You can request access to the information we hold about you, with some limited exceptions for example confidential information or trade secrets, internal drafts and memos. We will also inform you about:

• why we are processing the information.
• who we are sharing the information with and if any information is transferred to a country not deemed to have adequate safeguards in place to protect personal data.
• how long we will be keeping the information.
• the source of the information, if it was not collected directly from you; and
• if we are using the data for automated decision making or profiling.

If you make a request for a copy of the personal information that we are processing, we may need you to complete a questionnaire. Please be as specific as possible as this will help us to identify the information more quickly.

In general, we will provide this information to you within one month of your request. It may take longer than this if we need to wait for you to provide any requested information. In certain cases, we may need to extend the response period to three months.

If you feel that the information we hold about you is inaccurate, you can ask us to correct and update it. If we have shared the personal data with a third party, we will inform such third parties about the corrections.

You can also request that we erase information. Erasing might not always be possible. If doing so means we cannot perform our contract with the corporate customer, or we have a legal obligation or legitimate interest to keep the information. We will explain the consequences of erasing your information.

If you feel that we are processing the information unlawfully or with inaccurate information, you can request us to restrict the processing. Where personal data is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. If the processing is restricted, we will continue to store the information.

If you disagree with any legitimate interest, we have relied upon to process the information, you can object to the processing. We will then stop processing the information unless we can demonstrate a compelling legitimate basis that overrides your rights, or the processing is required to establish, exercise or defend a legal claim.

You have a right to object to direct marketing.

If we process your personal data based on your consent, you may withdraw your consent using the same channels as were used when consent was given.

You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible. The right to data portability does not apply if the information:

• is only available in paper form or as a scanned document in AirPlus’ electronic archive
• would infringe the rights of someone else
• does not come directly from individual; or
• is created for internal use through analysis or evaluation.

You have the right to complain to us as data controller regarding the processing of your personal information. Please reach out to us via the provided contact details in the last section of this notice.

You can always reach out to your local data protection authority. To find contact information please visit the Information Commissioner’s Office website - ico.org.uk/make-a-complaint.

Reasons for processing your personal data

To identify you; register and update customer profiles with your personal details and contact information; manage contracts.

Legal basis

The processing is based on our legitimate interest to ensure the proper fulfilment of our contractual obligations with the corporate customer.

Categories of personal data collected from you

Identification data, contact details, name, national ID/passport, employee number (where applicable), relationship to corporate customer/product subscriber and residential address.

Categories of personal data collected from other sources

We regularly update information about name & address via population registers.

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, authorised signatories, Beneficial Owners, Company representatives.

Reasons for processing your personal data

To process payments; set up and manage accounts; set up and manage portals; issue cards; handle travel bookings; generate reports; facilitate expense management; authorise payment transactions; provide accounting and invoicing information.

Legal basis

The processing is based on our legitimate interest to ensure the proper fulfilment of our contractual obligations with the corporate customer, to deliver safe product functionality and expedite and facilitate travel expense management/procurement.

Categories of personal data collected from you

Transaction data; account data; billing data; travel information, contact information, log in data, identification of authorised signatories; card information.

Transaction data include payment method/network, Date & time of payment, Merchant & Location, Purchased Amount, Descriptive Billing, Card Details: card number, name, expiry date, CVC, means of identification and your credit limit to verify transactions.

Travel information may include Descriptive Billing Information, Ticket Numbers, Destinations, Traveler Data, Time & Date of Travel, Expenses related to Travel.

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, Authorised signatories.

Reasons for processing your personal data

To assess credit worthiness; make credit checks; conduct risk analysis including business partner due diligence; monitor credit risk behaviour to prevent credit losses; assess credits applications.

Legal basis

The processing is based on our legitimate interest to assess credit risks, assess if you're likely to meet your payment obligations (Credit Worthiness Check) and prevent credit losses and to ensure the proper fulfilment of our contractual obligations with the corporate customer.

Categories of personal data collected from you

Financial information, user and product information, identification data, relationship to corporate customer.

