Personal data

Personal Data Processing and Protection Policy of Ural Airlines, JSC

The principles and rules of protecting individuals when processing their personal data, regardless of their citizenship or place of residence, should comply with the fundamental rights and freedoms, in particular, the right to protect personal data. 
Ural Airlines considers it its priority to ensure safety and security of its customers including information and any other security. 
In order to ensure protection of rights and freedoms of a person and a citizen, Ural Airlines undertakes to guarantee high level of personal data protection, of both existing and potential customers, users of the website, mobile site, and mobile application, and of other persons whose personal data are processed by the company.

Ural Airlines, JSC determines the goals and methods of processing personal data in accordance with the Personal Data Processing and Protection Policy, controls and processes personal data acting as “the personal data operator”, and acts in accordance with the current legislation.

The location of the personal data operator: Ural Airlines, JSC, 1G per. Utrenniy, Ekaterinburg, 620025. 
The Policy is drawn up in accordance with the requirements of Federal Law No. 152-FZ dated 27/7/2006 ‘On Personal Data’ and Regulation (Eu) 2016/679 of the European Parliament and of the Council of 27 April 2016 ‘On the Protection of Natural Persons with Regard to the Processing of Personal Data and On the Free Movement of Such Data, and repealing Directive 95/46/EC’. 

1. Principles of Personal Data Processing
Ural Airlines establishes the following principles:

  • Personal data are processed in accordance with the law, fairly and in a transparent manner.
  • Personal data are processed for clearly defined and specific purposes and shall not be processed in any manner contradicting such purposes or the law.
  • Personal data are processed only to the extent required for the defined purposes.
  • All reasonable and possible measures are taken to ensure correctness and timeliness of personal data, as well as justified measures to guarantee prompt deletion or correction of personal data taking into account the purposes of their processing.
  • Personal data are kept in a form that allows to identify data subjects for a period required for the purposes, regarding which personal data are processed; personal data can be kept for a longer period if they are processed in public interest only, or for the purposes of a scientific or historical research, or for statistical purposes.
  • Personal data are processed in a manner that ensures appropriate security of personal data including protection from unauthorized or unlawful processing and from incidental loss, destruction, or deletion of data, applying appropriate technical and organizational measures.

2. Goals of Personal Data Processing

Ural Airlines, JSC processes personal data for the following purposes:

  • Discharging obligations in rendering services including air transportation or other services, regardless of whether such services are rendered by Ural Airlines or agents on behalf of Ural Airlines;
  •  Managing passenger boarding and flight connection during transfer transportation;
  •  Ensuring safety and security on Ural Airlines flights and complying with the current legal and regulatory requirements that apply to the airline’s activity;
  •  Rendering special services and ensuring individual approach;
  •  Conducting market research;
  •  Conducting marketing campaigns and informing customers of products and services provided by Ural Airlines and its partners;
  •  Carrying out targeted advertising campaign;
  •  Ensuring that messages on flight status etc. are sent;
  •  Improving the website, mobile site, mobile application, products, and services.

3. Methods of Personal Data Processing

Ural Airlines keeps records of all activities related to personal data processing. Personal data are processed both manually and using automation means by collecting, recording, systematizing, accumulating, keeping, specifying (updating or changing), extracting, using, transferring (providing or providing access to), anonymizing, blocking, deleting, or destructing personal data in accordance with the requirements of the current legislation. 

4. Methods of Obtaining Personal Data

  •  Executing a contract with Ural Airlines;
  •  Usage by a customer or a potential customer of the Ural Airlines website or mobile application, customer’s phone calls to the Ural Airlines Contact Center or sending messages by e-mail;
  •  Obtaining information from partner companies including companies that organize customers’ trips, airlines that service previous or subsequent flights, relevant airport services, or customs and immigration services;
  •  Receiving information from companies that participate in loyalty programs and other programs for customers.

5. Categories of Processed Personal Data

  •  Information provided to Ural Airlines in order to complete booking and manage it, as well as to render some other related services, including name, address, e-mail address, contact data, date of birth, gender, passport number, account information, and payment information both of a passenger and of an ordering customer if these are different persons;
  •  Information on a person effecting a sale, for example, a tourist agency or a website;
  • Information of trip details, including flights – data on booking, route, required additional services, and other;
  •  Information on previously rendered services;
  •  Information on online registration and other types of interaction;
  •  Information on using the website, a hostname for an IP-address, user’s browser, its location, contact centres, and mobile programs.

