Privacy Policy

04 декабря 2020

Privacy Policy

January 01, 2021

Aviasales is a metasearch engine for flight tickets, hotels, and other services for travelers that is available through our websites and mobile apps (hereinafter “Aviasales”).

User privacy is important to us and we are doing whatever is required to protect it. In terms of Data Processing, we ensure your rights as Data Subjects and observe the regulations of the EU General Data Protection Regulation (“GDPR”), California Consumer Privacy Act (“CCPA”), and other applicable laws and rules. In this Policy, we aim to openly explain how we will possess your data and what processing standards we follow.

The present Policy includes the Cookie Policy, which is an integral part. The Policy is also closely related to the Terms of Use, where you can find information about Aviasales’ functionality as well as your rights and liabilities when using the service.

Pay close attention to this Policy. If you have any questions after reading this Policy or if you find any errors or inaccuracies, please contact us. Please describe your problem or question in detail so that we can quickly respond to it, help you, or correct the error and improve in the process.

We reserve the right to change this Policy if we make changes to our processing procedure or need to take newly-enacted Personal Data protection legislation into account. We’ll notify you in case of significant changes that may affect your interests, rights, and status. In spite of everything, we guarantee that the protection of your Personal Data is always legitimate and fair, and that your data is secure.

Key Terms

For starters, let us clarify some key terms that we use in this Policy to eliminate the possibility of misinterpretations.

Personal Data or Personal Information refers to any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute Personal Data, including an email address, identification number, device information, location data, or online identifiers, such as cookie files or similar technologies.

Data Processing refers to any operation or set of operations performed on Personal Data or on sets of Personal Data, whether by automated or non-automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction.

“You”, “your”, or “Data Subject” refers to a visitor to our websites, a subscriber to any service we offer through our websites, or prospective/existing clients communicating with us by email or otherwise.

Data Controller refers to a person who (either alone or jointly with other persons) determines the purposes for which, and the manner in which, any Personal Data is, or is to be, processed. In this policy, the Data Controller is Go Travel Un Limited, a Hong Kong corporation registered under the number 1658681 with a legal address at Suite 1504, 15/F, Chinachem Tower, 34-37 Connaught Rd Central, Hong Kong, doing business as Aviasales.

Data Processor, in relation to Personal Data, refers to any person (other than an employee of the Data Controller) who processes data on behalf of the Data Controller. We describe how we engage third parties that may process Personal Data on our behalf in Section 3 of this Policy.

Profiling refers to any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to Data Subjects. Profiling is done to analyze or predict aspects concerning that specific Data Subject’s preferences and interests while using a particular one of our services or websites.

Account refers to a section of our websites that is available to you after authorization (signing up) and gives you access to certain services and features, which improve your user experience, that may not be accessed without authorization.

Assisted Booking refers to the function of Aviasales to allow for the purchasing of airline tickets through a special interface by concluding an agreement with the travel service provider without leaving our website. The interface simplify filling of user data necessary for the booking (surname, name, passport data, contact data), which you uploaded to Aviasales earlier or when using the function for the first time.

We can use other terms and definitions as well, even if they’re not specified in this section, as long as they are set out in the applicable legislation or in our Terms of Use.

Data that we can collect and process on Aviasales

When you use our websites and their different features or contact us, we may process any data and information that you provide to us voluntarily, that is collected automatically, or that we receive from other sources.

Voluntarily provided data

This includes any information you provide to us yourself, such as information provided when you fill out a search form, subscribe to our marketing communications, enter your account information, send us a query or feedback, participate in discussion boards or other social media functions on Aviasales and marketing special project subdomains, complete promotions or surveys, or report a problem. We also may process data you provide to our partners, including airlines and OTA’s, while using Assisted Booking or making a booking after redirection.

Voluntarily provided data may include the following Personal Information:

  • Search data of available products on Aviasales, including travel dates and destinations;
  • Respective authentication data, including, for example, social network parameters and email addresses;
  • Your personal details and respective data of people who will accompany you on a trip if you proceed purchase using Assisted Booking;
  • Contact data entered by you in the input fields on the airline, hotel, or OTA website after redirection;
  • Other Personal Information contained in your queries and communications with us.

Automatically processed information

This mostly consists of online identifiers or technical facts about your connection point. For example, device and connectivity information, such as IP address (Internet Protocol), unique device identifiers (such as the IMEI for phones, MAC address of the device's wireless network interface), mobile network information, your mobile operating system, the type of browser you use, and time zone settings. Other types of configuration data include browser type, version, language settings, browser plug-in types, and browser versions.

This data is automatically collected when you visit our websites and/or using our service. In some cases, this data can be created by our software or third-party programs, integrated in Aviasales.

Automatically-collected data may include the following information:

  • IP-address and log information (such as error reports);
  • Geolocation (meaning country or region in terms of redirection to appropriate website version);
  • Device and browser information, including device locale and OS information;
  • Impersonalized booking data after redirection or use of Assisted Booking (meaning destination, dates, and prices);
  • Cookies and similar tracking technologies, including local storage data, statistics and analytics on the use of the service and its different functions, as well as interaction information (scrolling, clicks, timings, etc.).

