This Privacy Notice applies to all personal data you provide to us and also to all personal data which we collect about you, either about how you use our website or mobile application (using "cookies") or about your travel patterns if you make bookings with us.
1. WHO WE ARE?
Wizz AirHungary Ltd. (“Wizz Air” or “we” or “us”) (registered seat: Laurus Offices,Kőér street 2/A, Building B, II-V., H-1103, Budapest, Hungary; companyregistration number: 01-10-140174) acts as a data controller. It means Wizz Airdecides how your personal data is processed and for what purposes.
If you are the customer or passenger of Wizz Air UK Limited (London Luton airport, Luton, LU2 9LY, United Kingdom) the present Privacy Notice applies to you accordingly. In these cases Wizz AirHungary Ltd. acts as joint data controller or data processor in respect of theprocessing of your personal data. When Wizz Air UK Limited and WiZZ Air HungaryLtd. act as joint data controllers, they will, in a transparent manner, determinetheir respective responsibilities for compliance with the obligations undermandatory data protection laws, in particular as regards the exercising of yourrights and their respective duties to provide the information required by suchlaws, by means of an arrangement between them. Irrespective of the terms ofsuch arrangement, you may exercise your rights under mandatory data protectionlaws in respect of and against each of the controllers.
As a data controller, Wizz Air is registered bythe Hungarian National Authority for Data Protection and Freedom of Information(“NAIH”) (the registration number related to theprocessing of passenger data is 01001, the registration number related todirect marketing is NAIH-83118/2015 and the registration number related todatabase development is NAIH-83120/2015NAIH).
2. HOW TO CONTACT US
2.1. Contactdetails of Wizz Air
In respect of dataprotection related questions, to exercise your rights or file a complaint,please contact the Data Protection Officer by sending an email to the emailaddress set forth below. You may alternatively contact us by post at the following address or by choosing the relevant data protection related category of request after logging in to your Wizz Air account or clicking on this link.
Contactdetails of Wizz Air’s Data Protection Officer
Wizz Air has a Data ProtectionOfficer (DPO) to whom you can turn with your questions.
Contact details of the DPO:
Email: firstname.lastname@example.org Postal address:attn.: DPO; Wizz Air Hungary Ltd., Laurus Offices, Kőér street 2/A, Building B,II-V., H-1103 Budapest.
3. YOURPERSONAL DATA –WHAT IS IT?
Personaldata relates to a livingindividual who can clearly be identified from that data, in particularyour name, address, phone number, email address, credit or bank card number,information on special care. Identification can be made by theinformation aloneor in conjunction with any other information otherwise in the datacontroller’s possession or likely to come into such possession.
4. HOW DO WE COLLECTPERSONAL DATA?
We collect your data on our website, mobile app, via email, call centre and post.
5. WHY DO WE COLLECTPERSONAL DATA?(DATA PROCESSING PURPOSES)
We collect anduse your personal data for the following purposes:
a) To createyour WIZZ Account, for this purpose we collect the following data: name, gender,mobile phone number, email address, nationality (citizenship).
b) In order to process yourbooking, we collect the following data: passenger names,addresses, passport or Government issued EU National ID card numbers, telephonenumbers, e-mail and IP addresses, credit/debit card or other payment details.
c) To deliver the servicesyou have purchased from us, for this purpose we collect the following data:passenger name, nationality, gender, phone number, email address, credit orbank card details, information on special care (sensitive personal data),flight details, confirmation number, date of birth, details of traveldocuments, and WIZZ Account number.
d) To facilitate thepurchase of third parties’ services or products on our website. For thispurpose, we collect the following data: passenger name, nationality, gender, phonenumber, email address, credit or bank card details, information on specialcare, flight details, confirmation number, date of birth, details of traveldocuments, and WIZZ Account number.
e) To communicate withyou (for example in the event of flight disruption). For this purpose, wecollect the following data: name and contact details, flight.
f) To send you reminders onunfinished bookings. For this purpose, we collect the following data:selected starting point and destination, one-way or return flight, departure andarrival times, number of passengers, selected fare type, total amount of fareprice, whether the user is a newsletter subscriber, booking type (normal, WIZZ Discount Club, group), selected services, language of the site/Wizz Airapplication.
g) To send you newsletters.For this purpose, we collect the following data: name and contact details,details of your historical searches.
h) To provide offerstailored to your preferences. For this purpose, we collect the following data:name and contact details, details of your historical searches and historicbooking details.
i) To communicate with you to carryout customer satisfaction survey for analytical purposes, for qualityimprovements, for service developments, to improve the performance of thewebsite, to measure the success of our advertising campaigns or to tailorservices to your needs. For this purpose we collect the following data: nameand contact details and historic booking details.
j) To supportadministrative and legal purposes for example anti-fraud screening, forsafety and security purposes. For this purpose, we collect the following data:passenger name, address, phone number, IP address, geolocation data, bookingand transaction history, credit/debit card details.
k) To comply with the mandatory provisions ofthe applicable laws. For this purpose, we collect the following data:personal data related to immigration and customs control, personal data relatedto invoicing, data related to persons requesting special assistance; personaldata related to our obligations in case of flight disruption or flight delay.
