PRIVACY POLICY

• When you visit our website or app: When you use our website or app, even if you have not registered, we may carry out some processing of personal data, although this will normally involve identifiers rather than identifying data as such. Essentially, this refers to the data captured through cookies, or the geolocation of the application, if you accept its use.
• When you register as a user: When you register as a user, you have some advantages, such as storing information so that you do not have to enter it again, access to all your bookings, customer service tickets, etc.
• When you make a booking: If you make a booking or contract an ancillary service or any other service or product that we offer on the website (for example: the purchase of a gift card), there are a series of processing activities linked to it that we need to carry out in order to perform the contract, regardless of whether the flight is for you or not. It is also possible that your booking is operated by another airline (codeshare or a flight marketed by Volotea but directly operated by others), which entails additional processing by other airlines.
• When you travel with us: When you fly with us, there are processing activities necessary in order to manage the flight (for example, check-in or boarding passes), and others that will depend on the situation of each passenger.
• When you contact us: Our customer service is at your disposal to carry out any procedure or resolve any doubt or incident you may have. To do this, it may need to carry out several data processing operations depending on the case. We will also process data if you contact us to exercise any data protection right.
• Megavolotea programme: This is our loyalty programme, which offers you exclusive benefits. However, it is an annual subscription programme, which can be contracted directly or during the booking process for a flight. Because of the way the programme is structured, the processing of certain specific data is also required, especially payment data, to ensure the proper management of the subscription and its annual renewal.
• Marketing and commercial communications: You can accept or object to receiving our offers or newsletters at different times in your relationship with us. Likewise, you can take part in opinion surveys, competitions or prize draws…
• Legal obligations and regulatory compliance: In certain cases, we must carry out processing in compliance with the law. Some examples of this would be data processing for billing, tax or air safety purposes.

We have implemented a drop-down system so that it is easier for you to find the information. However, if you have any questions about a specific processing activity, you can contact us through the form provided in the previous section or the one you will find below in the section on exercising data protection rights.

• Statistical analysis of website and app browsing

  What do we use your data for?

  To improve your experience every time you visit our website or app, we analyse how you interact with them: which pages you visit, which features you use most, or where technical errors may arise. All this helps us make the website and the app increasingly useful and easy to use.

  We may also use them for advertising purposes and may generate advertising profiles, but without any legal or similar effect (they are mainly used to show specific advertising).

  For more information about cookies, you can consult our Cookie Policy.

• Geolocation through the mobile app

  What do we use your data for?

  If you allow us to do so in your device settings, we can know where you are in order to offer you more useful information, such as personalising the departure airport to the nearest one when you make a search, or showing your location on the map. What is the legal basis? Your consent, which you give us through the permissions on your mobile device. You can disable it at any time from your phone settings.

  Who do we share them with?

These data are not shared with any third party, except with those providers who access them in a limited way to provide a service to us and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• User account management (registration, authentication and profile)

  What do we use your data for?

  When you create an account on our website or app, we use your data to give you access to your personal space: from there you can check your bookings, save your preferences, manage your user data and retrieve the information more quickly for your next bookings with us.

  To create your account, you only need to enter your email address and a password. It is not mandatory to add any more data to your profile, except where, as explained in this Privacy Policy, it is necessary due to the type of action or processing carried out.

  Other possible data to include in your profile may be:

  • Data of other people who usually travel with you. Bear in mind that in these cases you provide us with third-party data, so you must ensure that you have informed them before providing it or that you have their authorisation to book on their behalf. In any case, to create a “Volotea friend” we only need their first name and surname in order to add them as a passenger to your bookings more easily, but you can also include their contact details and/or travel documents if you wish.

  • Identification document details such as ID card or Passport, which are often requested by the authorities when carrying out international flights. We will never ask you for a photograph of the document. We do not check the validity of this information, so we recommend that you verify that you enter it correctly.