You can find more information on cookies and similar technologies in our Cookie Policy.

Data received from third parties

This category includes different types of data, mostly online identifiers, which we receive from airlines, OTAs, GDS, as well as our technical, analytical, marketing, and other partners.

For example, we might insert advertising on our partner websites, social networks, or advertising networks that may categorize website visitors with similar characteristics or interests into non-personally-identifiable data segments and offer these segments to their own clients, visitors, and subscribers.

We might obtain and record information that an ad was requested or shown, how many times said ad was shown, the target geo of said ad (which will not include an IP address or specific personally-identifiable location information), and any user interactions with said ad or the page where it appears. This information is used for statistical purposes, analysis, reporting, and troubleshooting. In most situation of Data Processing such information doesn’t allow us to identify you as a Data Subject and we will process it with an appropriate level of protection and limitations, which the data source establishes.

The data that we don’t process

We don’t process data on children, as Aviasales is intended only for use by users over the age of 16 (or another age determined by applicable local laws allowing for the independent use of internet services like Aviasales). If you are under the specified age, you may only use Aviasales with the involvement of your holder of parental responsibility. We do not knowingly collect or process Personal Information from children below the specified age without the consent of the child's holder of parental responsibility. In case of doubt, we will close processing of questionable data and delete it.

We do not collect and process special categories of Personal Data and genetic data without your direct consent, such as your name, age, email, passport details (unless you subscribed to our marketing mailing, entered an Account, and use Assisted Booking), phone number, home address, etc.

We don’t process data that you’ve directly asked us to stop processing or opted out in any way possible.

We also don’t process your data gained by third parties on other platforms that you click out to from our website. For instance, by clicking on the ad banner, except for cases and particular data types directly mentioned in the Policy. Your Data Processing on third-party platforms is carried out according to the rules and processes set out by owners of those platforms.

Additional information on Data Processing

Please note that when you proceed with airline tickets or other travel services after redirection from our website to the provider carrying out the particular service, we do not acquire, store, transmit, or process any additional information except depersonalized information, such as prices, dates, destinations, and a transaction’s identifier. Whereas you may make a payment on the OTA’s or airline’s website using the Assisted Booking, we may process all the information you fill in, including your name, passport data, how many people will accompany you, and their respective details, in order to perform our obligations and reach stated purposes.

In providing Personal Data about other individuals (such as someone whose name you are using to enter an Account or subscribe to our marketing promotions), you represent that you have notified them of: (1) the grounds and purposes for which said information will be used (see below), (2) the recipients of their Personal Data, (3) and how they can access and correct this information. The consent that you give for a third person is considered by us to be the consent of said third person.

Email marketing. We believe that Aviasales’ users would like to get more information about the best deals on airline tickets, other travel products, and more. In addition, they’d like this information to meet the needs and interests of their own. Upon authorization in the Account or when using particular functions of the service, we offer you to subscribe to our marketing newsletter to receive such news and third-party ads. You can unsubscribe from direct marketing communications by email at any time by using the opt-out form in one of the received emails or by contacting our support team.

Profiling. It’s important for us to understand the Aviasales audience, including their needs and preferences, in order to make the service better and more convenient both in general and for each particular user. To achieve these goals, we can create profiles of our users based on the data collected in their interactions with Aviasales in order to provide our service in the best way possible or provide personalized ads and marketing communications if we’ve received your consent. In any case, we never use collected data to make automated decisions that significantly affect your interests or rights as a Data Subject.

Just to make sure, we never show our users different prices on the analogous services they may find using our metasearch and we never prohibit or block use of a particular function of Aviasales solely based on your online profile.

Grounds and purposes for Data Processing

Grounds for Data Processing

In this section of the Policy, we describe legal grounds and purposes for processing Personal Data in your interaction with Aviasales, related domains, or individual functions of our service which can be available on our travel network partners’ websites.

We process your data only if there are legal grounds to do so. When applicable, we receive your consent for Data Processing, which you provide through an explicit action, such as clicking a suitable consent-button or ticking the relevant box.

In other cases, data is processed (1) in your interest or to provide you with the relevant service or functionality of the Service according to the Terms, for instance, to provide search results or fix your problem, or (2) to email marketing information about Aviasales or our advertisers or (3) fulfill other contractual obligations.

Example: by transferring the relevant information about your chosen flight tickets to our partners, available in the search results, we fulfill our obligations to these partners to properly record booking and statistics on our side. Also, user data is processed in our legitimate interests, for example, to improve the performance of Aviasales or particular functions of the metasearch service, prevent fraud, data parsing, etc.

Purposes of Data Processing

Data Processing purposes are largely determined by Aviasales’ functionality and derive from grounds for Data Processing. Primarily, we strive towards improving our service and making your experience with Aviasales efficient, secure, convenient, and personalized. We also want you to always be updated about new functions, products, promo campaigns and special Aviasales projects. Other interesting and beneficial deals in the travel market and more. In addition, we have income by displaying third-party ads and can process data to track ad performance or select the ads that suit you most.

To make it more readable, we gathered all the grounds, potentially applicable purposes, and the data being processed on these grounds and for these purposes in the table below.

