it.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

We may also use your information to contact you about our own and third-parties' services that may be of interest to you, but only where you have provided your consent or where we have another lawful basis for doing so. For more information, see Choices About How We Use and Disclose Your Information.

We may use the information we have collected from you to enable us to display advertisements to our advertisers' target audiences. Even though we do not disclose your personal information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• To service providers such as Google LLC and Hubspot, Inc. for analytics and advertising purposes.
• To third parties to market their products or services to you, but only with your prior consent. We will not share your personal information for third-party marketing purposes unless you have affirmatively opted in to such disclosures. We contractually require these third parties to keep personal information confidential and use it only for the purposes for which we disclose it to them. For more information, see Choices About How We Use and Disclose Your Information.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our terms of use (www.grr.org/terms-of-use) and other agreements.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Authority, our customers, or others.

Public Records

The Authority is a public body subject to Michigan’s Freedom of Information Act (MCL 15.231 et seq.). This means that certain records maintained by the Authority, including records containing personal information, may be subject to disclosure in response to a public records request. However, Michigan law provides certain exemptions from disclosure, including for information of a personal nature where disclosure would constitute a clearly unwarranted invasion of an individual’s privacy (MCL 15.243(1)(a)). The Authority will assert applicable exemptions to protect personal information where permitted by law, but we cannot guarantee that information you provide will be exempt from disclosure under all circumstances.

Security-Sensitive Information

Certain information collected by or on behalf of the Authority in connection with airport security operations may constitute Sensitive Security Information (SSI) governed by federal Transportation Security Administration regulations (49 CFR Part 1520). The collection, use, maintenance, and disclosure of such information is governed by those federal regulations and applicable federal law, not by this privacy policy.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of information and the purpose for which it was collected. For example, we may retain correspondence for a longer period if needed to respond to ongoing inquiries or for legal compliance purposes. As a public body, we are also subject to record retention requirements under Michigan law and, where applicable, federal law. When personal information is no longer needed for any of these purposes, we will securely dispose of it in accordance with our records retention policies.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Website may then be inaccessible or not function properly.

• Cookie Preferences. When you first visit our Website, you may be presented with a cookie consent banner that allows you to accept or decline non-essential cookies, including those used for analytics and advertising (such as Google Analytics). You may update your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our Website.
• Email Newsletters. If you provide us with your email address in order to subscribe to our email newsletters, you may opt-out any time by clicking “unsubscribe” at the bottom of the email.
• Disclosure of Your Information for Third-Party Advertising. We will not share your personal information with unaffiliated or non-agent third parties for their promotional purposes unless you have provided your prior consent. If you have previously consented and wish to withdraw that consent, you may do so at any time by sending us an email with your request to gfiainfo@grr.org.
• Targeted Advertising. We will only use information that we collect or that you provide to us to deliver targeted advertisements according to our advertisers' target-audience preferences if you have provided your prior consent through our cookie consent banner for the placement of advertising cookies. If you have previously consented and wish to withdraw that consent, you may do so at any time by updating your cookie preferences through the “Cookie Settings” link in the footer of our Website or by emailing gfiainfo@grr.org.
• Google Analytics. We will only place Google Analytics cookies on your device with your prior consent. You may withdraw your consent at any time by updating your cookie preferences through the “Cookie Settings” link in the footer of our Website. In addition, you may opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout.

We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with additional ways to manage how your information is collected or used. For example, you can manage your preferences with members of the Network Advertising Initiative ("NAI") on the NAI's website.

Data Security

We have implemented reasonable physical and cyber security measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page with a notice that the privacy policy has been updated on the Website home page. If we make material changes to how we treat our users' personal information, we will provide notice through a notice on the Website home page. The date the privacy policy was last revised is identified at the top of the page. You are responsible for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information

To ask questions, comment, or register a complaint or concern about this privacy policy and our privacy practices, contact us at:

Email address: gfiainfo@grr.org.

or via our phone number: (616) 233-6000.

Supplemental Notice for Canada, EEA, and UK Residents

This supplemental privacy policy ("Canada, EEA & UK Notice") provides Canada, European Economic Area ("EEA") and United Kingdom (“UK”)-based individuals additional information required by the Canadian privacy laws, the EU General Data Protection Regulation, and the UK General Data Protection Regulation. These provisions, together with the statements in the above general Privacy Policy ("Privacy Policy"), set forth our practices and reasons for processing your personal information with regard to Canada, EEA and UK personal data. For Canada, EEA and UK individuals, if there is a conflict between this supplemental Notice and the Privacy Policy, this Notice governs. Certain capitalized terms used but not defined in this Notice shall have the meanings set forth in our Privacy Policy.

To ask questions, comment, or register a complaint or concern about this privacy policy and our privacy practices, contact us as follows:

Privacy Contact: Emma Pawlowski

Email: epawlowski@grr.org

or via our phone number, (616) 233-6000.

Legal basis and purposes for data processing (EEA and UK):

We only process personal information when we have a legal basis for the processing or have your consent to do so. Specifically, we will only process your personal information in connection with one or more of the following bases:

• With your consent.
• For the reason you provided it to us, including to provide any services requested or evaluate your employment candidacy.
• To further our legitimate interests. Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. Our legitimate interests include: (i) analyzing and improving our Website and services; (ii) preventing fraud, security threats, and misuse of our Website; (iii) marketing and promoting our services to existing users; and (iv) administrative purposes such as maintaining records and responding to inquiries. You have the right to object to processing based on legitimate interests, as described below.
• To perform a contract between you and us.
• To satisfy an applicable legal requirement.
• To serve the public interest, such as processing in response to a governmental request.

