This policy applies to personal information. Personal information is any information about an identifiable individual, such as an individual's home address, telephone number, email address, or activity in the Program.

We collect personal information reasonably needed to fulfill our business purposes, like the purposes discussed in part 3 “Why do we use and share your personal information?”.

We collect personal information when you interact with us, for example:

• When you enroll in Aeroplan, we collect information that you provide during the enrollment process.
• When you contact us, we collect information about that interaction, such as when and why you contacted us.
• When you redeem your points for a reward, we collect information about the reward and any additional information necessary to fulfil your redemption request.
• When you browse our website, we collect information including your internet protocol address, device type and browsing activity, subject to your consent in certain circumstances – for more information please see the aircanada.com Cookies and Tracking Technologies Policy.

If you are an Aeroplan Member, we may collect personal information when you interact with any company in the Air Canada Group:

• When you make purchases or redemptions with a company in the Air Canada Group, that company provides information about the transaction to us – such as transaction date, dates of travel, price, destination, products purchased (ticket type, checked bag, advance seat selection, hotel, cruise), and any other information you provided as part of that transaction.
• When you receive any Air Canada Group emails, we may collect information about how you engage with us, such as whether and when you open our emails – for more details, please see aircanada.com Cookies and Tracking Technologies Policy.
• When you visit or use any Air Canada Group website, mobile application, or any other Air Canada Group online platform, we may collect information such as the webpages you viewed, search queries, frequency of visits, time spent on the site or application, and location information (e.g. to identify where you will depart when you start the booking process) – for more details, please see the terms and conditions of the applicable website or mobile application, and aircanada.com Cookies and Tracking Technologies Policy.
• When you interact with Air Canada Group social media pages and contests, we may collect or receive information about that interaction.

This collection can include information about past interactions – including those that occurred before you became an Aeroplan Member – so we can more quickly understand your preferences and tailor the program to you.

If you are an Aeroplan Member, we may collect personal information when you interact with our program partners – for example:

• If you accumulate points or make a redemption, we receive a description of the transaction (including location information). We collect browsing data from websites co-branded with Aeroplan and, for purchases on non co-branded third-party websites accessed via our eStore, we also collect information about what product was purchased using cookies – for more information about our use of cookies see the aircanada.com Cookies and Tracking Technologies Policy.
• If you are an Aeroplan Credit Cardholder, Aeroplan will receive information about you from the financial institution that issued you an Aeroplan credit card – including information about specific transactions made with the card. The transaction information may include: the merchant’s name, location, date and amount of purchase. This information-sharing is described in more detail in the cardholder documents provided with your Aeroplan credit card.
• If you provide a separate consent to link a program partner’s loyalty or marketing program with your Aeroplan account, the program partner may share additional information with us as set out in that consent.

On occasion, we may acquire information about groups of people generally – not individual members – from trusted third parties. We apply those general insights to members to help us better understand their interests and preferences. For example, we may receive demographic information (average age, income, family size, etc.) about certain geographic areas. We may also receive insights into the frequency or popularity of credit card types (premium, cash-back, no-fee, etc.) among members.

We use and share your personal information to manage Aeroplan – including to:

• Communicate with you, such as to advise you of changes to the program or respond to your questions
• Administer our websites and mobile application, and make them easier for you to use, such as by pre-populating forms with your contact information or other applicable personal information
• Address customer service matters, including reward travel reservations and questions you may have about your account
• Monitor and maintain the quality of our operations, such as monitoring or recording telephone discussions with our representatives for quality assurance purposes.

We also use and share your personal information to maximize the value of your membership to you – including to:

• Better understand your preferences, needs, and interests in order to develop and enhance offers, promotions, benefits, contests, products and services that are relevant to you
• Send you offers about accumulation and redemption opportunities, benefits, products and services related to Aeroplan and our partners that are most likely to be of interest to you. This includes serving you advertisements on other websites (for more information, see aircanada.com Cookies and Tracking Technologies Policy).