Data Category

Grounds

Purposes

Contact information (most often, an email address, sometimes name and social networks data)

Consent, fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and service, (2) necessary internal analytics and research of the service, (3) providing advertising information, (4) monitoring, accessing and using user-generated content

Data on searches

Fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, (2) necessary internal analytics and research of the service

Data on the Account

Consent, fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, (2) providing advertising information (3) monitoring, accessing and using user-generated content

Data on the device and browser

Fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, (2) necessary internal analytics and research of the service

Cookies and other online identifiers, including local storage data (find out more in our Cookie Policy)

Consent, fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, provision of advertising information, (2) necessary internal analytics and research of the service

Data on the use of functions of Aviasales

Fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, provision of advertising information, (2) necessary internal analytics and research of the service

Passport and other Personal Data for using the Assisted Booking function

Consent, fulfillment of obligations, legitimate interest

(1) Provision and personalization of functions and services, (2) necessary internal analytics and research of the service, (3) provision of advertising information

Data Processing conditions and principles

Confidentiality and security

We believe that confidentiality and the security of our users’ data is key to maintaining trusting long-term relationships with them. We are committed to protecting the Personal Data you share with us. We use a combination of industry-standard security technologies, procedures, and organizational measures to help protect your Personal Data from unauthorized access, use, or disclosure.

Data Processing performed in hosting provider services (storage and maintenance of databases containing your Personal Data, which are protected by password) is performed on our behalf under confidentiality agreements by our Data Processor Amazon Web Services, Inc. (“AWS”), which is part of a global organization of locally operating companies in a number of countries worldwide. All information is stored on AWS data centers in the United Kingdom. AWS participates in the EU-US Privacy Shield framework. Please find more information here.

We can recourse to the services of other data centers to store and support databases, depending on the region and DNS zone. In EU zone, for instance, we use servers in the Netherlands. In any case, our Data Processors will only act on behalf of our documented instructions and have direct responsibilities under the GDPR and our Data Processing agreements.

On Aviasales, we use the services of Data Processors, whose products and solutions are required for implementing functions of the website, analyzing and testing the site, profiling, email marketing, and supporting interactions with you. Providers of such services are carefully selected based on Aviasales’ specifics and ensure the safety of data at the appropriate level, according to the present policy. In most cases, such providers help us collect cookies and similar technologies. You can learn more about them in the Cookie Policy.

Data retention

Basically, we retain your Personal Information for as long as needed on the grounds of processing purposes. Terms may also differ for particular categories of Personal Information.

We also reserve the right to store various types of information (without any time limit) to use for analyzing our service performance, improving its functions, providing you services, and protecting the interests of Aviasales.

Meanwhile, we give you the opportunity to control and influence the time we store and process your data, as specified in Section 4 of the Policy.

Transferring Personal Data to third parties

We do not rent, sell, or share Personal Information about you with third parties or non-affiliated companies without your consent, except to provide services you've requested, when we have your permission, or under the following circumstances:

  • We provide information to trusted third parties, who provide us services and work on our behalf under confidentiality agreements. These companies may store, maintain, or process your data. These companies do not have any independent right to process this information.
  • We may disclose your information to third parties when we reasonably believe we are obligated to do so by law and/or in order to investigate, prevent, or take action regarding suspected or actual prohibited activities, including, but not limited to, fraud and situations involving potential threats to the physical safety of any person.
  • In the event we are acquired by or merge with a third party or undergo another change of control, we reserve the right to transfer information, including any personal identifiable information, to a successor entity.

We may disclose or otherwise allow others to access your Personal Information pursuant to a legal request, such as a subpoena, legal proceedings, search warrant, or court order, or in compliance with applicable laws, if we have a good faith belief that the law requires us to do so, with or without notice to you. Your details may also be disclosed to the police and law enforcement agencies for the purpose of fraud detection, crime prevention, and national security.

Your rights

GDPR application

If you are located in an EU territory, are an EU citizen, or GDPR applies to you on other applicable grounds, you have the following rights:

The right to be informed. In this Policy, we provide you with detailed information related to your Personal Data Processing.

The right to access information held about you. i.e., you may always get information about your data that we process.

The right to rectify your Personal Data if it is inaccurate, incomplete, or outdated.

The right to erasure (deletion or removal) of your Personal Data. The right to restrict (block) processing. When processing is restricted, we will continue to store your Personal Data, but not process it any further.

The right to data portability, which allows individuals to obtain and reuse their Personal Data for their own purposes across different services. This right allows users to easily move, copy, or transfer Personal Data from one IT environment to another in a safe and secure way, without hindrance to usability.

Rights related to automated decision-making, including profiling, as stated in Article 22 of GDPR. We are not making any decisions which might produce a legal effect on you based on automated processing without legal grounds.

The right to withdraw your consent (object) to direct marketing.

The right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint with your local supervisory authority if you have a concern about our processing practices.

СPPA application

In addition, users subject to CCPA have following rights in relation to the Personal Information that we hold about you:

Request to access information about the collection of your Personal Information by us, as well as request the deletion of your Personal Information.

You can exercise all of your above rights by contacting us.