EU Addendum

This Addendum applies if you are based in the European Economic Area (the EEA) during your interactions with us (other than where you are in the EEA solely for travel purposes).

Processing of sensitive personal data

1. The European data protection law considers certain categories of personal data as particularly sensitive, which include data about racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.
2. When passengers request special assistance (e.g. medical assistance or special meal request) or require medical condition clearance before flying, we may collect sensitive personal data which may indicate their heath conditions or religious beliefs.
3. Where required by law, we will ask for you consent to process any sensitive personal data. You may withdraw your consent via our member service communication channel, but this may mean that we will not be able to facilitate your request.

Legal grounds for processing personal data

1. In compliance with our obligations under the European data protection law or the laws of the EU Member State in which you are based, we are required to identify the legal grounds for our use of your personal data, which we have set out in the table below. We have linked each purpose mentioned in section [4] of our Privacy Policy to the relevant legal grounds. For more details on each of the legal grounds : EU use bases table

   Purposes of the data processing	Legal grounds (The specified ground may vary depending on the specific processing activity and particular personal data being processed)
   To deliver our travel products and services [4(a)]	•   contract performance •   legitimate interests (to allow us to perform our obligations and provide services and products to you) For sensitive personal data •   consent
   To improve and personalise our products and services [4(b)]	•   contract performance •   legitimate interests (to allow us to improve the quality of our products and services and to provide tailored products and services to you) For sensitive personal data •   consent
   To communicate with you [4(c)]	•   contract performance •   legitimate interests (to allow us to correspond with you in connection with our services) For sensitive personal data •   consent
   To facilitate the FlyerBonus and/or Beyond Flying program [4(d)]	•   contract performance •   legitimate interests (to allow you to participate and enjoy the privileges of the frequent flyer program) For sensitive personal data •   consent
   For marketing [4(e)]	•   consent
   For safety and security purposes [4(f)]	•   legal obligation •   legal claims •   legitimate interests (to cooperate with law enforcement and regulatory authorities) For sensitive personal data •   legal claims •   vital interests •   substantial public interest •   public interest in area of public health
   To comply with legal or regulatory obligations [4(g)]	•   legal obligation •   legal claims •   legitimate interests (to cooperate with law enforcement and regulatory authorities) For sensitive personal data •   legal claims •   substantial public interest
   To ensure our websites and mobile application function properly [4(h)]	•   legitimate interests (to allow us to provide you with the content and services on the websites and mobile application)
   To reorganise or make changes to our business (4.1(g))	•   legitimate interests (in order to allow us to change our business)

Description of legal grounds for processing personal data

1. These are the legal grounds that justify our use of your personal data:

   Consent: Where you have consented to our use of your information (you will have been presented with a consent form in relation to any such use [by contacting us as set out in paragraph [6.3] of the Privacy Policy].

   Contract performance: Where your information is necessary to enter into or perform our contract with you.

   Legal obligation: Where we need to use your information to comply with our legal obligations.

   Legitimate interests: Where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.

   Legal claims: Where your information is necessary for us to defend, prosecute or make a claim against you, us or a third party.

2. These are the legal grounds that justify our use of sensitive personal data:

   Explicit consent: You have given your explicit consent to the processing of those personal data for one or more specified purposes. You are free to withdraw your consent [by contacting us in as set out in paragraph [6.3] of the Privacy Policy]. If you do so, we may be unable to provide a service that requires the use of such data.

   Legal claims: Where your information is necessary for us to establish, defend, prosecute or make a claim against you, us or a third party.

   In the substantial public interest: Processing is necessary for reasons of substantial public interest, on the basis of EU or local law.

   Vital interests: Processing is necessary to protect the vital interests of you or of another natural person where you are physically ore legally incapable of giving consent.

   Public interest in area of public health: Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health, on the basis of EU or local law.

Export outside the EEA

1. Where we transfer personal information from inside the European Economic Area (the EEA) to outside the EEA, we may be required to take specific additional measures to safeguard the relevant personal information. Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws and therefore no additional safeguards are required to export personal information to these jurisdictions. In countries which have not had these approvals (see the full list here http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm), we will establish legal grounds justifying such transfer, such as EU Commission-approved model contractual clauses, or other legal grounds permitted by applicable legal requirements.
2. Please contact us as set out in the “Your Rights and Contacting Us” section in the Privacy Policy if you would like to see a copy of the specific safeguards applied to the export of your personal data.

Your rights

1. In addition to the paragraph [6] of the Privacy Policy, in certain circumstances, you may have the rights under European data protection law to:
   1. Require us to provide you with further details on the use we make of your personal data;
   2. Require us to provide you with a copy of personal data that you have provided to us;
   3. Require us to update any inaccuracies in the personal data we hold;
   4. Require us to delete any personal data that we no longer have a lawful ground to use;
   5. Where processing is based on consent, withdraw your consent so that we stop that particular processing;
   6. Require us to transmit the personal data you have provided to us and we still hold about you to a third party electronically;
   7. Object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and
   8. Restrict how we use your personal data e.g. whilst a complaint is being investigated.
2. You may exercise these rights [by contacting us as set out in section [6.3] of the Privacy Policy]. Please note that we will not charge a fee when we deal with your requests in the exercise of these rights.
3. These rights are subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). We will aim to respond to requests within 30 days.
4. If we are unable to resolve an inquiry or a complaint, you have the right to contact the data protection regulator in the country in which you are based.