We personalize offers for certain segments of our membership based on member behavior, transactions, and other information collected by us, as described above. We consider trends in your accumulation and redemption of points across various sectors to determine which program partners, offers, promotions, benefits, contests, products and services are most relevant to you.

For example, members who frequently accumulate points on car rentals may be selected for special offers or promotions offering discounts or bonus points on car rentals. These offers are communicated in multiple ways (such as by email, mobile app, SMS/text messages and our website).

We also use and share your personal information to improve Aeroplan and address our business or legal needs – including to:

• Measure the success or effectiveness of offers, promotions, benefits contents, products and services associated with Aeroplan
• Generate de-identified information for further analysis, such as to identify trends about our members as a whole, including to support program growth or engagement
• Protect our business or legal interests, such as to investigate, detect or prevent fraud or harm to our systems
• Fulfil other purposes to which you may consent, or as permitted or required by applicable law.

Sharing within the Air Canada Group

We want you to travel more and travel better.

To maximize the value of your membership to you, and to serve you better, we collaborate extensively with other companies in the Air Canada Group. Part of this collaboration involves sharing relevant personal information with companies in the Air Canada Group, including our understanding of your interests, preferences and purchasing patterns. Companies in the Air Canada Group then use that personal information to better tailor their travel-related offers to you – giving you more opportunities to earn points and to receive rewards. Air Canada also uses relevant personal information to deliver, promote and develop its Aeroplan Elite Status program and to provide services to participants in that program, which is available exclusively to Aeroplan Members.

Sharing with program partners

Aeroplan is founded on sharing certain member personal information with program partners. Here, “program partners” means program partners that are not Air Canada affiliates (since we share information with Air Canada affiliates as set out under the previous heading).

• We share your personal information with a program partner as necessary to fulfill a redemption transaction, such as your name, contact information and point balance – including when you use your Aeroplan credentials on a partner website or application.
• We may share information about your activity in the program or general characteristics about you with any of our partners of which you are a customer, so that the partner can make relevant offers to you that allow for the accumulation or redemption of points, or otherwise provide a member-related benefit or privilege, or use it for other purposes permitted under its own privacy policy. For example, we may share your contact information, your program status, how long you have been a member, which region you live in, your age range, and that you had at least a certain number of transactions within a partner category in a period of time.
• We may share your personal information with partners if it is necessary to address a customer service issue or as permitted by law (such as detecting or preventing fraud).

If you provide a separate consent to link a program partner’s loyalty or marketing program with your Aeroplan account, then we may share additional information with that program partner as set out in that consent.

If you are an Aeroplan Credit Cardholder, we will not share with our program partners the personal information that we receive from your financial institution (without your separate consent).

Program partners are contractually required to comply with privacy laws in collecting, using, disclosing, and safeguarding member personal information. Although we make reasonable efforts to ensure that our program partners respect your privacy, ultimately program partners control the personal information that we share with them, and they are responsible to you for their privacy practices. However, we would be interested in any concerns you have about the privacy practices of our program partners. You may share any concerns by emailing AeroplanPrivacy@aircanada.ca.

Sharing with social media platforms

We may share identifying information – for example, your hashed email address – with social media providers to make relevant offers to you on their platforms. Those offers allow for the accumulation or redemption of points, or otherwise provide a member-related benefit or privilege.

Sharing with and from credit card partners

Aeroplan has partnered with financial institutions to issue Aeroplan credit cards. These credit cards afford members more opportunities to earn points for everyday activities, as well as a range of other travel rewards and benefits. If you are logged into the Air Canada website or app and apply for an Aeroplan credit card with one of our financial institution partners, we will share relevant personal information with the financial institution to pre-populate the credit card application form and expedite the application process.