  • Payment methods you use regularly, to make future bookings easier for you without having to check your credit card each time or enter the details of any other payment platform, for example. Bear in mind that if you subscribe to the Megavolotea programme, the details of the payment method will be stored by default in your profile to ensure that we can process its renewal once it expires (in accordance with the content set out in the following section “Storage of payment method in user profile”).

  To contract Volotea services or products, it is not necessary for you to create an account.

• Likewise, you may delete your user account at any time.

  What is the legal basis?

  Your consent. Registering is completely voluntary, and by doing so you give us your permission to manage your account.

  Contractual obligation if you register in Megavolotea and did not previously have an account (see the section “Megavolotea Programme” for more information).

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide a service to us and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Registration and sign-in via social networks and other platforms

  What do we use your data for?

  To make registering more convenient, we give you the option to do it with your account from other services where you already have an account. When you choose this option, the relevant platform shares your basic profile details with us (usually your first name, surname and email address and, if you agree, your profile picture) so that we can identify you.

  You will always have to accept that said social network or platform shares the data with us, and you will be informed of the information they will share (as a rule, first name and surname and email address, never your social network password, since you will not need it to enter our website; you will always sign in with the social network you chose).

  What is the lawful basis?

  Your consent. You decide whether you want to use this method or register in the traditional way.

  Who do we share them with?

  The social network or platform provider you choose manages its own part independently, although in this case Volotea only receives the data you have authorised to share. On each sign-in request there will be a connection between our website and the social network to verify your identity.

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. Please refer to section 6 for more information on how we manage data with our service providers.

• Storage of payment method in user profile

  What do we use your data for?

  So that you do not have to enter your card details every time you want to buy, you can save them in your profile. This way, your next purchases will be much quicker. Your payment details are always stored securely. If you are a Megavolotea subscriber, your payment details are automatically stored in your user profile to manage your subscription renewals. Please note that you may ask us to delete them at any time.

  What is the lawful basis?

  Your consent if you are a registered user who chooses to save your payment method.

  If you are registering for our Megavolotea programme, we will retain this information as part of the performance of the contract since it is necessary to process automatic renewals. You may in any case request that this information be erased, although this will prevent any future renewal.

  Who do we share them with?

  We do not share your payment data with any third party except, depending on the payment method chosen, with our payment service providers, who are responsible for settling it, together with the transaction identification data.

  The processing of your card details or payment credentials is carried out directly by the payment provider, the relevant entity in each case if you choose third-party services, each acting as an independent data controller. We recommend that you review the privacy policy of the platform you use to find out how your payment data is handled.

  Likewise, these data may be accessed by providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Storage of identity documents in the user profile

  What do we use your data for?

  If you wish, you can save the details of your passport or identity document in your profile to speed up future bookings and the check-in process. As a general rule, this is an option intended for your convenience, not an obligation. You can delete these details at any time directly from your profile.

  What is the legal basis?

  Your express consent given by including that information in your profile.

  Who do we share them with?

  We do not share them with third parties, except when they are necessary to manage a booking that you have made. For example, if the country of origin or destination so requires, we may need to provide the relevant identification details and identity document data in order to comply with applicable law in those countries.

  Likewise, these data may be accessed by providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Booking management and performance of the transport contract

  What do we use your data for?

  When you buy a ticket from us, we need your data to confirm the booking, issue your ticket, assign your seat and manage any changes that may arise: modifications, cancellations or refunds.

  If you travel accompanied, or if you book on behalf of another person, we also need the details of all passengers in the booking. In these cases, you will be providing us with third-party data, so you must ensure that you have informed them before providing it, or that you have their authorisation to book on their behalf.

  Additionally, in some cases we will also carry out this processing, even if you have not booked directly with us. Some examples are bookings through travel agencies or internet aggregators (for more information we recommend that you review the section What type of personal data does Volotea collect?), or also when it concerns codeshare flights or flights operated by third parties (you have more information further on, in the corresponding section).

  In some destinations, especially outside the European Union or the European Economic Area, it may be necessary and mandatory for you to enter your passport details, if the immigration and entry laws of that country so require. Where applicable, we will inform you of this, and this information will be linked only to your booking, not to your user profile.

