国航隐私政策

　　We will ask you to provide your personal information voluntarily for the following purposes:

　　1. For the purpose of performance of your air transport contract with us:

　　(1) We will provide you with reservation and ticket purchase service

　　In order to complete your ticket booking, you are required to provide the following information:name, gender, valid identity document information, date of birth, contact number, email address (necessary for overseas ticket purchase), name and telephone number. If you book a flight via or from/to a U.S. territory, you will also need to provide residential address information of departure and destination according to local regulatory requirements. To complete the payment, you need to provide the following payment information: bank card number, expiry date, CVV, billing address, cardholder's name, bank reserved mobile phone number, valid identity document information (note : financial account information is your sensitive personal information), mileage payment password. After purchasing the ticket, we will generate your order information, including your seat reservation record, ticket number, flight number, departure place, destination, flight time and class.

　　If you need to mail the itinerary, you need to fill in the recipient's name, telephone number and mailing address.

　　(2) To provide you with passenger and luggage transport services

　　When you check in at the airport, we need to check your ticket number and valid identity documents. After confirming your seat number, we will generate a boarding pass. In the event of a payment risk control issue, we will require you to provide the payment card information used at the time of ticket purchase.

　　To assist you in checking your luggage, we will verify your ticket number and generate your baggage number.

　　In the event of a flight delay, if you apply for a delay certificate, we will collect your name, ticket number or valid identity document number, flight number and date of your flight.

　　(3) To help you register and use the Phoenix Miles member service

　　If you choose to register as an Air China account, you will need to provide your name (Chinese name, English name / pinyin of Chinese name), valid ID information (ID type, number, period of validity), mobile phone number and verification code, email (not required), contact language, password, nationality (country/region), birthday, gender, and we will verify the validity of your information in a variety of ways, including - but not limited to - sending an SMS verification code, email verification code, face verification, etc. You may modify and supplement your real-name authentication information, which is all your "Account Information". Your additional account information will help us provide you with personalized product recommendations and a better flight experience.

　　If you choose to register as a member of Phoenix Miles, you will need to provide your name (Chinese name, English name / pinyin of Chinese name), valid ID information (ID type, number, period of validity), mobile phone number and verification code, email (not required), contact language, password, nationality (country/region), birthday, gender, and we will provide you with your "Phoenix Miles" membership card number and your membership level. When you use the Phoenix Miles membership card, your mileage accumulation and redemption information will be generated, including your Miles Mall order history, and your membership level may change according to the membership level rules. When you register for a Phoenix Miles membership, you will also register for an Air China account.

　　If you are a Phoenix Miles or VIP member, we will need to collect your contact address to mail you a membership card. If you are a minor under the age of 14, you will need to provide your guardian's card number. In addition, you may voluntarily provide other information such as an e-mail address (for service or marketing mailings), opt-in or opt-out promotions, interests and preferences (seating and dining). In order to avoid the hassle of entering your information, we will take some of the information directly from the application form or during the processing flow. This includes your registration date, channel, and preferred language of communication. You can use miles to redeem award tickets for you and your transferees, in which case you will be required to provide the information needed for reservation and ticketing services. As an additional way for members to accrue miles, we have initially provided all members with an automatic member card number identification service. That is, when members purchase tickets for flights operated by Air China using the system of China TravelSky Holding Company Limited, if a passenger's name and valid ID number are the same as those registered in his or her member account, the passenger's member card number will be automatically identified and the flights taken may be automatically credited. If you do not want the automatic identification service, you can log in to your member account on the Phoenix Miles website and turn off the automatic identification of your membership through "My Account - Account Management".

　　You can also use mileage to redeem goods in PhoenixMiles or offline cooperation scenarios. In this case, you need to fill in the name, phone number and postal address of the consignee. You can also fill in the common contact information and common consignee information voluntarily. We will send the contact information of consignee to the mall merchants and logistics service providers. If we cannot contact the consignee, we may provide your contact information to the merchants. In offline cooperation scenarios, when mileage is used to redeem goods, we will send your order information and membership card number to the cooperative service provider. If customer service problems need to be processed by the cooperative service provider, we may provide your contact information to the cooperative service provider.

