Privacy Policy of airBaltic Club Program

1 Introduction

“Air Baltic Corporation” AS takes care of the privacy of the data subjects and the protection of their personal data, observes the data subjects’ right to the lawfulness of the processing of personal data in accordance with the requirements of applicable EU and local laws in the field of privacy and data processing.

The purpose of Privacy Policy of airBaltic Club Program is to inform data subjects on personal data processing related to airBaltic Club. Privacy Policy of airBaltic Club Program is an integral part of Privacy Policy of airBaltic. In the Privacy Policy of airBaltic you may find more detail information about how passenger data are processed for flight purposes, information about cookies policy and other aspects of data processing. This Privacy Policy of airBaltic Club Program emphasis data processing aspects in particular within airBaltic Club Program.

The designations with the capital letters used herein correspond with the definitions of these designations provided in the  Privacy Policy and Program Terms & Conditions, unless defined otherwise herein.

2 Data controller

The company responsible for collection, use and disclosure of your personal data under this Privacy Policy is akciju sabiedrība “Air Baltic Corporation” with registration number 40003245752 and legal address Tehnikas iela 3, Lidosta “Rīga”, Mārupes novads, LV-1053, Latvia.

If you have questions about Privacy Policy of airBaltic Club Program, or if you would like to request  exercising any individual rights related to airBaltic Club, please contact  us via e-mail info@pins.co, or write to the postal address of airBaltic.

3 Purposes of processing your personal data and legal basis for processing

When using the airBaltic Club website or the airBaltic Club mobile application (airBaltic Club App), we may ask you to submit and we may process your personal data listed under Section 7 of this Privacy Policy, or offer to subscribe to newsletters or request feedback.

The legal basis for use of such personal data by airBaltic Club is to interact and engage with you when we:

• are preparing to enter into a contract with you on participation in airBaltic Club, including to ensure that your membership account operates;
• have a contractual relationship with you;
• pursue a legitimate interest to operate our business;
• comply with our legal obligations;
• for statistical purposes;
• improve our service, offers and airBaltic Club App, conducting surveys, based on our legitimate interest;
• provide you with marketing and promotional communications, when we have your consent or when it falls within our legitimate interest.

Submission of certain personal data is necessary for the purpose of identifying you, registering you in the airBaltic Club Program and creating your Member Account so that you could receive all services provided by airBaltic Club. It is not possible to become a member of airBaltic Club Program without providing personal data that allows your identification and the creation of your airBaltic Club Account. You are informed, which personal data is mandatory, when airBaltic Club requests such personal data from you.

The personal data you submit to the airBaltic Club website or the airBaltic Club App will be treated with utmost care and respect. airBaltic Club will use it to ensure operation of website or airBaltic Club App, to fulfill our obligations during the handling and administration of accrual and redemption of PINS points, to ensure your participation in airBaltic Club Program.

We may process your personal data as required for the purposes of marketing (informing on similar services based on legitimate interest, providing you with rights to object and sending any other commercial communication and offers (including third party offers), based on your consent), correctly identifying you, properly supplying services or goods to you, responding to your inquiries or contacting you, for proper operation of airBaltic Club Program, system testing, maintenance and development, customer relations and surveying.

We may process your data in case of reorganization, mergers or divisions, different acquisitions and/or transfer of liabilities, business and assets in full of partially, as well as within different legal proceedings, for example, legal protection proceeding, liquidation, insolvency proceeding. Additionally, in case of reorganization and/or acquisition and transfer of assets, liabilities and business, before such transaction client data base may be processed (accordingly, your personal data therein) with purpose to get acquainted with business transaction content and to evaluate its value. In any such case we will assess necessary scope of personal data with due care and will reduce personal data processing as much as possible to achieve the purpose and ensure appropriate protection of personal data, as well as conclusion of appropriate agreement with partner. We will inform you in cases if any of such transaction may impact our liabilities towards you or may involve transfer of your personal data to another company. Such processing may be based on law (for example, Commercial law) and legitimate interest.

4 Disclosure of personal data to third parties

For the above purposes, and subject to the airBaltic Club products or services that you have chosen within the airBaltic Club Program, we may disclose and transfer your personal data within the EU to our employees, airBaltic Club group companies or airBaltic Club Partners that provide the goods or services within the airBaltic Club Program or data processing companies working on airBaltic Club behalf.

In particular, we may disclose your personal data to:

