XL Airways France
Personal data protection policy intended for users
This document constitutes the personal data protection policy (hereinafter the “Policy”) of XL Airways France. Based on our company’s desire for transparency, this policy has been drafted to be easily understandable and accessible and to express the commitments of XL Airways France under the European Regulation (EU) 2016/679 on personal data protection (hereinafter “RGPD/GDPR” or “GDPR”) as well as on the amended French Data Protection Act.
This personal data protection policy is intended for anyone who enters into a relationship with XL Airways France, which includes passengers who have purchased a travel ticket or anyone who has made a booking through our intermediary or by the intermediary of a third party (online or not travel agency, or tour operators, etc.) as well as anyone visiting our websites or using our mobile services and applications (hereinafter “User”). The Policy is accessible via various means which are made available to natural persons by XL Airways France to enter into a relationship with the company (websites, applications, or mobile services, etc.).
This Policy is likely to evolve, so please consult it regularly.
As the organisation of your flight with XL Airways France may have been preceded by contacts with facilitators who collected and processed data, especially if you have made a booking through a travel agency, a third-party website or a tour operator, please contact them directly to find out about their personal data processing policy or direct any requests concerning the processing of your personal data to them.
Thus, we collect and process data, documents and information in order to fulfil lawful, explicit and legitimate objectives and purposes, according to loyal processes in the context of managing the customer relationship and making contact, with a view to providing transport services and additional services and this, in compliance with the rules applicable to our specific business activity.
Therefore, as part of the processing we perform:
- We make sure we indicate whether the requirement for the provision of personal data by you is of a regulatory nature or a contractual nature or if this provision affects the conclusion of a contract;
- We make sure we indicate whether the person concerned is required to provide such personal data or if it is optional and we inform you of any consequences that there may be for the person concerned by not providing these data;
- When this is the case, we make sure we indicate the existence of automated decision-making including profiling. To this end, we provide you in such a case on the one hand, with useful information concerning the reasoning underlying this computerised decision and on the other hand, we provide information as to its importance and expected consequences of this potential processing for the person concerned;
- When this is the case, we make sure we indicate our intention to the person concerned to carry out further processing of personal data for purposes other than that for which the personal data were originally collected. We therefore provide prior information about the other purpose and any other information allowing its comprehension in a transparent way;
- We communicate restricted data concerning our customers and contacts and only to authorised recipients. These may be competent departments of XL Airways France as well as experts, subcontractors and partners involved in the provision of the services, as well as the airport authorities or the public authorities empowered to receive communication of personal data in the framework of applicable law;
- We undertake to ensure the transparency of data processing and collection by providing people with adequate information in all cases of the collection or receipt of data, when the data are transmitted directly by the persons or are transmitted to us by third parties or when they are collected using technology;
- We undertake to
- minimise processing,
- ensure the regular updating of data,
- proceed to a proportionate retention of data according to criteria determined in particular in the light of the purpose of the processing, contractual or operational requirements or to meet our regulatory obligations according to applicable law,
- take into account the rules governing commercial solicitations by email and telephone,
- oversee relations with partners and subcontractors by all means to ensure our legal obligations are complied with,
- in the case of the transfer of data destined for a country located outside of the European Union, to take all possible measures, in accordance with RGPD/GDPR requirements, ensuring compliance with the applicable regulations in Europe. In fact, XL Airways France uses providers providing services including from or in countries outside of the territory of the European Union,
- make our collaborators aware of the personal data protection and confidentiality requirement,
- ensure data and processing security,
- take into account all the rights recognised to natural persons under the applicable regulations.
Within XL Airways France, the principles and requirements of the right to the protection of personal data is accompanied by organisational and technical measures in order to concretely apply the provisions of GDPR. XL Airways France is willing to provide you with any further information or clarifications on this subject.
II. The processing of personal data is based on situations clearly identified according to your relationship with XL Airways France
XL Airways France processes personal data for the purposes of external information or communication intended for anyone who wants to know more about our activities or be informed over time. This includes managing operations related to our event activities, managing newsletters and the organisation of our activities on social networks.
XL Airways France processes personal data for the purposes of:
i. Managing bookings for passengers, issuing travel tickets, implementing air transport contracts and additional associated services (choice of seat, purchase of a specific meal-tray, taking out insurance, downloading the services application provided by our partners allowing access to an on-board entertainment offer). We process data electronically for the purpose of enabling the conclusion of the Contract of Carriage and must have the identification data in order to record them in the Passenger Name Records (PNR) containing the information concerned (passenger identity, contact information, ticket price, trip route/s and date/s). According to the regulations applicable to travel, XL Airways France must also collect the main information contained on the travel documents (for example: passport or identity card number, date and country of issuance, expiry date, passenger nationality)..
ii. As an air carrier, communicating to the French administration, passengers’ reservation, check-in and boarding data (API-PNR France, Article L.232-7 of the French internal security Code, modalities and purposes of processing set by Decree 2014-1095 of September 26, 2014 changed by decree 2018/714 of September 3, 2018; https://pnr.gouv.fr )
iii. As an air carrier, communicating to the entitled authorities of certain countries of destination, or of overflight, or of transit, passengers’ reservation, check-in and boarding data, required by the Regulation of the relevant country;
iv. Transmitting the relevant information to the air carriers which operate flights with an XL Airways France flight number.
v. Collecting sums which are due to XL Airways France or its partners, to combat payment fraud;
vi. Ensuring the follow-up of your relationship with XL Airways France and its partners to provide a better service (such as your location in the terminal); in order to provide information in the case of a flight irregularity/ies, in order to collect the opinions of the people on the quality of our services to improve them, in order to manage requests or to provide an after-sales service;
vii. Ensuring communication with the relatives of passengers in the event of an emergency, to provide you with the necessary assistance due to your physical condition or still further in order to provide the necessary care in the event of a health problem on-board our flights;
viii. Fulfilling our legal obligations with regard to the authorities of the departure, destination, transit and overflight country and necessary for the implementation of the Contract of Carriage.
