We will ask you to provide your personal information voluntarily for the following purposes:

　　1. Information required for the performance of the air transport contract between you and us:

　　(1) Information required for reservation and ticketing service

　　To complete your reservation and ticket purchase, we require the following information: passenger's name, gender, valid ID information, date of birth, contact phone number, email address (mandatory for ticket purchases outside the Chinese mainland), contact person's name and phone number. If you book flights to/from or transiting through U.S. territory, local regulatory requirements also necessitate providing residence address information for both origin and destination. To complete payment, we require the following payment information: bank card number, validity date, CVV, billing address, cardholder name, bank-registered mobile number, valid ID information (financial account information constitutes your sensitive personal information), and mileage payment password. After ticket purchase, we will generate your ticket order information, which will include your reservation record, ticket number, flight number, origin, destination, travel time, and cabin class.

　　If you require mailing of the itinerary, you need to provide the recipient's name, contact phone number, and mailing address.

　　(2) Information required for passenger and baggage transport services

　　During airport check-in, we need to verify your ticket number and valid ID, then generate your boarding pass after seat assignment. When payment risk control issues arise, we may require the payment card information used for ticket purchase.

　　To assist with baggage check-in, we will verify your ticket number and generate baggage tags for you.

　　For flight delay certificates, we will collect your name, ticket number, or valid ID number, flight number, and travel date if you apply for such documentation.

　　(3) Information required for PhoenixMiles membership registration and services

　　If you choose to register for an Air China account, you must provide: name (Chinese name, English name/Chinese name pinyin), valid ID information (ID type, ID number, ID validity date), mobile number with verification code, email (optional), language for communications, login password, nationality (country/region), date of birth, and gender. We will verify your information through various methods including but not limited to SMS verification codes and email verification codes. You may modify and supplement your identity verification information, all of which constitutes your "account information." Supplemental account information helps us provide personalized product recommendations and enhanced flight experiences.

　　If you choose to register as a PhoenixMiles member, you must provide: name (Chinese name, English name/Chinese name pinyin), valid ID information (ID type, ID number, ID validity date), mobile number with verification code, email (optional), language for communications, password, nationality (country/region), date of birth, and gender. We will provide your "PhoenixMiles" membership number and tier level. Your use of PhoenixMiles generates mileage accrual/redemption records, including PhoenixMiles E-shop order history, and your membership tier may change according to membership tier rules. Registering for "PhoenixMiles" automatically creates an Air China account for you.

　　If you are a Phoenix Junior or elite member, we will need to collect your mailing address to send you the membership card. For minors under 14 years old, a guardian's associated card number must be provided. Additionally, you may voluntarily provide other information, such as an email address (for service or marketing emails), preferences for receiving promotional information, and interests and preferences (such as seat and meal choices). To save you the trouble of inputting information, we will automatically extract certain details from your application form or during the processing procedure, including your registration date, registration channel, and preferred language for communications. You may use mileage to redeem award tickets for yourself or your alienee, in which case we will require the same information needed for reservation and ticket purchase services. As a supplementary method for members to earn mileage, we automatically activate the membership card number recognition service for all members. This means when purchasing tickets for Air China-operated flights through the TravelSky system, if the passenger's name and valid ID number match the information registered in their member account, the membership card number will be automatically recognized, and the flight may be automatically credited to the member's account. Members who wish to disable this automatic recognition service may log in to their PhoenixMiles account on the website and disable "Membership Auto-Recognition" under "My Account - Account Management."

　　You may also use mileage to redeem products through the PhoenixMiles E-shop or at offline partner locations, in which case you will need to provide: recipient's name, contact phone number, and mailing address. You may also voluntarily provide frequently used contact person information and recipient information. We will share your recipient information with E-shop merchants and logistics providers. If the recipient cannot be contacted, we may provide your contact information to the merchant. When redeeming products at offline partner locations using mileage, we will share your order information and membership card number with the partner service provider. If customer service issues need to be transferred to the partner service provider for handling, we may provide your contact information to the partner service provider.

　　By participating in membership products, activities, and using mileage payment features (both online and offline), as well as mileage reward or benefit activities offered by our business partners, you will be deemed to have consented to our collection and use of your name, ID information, contact phone number, email address, travel information, and membership information for product activity statistics and membership services.