  What is the legal basis?

  Performance of the contract. Without these data, we would not be able to take you, your companions or the persons for whom you are booking, to the requested destination.

  If any applicable regulation obliges us to process additional data (for example, passport data under immigration regulations), such data will be processed due to a legal obligation.

  Who do we share them with?

  With handling agents at airports, airport authorities, the airlines with which we operate codeshare flights or the airlines that operate their own flights sold on our website, payment service providers (depending on the chosen method) and, where applicable, the travel agencies or internet aggregators through which you have booked.

  Likewise, these data may be accessed by providers who access them in a limited manner to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Flight and booking notifications

  What do we use your data for?

  We want you to always be informed about what happens with your flight. That is why we will send you notices by email or SMS about delays, cancellations, gate or terminal changes, timetable changes and any relevant incident. These communications are part of the service you have contracted, they are not advertising.

  If you have our APP, and have accepted receiving PUSH notifications (pop-up notifications from the mobile device you use), you may also receive them through it, although since it is directly linked to having an active data connection, we do not recommend relying on it alone, especially abroad.

  What is the legal basis?

  Performance of the contract. Informing you of what happens with your flight is one of our obligations. PUSH notifications are under your control at all times, so they will additionally be managed through your consent on your mobile device.

  Who do we share them with?

  These data are not shared with any third party, except for those providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Management of codeshare flights

  What do we use your data for?

  Some of our flights are operated in collaboration with other airlines under a codeshare agreement. This means that you may have bought your ticket from Volotea, but the flight is physically operated by another airline, or vice versa: the other airline sold the ticket, but we operate it.

  In both cases, it is essential to exchange your booking details with the airline operating the flight or with the airline with which the booking was made so that you can board without problems, receive your boarding pass and obtain the appropriate assistance throughout the journey.

  For our part, whenever you make bookings on our website for a flight to be operated by another airline, we will always inform you in advance.

  Why can we process them?

  Performance of the contract. The exchange of data between airlines on codeshare flights is an essential operational condition for the air transport service to be properly provided. Without it, it would not be possible to manage your boarding or guarantee the assistance you need.

  Who do we share them with?

  With the airline that operates or markets the flight, as applicable. That airline acts as the data controller for the data necessary for the operation of its flight or management of its booking, and has its own privacy policy, which we recommend that you consult.

  Likewise, these data may be accessed by providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Sale of flights on our website operated by third parties

  What do we use your data for?

  In certain cases, through our website you can purchase flights that are operated directly by other airlines, not by Volotea. In those situations, Volotea acts as an intermediary: we manage the booking and the payment, but the operating airline is the one that provides the air transport service and manages the relationship with you as a passenger.

  In order for you to take the flight you have purchased, it is necessary for us to transfer your booking details to that airline, which then becomes the data controller for everything relating to the performance of the flight.

  Each airline has its own privacy policy, and we recommend that you read it, as it governs how it will process your data as its passenger.

  Why can we process them?

  Performance of the contract. The transfer of your data to the operating airline is a necessary and essential condition for you to be able to take the flight you have purchased. We inform you of this before you confirm the purchase.

  With whom do we share them?

  With the operating airline for the flight, which will act as an independent controller for the provision of the transport service.

  Likewise, these data may be accessed by providers who access them in a limited way in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Gift card management (Gift Card)

  What do we use your data for?

  If you buy a Volotea gift card to give flights to another person, we process your data to process the payment, issue the card to you and, if you provide us with the recipient's email address, send it directly to them. When the recipient uses the card to book a flight, their data will be processed as described in the booking management processing. If you are the person receiving a gift card from someone else, we use your email address to send it to you and then manage its redemption.

  Why can we process them?

  Performance of the contract for payment processing and card issuance; legitimate interest for sending it to the recipient, if different from the person who contracts it, whose email the purchaser provides to us solely for the purpose of delivering the gift.

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Additional third-party services

  What do we use your data for?