　　If you participate in the member's products, activities and use the mileage payment functions (including online and offline), and our business partners to provide the mileage rewards or rights and interests of activities, we will collect and use your name, identity document number, phone number, email address, travel information, membership information, for the purposes of statistics and membership service.

　　In addition, when you modify your critical personal information, redeem goods, click real-name authentication, you need to confirm whether it is your operation through face authentication, WeChat public security authentication, UnionPay authentication.

　　When you call 95583 for membership service, your name, identity document number and mobile phone number will be used to confirm your membership, so as to ensure the security of your account.

　　(4) Other services provided to you

　　If you need to apply for a stretcher, wheelchair, Unaccompanied Minors, Passengers Traveling With Portable Oxygen Concentrators (POCs) or Continuous Positive Airway Pressure (CPAP) Machines, the OPO Staff Transporting Donated Human Organs and other services, you need to fill in your name and contact information, valid identity documents information, contact information and address of relevant fellow traveler, or the one who pick up or drop off the passenger, we will verify your medical certificate, or collect related documents in accordance with the relevant requirements of competent authority.

　　If you need to purchase our additional services such as prepaid luggage and paid seat selection, you are required to provide your ticket number or valid identification information, flight number and flight date.

　　Your account information and order information will be used by our telephone customer service and after-sales functions. To ensure the security of your account, our call center customer service and online customer service will verify your identity with your account information. When you need us to provide customer service and after-sales service related to your order information, we will check your order information. To facilitate contact with you, as soon as possible to help you solve problems, or records related to problems of processing scheme and results, we may store your communication with us, communication/phone records and related content (including account information, order information, in order to prove the facts you provide other information, or the contact information you left). We will use your account information and order information if you consult, complain or provide suggestions for specific orders. You may provide other information other than the above information when communicating with our customer service personnel, such as when you ask us to change the delivery address, contact person or contact number.

　　If you are unable to travel due to illness, we will require you to provide a medical certificate for verification.

　　If you are using our in-flight WIFI service, you will need to fill in your seat number and name. WIFI usage information may be generated when you use WIFI on the computer, including network device identification information (such as nickname and profile picture), personal commonly used device information, and personal Internet browsing history.

　　If you are an employee of our enterprise customers (enterprises, government customers, etc.) or an employee of “ Commercial Travel Platform” who has signed and registered a ticket, we will keep the exclusive agreement code information of the major customer in your reservation record to ensure that the ticket you purchased is the exclusive price stipulated in the agreement. The Universal Air Travel Plan (UATP) account information designated by your employer will be kept in the reservation information; When you (or your employer's contact person) apply for the exclusive service of big customers, we may require you (or your employer's contact person) to provide your employer's name, position, enterprise email, number, contact information, valid certificate information, date of birth and other personal information; Your company contact may contact us, we will invite your company contact to register our " Commercial Travel Platform" customer management platform, input " Commercial Travel Platform" customer information and contact information (name, mobile phone number and email, login name and password), after successful registration, The account administrator of your company will manage the booking list and booking information of employees of your company through " Commercial Travel Platform" . During your use of the Service, the above information is uploaded to Air China through the account administrator of your employer and continues to authorize us to use it. At the same time, in order to facilitate the management needs of your employer, the account administrator of your employer has the right to access the above information or register you as a Member of PhoenixMiles member. If you need to cancel your personal account or apply for deleting the above personal data, please contact the account administrator of your employer.

　　If you have any questions about this, please contact your employer's contact person first to lodge your appeal.

　　(5) Necessary to ensure the security of transactions

　　To improve your use of our products and/or service security of the system, and more accurate to prevent fishing website fraud and protect the security of the account, we may be through understanding your browsing information, order information, equipment information (IP address, type of equipment and equipment identification number) to determine your account security/transaction security risks, to prevent fraud.