Categories of personal data collected from other sources

We regularly update information about name & address via population registers. We request information from credit bureaus Tax Registers as well as company registers.

Applicable to (categories of data subjects)

Authorised Signatories, Company representatives, Cardholder if private liability.

Reasons for processing your personal data

To conduct risk analysis including “know your customer” evaluation and business partner due diligence required to comply with financial crime prevention regulation; identify beneficial owners; comply with sanction lists.

We perform know your customer (“KYC”), by obtaining information required to comply with to detection and prevention of money laundering and terrorist financing under the Money Laundering Regulations 2017.

Legal basis

The processing is based on the legal obligation to comply with anti-money-laundering and terror prevention regulation and payment industry guidelines and laws.

Categories of personal data collected from you

Financial information, identification data, relationship to corporate customer, Information regarding affiliations, status as a Politically Exposed Person and close family members.

Categories of personal data collected from other sources

We regularly update information about name & address via population registers. Information from Press, Tax Registers as well as company registers, EU & UN sanctions list, Criminal Offense Data to conduct KYC checks

Applicable to (categories of data subjects)

Authorised signatories, Beneficial Owners

Reasons for processing your personal data

Transaction monitoring; fraud detection; investigations; to detect potential suspicious transactions according to Anti Money Laundering and Anti-Terrorist Financing Laws & Regulations (TF).

Our experts who are supported by a software, use previous experience regarding fraudulent transactions as well as an analysis of your previous behaviour. AirPlus Fraud Prevention uses a proven mathematical statistical model to check for fraudulent transactions.

We may also use automated systems to identify and assess risk levels related to fraud, money laundering and other financial crime. This includes continuous monitoring of transactions that may result in a payment being stopped or blocked where it is likely to be fraudulent or otherwise unlawful.

Legal basis

The processing is based on our legitimate interest to ensure the proper fulfilment of our contractual obligations with the corporate customer, to deliver safe product functionality and to prevent money laundering and terrorist financing.

The processing is based on the legal obligation to comply with anti-money-laundering and terror prevention regulation and payment industry guidelines and laws.

Categories of personal data collected from you

Transaction data; behavioural data; logs; Information on credit card usage expectation, Employer, example includes e.g. Average Amount used, Mathematical Input for Card Security Systems.

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, Authorised signatories, Beneficial owners

Reasons for processing your personal data

To transfer data to public authorities to comply with legal obligations. Regulatory reporting; sanctions screening; business partner due diligence.

Legal basis

The processing is based on our legal obligation to carry out pre-contractual measures as well as to transfer personal data to public authorities, such as financial regulators, police, prosecutors, courts when required to do so by law.

Categories of personal data collected from you

Identity data; Politically exposed person (PEP) data; data from sanction list; financial data.

Categories of personal data collected from other sources

Information from Press, Tax Registers as well as company registers, EU, UK & UN sanctions list, Criminal Offence Data.

Applicable to (categories of data subjects)

Beneficial Owners, Cardholders, Portal users & Account users.

Reasons for processing your personal data

To manage all customer support matters and manage customer complaints, to support and correct reported errors, handle customer inquiries & communications; provide customer support; to record customer support phone calls for service improvements, quality and monitoring purposes.

We may, in some cases, ask you to consent to call recordings for service improvements and service agent training purposes.

Legal basis

The processing regarding call recordings is based on consent or legitimate interest depending on country.

The processing of providing general customer support is based on our legitimate interest to provide support to our customers.

Categories of personal data collected from you

Communications; case history; Identification data, contact details, relationship to corporate customer/product subscriber.

Audio & Information you share with us over the phone support.

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, Authorised signatories, Beneficial Owners, Company representatives.

Reasons for processing your personal data

To market products and services to corporate customers and prospects. Send marketing communications and information; segment audiences; manage events; preference handling.

Legal basis

The processing is based on our legitimate interest to manage marketing and customer relationship, to send ads, promotions and offers about products and services that are relevant to our customers.

You always have the right to decline to direct marketing.

Depending on market, we base our processing of your personal data to advertise by e-mail or text message (SMS) on consent.

