REGULATIONS FOR THE PROCESSING OF PERSONAL DATA BY GLOBAL AIRLINE SERVICES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ – PRIVACY POLICY

Global Airline Services Spółka z o.o. (hereinafter referred to as GAS) with its registered office in Warsaw at the address: 01-471 Warsaw, ul. Narwik 10/6, processes personal data as the Personal Data Controller under Regulation (EU) 106/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, i.e. EU General Data Protection Regulation (GDPR).

1. Personal data, as defined in the GDPR, means any information related to identifying a natural person in any form (by means of writing, sound, image), such as: name, surname, address, telephone number, e-mail address, PESEL number, NIP number, passport or other document number and its expiry date, image of the person, date and place of birth, ethnicity, gender, number, citizenship, credit card details.
2. Personal data database, as defined in the GDPR, means any structured filing system containing personal data, available according to predetermined criteria. GAS owns databases containing personal data of employees, customers, suppliers or associates which may be accessed solely by authorized employees.
3. Personal data processing, as defined in the GDPR, means any operations performed on personal data, such as collecting, retaining, erasing, sharing, compiling.
4. GAS offers services in the field of sale of airline tickets and travel management. We provide these services directly or though our partners. Therefore, your personal data may be processed for the following purposes:

• Preparing an offer for the sale of airline tickets, organizing a tourist service, including hotel, railway, bus and other reservations, as indicated by the client, making reservations in reservation systems, handling the visa process, sending data to service providers and entities involved in the reservation process, distributing messages, handling claims, creating a traveller profile, provided that the traveller is of age when organizing the travel. The data will be processed pursuant to Article 6(1)(b) of the GDPR, as this is necessary to perform the contract, i.e. to purchase the service or take necessary actions before and after purchasing the service.
• Carrying out marketing activities. The data will be processed pursuant to Article 6(1)(f) of the GDPR, i.e. to pursue the legitimate interest of the Controller. In this case, the legitimate interest involves presenting an offer for products and services, but only if you are already our client or have agreed to receive commercial information electronically. You have the right to object to this processing operation.
• Handling telephone sales and customer contact channels, recording and accounting for the sale, preventing fraud related to services and improving services, handling withdrawal from the contract, administrative purposes. The data will be processed pursuant to Article 6(1)(f) of the GDPR, i.e. to pursue the legitimate interest of the Controller. In this case, the legitimate interest involves using the IT infrastructure to provide services, providing after-sale services, accounting for the services sold and sales management in a broad sense. You have the right to object to each of these processing operations.
• Following guidelines issued by authorized state administration bodies. The data will be processed pursuant to Article 6(1)(c) of the GDPR, i.e. to fulfil the legal obligation of the Controller.
• Protecting your (or other persons’) health, life and property in the event of an emergency while travelling. The data will be processed pursuant to Article 6(1)(d) of the GDPR.
• Implementing own loyalty programmes and those of service providers. The data will be processed on the basis of Article 6(1)(a) of the GDPR, i.e. your consent given directly or through a specific, informed and clear statement of intent.
• Establishing cooperation between GAS and the entity you represent, correspondence as part of the cooperation that has already been established. The data will be processed pursuant to Article 6(1)(f), to pursue the legitimate interest of the Controller. In this case, legitimate interest involves establishing and continuing business relations. You have the right to object to this processing operation.

5. Personal data will be provided on a voluntary basis, but it is a necessary condition for the performance of the order. If GAS does not receive personal data, GAS will be unable to perform the order involving services where the provision of data is necessary.
6. To whom may we transfer your personal data and for what purpose?    We may transfer your data to:

• our employees and associates who need to have access to these data to be able to fulfil our obligations or carry out activities for you;
• like most entrepreneurs, we are also supported by other entities in our business activities which often involves the need to transfer personal data. Therefore, if required, we transfer you personal data to the following recipients:
• entities providing marketing services for us;
• entities providing system services who are intermediaries in reservation processes;
• entities operating our IT and ICT systems;
• entities engaged in payment activities (banks, payment institutions);
• entities engaged in postal, courier or transport activities – freight transport or forwarding services;
• entities purchasing debt claims;
• entities providing legal and accounting services for us;
• in addition to this, it may happen, e.g. on the basis of an applicable provision of law or a decision of a competent authority, that we will also have to transfer you personal data to other entities, whether public or private. Therefore, it is extremely difficult to predict who may demand that personal data be shared with them. However, we assure you that we analyse very carefully and thoroughly each demand involving disclosure of personal data to avoid disclosing information to unauthorized persons by accident. 

1. GAS, as the Personal Data Controller, agrees to use adequate security measures, both technical and organizational, to protect personal data being processed. Personal data will be retained by GAS or data processors only for the period necessary to achieve the purposes for which the data are collected or for the period of consent and for the period required by law (in particular tax law and the period of limitation for claims) after its withdrawal.
2. You have the right to access personal data, request rectification, erasure or limitation of processing, the right to object to processing, and the right to transfer data. You have also the right to lodge a complaint with the competent regulatory body (i.e. the President of the Office for Personal Data Protection).
3. Please be informed that GAS does not make automated decisions, including based on profiling.
4. Please be informed that your personal data  may be transferred to a recipient who is an entity based outside the European Economic Area but only insofar as necessary to provide the service ordered by you. Please be informed that if the transfer of your personal data to a third party outside the European Economic Area is a necessary condition for the performance of the service ordered by you due to the legal regulations in force in a third country, we will be unable to guarantee you an adequate level of personal data protection and provide effective legal remedies in third countries. We will make every effort to mitigate the risk, but we ask you to thoroughly consider this issue and make your decision being aware of the risk resulting from the above.

5. Please be informed that GAS has not appointed a Personal Data Protection Inspector. 

6. If you have any questions regarding the protection of personal data or the exercise of privacy rights, please contact the Personal Data Controller at the following e-mail address: rodo@gas.pl.