  During the booking process, you can purchase some additional services, such as car hire at your destination or insurance to protect your trip. These products, although offered on our website, are marketed directly by the companies that offer them at any given time, in accordance with their own terms and conditions and privacy policies, which you will find in the information about each product.

  Volotea does not process any information linked to these services, beyond knowing that you have contracted them. For example, if you rent a car with us, although the price appears in the total of the booking, the service will be invoiced directly by the car rental company, and it is the one that will have all the details of this service.

  Why can we process them?

  We only process the information, within your booking, on the basis of performance of the contract. Please note that the companies offering the additional services may have their own privacy policies and legal bases.

  With whom do we share them?

  As a general rule, third-party companies offering services or products on our website collect the data directly from it. The information transmitted is only what is necessary for the booking, such as your first and last names, contact details or booking number, so that they can link it.

  These data are not shared with any third party, except with those providers who access them in a limited way to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Check-in and identity verification

  What do we use your data for?

  For the proper management of your flight, we need to process your personal data in order to facilitate the check-in process, issue your boarding pass (digital or physical), verify your identity as a passenger and check that you meet the travel requirements of your destination: valid documentation, passports, etc.

  What is the legal basis?

  Performance of the contract; legal obligation as regards the documentary checks required of us by the authorities and border control.

  With whom do we share them?

  With ground handling agents at airports (or airport handling staff), the authorities, and boarding control systems.

  Likewise, service providers who have limited access to this data to provide us with a service and with whom we have a contract may also access it. See section 6 for more information on how we handle data with our service providers.

• Management of special assistance and medical needs

  What do we use your data for?

  If you need any kind of special assistance for your flight — wheelchair, help boarding and disembarking, other needs arising from a disability or medical condition —, we use the data you provide to coordinate the necessary assistance both at the airport and during the flight. Your comfort and safety are our priority.

  This information is not requested during booking; instead, you must provide it directly to our customer care department (who will contact you if you selected the special needs option during the booking process).

  What is the legal basis?

  Performance of the contract and your explicit consent for the health data you provide us.

  Who do we share it with?

  With ground handling agents at airports (or airport handling staff) or airport assistance services, the airport medical service and the cabin crew, as required in each case.

  Likewise, service providers who have limited access to this data to provide us with a service and with whom we have a contract may also access it. See section 6 for more information on how we handle data with our service providers.

• Baggage management

  What do we use your data for?

  When you check in baggage, we use your data to register and manage your baggage throughout the journey. If for any reason your baggage is delayed, lost or arrives damaged, that information allows us to handle the incident and process your claim appropriately.

  What is the legal basis?

  Performance of the contract; legal obligation.

  Who do we share them with?

  With airport ground handling agents (or airport handling staff), baggage tracking systems and, in the case of connections, with the other airlines involved.

  Likewise, these data may be accessed by providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we handle data with our service providers.

• Management of onboard services

  What do we use your data for?

  On board our aircraft, you have access to certain onboard services, such as onboard entertainment or Wi-Fi and any others we may add in the future. To access the service, you only need to create a quick account with your email address and a password. That data is used solely to manage your access to entertainment during the flight.

  What is the lawful basis?

  Performance of the contract. You request the service and register in order to use it.

  Who do we share them with?

  These data are not shared with any third party, except with those providers who access them on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Multichannel customer service

  What do we use your data for?

  Whenever you contact us - by email, online forms, phone, chat or social media - we use your data so that we can respond to you and help you as best as possible.

  We may also process them when you ask us to exercise any data protection right, by contacting us via the following email address: dataprotection.officer@volotea.com.

  What is the lawful basis?

  Legitimate interest in properly assisting our users who contact us when there is no relationship between us; performance of the contract when your enquiry is related to a booking or service you have contracted; legal obligation when your request is linked to the exercise of a right granted to you by the applicable regulations.

  With whom do we share them?

  As a general rule, we do not share your data with any third party, except for outsourced customer service providers with whom we have contracts to ensure compliance with the regulations and protect your information. However, certain enquiries or incidents may require us to do so with third parties involved or interested (for example, with the baggage handling provider in the case of lost baggage, or with other airlines in codeshare cases, etc.). Please see section 6 for more information on how we handle data with our service providers.