　　Additionally, when you modify key personal information, redeem virtual products, or click on identity verification, you will be required to verify that the operation is performed by yourself through facial recognition, WeChat Public Security authentication, or UnionPay verification. When you call 95583 for membership service, your name, identity document number and mobile phone number will be used to confirm your membership, so as to ensure the security of your account.

　　(4) Information required for other services

　　If you require special services such as stretcher assistance, wheelchair service, unaccompanied children service, portable oxygen concentrator or ventilator equipment transportation, or human organ transportation, you will need to provide your name, contact information, valid ID information, as well as the contact information and address of any accompanying or receiving personnel. We will verify your medical certificates or collect relevant supporting documents in accordance with national regulations.

　　If you wish to purchase additional services such as prepaid baggage allowance or paid seat selection, you will need to provide your ticket number or valid ID information, flight number, and flight date.

　　If you use the inflight Wi-Fi service and log in, you will be required to provide the last four digits of your ID used for booking and your seat number.

　　If you are an employee of one of our corporate customer (enterprise, government, etc.), to ensure that the tickets you purchase are at the agreed contractual rates, we will retain the exclusive corporate customer agreement code in your booking record. The UATP (Universal Air Travel Plan) account information designated by your employer will also be stored in the booking details. When you (or when you are your employer's designated contact person) request access to exclusive corporate customer services, we may require you (or your employer's contact person) to provide your employer's name, relevant job title, corporate email address, PhoenixMiles card number, contact information, valid ID information, and date of birth. Your employer's contact person may communicate with us, and we may invite them to register on our "Corporate Travel Program" customer management platform to input corporate customer and contact information (including name, mobile number, email address, login username, and password). Upon successful registration, your employer's account administrator will manage the employee booking list and booking details through the "Corporate Travel Program" platform. During your use of this service, the aforementioned information will be uploaded to Air China by your employer's account administrator, who will grant us ongoing authorization to use it. For your employer's management purposes, the account administrator will have access to this information and may also register you as a PhoenixMiles member. If you wish to deactivate your personal account or request the deletion of the above personal data, please contact your employer's account administrator.

　　If you have any questions regarding this, please first reach out to your employer's designated contact person to raise your concerns.

　　(5) Mandatory for ensuring transaction security

　　To enhance the security of your use of our products and/or services, more accurately prevent phishing website fraud, and protect account security, we may assess your account/transaction security risks and prevent fraud by reviewing your browsing information, order details, and device information (IP address, device model, device identification number).

　　2. Required when you consent

　　To improve your service experience and enhance our products and services, we may request your voluntary consent to collect and use your information.

　　Our app may ask you to enable specific mobile permissions to deliver a better service experience or improve our products/services. For the detailed list of permissions, please check the "System Permissions List" under "Personal Center - Settings - Privacy" in the app.

　　We may invite you to provide an email address to send you order and flight information or subscribe you to promotional content, including discounts for specific routes, products, or services. Your proactive input will be considered as consent. We may also conduct promotional campaigns requiring your name and contact details for participation.

　　When you consent to facial recognition, we may offer services such as lounge access or identity verification. For the facial recognition feature itself, we may collect your facial image, facial recognition feature values, valid ID information, and PhoenixMiles membership number. You can enable or disable facial recognition to exercise your own control.

　　If you are an employee of our corporate customer (enterprise, government, etc.), you may complete corporate identity verification and select services. You may voluntarily choose to consent to or cancel the verification.

　　With your consent for personalized recommendations, we will analyze your behavioral preferences based on past ticket purchases/service inquiries to provide tailored content. You can toggle the personalized recommendation setting to control this feature. Disabling it will stop targeted recommendations, though non-targeted content will still appear.

　　Ensure that when providing third-party or sensitive information for these features, you have obtained full authorization and that your actions do not infringe on any third party's legal rights. You must also ensure the third party can comply with privacy policies regarding their data. If a third party requests deletion or correction of their information, you must act promptly; otherwise, you may bear legal consequences. If we change how third-party data is used for business needs, we will notify you, and you must decide whether continued processing is permissible based on their authorization.

　　Additionally, when you follow our official WeChat, Weibo, or other social media accounts, your proactive follow action constitutes consent, allowing us to identify follower details and follow timestamps—used solely for platform interaction. You may withdraw consent by unfollowing at any time.