We would like to draw your attention to the factthat the personal data you provide us with duringthe creation of your WIZZ Account will be usedfor booking your flight as a passenger with us.
This is why you should make sure that you provide us with personal data during the registration process that exactly matches your travel document that you use for travelling with us.
If your personal data is inaccurate or incomplete, you may have the right to obtain from us the rectification or completion of your personal data according to point 10.2. of this PrivacyNotice.
6.1. PROCESSING SENSITIVEPERSONAL DATA
In certaincases, we also need to process special categories of personal data (sensitive personal data), e.g. health related data, for example when you requestspecial assistance from us and/or an airport operator (such as the provision ofoxygen), or when you provide us with information about your fitness to fly(for instance if you are pregnant, or allergy information) for safety reasons.
To process your sensitive personal data, we willneed to obtain your specific consent, otherwise, we may not be able to provideyou with the requested service(s). We may use your sensitive personal data, where necessary, in order to establish, exercise or defend legal claims, and toensure compliance with the mandatory legal requirements. The transfer of yoursensitive personal data to third parties, even outside the European EconomicArea, may also be required during the provision of the services requested fromus based on mandatory legal provisions.
Based on your consent, we perform profiling in orderto provide you with offers tailored to your needs, preferences and interests.Offers might include, inter alia, discounts on flight tickets, discounts on otherservices, vouchers provided in exchange of participation in surveys. Offersmight mean offers of Wizz Air Hungary Ltd., Wizz Air UK Limited or of ourcontracted partners (e.g. banks issuing WIZZ branded credit/debit cards, withspecial benefits) or other third persons. The offers might be provided viaemail, phone or push notifications.
Profiling is any form of automated processing of your personal data, consisting of the use of personal data to evaluate certain personal aspects relating to you, in particular to analyse or predict aspects concerning economic situation, health, personal preferences, interests, reliability, behaviour or your location/movements.
7. LEGAL BASIS OF DATA PROCESSING
The legal basis of data processing activitiesindicated in point a)-f) of Section 5 of this Privacy Notice lies in Subsection(a) Paragraph (1) of Article 5 of Act CXII of 2011 on the Right ofInformational Self-Determination and on Freedom of Information (hereinafter the“Freedom of information Act”), i.e. based on your consent, andcommencing from 25 May 2018 also Article 6 (1) (b) of the General DataProtection Regulation (Regulation No. 2016/679 of the European Parliament andof the Council) ("GDPR"), i.e. such processing activities arenecessary for the performance of the contract or in order to take steps at the request of data, subject to entering into a contract.
The legal basis of data processing activitiesindicated in point g)-h) of Section 5 of this Privacy Notice lies in Subsection(a) Paragraph (1) of Article 5 and Subsection (a) Paragraph (2) of Article 5 ofthe Freedom of information Act, i.e. based on your consent, and commencing from25 May 2018 also Article 6 (1) (a) and Article 9 (2) (a) of the GDPR, i.e. suchprocessing activities will be based on your consent.
The legal basis of data processing activity indicated in point i)-j) of Section 5 of this Privacy Notice lies in Subsection (a) Paragraph (5) of Article 6 of the Freedom of Information Act, i.e. based on your consent, and commencing from 25 May 2018 also Article 6 (1) (f) of the GDPR, i.e. such processing activity will be based on Wizz Air’s legitimate interest. If the legal basis is the legitimate interest of WizzAir, we will carefully consider your interests and fundamental rights andfreedoms, and whether these override such legitimate interests (balancingtest).
The legal basis of data processing activityindicated in point k) of Section 5 of this Privacy Notice lies in Subsection(b) Paragraph (1) of Article 5 and Subsection (a) Paragraph (5) of Article 6 ofthe Freedom of information Act, i.e. based on your consent, and commencing from25 May 2018 also Article 6 (1) (c) of the GDPR, i.e. such processing activityis necessary for compliance with legal obligation(s).