　　2. When obtaining your consent

　　To enhance your service experience and improve our products and services, we will ask you to voluntarily consent to our collection and use of your information.

　　Our APP will invite you to open specific mobile permissions to provide better service experience or improve our products or services. For specific mobile permissions, please see our system mobile permissions list in APP Personal Center - Settings - Privacy.

　　We will invite you to reserve your email address to send orders and flight information, or subscribe to our promotional information, including special offers and discounts for specific routes, products or services, etc., and your initiative to fill in the action will be regarded as consent. We may also hold some promotional activities, and we need to collect your name and contact information to complete these promotional activities.

　　When you agree to use face recognition, we provide you with lounge access, real name authentication and other services. On the face recognition function itself, we may collect your face image, face recognition characteristic value, valid identity information, PhoenixMiles member card number. You can turn on or off the face recognition function to achieve your own control.

　　If you are an employee of our enterprise customers (enterprises, government customers, etc.), you can carry out the enterprise customer identity authentication and choose the service. You can voluntarily choose to agree to the authentication or cancel the authentication.

When you agree to receive personalized recommendations, we will analyze your behavioral preferences based on the inquiry/processing of your previous ticket/service purchase, and provide you with personalized recommendations. You can enable or disable personalized recommendations feature at your own convenience. Once the feature is disabled, we will no longer offer you personalized recommendations and presentations. Non-targeted content recommendations and presentations will not be affected.

　　Please ensure that you are fully authorized by the nature persons when providing their personal information and sensitive information when using the above functions. Please ensure that your operation does not violate the legal rights or interests of any third party, and confirm that the third party can follow the privacy policy to process personal information. If an individual requests to delete or correct the relevant information, you need to delete or correct the above information in a timely manner, otherwise you may bear the legal consequences arising therefrom. If we change the purpose of using information of an individual due to business needs, we will inform you in time. Please decide whether the above information can continue to be processed according to the authorization of the third party.

　　In addition, when you follow our WeChat official account, Weibo official account and other social media platforms, your active following behavior will be regarded as valid consent, and you can identify the specific follower's information and time of following, but we will only use it to interact with you on the platform. You can withdraw your consent at any time by unfollowing.

　　3. To comply with legal obligations

　　In order to comply with applicable laws and regulations, we will ask you to provide your real name and valid ID information if required by applicable civil aviation laws and regulations. We will collect and store your log information to fulfill our classified protection obligation of cybersecurity under the Cybersecurity Law of China.

　　In addition, we may collect and use your personal information in accordance with the law to protect your life, health and property rights due to public health emergencies, such as requiring you to check your previous travel, taking your temperature or requiring you to provide a specific health certificate.

　　Collect your personal information through a third party

　　We may receive your personal information from third parties from time to time. These third parties include our affiliates and business partners. We use this information collected from third parties to provide you with services under relevant contracts and to ensure the accuracy of the records we hold about you.

　　In addition, please note that third parties may have their own special privacy policies to explain how they collect and process your personal information. Such privacy policies do not constitute a part of this Privacy Policy. You need to carefully read and decide whether agree with their privacy policies or not.

　　When you use our website, we may collect tracking information including your browser type, operating system type, name of Internet service provider and pages you visit on our website, etc. We use a variety of technologies to obtain this information, including Cookies and Web beacons, to enhance the functionality and ease of use of our websites, products and services to better meet your needs.In addition, we use this information to determine whether visitors are qualified to request services and to aggregate site activity data.

　　Please refer to our Cookie Statement for details on how we use Cookies and similar technologies.

　　1. Our service providers and our affiliates

　　We will allow our third party service providers (including agents, contractors and affiliated companies) to use your Personal Information on our behalf for the purposes set forth in this Privacy Policy. For example: staff who assist you with check-in and boarding, our system service providers. We may also disclose your personal information to third parties to make it easier for them to implement any special arrangements you may require, such as wheelchair services.