If you are an Aeroplan Credit Cardholder, then Aeroplan will share certain personal information with the financial institution that issued you that credit card – namely:

• your general accumulation and redemption activity (such as your relative points balance and rate of accumulation and redemption, last contest participated in, and accumulation / redemption category (e.g., travel, merchandise))
• information about your use of Aeroplan benefits and services associated with your Aeroplan credit card
• your communication preferences and general characteristics (such as date of enrollment and age group).

Your financial institution may then use this personal information (along with its own information) for market analysis, and to make better offers to Aeroplan Members for the marketing and promotion of Aeroplan credit cards and other financial products.

As Aeroplan is the Air Canada loyalty program, Air Canada will have access to your Aeroplan credit card information, including transactions. With some card brands, other companies in the Air Canada Group will receive relevant insights from your credit card activity, such as your interest in certain travel experiences or your relative spending with certain travel operators, but they will not receive transaction-level data.

This information may only be used to enable companies in the Air Canada Group to market their products and services to you, and (if de-identified) to improve their products, services and operations – all with a view to maximizing the value of Aeroplan and Air Canada Group products and services to you. This information is never used for other purposes, or further disclosed, without your express consent or as permitted or required by law. See “Sharing within the Air Canada Group” above.

For more information about Aeroplan credit cards and privacy, review your cardholder documents and your financial institution’s privacy policy.

Transfers to our service providers

We may transfer your personal information to service providers who support us in carrying out the activities described in this policy. These service providers process personal information on our behalf for our purposes only and must agree to certain privacy obligations in their contracts with us. These include complying with privacy laws, safeguarding the personal information, and only processing that information under our direction for permitted purposes.

Other types of sharing

We may share your personal information with other third parties where necessary to fulfil other purposes to which you may consent, or as permitted or required by applicable law. For example, we may need to share personal information with law enforcement agencies for fraud investigations.

Cookies and Tracking Technologies

You may modify your communication preferences (to receive or not to receive offers) by logging into your member account, or by contacting us. You may also opt out using the unsubscribe mechanism in any SMS text or email marketing communications.

As permitted by law, some unsubscribe requests may take up to 10 business days to complete (e.g., if a campaign is underway, you may still receive marketing messages shortly after you unsubscribe).

If you withdraw your consent to receive these electronic marketing communications, you will continue to receive administrative information related to your account or changes to our program.

Changing browser or device settings

We use cookies, tags, scripts, tracking pixels, and other tracking technologies on the websites and our mobile applications to help administer them, to improve your experience, and to improve the program.

For more information on how we use these technologies, including how you can manage certain of these technologies, see aircanada.com Cookies and Tracking Technologies Policy.

Changing program partner consents

If you have separately agreed to certain additional Aeroplan-related activities, you can terminate those activities and the associated collection and disclosure of your personal information. For example:

• If you are an Aeroplan Credit Cardholder and you object to the sharing of your personal information by or with your financial institution, please contact your financial institution to discuss your options.
• If you have previously given your consent to link your Aeroplan account with a program partner’s own loyalty or marketing program – and you no longer wish to consent to the information-sharing enabled by that consent – you have the option of contacting Aeroplan or that program partner to withdraw that consent.

Opting out of sharing within the Air Canada group

If you are an Aeroplan Credit Cardholder whose card type permits the sharing of relevant insights from your credit card activity with other companies in the Air Canada group, you may opt out of that sharing by signing in to your Aeroplan account, navigating to “My profile”, and reviewing the “Manage my Aeroplan credit card sharing preferences” section.

Other data handling choices

If you wish to withdraw from other collections, uses or disclosures of your personal information by Aeroplan, please contact us (see part 10 “How can you ask questions or raise concerns about privacy?”). Please note that we may be unable to accommodate a withdrawal from particular collections, uses and disclosures that are central to our program. In that case, your only option may be to terminate your membership in Aeroplan. 

Terminating your Aeroplan membership

If you terminate your membership in Aeroplan, we will delete your profile information (for example, your name, mailing address, date of birth, email address and telephone number). We will also de-identify your transaction information (how you accumulated and redeemed points) and retain it as required to comply with our legal obligations, including tax law. For assistance with terminating your membership and for more information on what we do with your personal information, please contact our Principal Privacy Officer (see Part 10 “How can you ask questions or raise concerns about privacy?”).