• Call recording for customer service

  What do we use your data for?

  When you call us by phone, we inform you at the beginning of the call that it may be recorded. Recordings allow us to resolve your enquiry correctly, improve the quality of our customer service, train our team better and, if necessary, have evidence should any discrepancy arise.

  What is the lawful basis?

  Legitimate interest. We understand that documenting conversations benefits both you, because we can verify what was said, and us.

  Performance of the contract: when your enquiry is related to a booking or service you have contracted and some details are handled by phone (for example, if special assistance services are needed).

  With whom do we share them?

  We do not share them with any third party beyond the outsourced customer service providers with whom we have contracts to ensure compliance with the regulations and protect your information, and who have limited access solely to check certain information, although this information could be made available to the competent authorities.

  See section 6 for more information on how we handle data with our service providers.

• Management of claims, complaints and disputes

  What do we use your data for?

  If something has not gone as you expected - your flight was cancelled, delayed longer than expected, you were denied boarding or your baggage arrived damaged - we use the data from your claim to review it, give you a response and, where applicable, process the compensation or refund that may be due to you under the applicable regulations.

  What is the legal basis?

  Performance of the contract; legal obligation when the claim must be processed before competent bodies or authorities.

  Who do we share them with?

  Where applicable, competent authorities, alternative dispute resolution bodies (ADR) or courts and tribunals.

  Likewise, these data may be accessed by providers who access them in a limited way to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Megavolotea subscription management and access to benefits

  What do we use your data for?

  When you subscribe to Megavolotea or Megavolotea Plus, we use your data to enrol you in the programme, manage your user profile on the website (see the section “When you register as a user” for more information), ensure you have access to the benefits corresponding to your membership type and keep you informed of any relevant news about your subscription.

  For more information about Megavolotea or Megavolotea Plus, you can consult this link.

  What is the legal basis?

  Performance of the contract. By subscribing to Megavolotea, you establish a specific contractual relationship with Volotea that is distinct from that of a flight booking. This also affects the lawful basis for creating your user profile.

  Who do we share them with?

  This data is not shared with any third party, except for those providers who access it on a limited basis in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Billing and automatic renewal of the Megavolotea subscription

  What do we use your data for?

  To ensure that your Megavolotea subscription renews automatically when the date arrives without you having to do anything, we need to retain the details of your payment method. This is a necessary condition of the service.

  For more information about Megavolotea or Megavolotea Plus, you can consult this link.

  What is the legal basis?

  Performance of the contract. By subscribing, you agree that we keep your payment details for this purpose.

  Who do we share them with?

  With banking entities and the payment service provider (PSP), and with the fraud detection systems we use. Please note that when you use third-party payment methods, they may carry out other processing activities linked to payment and fraud prevention, so we recommend that you review their own terms and conditions.

  In addition, providers who access it on a limited basis in order to provide us with a service and with whom we have a contract may also access this data. See section 6 for more information on how we manage data with our service providers.

• Newsletter and commercial communications derived from a booking

  What do we use your data for?

  When you make a booking with us, we assume by default that you are interested in receiving information about offers, new routes or other Volotea news that may interest you, based on your profile. We may personalise those communications according to your purchase history so that they are as relevant to you as possible.

  With each booking you will have the option to object to them and, if at any time you no longer wish to receive these communications, you can easily unsubscribe from any of them.

  What is the lawful basis?

  Legitimate interest in sending commercial communications to customers who have already contracted similar services. We will always offer you the option to object at the time of contracting.

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. Please see section 6 for more information about how we manage data with our service providers.

• Newsletter and commercial communications with consent

  What do we use your data for?

  If you authorise us to do so, we will send you our newsletter with the latest offers, promotions, new routes and news from Volotea. You can subscribe during registration, in the booking process or at any time from your user profile or by browsing our website.

  What is the lawful basis?

  Your explicit consent. You can withdraw it at any time free of charge and easily by using the unsubscribe link included in each email we send you or by contacting us.