　　2. Third parties such as airlines, hotel partners, tour operators, online travel agencies （OTA） , insurance institutions, banks and financial institutions

　　To facilitate and manage your travel arrangements and provide you with products or services you need, we may share your personal information with third parties, such as other airlines (including Star Alliance partner airlines , other partners and cooperative code-sharing airlines), hotel partners, Land or sea transport operators, partner insurance or banking financial institutions, and travel agents or other personnel who interact with us on your behalf. Your personal information will be used by such third parties in accordance with their privacy policies. The privacy policies of our intermodal, syndicated and code-sharing partner airlines are available in the International Air Transport Association (" IATA ") Privacy Policy database .

　　3. Partner of Phoenix Miles Membership Program

　　We may share your information with airlines who jointly use PhoenixMiles Membership program and the cooperation partners of PhoenixMiles to facilitate you to enjoy our PhoenixMiles membership products and services, such as your mileage accumulation and exchange, lounge access, etc.

　　4. Our enterprise customers (enterprises, government customers, etc.)

　　We will disclose your travel details and information about your use of our services to our major customers, employees of our enterprise customers, or those who travel or obtain products or services paid for by our enterprise customers.

　　5. Government, regulatory agencies or organisations required by laws

　　We may disclose your personal information to the government, regulatory authorities and legally required entities, such as immigration authorities, Customs and border defense authorities, Civil Aviation Administration and airport authorities, dispute settlement authorities, procurator authorities and law enforcement authorities, such as: The laws of the United States and other countries require us to disclose personal information (Passenger Name Record (PNR) and/or Forecast Passenger Information (API)) about your travel documents, booking details and flight schedules as required by law. We will disclose your personal information to these institutions so that we can provide you with products and services under the law and regulation.

　　6. Our SDK provider. Details are as follows :

　　7. Other circumstances in which we disclose your information to designated third parties with your consent or upon your own initiative.

　　We will not process your personal information without any legal basis. Generally speaking, the legal basis for us to process your personal information would be as followings :

　　• Performance of the contract between you and us, such as general terms of transportation, service agreement for specific products and PhoenixMiles Member's Guide.

　　• Comply with our legal obligations, such as real-name obligations or other information reporting obligations stipulated by civil aviation laws and regulations, our classified protection obligation of cybersecurity under the Cybersecurity Law of China and user information security obligations.

　　• Obtain your consent, such as when you turn on the face recognition function switch, or you allow us to send promotional messages to you.

　　• In order to deal with public health emergencies, or to protect the life, health and property safety of you or other natural persons, for example, we will ask you to measure the temperature at the boarding gate and record passengers whose temperature is abnormal and report to the competent authorities for follow-up treatment.

　　• Within the territory of the EU and / or EEA, for our legitimate interest , including managing your personal information in our IT systems , to improve our products and services, holding on PhoenixMiles Membership activities, to participate in our social activities, for the transaction security to prevent fraud and network information security.

　　(I) Our technology and measures to protect your personal information

　　We value personal information security and will take all appropriate and plausible security control measures to protect your personal information:

　　1. We have used industry-standard security measures to protect your personal information from unauthorised access, public disclosure, use, modification, damage or loss. We will take all reasonable and practicable steps to protect your personal information. For example, we use transport layer security protocol encryption technology and use a combination of strong cryptographic algorithms (such as ECDSA key agreement, AES256 channel encryption and other technologies) to ensure security during transaction transmission. For the storage of personal information data, industry-standard encryption technology is used to encrypt and store user personal information securely. Our access to stored data is logged and saved by relevant logs, and centralized log collection and integrity monitoring ensures that log files are not tampered with. We also periodically perform internal and external security scans and penetration tests to ensure the safety of the production systems.

　　2. Certifications: Our core business system has passed the People's Republic of China Information System Level Protection Level 3 certification, and we have obtained ISO27001 certification and PCI DSS certification.

　　3. We have appointed a Data Protection Officer (DPO) to be responsible for and overlook the data protection and compliance operations within the company. We have also established a data security team to promote and protect personal information security. We regulate the collection, transmission, use and storage of personal information through established information security management systems. We signed the Non-disclosure Agreement with all members, requiring all personnel who may be exposed to personal information to perform their respective confidentiality obligations. Furthermore, we regularly train employees on proper information security and privacy protection measures to enhance employees’ awareness of the importance of protecting personal information.