Categories of personal data collected from you

Contact details; marketing data; preferences.

Categories of personal data collected from other sources

The corporate product you use. Website Usage Behaviour via Web Analytics or Cookie Consent.

Applicable to (categories of data subjects)

Prospects; card holders, account users; event participants, newsletter subscribers.

Reasons for processing your personal data

Analyse usage of our services and products; compile statistics; data analysis for service and product improvement; testing and development of products and services; perform satisfaction and market surveys.

We do not use this data to draw conclusions about you as a person.

Legal basis

The processing is based on our legitimate interest to develop competitive products and services.

Categories of personal data collected from you

Information on the use of mobile app and other online services. E.g. IP Address, MAC ID, geographical location, internet provider, transactions, product usage, contact details.

Categories of personal data collected from other sources

Aggregated usage data and technical data collected from us and our vendors.

Applicable to (categories of data subjects)

Cardholders, Account users.

Reasons for processing your personal data

To provide secure access to online account management & digital services; authentication; access and authorization management; logging; system operation; maintenance; troubleshooting.

To conduct CCTV surveillance on AirPlus premises to keep our visitors and employees safe.

Legal basis

The processing is based on our legitimate interest to ensure the proper fulfilment of our contractual obligations with the corporate customer by keeping systems and services safe and updated and deliver safe product functionality and protect our customers from misuse.

The processing is based on our legitimate interest to keep our premises and employees safe.

Categories of personal data collected from you

Identification data, relationship to corporate customer/product subscriber, log in information, authentication data; role and access data, IP addresses; device data; logs.

CCTV recordings (for more information, see specific policy for each location).

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, authorised signatories, Beneficial Owners, Company representatives.

Visitors of Premises.

Reasons for processing your personal data

To handle legal claims; dispute management; evidence collection; legal case handling.

Legal basis

Legitimate interest to establish, exercise or defend legal claims.

Categories of personal data collected from you

Contract data; communications; evidentiary material.

Applicable to (categories of data subjects)

Cardholders, Portal users, Account users, Authorised signatories, Beneficial owners.

AirPlus provides access to or shares your personal data with carefully selected service providers. These service providers only handle your product data on behalf of AirPlus as so-called data processors, acting only on instructions given by AirPlus. Our service providers are contractually obligated to follow those instructions. AirPlus shares your personal data under strict confidentiality obligations with the following categories of service providers:

• IT service provider (hosting and infrastructure services),
• Transaction-related service providers (receipt processing services), located in Europe
• Customer relationship service providers (call center services), located in Europe and UK

To facilitate payments, transaction data is exchanged among various parties involved: the merchant, the merchant's acquirer (often a bank), credit card networks (like VISA, UATP or Mastercard), and the card issuer (like AirPlus).
We may share your data to facilitate Corporate Discount Agreements with brokers between travel traders and airlines.

We may transmit account data to the contracting partners on request of the Corporate Customer/Product Subscriber (central settlement accounts only).

We may share your data with auditors, insurance companies, lawyers, and public authorities as required by law, such as audits, insurance claims, legal proceedings or regulatory compliance.

We will share personal data about you with other legal entities and affiliates within the SEB Group (which AirPlus is part of) in order to meet our legal and regulatory obligations such as:

• For internal approval processes
• For risk measurement, control, and reporting
• For regulatory and financial transaction reporting
• Financial crime and external fraud prevention, for instance to be able to comply with our obligations pursuant to AML/TF regulation
• To be able to provide as good service to you as possible and act as one bank and payment solutions provider

Personal Data will be transferred to countries outside of the European Union or the European Economic Area (“third countries”) only to the extent required for the respective purpose (e.g. enabling transactions or reports to corporate customer/subscribers) or mandated by law (e.g. reporting duties stipulated by tax laws). Prior to any transfer of personal data to processors or third parties in third countries, AirPlus ensures that a transfer mechanism is in place (e.g. the Standard Contractual Clauses provided by the European Commission and the ICO’s supplementary Addendum).