In order to facilitate your travel, and to provide you with information about us, we collect and maintain personal information about you. We collect personal information about you from:

　　• You, when you voluntarily provide us with information

　　• Your browser, when you visit our web site and your browser interacts with us

　　• Your transactions with the Air China web site

　　• Air China travel partner web sites (for example, hotel partners, car rental partners and tour company partners), in connection with meeting your needs.

　　The personal information we collect about you through these various sources may include:

　　• Name, addresses and telephone numbers

　　• Email addresses and fax numbers

　　• PhoenixMiles frequent flyer program account number and flight information

　　• Online forms of payment like credit card number(s), including associated billing address(es) and expiration date(s)

　　• Information necessary to facilitate travel and related services, including travel companion(s) names, emergency contacts, special service needs

　　• Passport number, nationality and country of residence

　　• Transactional and online activity data pertaining to mileage activity with airline companies participating in the PhoenixMiles frequent flyer program

　　• Use of products and services such as self-service devices, and on-line tools available on this web site, such as flight status notification and web check-in

　　• Personal information provided via survey, focus group or other marketing research efforts

　　• Personal information provided to customer-service representatives to research and resolve issues or questions

　　• Corporate-contract, employer and/or other corporate affiliation (i.e. employer name, title, address and contact information)

　　When you use our site, we may collect tracking information such as your browser type, the type of operating system you use, the name of your Internet service provider, and pages visited on our site. Air China obtains this information by using technologies, including cookies and web beacons, to increase the functionality and user-friendliness of our site and to better tailor our site, products, and services to our visitors’ needs. We also use this information to verify that visitors meet the criteria required to process their requests and for reporting onsite activity in the aggregate. For further information on cookies and web beacons, and how you may elect to reject them, please refer to the section "Cookies and Web Beacons" below. These processing activities rely on the consent you give to the use of cookies and similar technologies when accessing our website.

　　Minors (under age 18) are not permitted to use this web site. As we cannot distinguish the age of persons who access our web site, a blanket privacy policy is applied. If a child has provided us with personal information without parental or guardian consent, the parent or guardian should email us at customer_relations@airchina.com to remove the information or unsubscribe from any promotional contact opportunities. Air China does not intend to or seek to receive information from minors.

　　Air China uses personally identifiable information to complete transactions and fulfill requests for our services. Air China requires you to provide personal information when making a reservation to purchase airline tickets or ancillary travel products and services on this web site, or enrolling in the PhoenixMiles program. These processing activities rely on the compliance of a contract entered into you and Air China. In addition to processing, confirming and fulfilling the travel or other services you request, Air China may use these data for administrative and analytical purposes such as accounting, billing and audits, marketing, credit card processing and verification, customer-relations correspondence, and/or operation of the PhoenixMiles program. These processing activities rely on Air China's duty to comply with its legal obligations, as well as on its legitimate interest in appropriately managing its business.

　　Air China does not sell any customer information or share your email address with third parties except in compliance with this Privacy Policy. We will require all such third parties to give adequate protection to your personal information and to process data according to our requirements. We may disclose or share your information to or with, among others, the following organizations:

　　1. Air China's subsidiaries, e.g. Shenzhen Airlines Co., Ltd., Dalian Airlines Co. Ltd, Air China Inner Mongolia Co., Ltd., Air Macau Company Limited, etc. Such disclosure or sharing of information relies on Air China's compliance with its legal obligations and its legitimate interests in appropriately managing its business.

　　2. IT service providers, social network providers, marketing agencies, credit card companies and other organizations providing business services to Air China. We only share data with these third parties to the extent necessary during our performance of the contract entered into with you.

　　3. Companies affiliated with Air China and/or unaffiliated third parties, e.g. air carriers, land transportation operators, frequent flyer program operators and other companies involved in provision of customer services or fulfillment of customers' requirements. This disclosure of personal data to such third parties is to meet your needs for products and services and relies on the performance of the contract entered into by you and Air China.

　　4. Any competent enforcement, regulatory or government authorities, courts or other third parties, to the extent that we deem it necessary (i) according to applicable laws or regulations, (ii) to exercise, establish or protect our legitimate rights, (iii) to protect the vital interests of you or any other persons, or (iv) to ensure in-flight order and security. Such information processing activities rely on Air China's compliance with its legal obligations.

　　5. Other entities subject to your consent.

　　If we sell a business unit to another company and your personal data is used by that business unit then your data may be transferred to the buyer along with the business for them to use in the same way. We will not transfer the data if this is contrary to applicable law. Such processing activity relies on Air China's legitimate interest in being able to transfer its businesses.

　　If you are a new customer, where we permit certain third parties to use your data, we (or they) will contact you by e-mail only if you have consented to this. We (or they) will contact you for the purposes of informing you about our (their) company news, products and services. Please indicate your consent to being contacted by e-mail by ticking the relevant box situated on the form on which we collect your data.

　　If you are an existing Air China customer, we will only contact you by e-mail with materials about products or services similar to those which have been previously provided to you (unless you consent to receiving e-mails about other products or services by ticking the relevant box situated on the form when we collect your data) unless you object or have objected to it.