　　4. The Internet is not an absolutely secure environment, and certain communication methods such as e-mail are not encrypted. We strongly recommend that you do not send personal information using such methods. Please use complex passwords to help us keep your account secure.

　　5. The Internet environment is not absolutely secure, but we will do our best to ensure the security of any information you send us. If our physical, technical, or administrative protective equipment is destroyed resulting in unauthorised access, public disclosure, alteration, or destruction of information, that result in damage to your legal rights, we will bear the corresponding legal responsibilities.

　　6. In response to possible risks such as leakage, damage and loss of personal information, we have formulated emergency measures. In the event of classified and categorized leakage of personal information, event reporting and disposal procedures are in place which a dedicated emergency response team. In the unfortunate event of personal information being at risk, we will promptly inform you in accordance with the requirements of laws and regulations: the current situation, the possible impact of the security incident, the disposal measures we have taken or will take, and how you can prevent and mitigate the risks autonomously, and any possible suggestions, remedies for you, etc. We will promptly inform you of the relevant circumstances of the incident by mail, letter, telephone, push notification, etc. When it is difficult to inform the affected parties individually, we will issue a notice in a reasonable and effective manner. If you find that your personal information has been leaked, please contact our customer service immediately so that we can take appropriate measures.

　　At the same time, we will also report the disposal of personal information security incidents in accordance with the requirements of the regulatory authorities.

　　(2) Preservation of your personal information.

　　We will store your personal information for the shortest period necessary to achieve the purpose stated in this Privacy Policy, except for where applicable laws and regulations require, such as the E-commerce Law of China requires us to store your transaction order information for no less than three years. After you cancel your account, we will also delete or anonymise your personal information. When your personal information storage exceeds the minimum period required for the above purposes, we will delete or anonymise your personal information.

　　We protect your personal information rights in accordance with the applicable laws, including:

　　1. Inquire, copy, and portably transfer your personal information

　　Unless otherwise provided by law or we have specific confidentiality obligations, you have the right to access your personal information at any time by:

　　(1) Your Account information:

　　Website Account Information: You can view or modify your personal information in the "Personal Center" after logging in as a user through the option on the top right corner of the home page of the website. APP: You can click on the "Member's Avatar" menu on the "Personal Center" page to view the information you have submitted. Commercial Travel Platform System Account Information: you can log in to the Commercial Travel Platform system and view your personal information in "Personal Information", if you need to modify your personal information, please contact the system administrator of the enterprise you belong to to modify it.

　　Member information: You can log in "PhoenixMiles " website, through "my Account - Account management" and "mileage bill" to access your membership information and mileage information.

　　(2) Your order information:

　　On the PC, you can view all of your completed, pending or after-sale orders in "My Orders" after logging into account through the option on the top right corner of the home page of Air China's website. In the mobile app, you can view your order history by visiting the "Home Page"-"Personal Centre" page. The specific path is: "Home Page" - "Personal Centre" - "All Orders". In Discount Business Travel System, you can view all your completed, pending payment or after-sale orders by visiting the "Ticket Orders" page after logging in to your account. On the Phoenix Miles website, you can check your order information by visiting "Home Page" - "My Account - Transaction Centre".

　　(3) Your browsing information:

　　You can access or clear your search history, access and modify interests, and manage other data. PC: Clear your history through your browser.

　　(4) If you need to inquire or copy any other personal information generated during the use of our products and/or services, please feel free to contact us by dialing 95583 or email dpo@airchina.com.

　　In addition, you have the right to request that we provide you with a copy of your personal information processed by us and, subject to legal or regulatory requirements, you also have the right to request that we transfer your personal information to other personal information processors designated by you.