　　3. Information required to fulfill legal obligations

　　To comply with applicable laws and regulations (e.g., civil aviation rules), we may require your real name and valid ID information. Under cybersecurity laws, we collect and store log data for security tier compliance.

　　Also, during public health emergencies, to safeguard your life, health, and property, we may lawfully collect and use personal information (e.g., travel history verification, temperature checks, or specific health certificates).

　　Collect your personal information through a third party

　　We may receive your personal information from third parties from time to time. These third parties include our affiliates and business partners. We use this information collected from third parties to provide you with services under relevant contracts and to ensure the accuracy of the records we hold about you.

　　In addition, please note that third parties may have their own special privacy policies to explain how they collect and process your personal information. Such privacy policies do not constitute a part of this Privacy Policy. You need to carefully read and decide whether agree with their privacy policies or not.

　　When you use our website, we may collect tracking information including your browser type, operating system type, name of Internet service provider and pages you visit on our website, etc. We use a variety of technologies to obtain this information, including Cookies and Web beacons, to enhance the functionality and ease of use of our websites, products and services to better meet your needs.In addition, we use this information to determine whether visitors are qualified to request services and to aggregate site activity data.

　　Please refer to our Cookie Statement for details on how we use Cookies and similar technologies.

　　1. Our service providers and our affiliates

　　We will allow our third party service providers (including agents, contractors and affiliated companies) to use your Personal Information on our behalf for the purposes set forth in this Privacy Policy. For example: staff who assist you with check-in and boarding, our system service providers. We may also disclose your personal information to third parties to make it easier for them to implement any special arrangements you may require, such as wheelchair services.

　　2. Third parties such as airlines, hotel partners, tour operators, online travel agencies （OTA） , insurance institutions, banks and financial institutions

　　To facilitate and manage your travel arrangements and provide you with the required products or services, we may share your personal information with third parties, such as other airlines (including "Star Alliance" partner airlines, other partners and cooperating codeshare airlines), hotel partners, land or sea transport operators, cooperating insurance institutions or banking financial institutions, as well as travel agencies or other personnel interacting with us on your behalf. Your personal information will be used by these third parties in accordance with their respective privacy policies.

　　3. Partner of Phoenix Miles Membership Program

　　We may share your information with airlines who jointly use PhoenixMiles Membership program and the cooperation partners of PhoenixMiles to facilitate you to enjoy our PhoenixMiles membership products and services, such as your mileage accumulation and exchange, lounge access, etc.

　　4. Our enterprise customers (enterprises, government customers, etc.)

　　We will disclose your travel details and information about your use of our services to our major customers, employees of our enterprise customers, or those who travel or obtain products or services paid for by our enterprise customers.

　　5. Government, regulatory agencies or organisations required by laws

　　We may disclose your personal information to the government, regulatory authorities and legally required entities, such as immigration authorities, Customs and border defense authorities, Civil Aviation Administration and airport authorities, dispute settlement authorities, procurator authorities and law enforcement authorities, such as: The laws of the United States and other countries require us to disclose personal information (Passenger Name Record (PNR) and/or Forecast Passenger Information (API)) about your travel documents, booking details and flight schedules as required by law. We will disclose your personal information to these institutions so that we can provide you with products and services under the law and regulation.

　　6. Our SDK provider. Details are as follows :

　　7. Other circumstances in which we disclose your information to designated third parties with your consent or upon your own initiative.

　　We will not process your personal information without any legal basis. Generally speaking, the legal basis for us to process your personal information would be as followings :

　　• Performance of the contract between you and us, such as general terms of transportation, service agreement for specific products and PhoenixMiles Member's Guide.

　　• Comply with our legal obligations, such as real-name obligations or other information reporting obligations stipulated by civil aviation laws and regulations, our classified protection obligation of cybersecurity under the Cybersecurity Law of China and user information security obligations.

　　• Obtain your consent, such as when you turn on the face recognition function switch, or you allow us to send promotional messages to you.

　　• In order to deal with public health emergencies, or to protect the life, health and property safety of you or other natural persons, for example, we will ask you to measure the temperature at the boarding gate and record passengers whose temperature is abnormal and report to the competent authorities for follow-up treatment.

　　• Within the territory of the EU and / or EEA, for our legitimate interest , including managing your personal information in our IT systems , to improve our products and services, holding on PhoenixMiles Membership activities, to participate in our social activities, for the transaction security to prevent fraud and network information security.