Consequencesof refusal/failure of providing personal data
Please be aware that we need the personal data listed in point b) of Section 5 in order to perform the General Conditions of Carriage and provide you with our services. If you do not provide us with the requestedpersonal data, we will not be able to provide you with all or parts of theservices you have requested.
If you withdraw your consent or do not provide theconsent for the use of your sensitive data mentioned in Section 6.1, we may notbe able to provide all or parts of the services you have requested. Please notethat in these circumstances you will not be able to cancel or obtain a refundof any fees you have paid.
8. FOR HOW LONG DO WE KEEP YOUR PERSONALDATA?
We process your personal data forthe time required consistent with the purposes set out in this Privacy Noticeor for the period of limitation prescribed in the relevant laws.
We keep your personal data for no longer thanreasonably necessary: for a period of 6 years from the fulfilment of thecontract concluded with us (i.e. deletion of your WIZZ Account) in order tocomply with applicable data retention laws.
We store internet search datacollected concerning you for four days.
In the case of accounting documents, the retention period is 8 years from the closing of the financial year, in accordance with Section 169 of Act C of 2000 on Accounting.
If a court or disciplinary procedureis initiated, then the personal data will be retained until the termination ofthe proceedings, including the duration of any possible remedy, which datathereafter, in the case of civil claims, will be deleted after the civil lawstatute of limitation runs.
In the case of consent-baseddata processing, personal data will be processed until the consent iswithdrawn.
9. FURTHER PROCESSING OF PERSONALDATA
If we wish to use your personaldata for a new purpose, not covered by this Privacy Notice, we will provide youwith a new notice explaining all conditions relating to the new processing priorto the new processing takes place. If required, we will seek your consentbefore commencing the new data processing activity.
10. YOUR PERSONAL DATA PROTECTIONRIGHTS
Pursuant to the applicable dataprotection law you may have the right:
- torequest access to your personal data,
- torequest rectification of your personal data,
- torequest erasure of your personal data,
- torequest restriction of processing of your personal data,
- torequest data portability,
- toobject to the processing of your personal data (including objection toprofiling as well as other rights in connection with automated decision-making),
- towithdraw your consent, andto lodge a complaint withthe supervisory authority.
10.1 Rightto access
You may have the right to obtainfrom us confirmation as to whether or not personal data concerning you isprocessed, and, where that is the case, to request access to the personal data.
You may have the right to obtain a copy of thepersonal data undergoing processing. We may request additional information fromyou for identification or for further copies requested by you, we may charge areasonable fee based on administrative costs
10.2. Rightto rectification
You may have the right to obtainfrom us the rectification of inaccurate personal data concerning you. Dependingon the purposes of the processing, you may have the right to have incompletepersonal data completed, including by means of providing a supplementarystatement.
Your right to rectification is provided by us free of charge in principle but in the case of passenger name changes in the existing booking up to 3 hours before the scheduled time of departure, we may charge you with the costs of the name change if certain conditions are met. For more informationin relation to our rules of name change correction, please click here.
10.3. Rightto erasure (right to be forgotten)
Under certain circumstances you may have the right torequest from us the erasure of your personal data and we may be obliged toerase such personal data. In such cases we will not be able to further provideyou with our services.
10.4. Rightto restrict processing
Under certain circumstances you may have the right to request from us the restriction of the processing your personal data. In this case the respective data will be marked and may only beprocessed by us for certain purposes.
10.5. Rightto object and rights relating to automated decision-making
Under certain circumstances youmay have the right to object, on grounds relating to your particular situation,at any timeto the processing of your personal data, including profiling, by us and we canbe required to no longer process your personal data.
Moreover, if your personal datais processed based on our legitimate interest, you have the right to object atany time to the processing of personal data concerning you for such purpose.
Furthermore, under certaincircumstances in case of automated individual decision-making, you have theright to obtain human intervention.. We inform you that Wizz Air does not apply an automated decision-making mechanism.
10.6. Rightto data portability
Under certain circumstances you may have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format (i.e. in digital form) and you may have the right to request the transmission of that data to another entity without hindrance from us if such transmission is technically feasible.
10.7. Rightto withdraw consent
When the processing of yourpersonal data is based on your consent, you can withdraw your consent at anytime without giving any reason to us, free of charge, by clicking the linkprovided in each newsletter, or via changing preferences in your Wizz Airaccount or mobile device.. The withdrawal of consent does not affect thelawfulness of processing based on consent before its withdrawal.
If you withdraw your consent toour processing your personal data, we may not be able to provide all or partsof the services which you have requested (e.g. in case of special assistanceservice if the processing of sensitive data is required by us).