　　2. Correct or update your personal information

　　If you find that our processing of your personal information is inaccurate and affects the realization of your rights and interests, you have the right to request us to correct or update your personal information at any time. You can further apply for correction on the personal information query page or through the channels above. If you still have questions, or if it is difficult to correct, you can call 95583 or submit a correction or supplementary application to us at dpo@airchina.com.

　　3. Delete your personal information

　　You have the right to request us to delete your personal information from our information systems as permitted by law, information that you may remove or delete from our products and/or services pages, and by calling 95583 or making your request to dpo@airchina.com, except where we are required by law to continue to store your personal information for a specific period.

　　In addition, for technical reasons, when you delete information, we may not delete the corresponding information in our own system immediately, but will delete the information when backup update, during which time we will only store and take security measures.

　　4. Change the scope of your consent or withdraw your consent

　　For personal information obtained by us based on your consent, you have the right to change the scope of your consent or withdraw your consent by disabling device functions, setting privacy Settings, canceling corporate customer identity authentication, turn off personalized recommendations, or canceling your account.

　　Please understand that after you withdraw your consent, we will no longer process the personal information obtained based on your consent, which will affect the products or services provided to you corresponding to this part of personal information. However, your decision to withdraw your consent or authorization will not affect the prior processing of personal information based on your consent before .

　　5. Cancel your account

　　If you choose to permanently cancel your Air China account, you can log in to the Air China website and apply for cancellation under "Personal Centre - Security Settings - Account Cancellation", and if you are a member of Phoenix Miles, your Phoenix Miles membership account will be canceled for you. After successful cancellation, we will stop providing the corresponding products and/or services, and all information and rights in your Air China account, as well as the member mileage and assignee information in your Phoenix Miles account, will be deleted and cannot be recovered, unless otherwise specified by laws and regulations.

　　If you choose to cancel your Phoenix Miles membership account, you can log in to the "Phoenix Miles" website or the "Air China" APP and click "My Account - Account Management - Permanent Account Cancellation", or log in to Air China's official website and select "Member Cancellation Only" in "Personal Centre - Security Settings - Account Cancellation".

　　After you cancel your membership account, we will stop providing corresponding products and/or services to you. Upon your request, unless otherwise required by laws and regulations, we will delete the information in your membership account, and your mileage will also be cleared.

　　6. Refuse us to send you promotional information:

　　You have the right to unsubscribe from the promotional information we send you at any time in the following ways:

　　(1) Please object to such promotional information by selecting the appropriate selection box in the form or sending us an email at dpo@airchina.com at any time thereafter when we collect data.

　　(2) You can go to the official website of Air China and set to refuse to receive "Promotion Notifications" under the page "Personal Center - Information Management - Personal Information - Personalized Information".

　　(3) You can log in to the " PhoenixMiles " website and set "Whether to accept promotional emails/SMS" on the page of "My Account-Account Management".

　　(4) Any email we send you may contain promotional information. You may cancel it at any time by clicking the "Unsubscribe" link at the bottom of the email. However, you should note that your service information cannot be unsubscribed.

　　(5) You can click on the "Home page" - "Personal Center" of the APP to enter the "Basic Information" page to enable or disable whether to receive promotional information pushed to you.

　　(6) You may unfollow or unsubscribe our WeChat official account, Weibo and other official social platform accounts at any time.

　　(7) You can cancel the authentication of enterprise customer employees on our APP at any time.

　　(8) You can turn off personalized recommendations at any time via our app .

　　(9) You can choose to cancel our account.

　　7. Restrict or object to process your personal information

　　You have the right to restrict our processing of your personal information under certain circumstances, and the right to object us to use your personal information for automated decision-making, profiling, or the right to object us to process your publicly available personal Information, or to opt-out the share of your personal information with third parties if required by applicable law.

　　You can request to exercise this right s by sending an email to dpo@airchina.com. Please note that once you exercise these rights, we will stop processing your personal information and wait for you r further requests, such as correcting or deleting your information.