　　If you have explicitly consented through our web site, we will, from time to time, use your data to deliver by e-mail materials about selected third parties, including Air China ancillary travel and promotion partners, which may be of interest to you.

　　You have the right to ask us not to process your data for marketing purposes. You can exercise your right to prevent such processing by informing us through the opt-out boxes on the forms we use to collect your data or at any time after this by e-mailing at customer_relations@airchina.com.

　　Where Air China wishes to obtain your consent for any of the aforementioned purposes, please indicate you consent to it as described in this section “How Your Information Will Be Used” by ticking the relevant box(es) situated on the form on which we collect your data.

　　We will not store your personal data beyond the period necessary for the purposes for which it was collected for and will only store the same for as long as it is necessary in accordance with our data retention policy.

　　The personal data that we collect from you may be transferred to, and stored at, a destination outside your country. We will always take steps to ensure that your personal data is used by third parties in accordance with this Privacy Policy and that your personal data is kept secure at all times. In particular, in relation to any transfer to and storage at a country that is not subject to an adequacy decision by the EU Commission, such transfer will be appropriately protected through the following mechanisms: EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or Binding Corporate Rules.

　　Your data may also be processed by staff operating outside your country who work for companies within the Air China or for one of our third party suppliers. These staff may be engaged in, among other things, the fulfilment of your booking, the processing of your payment details and the provision of support services. The purposes of the processing of your data are as set out in the first paragraph of “How Your Information Will Be Used”. Those processing the data include service providers working with Air China providing internet booking engine services, computer reservation system services, online payment management services, and email services. Air China will take all necessary and reasonable measures to ensure your data is processed in a safe manner in compliance with this Privacy Policy.

　　Air China uses links to other Internet sites to improve your experience of our web site. We will always seek to make these links clear by opening them in a new window of your web browser. However, please be aware that these web sites may be owned and run by other companies and organizations. Air China does not endorse any such web sites and we are not responsible for the information, material, products or services contained on or accessible through those web sites. Your access and use of such web sites remains solely at your own risk. We cannot accept responsibility for any information you divulge to a linked web site.

　　Please note that the Air China Privacy Policy does not cover these other web sites, and Air China would recommend that you review the privacy notices that apply to these web sites before you use them.

　　A cookie is a text-only string of information that a web site transfers to the cookie file of the browser on your computer's hard disk so that the web site can remember who you are. Cookies will typically contain the name of the domain from which the cookie has come, the "lifetime" of the cookie, and a value, usually a randomly generated unique number. Two types of cookies are used on this web site - session cookies, which are temporary cookies that remain in the cookie file of your browser until you leave the site, and persistent cookies, which remain in the cookie file of your browser for much longer (though how long will depend on the lifetime of the specific cookie). Most browsers have options that allow the visitor to control whether the browser will accept cookies, reject cookies, or notify the visitor each time a cookie is sent. You may elect to reject cookies by adjusting your browser's settings, but doing so will limit the range of features available to the visitor on our site and most other major web sites that use cookies. To find out more information about cookies, please visit www.allaboutcookies.org.

　　Web beacons are used in conjunction with cookies to record the simple actions of the user opening the page that contains the beacon. When a user's browser requests information from a web site in this way certain simple information can also be gathered, such as: the IP address of your computer; time the material was viewed; the type of browser that retrieved the image; and the existence of cookies previously set by that server. This is information that is available to any web server you visit. Web beacons do not give any "extra" information away. They are simply a convenient way of gathering the simplest of statistics and managing cookies. Web beacons may be disabled [in the same way as you disable cookies.]

　　A growing number of destination countries oblige the airlines that fly to them to transmit passenger data before an aircraft lands in one of them. Usually, these legal regulations encompass the transmission of data on the passengers' identity and travel documents (passport, visa).

　　As a rule, an airline does not have these data, so it must collect them shortly before an aircraft departs, which increasingly is being done by means of the so-called 'machine-readable zone' in the new travel documents. If we are requested to transmit your passenger data to foreign authorities other than the United States or Canada, we will obtain your consent before doing so.

　　This processing activity relies on Air China's duty to comply with its legal obligations, and the potential transfer of personal data outside the EEA is necessary for the performance of the contract entered into by you and Air China or by a third party and Air China on your interest.

　　Collection of the data is done solely for immediate transmission to the authorities of the destination country.

　　Air China takes your data security very seriously. In addition to complying with all applicable data security regulations, to ensure the highest possible security for the transmission of your data between your web browser and our internet system we use the Secure Socket Layer (SSL) encrypting technology. SSL is an industry standard way to send personal information over the Internet. It enables an encrypted communication respectively transfer of documents via the internet between web browser and web server. The URL of a web site with SSL connection to your browser starts with https://. SSL is fast, secure, and it ensures that your personal information will not be read by anyone else.

　　You have certain rights under applicable laws with respect to your personal data:

　　You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller.

　　In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

　　These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

　　To exercise any of these rights, you can get in touch with us by sending an email to customer_relations@airchina.com. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.