• airBaltic employees responsible for customer service and processing of customer requests, as well as those employees who perform accounting, IT platform maintenance and data analytics functions, and emloyees, who ensure collaboration with Partners;
• airBaltic Club Partners in relation to accrual and/or redemption of PINS points with the respective Partner and in relation to services you have chosen to use from this Partner, including, value of transaction, confirmation on receipt of service, as well as in cases when sharing information is necessary to identify and/or prevent possible fraud transactions;
• credit institutions or other companies that may produce and deliver the airBaltic Club Cards;
• airBaltic Club award suppliers for the purpose of processing orders;
• airBaltic Club IT system suppliers, marketing and communications platform providers and airline reservation systems;
• the State Police and other public authorities upon the receipt of their formal notification, when the disclosure of such data is required under the law.
• persons, which provide IT systems, IT support, maintenance services and infrastructure, airBaltic Club application, web page maintenance services;
• other controllers that are part of a group of undertakings as far as it is necessary for legitimate interest to ensure internal administrative purposes;
• person, which ensure and provide support for conducting different surveys, partners conducting surveys on behalf of airBaltic Club or partners.
• consultants, revision inspectors, auditors, accountants, debt collectors, lawyers, when it is necessary to ensure organizational management and business activity;
• persons, which are involved in transactions of reorganization, acquisition and/or transfer of assets, liabilities and business, and any others, who provide support or consultations for preparation and execution of such transactions, as well as those, who are involved in evaluation of such transaction before it is commenced.
• Persons, which provide different type of support and services to airBaltic Club for administrative, organizational and financial management and business management purposes.

The Google Analytics tool provided by Google Inc. (a US company) has access to statistical data collected by that tool on airBaltic Club website or airBaltic Club App. Google Inc. has informed that they are relying on Standard Contractual Clauses to ensure that data subject rights are protected, when and if transferred to USA. Contractual obligations to ensure privacy are also applied to this provider, which you may read here: www.google.com.

We may disclose your data to marketing service providers, for example, companies which provide consultations on marketing, IT solutions for marketing needs, service providers, which ensures solution for sending newsletters, offers and information (Mailchimp service provider, Rocket Science Group LLC service provider, which data centres are located outside European Union in United States of America, information on privacy protection measures are available at: https://mailchimp.com/legal/privacy/.

5 Profiling and website browsing statistics

We may compile data on the usage, traffic volumes, transactions and other related statistics of airBaltic Club website and airBaltic Club App and we may process and analyse such data. We may also acquire such data on aggregate levels from reputable third parties or disclose such data to them. However, such data is not assigned to any particular person, nor shall it be de-compiled or reduced to personal data or other information regarding any particular person.

airBaltic Club collects this data by using an automated tool called Google Analytics. This allows airBaltic Club to record and analyse how visitors use the website. You can learn more about how Google Analytics works and the information it allows us to collect and analyse here - support.google.com.

You may at any time disable collection of your data by Google Analytics, as described here - tools.google.com.

6 Surveys and profiling

Taking into account that it is important for us that you receive the service and loyalty program in a good quality, we may conduct surveys from time to time in order to understand how satisfied you are with our service, loyalty program and service of our loyalty program partners, as well as surveys, in which we may ask you different questions in order to understand your interests and needs.

The participation in surveys are always voluntary. You have always rights to change your mind if you do not want to participate in the surveys.

We may receive your data from surveys you participate. We may conduct surveys by ourselves or survey results may be shared with us by our partners. However, if partner is going to share the survey results with us, we are requesting partner to obtain your consent or to inform you if the sharing is based on legitimate interest. It is important for us that you are informed and in control of how your data are processed and shared concerning surveys.

Surveys’ data results we may use for profiling purposes based on your consent or legitimate interest. The survey results may help us to understand in what areas and offers you might be interested in, as well as to understand your needs - thus improving our loyalty program and make it more interesting and suitable for you. Beside mentioned, you may receive direct marketing communication from us based on the answers you have provided in a survey. In such a way we want you to know about great offers and opportunities which might be interesting and suitable for you.

Nevertheless, please, be informed that you have always rights to withdrawn any consent you have given, as well as to object when processing is based on legitimate interest. If you do not want that survey results are stored or otherwise profiled and processed by us, please, let us know, by writing message to the following contacts available at our website:  www.pinsforme.com/contact-us

7 Direct marketing communications

In order to present offers and services that we believe are of particular interest to you, airBaltic Club may use your personal data, such as geographic location data (only for airBaltic Club APP), date of birth, language, gender and your contact information, survey data (if you have agreed to participate in a surveys), for marketing and communication purposes. You can opt out or withdrawal consent from receiving these marketing communications at any time.

airBaltic Club will provide you information about activities, offers and news regarding the use of airBaltic Club Program, including offers of airBaltic Club Partners, if you have consented on receiving such offers or if we are entitled to provide you with such offers, based on legitimate interest.

8 The categories of data

airBaltic Club may collect and process the following information:

8.1. Basic information about the member

• Name
• Phone number
• Postal address
• E-mail address
• Date of birth
• Language
• Gender
• Number of persons in the airBaltic Club Members Collective Account
• Geographic location data (on the basis of your device settings – only relating to airBaltic Club Application)

8.2. airBaltic Club membership information

• airBaltic Club membership start date
• User ID and password
• Membership number
• airBaltic Club card type
• Information about the financial institution of the airBaltic Club payment card or other type of airBaltic Club
• Membership level
• airBaltic Club members online identification
• Other airBaltic Club members information (e.g. membership of the airline, the data belonging to a member of the staff of the partner)

8.3. airBaltic Club card usage information

• The amount of airBaltic Club (cumulative data)
• Information about badges entitling the holder to purchase events, such as the place of purchase and date of receipt of the final sum (category or product level), receipt number, method of payment, purchases made for the airBaltic Club
• Information on the use of airBaltic Club, such as airBaltic Club Partner, redeemed product, etc.