6. Processing Special Categories of Personal Data

Some categories of personal data, such as ethnicity, nationality, religion, political views, state of health, sexual orientation, biometric or genetic information, are special categories of data that require additional protection. Ural Airlines restricts the cases of processing special personal data. However, Ural Airlines is obliged to process special personal data under specific circumstances, for example:

  •  When rendering special medical services during a flight;
  •  When obtaining biometric information (for example, face recognition) during security check before and after transportation by Ural Airlines flights.

Besides, a customer may order services (for example, meals) that are not related to special personal data but may indicate religion, state of health, or other information. 

7. Consent to Personal Data Processing

Ural Airlines processes personal data of its customers and potential customers under their consent in the cases stipulated by the law. Under certain circumstances personal data are collected and used only subject to consent from a customer or a potential customer, including for marketing purposes, including for marketing purposes, including sending information about the airlines Ural Airlines and its partners* of advertising campaigns and messages of other information nature using cookies (text files used for identifying a user’s computer), or processing special categories of personal data. The consent to personal data shall be specific, informed, and conscious. 
In case a personal data subject is incapable, the consent to processing personal data of such subject is given by a legal representative of such personal data subject. Taking into account the existing processing capabilities, Ural Airlines takes reasonable measures to confirm, in the above-mentioned cases, that the consent is given by a legal representative of an incapable person. 
The consent to personal data processing may be withdrawn at any moment. Withdrawing a consent to personal data processing can be made only for the future and cannot impact the lawfulness of personal data processing prior to the moment of such withdrawal. In case a personal data subject withdraws his/her consent, Ural Airlines is unable to render to a customer or a potential customer services that he/she requests, partially or in full. 
In case a consent to personal data processing is withdrawn, Ural Airlines may proceed with processing personal data without a customer or a potential customer’s consent, if there are grounds stipulated by the law. 

8. Rights of Personal Data Subject

  • A personal data subject may request confirmation of whether his/her personal data are processed, and in case such confirmation is provided, he/she may receive information related to processing of his/her personal data.
  • A personal data subject may declare the termination of using his/her personal data. Exception to this rule applies where usage of personal data is required under legal proceedings or in case there are other lawful grounds not to terminate using personal data.
  • A personal data subject may request changing incorrect personal data related to him/her. Taking into account the purposes of processing, a data subject may introduce additions to his/her personal data, including by way of submitting an additional request.
  • A personal data subject may request restricting processing of his/her personal data.
  • A personal data subject may request immediate deletion of his/her personal data.
  • If personal data are processed for the purposes of direct marketing, a personal data subject may object to processing his/her personal data for such purposes.
  • A personal data subject may appeal against actions of a data operator.

9. Personal Data Transfer

Data obtained via a website, mobile site, and mobile application of Ural Airlines may be transferred to authorized employees of Ural Airlines, partner companies (Wings Loyalty program, authorized agencies, other carriers, for example, if one or several flights are performed by other airlines, car rental companies, including Rentalcars.com, companies rendering hotel booking services, including Booking.com, or banks) and other providers of above-mentioned additional services. Any service provider, such as a hotel, a car rental company etc., acts as an independent responsible party having its own policy of confidentiality that can be found at service providers’ directly. Similar situation occurs in the cases when flight tickets are purchased from Ural Airlines directly when one or several flights are performed by another air carrier. If a user goes to third-party websites by external links, Ural Airlines bears no responsibility for confidentiality of personal data. However, Ural Airlines demands from all its partners to apply strict measures to ensure confidentiality and data protection. 
In some cases stipulated by statutory regulations, Ural Airlines will be obliged to provide account information to supervisory authorities under their request, for instance, in case of carrying out mandatory formalities related to immigration, support of defense and security including transport security, counterterrorism and anti-corruption, etc. 
Some of the above-mentioned recipients of customers’ personal data are located outside the territory of the Russian Federation, including within the territory of the European Union and in those countries where such high level of protection personal data is not ensured. In case of cross-border transfer of personal data, Ural Airlines, in accordance with the applicable legislation on personal data protection, aims to ensure adequate level of data protection. In case personal data re transferred to another state, the procedure of personal data processing shall be regulated by the legislation of such state.

 

10. Amending the Personal Data Processing and Protection Policy of Ural Airlines, JSC

The Policy can be amended in order to enhance the level of personal data protection. If the Policy is amended, the amended version shall be immediately placed on the official website of Ural Airlines. 
Please contact the personal data protection inspector at proekt4@u6.ru if you have any questions regarding the Personal Data Processing and Protection Policy of Ural Airlines, JSC. In order to revoke consent to the processing of personal data, the client must send a written application containing a personal signature to the Ural Airlines, the application must be sent by postal communication to the address: 620025, G. Yekaterinburg, per. Morning, 1g. If the consent is revoked by the subject of personal data, the Ural airlines will not partially or wholly be able to provide the client or potential customer with the services for which it has left the request.