Legal basis for data processing (Canada):

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), the primary legal basis for our collection, use, and disclosure of your personal information is your consent. By providing us with your personal information or by using our website, applications, or services, you consent to our collection, use, and disclosure of your personal information for the purposes identified in our Privacy Policy and this Notice. We will obtain your express consent for sensitive personal information, and we may rely on implied consent where appropriate and permitted by law. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. In limited circumstances, we may collect, use, or disclose your personal information without your consent where permitted or required by PIPEDA, such as to comply with a subpoena, warrant, or court order, or for the detection and prevention of fraud.

Automated decision making and profiling:

We do not make automated decisions about you or engage in data profiling.

Personal information requirements:

To engage with our services, website, or applications, you may be required to provide certain personal information to enable us to perform the services. Where this is the case, you will be provided with information regarding which data elements are required.

Cookies and Other Tracking Technologies (EEA, UK, and Canada):

In addition to the cookies and tracking technologies described in the Privacy Policy, if you are located in the EEA, UK, or Canada, we will only place non-essential cookies and similar tracking technologies on your device with your prior consent. For EEA and UK residents, this is required under applicable EU member state ePrivacy laws and the UK Privacy and Electronic Communications Regulations (PECR). For Canadian residents, this is consistent with the Office of the Privacy Commissioner of Canada’s guidance on meaningful consent. You may manage or withdraw your cookie consent at any time through our cookie consent tool or your browser settings; withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal.

Your rights:

If you are a resident of the EEA or UK, you have the following rights under the GDPR and UK GDPR, as applicable, with respect to your personal information:

The right to access: You have the right to confirm whether we are processing your personal information and to request a copy of your personal information.

The right to rectification: You have the right to request that we correct any information that you believe is inaccurate. You also have the right to request that we complete information that you believe is incomplete.

The right to erasure: You have the right to request that we delete your personal information in certain circumstances, including where: (i) the information is no longer necessary for the purposes for which it was collected; (ii) you withdraw your consent (where consent was the legal basis for processing); (iii) you object to processing based on legitimate interests and there are no overriding legitimate grounds; (iv) the personal information has been unlawfully processed; or (v) deletion is required to comply with a legal obligation. Please note that this right is subject to certain exceptions, including where retention is necessary for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or for archiving purposes in the public interest. As a public body subject to Michigan law, we may be required to retain certain records for specified periods.

The right to restrict processing: You have the right to request that we limit the way we use your personal information in certain circumstances, including where: (i) you contest the accuracy of your personal information, for a period enabling us to verify its accuracy; (ii) the processing is unlawful and you oppose erasure and request restriction instead; (iii) we no longer need the personal information for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims; or (iv) you have objected to processing based on legitimate interests pending verification of whether our legitimate grounds override yours.

The right to object: You have the right to object to our processing of your personal information where we rely on legitimate interests as our legal basis, and you have an absolute right to object to processing of your personal information for direct marketing purposes at any time.

The right to data portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to have that information transmitted to another controller, where technically feasible.

The right to withdraw consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before your withdrawal.

The right regarding automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you.

The right to lodge a complaint: If you are located in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority. If you are located in the UK, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

If you are a resident of Canada, you have the following rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to your personal information:

The right to access: You have the right to request copies of your personal information. We may charge you a minor fee for this service.

The right to correction: You have the right to request that we correct any information that you believe is inaccurate or incomplete.

The right to withdraw consent: You have the right to withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we will cease collecting, using, or disclosing your personal information for the purposes to which you had consented, unless we have other legal grounds to continue processing. Please note that withdrawing consent may affect your ability to use certain features of our Website or receive certain services, such as email newsletters, personalized content, or services that require your personal information to function. Withdrawal of consent does not affect the lawfulness of processing carried out before your withdrawal.

The right to challenge compliance and complain: You have the right to challenge the Authority’s compliance with PIPEDA by contacting us at the Privacy Contact information above. We will investigate and respond to your challenge. You also have the right to file a complaint regarding our handling of your personal information with the Office of the Privacy Commissioner of Canada (OPC).

In addition, when we provide services or act as a data processor, we may receive your personal information from third parties as needed to provide our services.

To exercise these rights, please contact us at the e-mail or mailing address above. Note that for your protection, we may need to verify your identity before we can process your request.

International Transfers:

The Authority is based in the United States. Your personal information may be transferred to, stored at, or processed in the United States, or other countries that may not have equivalent privacy or data protection laws. For transfers of personal information out of the EEA, we generally rely on the European Commission-approved Standard Contractual Clauses. For transfers of personal information out of the UK, we generally rely on the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, as issued by the UK Information Commissioner’s Office, to help ensure that your personal information receives an adequate level of protection. For transfers of personal information from Canada, we take steps to ensure that your personal information receives a comparable level of protection as required under PIPEDA, including through contractual commitments with service providers to protect personal information in accordance with applicable privacy laws.

Data Retention:

Your personal information will be retained for as long as the information is needed for the purposes set forth in our Privacy Policy and this supplemental Notice, as well as for any additional period that may be required or permitted by law. The retention period depends on the purpose(s) for which the data was collected, how it is used, and applicable law. If we do not have a legal basis for retaining your information, we will delete it, as required by applicable law.