14 March 2018
We will below explain how we collect, use, transfer, store or otherwise process any personal data relating to you as a Profile Account holder. Our aim is to be as clear, transparent and candid as possible. Should you still have questions about how we process your personal data, please contact our Data Protection Officer at firstname.lastname@example.org.
What is personal data?
Personal data means any information relating to you as a natural person and through which you can be identified, directly or indirectly, such as your name or photo.
What does processing mean?
Processing of personal data means any operation or set of operations performed on personal data, whether or not by automated means. All actions carried out on personal data, from collection and storage to alteration, use or disclosure thus constitute ‘processing’.
The legal bases for our processing of personal data
Performing the Profile Account Terms and Conditions
Your choice to create a Profile Account necessitates SAS to register and process your personal data and your activities while logged in and using our website. We will thus process your personal data on the legal basis that the processing is necessary in order to fulfil our requirements under the Profile Account Terms and Conditions.
We will process personal data based on our legitimate interests to remain competitive within our market segment and therefore to be able to, among other things, analyse the personal data of our Profile Account holders related to booking flights, popular destinations, choice of ancillary products, use of the homepage and application, and following up the outcome of e.g. email communications.
We will also process personal data based on our legitimate interests to prevent, investigate or report cases of fraud or safety issues and to cooperate with law enforcement agencies.
We have weighed our legitimate interest against the level of privacy intrusion that our processing of your personal data could lead to. We process your personal data on a general and aggregated level, in a transparent manner, for the purpose of improving our products and services offered to you and with a very high level of security and safeguards in place. We thus assess that the level of privacy intrusion is limited and that our interests of carrying out this processing of personal data is justified and legitimate.
We will process your personal data when we are under a legal obligation to do so, for instance when we are obliged to provide information to government authorities or we are subject to a court order.
What personal data will we process?
SAS registers and processes the following personal data about you and your activities, collectively the “personal data”:
• Personal data submitted when you create, maintain or update the Profile Account.
• Details collected regarding your travels and use of your Profile Account, such as origin and destination for the trip, carrier, type of tickets, luggage, pre-ordered meals, duration of stay, any complaints made, time of purchase, and amounts paid.
• Information on customer care and travel irregularities such as delayed or cancelled flights, lost luggage, and complaints, refunds, and compensation paid.
• Process, on an aggregated level, all reservations and total revenue in order to optimise e.g. the flight network and pricing.
Where do we get your personal data from?
The personal data that we process is primarily collected directly from you, e.g. when you enter your contact details to register a Profile Account. In addition, we collect and derive personal data from our flight schedules, airport departments and systems as necessary to fulfil our requirements under the Profile Account Terms and Conditions.
For what purposes do we use the data?
The personal data is registered and processed for the following purposes:
• Administer the Profile Account and bookings etc. made through the account.
• Manage and carry out your bookings and travels.
• Provide you with relevant information, such as booking information with flight dates, pre-ordered meals, seat selection, luggage purchased, in anticipation of an upcoming trip, as a message on the Profile Account or if you have requested to receive information through a different channel of communication, through that channel.
• Register and analyse information on customer care and travel irregularities in order to e.g. follow-up on and improve our customer care services on a general and aggregated (i.e. not individual) level.
• Carry out statistical analyses on needs, preferences and purchasing behaviour on a general and aggregated (i.e. not individual) level.
• Perform basic analyses on the use, frequency, preferred features and length of visits on our SAS website and application, to maintain, optimise and continuously improve the functionality and features of our digital platforms and the Profile Account.
• Update your contact information and cancel/block accounts of deceased customers.
How long will we keep your personal data?
We process the personal data regarding you as long as you are registered with an account. Your personal data is retained until the Profile Account is terminated.
Who may access your personal data?
Personal data is shared between affiliates within the SAS group to operate our international flights, to manage the Profile Account, for statistical analyses, among other things.
Personal data that is shared within the SAS group will sometimes be transferred to countries that do not belong to the European Union (“EU”) or the European Economic Area (“EEA”) and which do not ensure an adequate level of protection for personal data. Such transfers will be carried out in compliance with applicable data protection laws.
When transferring personal data to a non-EU/EEA country without an adequate level of protection for personal data we will apply appropriate safeguards normally by entering into standard contractual clauses adopted by the European Commission. The standard contractual clauses can be found via the following link: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm.
Who can I talk to about my personal data and my rights?
Scandinavian Airlines System Denmark- Norway-Sweden, a consortium established under the laws of Denmark, Norway and Sweden, and having its principle office at Frösundaviks allé 1, SE-195 87 Stockholm, Sweden, is the controller which will determine the purposes and means of the processing of your personal data.
SAS is the legal entity responsible for personal data in accordance with applicable legislation on data protection, including the General Data Protection Regulation (EU Regulation no. 2016/679).
SAS has designated a Data Protection Officer who supports SAS in ensuring that the members’ personal data is processed correctly. You may contact the Data Protection Officer with questions or requests relating to the processing of your personal data, at the following address: email@example.com.
If you have questions about your Profile Account, please refer to our contact details at flysas.com.
What are my rights?
For instance, you have the right to access the personal data that we process on you. You can easily obtain an excerpt of the personal data on you that we process and find more information by signing in to your profile account.
In the same way, you can find further information on and enforce also the following rights:
• Correct, update or delete information that is incorrect or incomplete on your profile account.
• Object to or restrict our processing of your personal data.
• To be forgotten. The right to be forgotten means that you may request that we delete all the personal data we have collected on you.
• Receive a copy of the personal data related to you and information regarding our processing of your personal data in a commonly used data format and to transmit – or have transmitted, where technically feasible – the data to another controller.
• Request that personal data not be used for direct marketing purposes.
• Lodge a complaint to the data protection authority within your jurisdiction, which in Sweden is the Data Protection Board (Sw. Datainspektionen).
You can also find more information about all the different safeguards and technical measures we have put in place to protect your data and your right to privacy and freedom and to ensure that we are fully compliant with applicable data protection legislation.
If you require assistance or have any questions regarding your rights, please contact our Data Protection Officer at firstname.lastname@example.org.
You are at any time welcome to become a EuroBonus member by clicking on the following link: https://www.sas.se/en/eurobonus//. In our EuroBonus program, we offer a range of easy, joyful and personalised services and offers to make life easier for our members.
When may SAS ask me for my consent?
In certain situations, we will need your consent in order to process your personal data.
Hence, we may ask you for your consent e.g. to process personal data to better understand your needs and preferences, i.e. for profiling purposes, to use information stored in cookies, or to pre-complete booking forms with your contact details, accompanying persons, passport and payment data etc. to facilitate a faster and simpler use of our services.
We may also ask for your consent to use post, mobile phone, SMS, MMS, email, social media and other digital channels to send promotional communications to you concerning our, or our business partners’, products and services.