10.8. Rightto lodge a complaint with the supervisory authority
If you feel that your personaldata rights have been breached, you can also contact and lodge a complaint withthe local data protection authority, in particular in the Member State of yourhabitual residence, place of work or place of the alleged infringement.
You can also contact the HungarianAuthority for Data Protection and Freedom of Information (Nemzeti Adatvédelmiés Információszabadság Hatóság, H-1125, Hungary, Budapest, Szilágyi Erzsébetfasor 22/C.; telephone: +36-1 391-1400; telefax: +36-1 391-1410).
11. HOW DO WE PROTECT YOUR PERSONALDATA?
Wizz Air complies with itsobligations under the applicable data protection laws by
- keepingpersonal data up to date;
- storingand destroying it securely;
- notcollecting or retaining excessive amounts of data;
- protectingpersonal data from loss, misuse, unauthorised access and disclosure and byensuring that appropriate technical measures are in place to protect personaldata.
We takeappropriate technical and organisational measures to ensure the protection ofyour personal data against accidental or unlawful destruction or accidentalloss, alteration, unauthorized disclosure or access, in particular but notlimited to where the processing involves the transmission of data over anetwork, and against all other unlawful forms of processing.
Wizz Air, in line with this, among other things, applies different levels of access rights to the data, which ensures that only the appropriate authorised person has access to the data, whose knowledge of the data is necessary to fulfil his or her obligation arising out of or in connection with the performance of his or her job.
We pay specialattention to the safe transmission of the personal and financial data. Thisdata is transmitted from your computer to the booking server of Wizz Airthrough encrypted channels with the support of the state-of-the-art SecureSocket Layer (SSL) technology.
12. SHARING YOUR PERSONAL DATA
Wizz Air, in the course of its operation, may utilise the services of various data processors and external service providers to handle and process your personal data for specific purposes, on behalf of and in accordance with the instructions of Wizz Air. Inaddition, under the applicable aviation laws Wizz Air is required to share yourpersonal data with governmental bodies, authorities and other enforcementbodies.
The data processors shall process the personal data at most as long as the term of the data processing contract concluded with them is valid and in force, or until they are required to keep your data under the applicable data retention laws.
We may disclose your personal data to the following categories of thirdparties (recipients) for the purposes described below:
- travelagents and other third parties who you book travel or other services through;
- third party service providers whose services you purchased on our website (including, but not limited to insurance, transfer services), in our application or via our call centre;
- ourpartners in loyalty schemes that you have joined;
- groundhandling companies and airports to provide the service you requested;
- credit card companies, payment service providers to process the payments you initiated on our website, in our application or via our call centre;
- third parties running customer surveys on our behalf;
- otherthird party service providers involved by us for data processing;
- thirdparties, such as law firms, courts, other bodies or service providers in orderto enforce or apply any contract with you;
- government authorities or enforcement bodies such asthe police and regulatory authorities, upon their request and only as requiredby the applicable law or to protect our rights or the safety of our customers,staff and assets.
12.1. Wizz Air Group
Your personaldata may be shared within the Wizz Air Group as far as such is necessary toprovide the services you have purchased from us or to facilitate the purchaseof third parties’ services or products on our website, via our mobileapplication or through our call centre. For moreinformation about Wizz Air Group, pleaseclick here.
12.2. Third party service providers
When youpurchase the service of a third party service provider on our website, in ourapplication or via our call centre (e.g. you order transport service or anyrelated activities) we will transfer your personal data to the respective service provider to facilitate the purchase.
The dataprocessing of such third parties may also be governed by their own privacypolicies. Please review the privacy policies on the website of such thirdparties directly for more information about their data processingpractices.Furthermore, we also receiveinformation about you from third parties, for instance when you participate ina loyalty programme.
Wizz Air engages certain third parties to provide assistance during theperformance of the services bought from us. Such third parties provide thefollowing services:
- ground handling services atairports;
- paymentprocessing services;
- running loyaltyschemes;
- provision of IT support services;
- provision of certain services at theairports, such as sale of tickets, services related to baggage, priorityboarding, flight changes;
12.4. Call centre
We engage third party suppliers for the provisionof call centre services for us. You can find more information about thesesuppliers here. Our call centre processes your personal data inaccordance with this Privacy Notice and applicable law. Calls are recorded forthe protection and reproducibility of verbal commitments if you give yourconsent to that and they may be connected with other reservation data .Complaints submitted electronically, via post or via email, are also archived,and may be connected with other reservation data for possible future complaintshandling.