　　8. Right to explain this Privacy Policy

　　When you have any questions about the rules governing the processing of personal information contained in this Privacy Policy, or about the processing of your Personal Information, or you require us to provide specific information in accordance with applicable law, you may request an explanation by sending an email to dpo@airchina.com.

　　9. Exercise of these rights

　　To protect the security of your personal information, we may require you to provide a written request or verify your identity, after which we will respond to your request for rights within a reasonable period permitted by law. Your request will be confirmed or responded within 10 working days. In addition, if you exercise your rights on behalf of others, or if you, as a close relative of a deceased of our passenger, request us to access, copy, correct or delete the information related to the deceased, please provide proof of your identity and the other person's identity, as well as proof of the relationship, such as special power of attorney or death certificate of the deceased.

　　You have the right to file a complaint or legal action with the regulatory authority or court of your residence or the place where the act ion takes place for the exercise of the above rights or our response.

　　We protect the personal information of minors in accordance with applicable laws and regulations. If you are a minor member of PhoenixMiles under the age of 14, you need to bind the account of your legal guardian when using our products or services. If you are not a member but a minor passenger under the age of 14, you must obtain the consent of your legal guardian before using our products and services.

　　In addition, we will only deal with minors under the age of 14 within the scope of products and services needed to purchase a minimum of information and to ensure that the appropriate security measures, not to profile or sent to the sales promotion information, or use their personal information induced the activities which are incompatible with their age and responsibility. To protect the information security of minors' accounts, face recognition will be enabled for children when the account information is modified with the consent of the legal guardian, but children's face recognition information will not be stored.

　　If a minor has provided us with personal information without the consent of their parent or guardian, their parent or guardian may send an email to dpo@airchina.com to delete such information.

　　Personal information collected and generated by us in China will be stored in the territory of China.

　　For the purposes set out in this Privacy Policy, your personal information may be transferred to countries or areas other than your residence. At this time, we will protect the security of your personal information in accordance with applicable laws and regulations and transfer your personal information worldwide, including but not limited to:

　　1. Before transferring your personal information outside of China based on your consent, we will fully inform you of cross-border transfers and request your explicit consent in accordance with the applicable laws.

　　2. If your personal Information is transferred outside of China, we will carry out risk assessment and/or personal information protection impact assessment in accordance with the law and regulatory requirements or sign standard contractual clauses released by the Cyberspace Administration of China.

　　3. If your personal information is transferred outside of EU to a country where the EU Commission has not made a sufficient decision, we will sign the standard contractual clauses approved by the EU Commission and take security measures to protect your personal information.

　　This Privacy Policy will be changed to adapt to the law, technological and practice changes.

　　However, we will not reduce your rights under this Privacy Policy without your express consent. We will post any changes to this Privacy Policy on this page. For major changes involving your rights, we will also provide more significant notifications, such as in- APP notification or email notification.

　　We will also archive older versions of this Privacy Policy（May 2018，October 2018，June 2019，November 2020，June 2021，November 2021，September 2022，August 2023，March 2024，September 2024，October 2024）for your review.

　　If you want to know more information about this privacy policy, including exercising your rights, complaints, or the rules of the processing of your personal information, if you have any questions, you can contact our data protection officer, or EU regional representative, we will respond to your request within the time frame required by laws:

　　Data Protection Officer

　　Email: dpo@airchina.com

　　Address：Room 4004 (4th Floor) No. 16 Tianzhu West Road, Tianzhu Airport Economic Development Zone, Shunyi District, Beijing, China, 101312

　　EU Representative

　　Email：dpo@airchina.com  

　　Address：4 Düsseldorfstrasse, 60329, Frankfurt, Germany

　　If your concerns are not resolved, you have the right to complain to your local authorities, workplace, or local regulatory agency, where you believe a violation occurred.

　　Latest Updated on: November 1, 2024

　　If there is a separate privacy policy or special provisions related to personal information protection in a certain product or service provided by us, this Privacy Policy of the product will be preferentially applied. Contents not covered by the Privacy Policy and terms and conditions of the product shall be subject to this Privacy Policy.