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. Please see section 6 for more information about how we manage data with our service providers.

• Satisfaction surveys and market research

  What do we use your data for?

  After your flight, or after a booking process or an interaction with us, we may send you a short questionnaire to find out how your experience with Volotea went. Your opinion is very valuable to us: it helps us understand what we do well and where we can improve. Answering is always completely voluntary.

  What is the lawful basis?

  Legitimate interest in sending the survey, and explicit consent if you respond (provided the survey is not anonymous). Improving our service based on passengers' real experience benefits us both.

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Personalised advertising on digital platforms and social networks

  What do we use your data for?

  To take advantage of new communication channels with users, such as social networks or other similar third-party services, we may process your data to send you commercial information on those social networks or services, for example:

  A) Retargeting

  When you browse our website or app and have accepted advertising cookies, we may show you Volotea adverts tailored to your activity. This includes, for example, reminding you of a flight search you started but did not complete, or showing you offers that may be of interest to you.

  B) Custom Audience or personalised audience

  If you are a registered Volotea user and have agreed to receive commercial communications, we may use your email address or phone number to show you Volotea advertising on third-party platforms such as social networks.

  What is the legal basis?

  Your consent, which you give us by accepting marketing cookies in our Cookie Policy. You can withdraw your consent at any time from the cookie preferences panel.

  On the other hand, for the purposes of the 'Custom audience', the applicable legal basis in relation to commercial communications applies. You may withdraw that consent at any time through our commercial communications opt-out channel.

  With whom do we share them?

  These data are not shared with any third party, except with those providers who access them in a limited way in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Contests, prize draws and promotions

  What do we use your data for?

  At Volotea, we like to organise contests, prize draws or promotional actions (hereinafter, "promotions") aimed at our users, both through our website or app and through social media or other channels.

  The specific conditions of each promotion, including detailed information on the processing of your personal data, will be set out in the legal terms of each action, which will be available before it starts and which you must read and accept in order to take part. These legal terms form an integral part of the privacy information and will complement what is described here or, where applicable, will replace and prevail over it.

  We also occasionally run actions to reward certain passengers for meeting specific conditions (for example, being the one millionth passenger to fly a particular route). In these cases, the conditions will be informed to the winner in advance, and the winner will be entirely free to accept them or not.

  What is the lawful basis?

  Managing your participation and, where applicable, delivering the prize is based on the performance of the legal relationship arising from your participation and therefore on contractual obligations.

  Likewise, in relation to those prizes that we decide to award to passengers who meet certain conditions at specific times, we process the data on the one hand on the basis of the contractual obligations arising from the booking from which we obtain the data, and on the basis of legitimate interest in order to be able to contact the winner and propose their acceptance of the corresponding prize and its conditions.

  If the award of the prize creates a tax obligation for Volotea, the processing of your tax data will be based on compliance with a legal obligation.

  Who do we share them with?

  As a general rule, we do not share your data with any third party, although there may be cases in which we must do so in order to deliver the prize, especially if it is a named prize and the person delivering it needs your data. See section 6 for more information on how we handle data with our service providers.

• Profiling for the personalisation of offers and communications

  What do we use your data for?

  So that the information we send you is as relevant to you as possible, we create a user profile based on data such as your booking history, your usual destinations, your searches on our website or app and the way you interact with our communications, if you receive them. This profile allows us to send you offers and recommendations that fit the way you travel - destinations you usually visit, seasons in which you fly, the type of fares you prefer - instead of identical communications for all customers. This profiling does not involve any automated decision that produces legal effects or affects you in a similar way.

  Why can we process them?

  Your express consent when profiling is based on analysis of your behaviour through marketing cookies, the acceptance of which you manage from our Cookies Policy; legitimate interest when the profile is created exclusively from data arising from the existing contractual relationship (purchase and flight history). In any case, you have the right to object to profiling or to withdraw your consent at any time.

  With whom do we share them?