8.4. Marketing and communications data

• Prohibitions or permissions to send marketing notifications;
• Member newsletters and ordered correspondence statements;
• Marketing applied by the data, such as data measurement for mail with details of the opening.

8.5. Survey data

Personal data you have provided within the survey.  This may include your opinions, information about your family, household, education, employments, habits, needs, grocery shopping, insurance, financial institutions, mobile service providers, vehicles, your interests, hobbies and other information you have provided within the survey.

9 Access to information

You have a right to request a confirmation from us to whether or not your data is being processed, where and for what purpose. We will provide a copy of the personal data, free of charge, in an electronic format.

We will provide all personal data concerning you, which you have provided to airBaltic Club, in a structured, commonly used and machine-readable format and you can transmit those data to another loyalty company without hindrance from airBaltic Club to which the personal data have been provided.

10 Information correction and deletion

If you believe that the information, we have about you is incorrect, do not hesitate to contact us, so we can update it and keep it accurate. Any data that is no longer needed for purposes mentioned in this Privacy Policy of airBaltic Club will be deleted.

If you wish to terminate your membership in airBaltic Club Program, you can request it according to the airBaltic Club Program Terms & Conditions, and we will close your Account and delete all your personal data related to airBaltic Club and airBaltic Club Account (please, note, that data about your fights still may be kept according to provisions of Privacy Policy of airBaltic), cease further dissemination of the data, and request third parties to stop processing of your personal data. We may choose to store your personal data also after the termination of your membership for a limited amount of time in the light of our legal position and obligations (such as to protect our legitimate interest and legal rights to the enforcement of the airBaltic Club Program Terms & Conditions, applicable statutes of limitations, litigation or regulatory investigations).

11 Other rights

In addition to the aforementioned rights You also have the rights, more details on your rights you may find in our Privacy Policy of airBaltic, including to

1. withdraw consent at any time, where applicable;
2. lodge a complaint with a supervisory authorityof the EU country of your habitual residence or the place of the alleged infringement. Contact information for these authorities can be accessed at ec.europa.eu. Data Protection authority of Republic of Latvia is Data Inspectorate of Republic of Latvia.

You may exercise your rights in line with the requirements of applicable EU and local laws.

12 Cookies

Cookies are small text files sent from a web server (such as that of www.pinsforme.com) to your browser whenever you visit a website. They are either saved or rejected, depending on your browser settings.

Saved cookies allow servers to identify your computer. This means that during return visits and when using password-protected areas of the website, you can avoid the hassle of repeatedly entering the same data.

In short, cookies make it easier to browse websites which require manual data input.

The legal basis for the use of cookies is airBaltic` legitimate interest in ensuring the technical functionality of its website.  We use cookies to help shape our website and streamline the user experience. By using cookies, we hope to be able to improve our Internet services according to your and our other customers’ preferences. We respect your privacy and are committed to protect your Personal Data. We have taken such measures as we have reasonably seen appropriate in each case to ensure the confidentiality, integrity and accuracy of your Personal Data. When we use cookies to remember your choices or for statistical purposes we will obtain your prior consent. This consent may be revoked at any time. Cookies are placed and used by Google Analytics tool.

Please be advised that enabling cookies is recommended for the best user experience and full site functionality. Nonetheless, cookies can be disabled via your browser settings, if you wish, or  by visiting here:

• google.com
• youronlinechoices.com

13 Security

We offer very high security against loss, misuse and unauthorized access to your personal data and payment details. airBaltic Club App keeps all your personal information in the device secure password management system (keychain for iOS, user preferences for Android). Processing and data transfer between airBaltic Club App and our server is secured using Transport Layer Security (TLS) protocol. Processing and data transfer between your web browser and our server is secured using 128 b Secure Sockets Layer (SSL).

14 Links to third party websites

Please be aware that this Privacy Policy applies only to the airBaltic Club website and the airBaltic Club App. Since our website and the App may contain links to other websites, we advise you to consult the Privacy Policies of these websites prior to submitting any personal data to them. We cannot be held responsible for any data shared when visiting other websites.

15 Use by children

Where our services are provided to a child and consent is relied on as the basis for the lawful processing of his or her data, consent must be given or authorised by a person with parental responsibility for the child. This requirement applies to children under the age of 16 (unless the national law provides for a lower age limit). When your legal guardian is giving consent on registering your membership with airbaltic Club Program, we may ask your legal guardian to identify themselves by entering name and surname during registration process. We store such data for period of time as long as your membership is active, because we should be able to prove that your legal guardian consented to registering of your member account and consented to your participation in airBaltic Club Program.

16. Conclusion provisions It is important for us to improve and develop our activity, so it is possible that time to time we may unilaterally amend and supplement this Confidentiality policy. The Confidentiality policy is available at our webpage. Therefore, please, follow up time to time and get acquainted with the topical Confidentiality policy. We will inform you on substantial changes of this policy, unless such changes intends to prevent grammatical or technical errors that do not affect the essence of the policy.