　　This Privacy Policy is compiled in Chinese. In the event of any inconsistency or ambiguity between the Chinese version and the translated version, the Chinese version shall prevail.

　　We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section.

　　Shenzhen Airlines is an airline that is established in 1989 and a member of the world's largest airline alliance, Star Alliance. Shenzhen Airlines is headquartered in the People's Republic of China. By the March 2018, Shenzhen Airlines has more than 204 aircrafts in total, including B-737, A-320, A-319 and other models, operating nearly 300 domestic and international lines.For more information about Shenzhen Airlines, please see the “About Us” section of our Website.

　　The personal information that we may collect about you broadly falls into the following categories:

　　• Information that you provide voluntarily

　　In order to use our Services, including our Website, we may ask you to provide personal information voluntarily such as.

　　o contact information such as your name, address, telephone number, email address, fax number;

　　o Phoenix Miles member account number;

　　o flight information (e-ticket number, seat number, passenger type, flight date, flight itinerary);

　　o online payment information (credit card number, billing address);

　　o personal preferences (dining, seat, language);

　　o identity information such as your identification number, passport number, gender, nationality, country of residence; and

　　o personal information for others in your travelling party.

　　We use this personal information to facilitate your travel, provide you with other goods and Services, to administer our Phoenix Miles loyalty programme, and to provide you with information about us. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

　　Some of the personal information that you provide may include sensitive personal information, such as health-related information or information about your race or ethnicity, which we need for to improve our service provided to you and protect your own interests. We will request your consent when we ask you to provide your sensitive personal information.

　　• Information that we collect automatically

　　When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws.

　　Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

　　Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

　　Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies and similar tracking technology” below.

　　• Information that we obtain from third party sources

　　From time to time, we may receive personal information about you from third party sources, but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

　　The types of information we collect from third parties include travel professionals, and others who assist in booking and arranging travel. We use the information we receive from these third parties to provide services to you, and maintain the accuracy of the records we hold about you.

　　In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.

　　We may disclose your personal information to the following categories of recipients:

　　• to our group companies, third party services providers and partners who provide data processing services to us (for example, to support the delivery of our Services or to provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information.

　　• to other airlines, such as our Star Alliance, joint venture, interline and codeshare partners, which furnish you with access to VIP airport lounges, perform part of the carriage, or assist with rebooking your flight should any disruption of your itinerary occur; We only share data with these airlines to the extent it is necessary for the performance of a contract with you.

　　• to third parties, such as employers and travel professionals, who have arranged for discounts, purchase travel or provide other services on your behalf. We only share data with these third parties to the extent it is necessary for the performance of a contract with you.

　　• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

　　• an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.

　　• to any other person with your consent to the disclosure.

　　If you are a visitor or customer from the European Economic Area, Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

　　However, we will normally collect personal information from you only (i) where we need the personal information to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

　　If we ask you to provide personal information to comply with a legal requirement or to perform a contact with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

　　If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our company and communicating with you as necessary to provide our services to you and for our legitimate commercial interest, for instance, when responding to your queries, improving our products and services, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

　　If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below.

　　We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you, including to serve interest-based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Statement.

　　We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include Secure Socket Layer (SSL) encrypting technology and compartmentalization of access rights to secure the transmission of your data from your web browser to our internet system.

　　Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

　　Specifically, our Website servers are located in the People's Republic of China, and our group locations and third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.

　　However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group locations, which require all group locations to protect personal information they process from the EEA in accordance with European Union data protection law.

　　Our Standard Contractual Clauses can be provided on request.

　　We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

　　When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

　　If you are a resident of the European Economic Area, You have the following data protection rights:

　　• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.

　　• In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “How to contact us” heading below.

　　• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “How to contact us” heading below.

　　• Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

　　• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries (including the US and Canada) are available here.

　　We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

　　We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

　　You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

　　If you have any questions or concerns about our use of your personal information, please contact [us / our data protection officer] using the following details: [dpo@shenzhenair.com].

　　The data controller of your personal information is Shenzhen Airlines Co., Ltd..