　　(I) Our technology and measures to protect your personal information

　　We value personal information security and will take all appropriate and plausible security control measures to protect your personal information:

　　1. We have used industry-standard security measures to protect your personal information from unauthorised access, public disclosure, use, modification, damage or loss. We will take all reasonable and practicable steps to protect your personal information. For example, we use transport layer security protocol encryption technology and use a combination of strong cryptographic algorithms (such as ECDSA key agreement, AES256 channel encryption and other technologies) to ensure security during transaction transmission. For the storage of personal information data, industry-standard encryption technology is used to encrypt and store user personal information securely. Our access to stored data is logged and saved by relevant logs, and centralized log collection and integrity monitoring ensures that log files are not tampered with. We also periodically perform internal and external security scans and penetration tests to ensure the safety of the production systems.

　　2. Certifications: Our core business system has passed the People's Republic of China Information System Level Protection Level 3 certification, and we have obtained ISO27001 certification and PCI DSS certification.

　　3. We have appointed a Data Protection Officer (DPO) to be responsible for and overlook the data protection and compliance operations within the company. We have also established a data security team to promote and protect personal information security. We regulate the collection, transmission, use and storage of personal information through established information security management systems. We signed the Non-disclosure Agreement with all members, requiring all personnel who may be exposed to personal information to perform their respective confidentiality obligations. Furthermore, we regularly train employees on proper information security and privacy protection measures to enhance employees’ awareness of the importance of protecting personal information.

　　4. The Internet is not an absolutely secure environment, and certain communication methods such as e-mail are not encrypted. We strongly recommend that you do not send personal information using such methods. Please use complex passwords to help us keep your account secure.

　　5. The Internet environment is not absolutely secure, but we will do our best to ensure the security of any information you send us. If our physical, technical, or administrative protective equipment is destroyed resulting in unauthorised access, public disclosure, alteration, or destruction of information, that result in damage to your legal rights, we will bear the corresponding legal responsibilities.

　　6. In response to possible risks such as leakage, damage and loss of personal information, we have formulated emergency measures. In the event of classified and categorized leakage of personal information, event reporting and disposal procedures are in place which a dedicated emergency response team. In the unfortunate event of personal information being at risk, we will promptly inform you in accordance with the requirements of laws and regulations: the current situation, the possible impact of the security incident, the disposal measures we have taken or will take, and how you can prevent and mitigate the risks autonomously, and any possible suggestions, remedies for you, etc. We will promptly inform you of the relevant circumstances of the incident by mail, letter, telephone, push notification, etc. When it is difficult to inform the affected parties individually, we will issue a notice in a reasonable and effective manner. If you find that your personal information has been leaked, please contact our customer service immediately so that we can take appropriate measures.

　　At the same time, we will also report the disposal of personal information security incidents in accordance with the requirements of the regulatory authorities.

　　(2) Preservation of your personal information.

　　We will store your personal information for the shortest period necessary to achieve the purpose stated in this Privacy Policy, except for where applicable laws and regulations require, such as the E-commerce Law of China requires us to store your transaction order information for no less than three years. After you cancel your account, we will also delete or anonymise your personal information. When your personal information storage exceeds the minimum period required for the above purposes, we will delete or anonymise your personal information.

　　We protect your personal information rights in accordance with the applicable laws, including:

　　1. Inquire, copy, and portably transfer your personal information

　　Unless otherwise provided by law or we have specific confidentiality obligations, you have the right to access your personal information at any time by:

　　(1) Your Account information:

　　Website Account Information: You can view or modify your personal information in the "Personal Center" after logging in as a user through the option on the top right corner of the home page of the website. APP: You can click on the "Member's Avatar" menu on the "Personal Center" page to view the information you have submitted. Commercial Travel Platform System Account Information: you can log in to the Commercial Travel Platform system and view your personal information in "Personal Information", if you need to modify your personal information, please contact the system administrator of the enterprise you belong to to modify it.

　　Member information: You can log in "PhoenixMiles " website, through "my Account - Account management" and "mileage bill" to access your membership information and mileage information.