XL Airways France processes personal data for the purposes of enabling you to manage your data within a dedicated account, accessible online, placed under your control with credentials that you must keep confidential.
Generally, in the context of managing and monitoring the relationship with our customers, personal data are processed by XL Airways France for the purposes of:
i. Offering products and services similar to those that you have already contracted with the company or different services and products when you have consented to receive other commercial solicitations;
ii. Facilitating the subscription of the Contract of Carriage by air when making a booking or selecting additional services allowing you to go back to your order when interrupted while placing it;
iii. Communicating good deals to you corresponding to your requests, to take into account your participation in games-contest or promotional actions, as well as loyalty schemes;
iv. Ensuring the achievement of operations of administrative nature related to managing the commercial relationship, including accounting, compiling statistics, managing unpaid debts and amicable or legal disputes, managing security incidents and managing rights relating to personal data.
XL Airways France processes data in the context of implementing websites accessible at the addresses www.xl.com/fr; www.xl.com/us, www.xl.com/en, as well as in the context of mobile sites or applications that can be downloaded from the Apple® Store and Android® Store (hereinafter the “Sites”). Data processing is mainly for the purpose of enabling XL Airways France to understand the uses of websites by its visitors and customers and to offer customised use, allow access to the user’s personal account and offer on-board services of entertainment.
Cookies and trackers: When visiting the Sites, cookies or tracker technologies are likely to be put in place automatically within the User’s web browser software and be stored in the terminal used. There are traditionally three types of cookies: browser cookies, statistics/audience measurement cookies and advertising cookies. Browser cookies allow services to be provided to users of Sites when placed there as well as during subsequent visits. The cookie file may in particular contain information such as the user’s ID to facilitate the use of certain features (filling of mandatory fields, passwords, etc.) or just Site browsing information (pages consulted, date and time of the consultation, etc.). The cookie cannot contain any personal identifying information and only allows XL Airways France to better understand visits to its site to improve content or contain information. The User can refuse the presence of cookies via the settings of the browser software that they use. In order to understand the possible settings, the User is invited to consult the instructional explanations proposed by the French supervisory authority, the National Commission for Information Technology and Civil Liberties: http://www.cnil.fr.
III. XL Airways France undertakes to examine any request concerning the rights resulting from RGPD/GDPR
Accordingly, natural persons have a set of rights that apply on a case by case basis considering the circumstances of the processing and their relationship with XL Airways France. These rights are:
- The right of access which allows you to obtain confirmation that personal data concerning you are or are not processed and, when they are the subject of processing, the possibility of obtaining access to the data,
- The right to rectification which allows you to demand the rectification of personal data when they are inaccurate and, taking into account the purposes of the processing, the right to demand that the data are complete, including by providing an additional declaration,
- The right to the erasure of personal data when certain grounds are met,
- The right not to be the subject of prospecting including by email or telephone,
- The right to restrict the processing of data when certain conditions are met.
You also have the right to introduce a request addressed to a supervisory authority, in particular if you believe you haven’t been given satisfaction after having exercised your rights with XL Airways France.
IV. How to exercise your rights with XL Airways France? How to contact us about our personal data protection policy?
XL Airways France undertakes to examine any request received from the individuals concerned in order to make our commitment to transparency effective and facilitate the exercise of the rights recognised by GDPR. We will endeavour to provide answers to your questions in a concise, transparent, comprehensible and easily accessible way, in clear and simple terms.
In addition, you can contact us at any time to find out more about the processing of your data, as well as on the application of RGPD/GDPR, the French Data Protection Act as amended and the application of this Policy. The information will be provided in writing or by other means, including by electronic means if appropriate or if your request is submitted in this form.
If you ask, the information may be provided orally, provided that your identity is proven by other means.
Requests relating to your rights and/or on the processing that we perform, on the application of RGPD/GDPR, the French Data Protection Act as amended and the application of this Policy as well as any question relating to personal data can be sent, as you wish, in writing or verbally, by using the following contact information so that we can respond in a timely manner:
By post to:
XL Airways France S.A.
BP1360 – 95 727 Aéroport Charles de Gaulle Cedex (France)
Or by email to: firstname.lastname@example.org
Or by using the section “Need Help” – By email available at the bottom of our website’s home page.
You may be asked to provide information or supporting documents to prove your identity.
XL Airways France having designated a Data Protection Officer (DPD/DPO), you may take contact with the latter for any question related to the processing of your personal data and to the exercise of your rights resulting from RGPD/GDPR. You may ask for our DPO’s contact details by contacting XL Airways France by letter, by email (email@example.com) or by using the “Need Help” section of our website.