  This data is not shared with any third party, except with those providers who access it in a limited way in order to provide us with a service and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Payment processing and fraud prevention

  What do we use your data for?

  To complete your booking, we process the payment data you provide us. In addition, we analyse certain transaction data to detect and prevent possible credit card fraud or attempts at unauthorised use. This protects us, but also you, by preventing fraudulent activity if someone has gained access to your payment data.

  What is the lawful basis?

  Performance of the contract for payment processing; legitimate interest for fraud prevention, since protecting payment security benefits everyone.

  With whom do we share them?

  With the banking entities and the payment service provider (PSP) and with the fraud detection systems we use. Please note that when you use third-party payment methods, they may carry out other processing activities linked to payment and fraud prevention, so we recommend that you review their own terms and conditions.

  Likewise, providers who access them in a limited way in order to provide us with a service and with whom we have a contract may also access this data. See section 6 for more information on how we manage data with our service providers.

• Transfer of data to security authorities

  What do we use your data for?

  European Union and other countries' aviation security regulations require us to share certain passenger data (Passenger Name Record - PNR) with the security and control authorities of the countries involved in your flight.

  What is the legal basis?

  A legal obligation established under aviation security regulations.

  Who do we share them with?

  With the security authorities established by each country in accordance with its own regulations.

  Also, data may be accessed by providers who access it in a limited way in order to provide a service to us and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Compliance with tax and accounting obligations

  What do we use your data for?

  Like any company, we are legally required to keep our accounts and retain records of all our transactions for a specified period. This includes data about the purchases you make with us.

  What is the legal basis?

  Legal obligation, in accordance with applicable commercial and tax regulations.

  Who do we share them with?

  With the competent tax authorities where applicable.

  Also, data may be accessed by providers who access it in a limited way in order to provide a service to us and with whom we have a contract. See section 6 for more information on how we manage data with our service providers.

• Disclosure of data to public authorities and law enforcement

  What do we use your data for?

  Sometimes, the competent authorities (state security forces and corps, aviation regulatory bodies, or other public administrations) may request information from us about certain passengers or flights. When such a request has legal basis, we are obliged to provide it.

  What is the legal basis?

  Legal obligation; public interest where applicable.

  With whom do we share them?

  Security forces and corps, Judges and Courts or competent authorities that request it.

  Likewise, providers who access them in a limited way to provide us with a service and with whom we have a contract may also access this data. See section 6 for more information on how we manage data with our service providers.

• Defence in judicial and administrative proceedings

  What do we use your data for?

  In certain circumstances, it may be necessary for Volotea to take part in a judicial or administrative proceeding - as claimant, defendant or in the context of an inspection by a regulatory body. In those cases, we may need to retain and use customer data as part of our defence or to exercise our rights.

  What is the legal basis?

  Legitimate interest in being able to exercise and defend our rights; legal obligation when the regulations require us to retain such data.

  With whom do we share them?

  With our internal and external legal advisers, the competent courts and tribunals and the relevant administrative authorities (AEPD, AESA, consumer bodies).

  Likewise, providers who access them in a limited way to provide us with a service and with whom we have a contract may also access this data. See section 6 for more information on how we manage data with our service providers.

• Processing of health data for public health reasons

  What do we use your data for?

  In exceptional situations such as pandemics or other health emergencies, public health authorities may require us to collect certain medical information from passengers (vaccination status, diagnostic test results, location forms, etc.) to control the spread of disease and protect everyone who travels. We only do so when the law or the competent health authorities require it, and we will inform you of this where applicable.

  What is the legal basis?

  As a general rule, public interest and reasons of public interest in the field of public health for health data; legal obligation when imposed by the competent authorities.

  In any case, this information may change from case to case.

  Who do we share it with?

  It will depend on the specific case or situation. Likewise, in the handling of previous cases, the information may have to be shared with national and international health authorities.

  Again, these are exceptional circumstances, which will be regulated as appropriate if they occur.

  Likewise, providers who have limited access to these data in order to provide us with a service and with whom we have a contract may also access them. See section 6 for more information on how we handle data with our service providers.