　　Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.

　　If you wish to know more about any matters in this Privacy Policy or wish to exercise your rights in relation to your personal information, make enquires or lodge a complaint, or opt out of direct marketing, or if you have any question on our processing of your personal information, please contact us according to the following contact details. If you have any unresolved concerns, you have a right to lodge a complaint to local regulatory authority where you live, work or where you believe a breach may have occurred.

　　Data Protection Officer

　　E-mail: customer_relations@airchina.com

　　Address: Room 4004, F4, 16 Tianzhu Xi Road, Airport Economic Development Zone, Tianzhu, Shunyi District, Beijing, China, Post Code: 101312

　　EU Representative

　　Email: customer_relations@airchina.com

　　Address: Duesseldorfer Str. 4, D-60329 Frankfurt/Main Germany

　　Air China reserves the right to amend this Privacy Policy from time to time and the updated versions will be posted on our web site and date stamped so that you are aware of when the Privacy Policy was last updated. We will seek to highlight major changes to amended policies when we post them. You should review our Privacy Policy from time to time as you use our web site so that you remain aware of these changes.

　　This Privacy Policy was last updated on 24 May, 2018.

　　We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section.

　　Shenzhen Airlines is an airline that is established in 1989 and a member of the world's largest airline alliance, Star Alliance. Shenzhen Airlines is headquartered in the People's Republic of China. By the March 2018, Shenzhen Airlines has more than 204 aircrafts in total, including B-737, A-320, A-319 and other models, operating nearly 300 domestic and international lines.For more information about Shenzhen Airlines, please see the “About Us” section of our Website.

　　The personal information that we may collect about you broadly falls into the following categories:

　　• Information that you provide voluntarily

　　In order to use our Services, including our Website, we may ask you to provide personal information voluntarily such as.

　　o contact information such as your name, address, telephone number, email address, fax number;

　　o Phoenix Miles member account number;

　　o flight information (e-ticket number, seat number, passenger type, flight date, flight itinerary);

　　o online payment information (credit card number, billing address);

　　o personal preferences (dining, seat, language);

　　o identity information such as your identification number, passport number, gender, nationality, country of residence; and

　　o personal information for others in your travelling party.

　　We use this personal information to facilitate your travel, provide you with other goods and Services, to administer our Phoenix Miles loyalty programme, and to provide you with information about us. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

　　Some of the personal information that you provide may include sensitive personal information, such as health-related information or information about your race or ethnicity, which we need for to improve our service provided to you and protect your own interests. We will request your consent when we ask you to provide your sensitive personal information.

　　• Information that we collect automatically

　　When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws.

　　Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

　　Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

　　Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies and similar tracking technology” below.

　　• Information that we obtain from third party sources

　　From time to time, we may receive personal information about you from third party sources, but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

　　The types of information we collect from third parties include travel professionals, and others who assist in booking and arranging travel. We use the information we receive from these third parties to provide services to you, and maintain the accuracy of the records we hold about you.

　　In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.

　　We may disclose your personal information to the following categories of recipients:

　　• to our group companies, third party services providers and partners who provide data processing services to us (for example, to support the delivery of our Services or to provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information.

　　• to other airlines, such as our Star Alliance, joint venture, interline and codeshare partners, which furnish you with access to VIP airport lounges, perform part of the carriage, or assist with rebooking your flight should any disruption of your itinerary occur; We only share data with these airlines to the extent it is necessary for the performance of a contract with you.

　　• to third parties, such as employers and travel professionals, who have arranged for discounts, purchase travel or provide other services on your behalf. We only share data with these third parties to the extent it is necessary for the performance of a contract with you.

　　• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

　　• an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.

　　• to any other person with your consent to the disclosure.

　　If you are a visitor or customer from the European Economic Area, Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

　　However, we will normally collect personal information from you only (i) where we need the personal information to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

　　If we ask you to provide personal information to comply with a legal requirement or to perform a contact with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

　　If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our company and communicating with you as necessary to provide our services to you and for our legitimate commercial interest, for instance, when responding to your queries, improving our products and services, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

　　If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below.

　　We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you, including to serve interest-based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Statement.

　　We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include Secure Socket Layer (SSL) encrypting technology and compartmentalization of access rights to secure the transmission of your data from your web browser to our internet system.

　　Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

　　Specifically, our Website servers are located in the People's Republic of China, and our group locations and third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.

　　However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group locations, which require all group locations to protect personal information they process from the EEA in accordance with European Union data protection law.

　　Our Standard Contractual Clauses can be provided on request.

　　We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

　　When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

　　If you are a resident of the European Economic Area, You have the following data protection rights:

　　• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.

　　• In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “How to contact us” heading below.

　　• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “How to contact us” heading below.

　　• Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

　　• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries (including the US and Canada) are available here.

　　We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

　　We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

　　You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

　　If you have any questions or concerns about our use of your personal information, please contact [us / our data protection officer] using the following details: [dpo@shenzhenair.com].

　　The data controller of your personal information is Shenzhen Airlines Co., Ltd..