12.5. Governmentauthorities and enforcement bodies:
We maytransfer your personal data to government authorities or enforcement bodiessuch as the police and regulatory authorities, upon their request and only asrequired by applicable law; or to protect our rights or the safety of ourcustomers, staff and assets.
12.6. Border police and immigration authorities:
In certain countries,Wizz Air is required by law to give border control agencies access to bookingand travel information. Therefore, any information we hold about you and yourtravel arrangements may be disclosed to the customs and immigration authoritiesof your place of departure or your destination. In addition, applicable laws incertain countries require Wizz Air to collect passport and associatedinformation for all passengers prior to travel to or from those countries. Whenrequired by applicable law, Wizz Air will provide this information to therelevant customs and immigration authorities.
13. TRANSFERRING YOUR PERSONAL DATATO THIRD COUNTRIES
The transfer of your personal data outside of the EuropeanEconomic Area may be necessary inorder to provide you with a service that you have requested, and your personaldata may be accessed by Wizz Air Group members and data processors and serviceproviders from countries that do not provide the same level of data protectionas provided in the European Economic Area. If necessary, Wizz Air will therefore take all measures, which in relation to the recipients of your personal data, is necessary to ensure an adequate level of protection as defined by the applicable data protection law, in particular through the application of the Standard Contractual Clauses issued by the European Commission or by a decision of the European Commission which states that the country in which the recipient of the transferred data is provides an adequate level of data protection.
If, in relation to data transfersabroad, an adequate level of protection of personal data cannot be ensured,then we shall request your express consent relating to any such data transfersabroad. Please note that such data transfers may be associated with certain risks, particularly that in the country of the data recipient, unauthorised third parties may also have unreasonable access to said data and you may not be able to exercise the rights of the data subject and/or your right to object against acts that may harm your personal data and your right to privacy.
On the website among the origins and destinations, you can find the third countries where your personal data may be transferred, or where it may be accessed from, based on your travel destination.
When you useour website, cookies are stored by your browser on your device. Read more aboutthe cookies used by Wizz Air and how you can block them by clicking here. Please note that if you disable cookies ourwebsite may not function properly on your browser. Our aim is to ensure thatour website offers visitors what they are looking for and provides them withthe most relevant marketing communication. In order to achieve this goal, wemay store and use your data, building usage profiles for market research, for qualityimprovements of our website and our services, for service developments, toimprove the performance of the website, to measure the success of ouradvertising campaigns or to tailor services to your needs.
Until you log in to your Wizz Air Account, the use of such data for the purposes described in the preceding sentence will be in pseudonymised form. That means we will replaceyour name and other features which may identify you with another identifier inorder to make it impossible to identify you as a person and we will not bundlesuch usage profiles with other data we store about you. Once you are logged in your Wizz Air account, the use of such data for the purposes described in the preceding sentence will be personalised and connected to you.
You areentitled to object against the use of your data for building usage profiles asdescribed above at any time.
We may also transferyour non-personally identifiable data such as, but not limited to, anonymousdemographic information and online behaviour to our contracted partners (e.g.third party service providers or banks issuing WIZZ branded credit/debit cards,with special benefits) for the purpose of market research. “Non-personallyidentifiable data” in this respect means we modify your personal data so thatthe information concerning personal or material circumstances cannot beattributed to you or that such attribution would require a disproportionateamount of time, expense and effort. We store data sent by your browser anddevice to our website during the reservation process. No such data will bedisclosed to third parties except in aggregate, non-personally identifiableforms.
15. THE USE OF YOUR PERSONAL DATA FORMARKETING PURPOSES
We send you newsletters on actual bargains and special offers if you have requested suchcommunication from us by subscribing to such services, or if you provided us with your details. We will not contact youelectronically for marketing purposes unless you have expressly indicated yourconsent by ticking relevant tick boxes on the data entry form in which youentered your contact information.
16. CHANGES TO OURPRIVACY NOTICE
If we changethis Privacy Notice, we will publish the updated version of it on ourwebsite, wizzair.com.
17. THIRD PARTYWEBSITES
The wizzair.com website provides links to otherwebsites for your convenience and information. Please be aware that these sitesmay be owned and run by other companies and organisations and have differentsecurity and privacy policies. Wizz Air has no control over and takes noresponsibility for any information, material, products or services contained onor accessible through those websites.
18. THIRD-PARTY LIABILITY
Wizz Air is not responsible for third parties’ use of your data, wheresuch use is permitted for their own purposes. In such cases that these third parties are also considered data controllers, please consult their privacy policies for further information.
This PrivacyPolicy is effective from 5 April 2019.