　　(2) Your order information:

　　On the PC, you can view all of your completed, pending or after-sale orders in "My Orders" after logging into account through the option on the top right corner of the home page of Air China's website. In the mobile app, you can view your order history by visiting the "Home Page"-"Personal Centre" page. The specific path is: "Home Page" - "Personal Centre" - "All Orders". In Discount Business Travel System, you can view all your completed, pending payment or after-sale orders by visiting the "Ticket Orders" page after logging in to your account. On the Phoenix Miles website, you can check your order information by visiting "Home Page" - "My Account - Transaction Centre".

　　(3) Your browsing information:

　　You can access or clear your search history, access and modify interests, and manage other data. PC: Clear your history through your browser.

　　(4) If you need to inquire or copy any other personal information generated during the use of our products and/or services, please feel free to contact us by dialing 95583 or email dpo@airchina.com.

　　In addition, you have the right to request that we provide you with a copy of your personal information processed by us and, subject to legal or regulatory requirements, you also have the right to request that we transfer your personal information to other personal information processors designated by you.

　　2. Correct or update your personal information

　　If you find that our processing of your personal information is inaccurate and affects the realization of your rights and interests, you have the right to request us to correct or update your personal information at any time. You can further apply for correction on the personal information query page or through the channels above. If you still have questions, or if it is difficult to correct, you can call 95583 or submit a correction or supplementary application to us at dpo@airchina.com.

　　3. Delete your personal information

　　You have the right to request us to delete your personal information from our information systems as permitted by law, information that you may remove or delete from our products and/or services pages, and by calling 95583 or making your request to dpo@airchina.com, except where we are required by law to continue to store your personal information for a specific period.

　　In addition, for technical reasons, when you delete information, we may not delete the corresponding information in our own system immediately, but will delete the information when backup update, during which time we will only store and take security measures.

　　4. Change the scope of your consent or withdraw your consent

　　For personal information obtained by us based on your consent, you have the right to change the scope of your consent or withdraw your consent by disabling device functions, setting privacy Settings, canceling corporate customer identity authentication, turn off personalized recommendations, or canceling your account.

　　Please understand that after you withdraw your consent, we will no longer process the personal information obtained based on your consent, which will affect the products or services provided to you corresponding to this part of personal information. However, your decision to withdraw your consent or authorization will not affect the prior processing of personal information based on your consent before .

　　5. Cancel your account

　　If you choose to permanently cancel your Air China account, you can log in to the Air China website and apply for cancellation under "Personal Centre - Security Settings - Account Cancellation", and if you are a member of Phoenix Miles, your Phoenix Miles membership account will be canceled for you. After successful cancellation, we will stop providing the corresponding products and/or services, and all information and rights in your Air China account, as well as the member mileage and assignee information in your Phoenix Miles account, will be deleted and cannot be recovered, unless otherwise specified by laws and regulations.

　　If you choose to cancel your Phoenix Miles membership account, you can log in to the "Phoenix Miles" website or the "Air China" APP and click "My Account - Account Management - Permanent Account Cancellation", or log in to Air China's official website and select "Member Cancellation Only" in "Personal Centre - Security Settings - Account Cancellation".

　　After you cancel your membership account, we will stop providing corresponding products and/or services to you. Upon your request, unless otherwise required by laws and regulations, we will delete the information in your membership account, and your mileage will also be cleared.

　　6. Refuse us to send you promotional information:

　　You have the right to unsubscribe from the promotional information we send you at any time in the following ways:

　　(1) Please object to such promotional information by selecting the appropriate selection box in the form or sending us an email at dpo@airchina.com at any time thereafter when we collect data.

　　(2) You can go to the official website of Air China and set to refuse to receive "Promotion Notifications" under the page "Personal Center - Information Management - Personal Information - Personalized Information".

　　(3) You can log in to the " PhoenixMiles " website and set "Whether to accept promotional emails/SMS" on the page of "My Account-Account Management".

　　(4) Any email we send you may contain promotional information. You may cancel it at any time by clicking the "Unsubscribe" link at the bottom of the email. However, you should note that your service information cannot be unsubscribed.

　　(5) You can click on the "Home page" - "Personal Center" of the APP to enter the "Basic Information" page to enable or disable whether to receive promotional information pushed to you.

　　(6) You may unfollow or unsubscribe our WeChat official account, Weibo and other official social platform accounts at any time.

　　(7) You can cancel the authentication of enterprise customer employees on our APP at any time.

　　(8) You can turn off personalized recommendations at any time via our app .

