Incident #8635E8 · 12 SEP 2026notable
Air Corsica rewrites resident-accreditation privacy terms and adds a full cookie section
The 'Corsican resident' accreditation section is restructured into a table with explicit purposes, legal bases (now legitimate interest instead of consent) and retention periods. Automated 2D-Doc reading of tax notices is added, with manual review by Tessi staff possible. A detailed cookie section, including targeted advertising cookies, and a data-breach notification section are added.
Taken from you
- Legal basis for resident accreditation changes from consent to the companies' legitimate interest
- Archived accreditation data now kept 5 years after the accreditation expires, rather than a flat 5 years
- Data may be shared with authorities for fraud and criminal-activity controls
- Detailed descriptions of ad-network and social-media button cookies are added; the old version already listed targeted advertising as a cookie purpose, with consent.
Won back
- Tax number no longer needs to be visible: applicants must mask it along with income details
- Cookie banner now offers a refuse button as visible as the accept button.
- For the resident accreditation process, the policy now states data is hosted and processed in the EU with no transfers outside it.
- Breach notification to CNIL within 72 hours, and to affected people when risk is high
- Resident accreditation retention is now set out per purpose, including at most three months for rights requests.
- The general rights list (section 5.2) now includes withdrawing consent and post-mortem directives. The resident-specific rights list no longer mentions them or portability.
Evidence · 4 of 4 quotes matched in source
Base légale : Intérêt légitime des Compagnies en exécution des conventions de délégation de service publique et en vue de l'utilisation par l'usager de son numéro d'accréditation+ inserted · ✓ matched in source
Lorsqu’un contrôle manuel est nécessaire, des intervenants TESSI, spécialement habilités et soumis à une obligation renforcée de confidentialité, accèdent aux données personnelles et les traitent.+ inserted · ✓ matched in source
Les données personnelles sont hébergées et traitées au sein de l’Union européenne et ne font l'objet d'aucun transfert en dehors de l'Union européenne.+ inserted · ✓ matched in source
Archived version ↗ · 5,800 words changed