　　(9) You can choose to cancel our account.

　　7. Restrict or object to process your personal information

　　You have the right to restrict our processing of your personal information under certain circumstances, and the right to object us to use your personal information for automated decision-making, profiling, or the right to object us to process your publicly available personal Information, or to opt-out the share of your personal information with third parties if required by applicable law.

　　You can request to exercise this right s by sending an email to dpo@airchina.com. Please note that once you exercise these rights, we will stop processing your personal information and wait for you r further requests, such as correcting or deleting your information.

　　8. Right to explain this Privacy Policy

　　When you have any questions about the rules governing the processing of personal information contained in this Privacy Policy, or about the processing of your Personal Information, or you require us to provide specific information in accordance with applicable law, you may request an explanation by sending an email to dpo@airchina.com.

　　9. Exercise of these rights

　　To protect the security of your personal information, we may require you to provide a written request or verify your identity, after which we will respond to your request for rights within a reasonable period permitted by law. Your request will be confirmed or responded within 10 working days. In addition, if you exercise your rights on behalf of others, or if you, as a close relative of a deceased of our passenger, request us to access, copy, correct or delete the information related to the deceased, please provide proof of your identity and the other person's identity, as well as proof of the relationship, such as special power of attorney or death certificate of the deceased.

　　You have the right to file a complaint or legal action with the regulatory authority or court of your residence or the place where the act ion takes place for the exercise of the above rights or our response.

　　We protect the personal information of minors in accordance with applicable laws and regulations. If you are a minor member of PhoenixMiles under the age of 14, you need to bind the account of your legal guardian when using our products or services. If you are not a member but a minor passenger under the age of 14, you must obtain the consent of your legal guardian before using our products and services.

　　In addition, we will only deal with minors under the age of 14 within the scope of products and services needed to purchase a minimum of information and to ensure that the appropriate security measures, not to profile or sent to the sales promotion information, or use their personal information induced the activities which are incompatible with their age and responsibility. To protect the information security of minors' accounts, face recognition will be enabled for children when the account information is modified with the consent of the legal guardian, but children's face recognition information will not be stored.

　　If a minor has provided us with personal information without the consent of their parent or guardian, their parent or guardian may send an email to dpo@airchina.com to delete such information.

　　Personal information collected and generated by us in China will be stored in the territory of China.

　　For the purposes set out in this Privacy Policy, your personal information may be transferred to countries or areas other than your residence. At this time, we will protect the security of your personal information in accordance with applicable laws and regulations and transfer your personal information worldwide, including but not limited to:

　　1. Before transferring your personal information outside of China based on your consent, we will fully inform you of cross-border transfers and request your explicit consent in accordance with the applicable laws.

　　2. If your personal Information is transferred outside of China, we will carry out risk assessment and/or personal information protection impact assessment in accordance with the law and regulatory requirements or sign standard contractual clauses released by the Cyberspace Administration of China.

　　3. If your personal information is transferred outside of EU to a country where the EU Commission has not made a sufficient decision, we will sign the standard contractual clauses approved by the EU Commission and take security measures to protect your personal information.

　　This Privacy Policy will be changed to adapt to the law, technological and practice changes.

　　However, we will not reduce your rights under this Privacy Policy without your express consent. We will post any changes to this Privacy Policy on this page. For major changes involving your rights, we will also provide more significant notifications, such as in- APP notification or email notification.

　　We will also archive older versions of this Privacy Policy（May 2018，October 2018，June 2019，November 2020，June 2021，November 2021，September 2022，August 2023，March 2024，September 2024，October 2024，November 2024）for your review.

　　If you want to know more information about this privacy policy, including exercising your rights, complaints, or the rules of the processing of your personal information, if you have any questions, you can contact our data protection officer, or EU regional representative, we will respond to your request within the time frame required by laws:

　　Data Protection Officer

　　Email: dpo@airchina.com

　　Address：Room 4004 (4th Floor) No. 16 Tianzhu West Road, Tianzhu Airport Economic Development Zone, Shunyi District, Beijing, China, 101312

　　EU Representative

　　Email：dpo@airchina.com  

　　Address：4 Düsseldorfstrasse, 60329, Frankfurt, Germany

　　If your concerns are not resolved, you have the right to complain to your local authorities, workplace, or local regulatory agency, where you believe a violation occurred.

　　Latest Updated on: July 30, 2025

　　If there is a separate privacy policy or special provisions related to personal information protection in a certain product or service provided by us, this Privacy Policy of the product will be preferentially applied. Contents not covered by the Privacy Policy and terms and conditions of the product shall be subject to this Privacy Policy.

　　This Privacy Policy is compiled in Chinese. In the event of any inconsistency or ambiguity between the Chinese version and the translated version, the Chinese version shall prevail.

　　We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section.

　　Shenzhen Airlines is an airline that is established in 1989 and a member of the world's largest airline alliance, Star Alliance. Shenzhen Airlines is headquartered in the People's Republic of China. By the March 2018, Shenzhen Airlines has more than 204 aircrafts in total, including B-737, A-320, A-319 and other models, operating nearly 300 domestic and international lines.For more information about Shenzhen Airlines, please see the “About Us” section of our Website.

　　The personal information that we may collect about you broadly falls into the following categories:

　　• Information that you provide voluntarily

　　In order to use our Services, including our Website, we may ask you to provide personal information voluntarily such as.

　　o contact information such as your name, address, telephone number, email address, fax number;

　　o Phoenix Miles member account number;

　　o flight information (e-ticket number, seat number, passenger type, flight date, flight itinerary);

　　o online payment information (credit card number, billing address);

　　o personal preferences (dining, seat, language);

　　o identity information such as your identification number, passport number, gender, nationality, country of residence; and

　　o personal information for others in your travelling party.

　　We use this personal information to facilitate your travel, provide you with other goods and Services, to administer our Phoenix Miles loyalty programme, and to provide you with information about us. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

　　Some of the personal information that you provide may include sensitive personal information, such as health-related information or information about your race or ethnicity, which we need for to improve our service provided to you and protect your own interests. We will request your consent when we ask you to provide your sensitive personal information.

　　• Information that we collect automatically

　　When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws.

　　Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

　　Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

　　Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies and similar tracking technology” below.

　　• Information that we obtain from third party sources

　　From time to time, we may receive personal information about you from third party sources, but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

　　The types of information we collect from third parties include travel professionals, and others who assist in booking and arranging travel. We use the information we receive from these third parties to provide services to you, and maintain the accuracy of the records we hold about you.

　　In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.

　　We may disclose your personal information to the following categories of recipients:

　　• to our group companies, third party services providers and partners who provide data processing services to us (for example, to support the delivery of our Services or to provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information.

　　• to other airlines, such as our Star Alliance, joint venture, interline and codeshare partners, which furnish you with access to VIP airport lounges, perform part of the carriage, or assist with rebooking your flight should any disruption of your itinerary occur; We only share data with these airlines to the extent it is necessary for the performance of a contract with you.

　　• to third parties, such as employers and travel professionals, who have arranged for discounts, purchase travel or provide other services on your behalf. We only share data with these third parties to the extent it is necessary for the performance of a contract with you.

　　• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

　　• an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.

　　• to any other person with your consent to the disclosure.

　　If you are a visitor or customer from the European Economic Area, Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

　　However, we will normally collect personal information from you only (i) where we need the personal information to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

　　If we ask you to provide personal information to comply with a legal requirement or to perform a contact with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

　　If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our company and communicating with you as necessary to provide our services to you and for our legitimate commercial interest, for instance, when responding to your queries, improving our products and services, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

　　If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below.

　　We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you, including to serve interest-based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Statement.

　　We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include Secure Socket Layer (SSL) encrypting technology and compartmentalization of access rights to secure the transmission of your data from your web browser to our internet system.

　　Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

　　Specifically, our Website servers are located in the People's Republic of China, and our group locations and third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.

　　However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group locations, which require all group locations to protect personal information they process from the EEA in accordance with European Union data protection law.

　　Our Standard Contractual Clauses can be provided on request.

　　We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

　　When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

　　If you are a resident of the European Economic Area, You have the following data protection rights:

　　• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.

　　• In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “How to contact us” heading below.

　　• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “How to contact us” heading below.

　　• Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

　　• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries (including the US and Canada) are available here.

　　We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

　　We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

　　You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

　　If you have any questions or concerns about our use of your personal information, please contact [us / our data protection officer] using the following details: [dpo@shenzhenair.com].

　　The data controller of your personal information is Shenzhen Airlines Co., Ltd..