We generally store, access and use personal information at our offices in Toronto and Montreal, and at our data centres in Canada and the United States.

Some of our service providers access, use or store your personal information outside of your province or territory, or outside of Canada. The laws of those other places will then apply to that information, including laws that may permit or require disclosing that information to government, courts and law enforcement. 

If you would like more information about our policies and practices regarding processing of personal information outside of Canada, please contact our Privacy Office directly, either by email or the postal address (see part 10 “How can you ask questions or raise concerns about privacy?”).

Each company in the Air Canada Group maintains appropriate organizational, technical, and physical safeguards to protect your personal information. These safeguards are intended to prevent the loss, theft or unauthorized access, use, disclosure, modification or destruction of your personal information.  For example:

• your personal information is subject to restricted access
• electronic data is protected by technological means, such as firewalls, access controls, encryption and pseudonymization (de-identification of information with pseudonyms)
• we use multi-factor authentication for Aeroplan members using our Single Sign-On to access Aeroplan and Air Canada applications with the same username and password
• our personnel are trained on the importance of safeguarding personal information from loss, theft or unauthorized access, use or disclosure

As many of our interactions with you are online or via email, we rely on you to take reasonable steps to safeguard your personal information.  For example:

• we expect you to use unique passwords for your accounts with us, and to safeguard those passwords so that they are not used without your permission
• you should not provide us with an email account with us that you share with another person – if you do, then any email messages (including password resets) sent to that email account would be accessible to that other person.

Like most companies, we cannot guarantee that our security safeguards are always effective or that online communications are always secure. A breach of security safeguards can result in the risk of identity theft, for example. In these cases, we act promptly to mitigate the risks and to inform you where there is a real risk of significant harm, or as otherwise required by law.

We keep your personal information for as long as it is needed to fulfill the purposes for which it was collected, or a longer period if permitted or required by law.  When no longer needed, personal information is destroyed, anonymized or disposed of using secure methods.  

Please note that if your personal information is collected by a third party, such as a program partner, it will be kept in accordance with the privacy policies and records retention requirements of that third party.

You have the right to access and correct your personal information and to be informed of the personal information collected about you, the categories of persons who have access to your information within the company, and the duration of time that the information may be kept.

By logging into your member account, or by contacting Aeroplan Contact Centre (see part 10 “How can you ask questions or raise concerns about privacy?”), you can view and edit your profile information, review your recent transaction history, and modify your communication preferences. It is your responsibility to provide and maintain accurate and complete profile information.

For any personal information that you cannot directly access or correct via these methods, you can make a formal access or correction request by contacting our Privacy Office (see part 10 “How can you ask questions or raise concerns about privacy?”).  In that case, we will respond to your access or correction request within a reasonable timeframe (but no later than 30 days from your request) pursuant to applicable laws.

If your personal information in our records is inaccurate or incomplete, we will amend the personal information as required. Where appropriate, we will transmit the amended information to third parties having access to your personal information.

You can withdraw your consent to certain collections, uses, and disclosures of your personal information (see section 5 “What are your choices when it comes to the handling of our personal information?”).

Aeroplan has adopted and implemented internal policies, processes and practices related to the governance of personal information, including:

• The designation of a Principal Privacy Officer for overseeing and monitoring compliance with this policy and privacy laws (see Section 10 "How can you ask questions or raise concerns about privacy?");
• Procedures for responding to inquiries and complaints, including one for handling requests from individuals who wish to exercise their rights (see Section 5 “What are your choices when it comes to the handling of your personal information” – “Other data handling choices” and Section 8 “How can you exercise your personal information rights”?);
• A Data Retention and Destruction Policy that sets out how long data or documents must be kept, and provides specific retention periods applicable to specific categories of documents or specific data classification types;
• A policy and related procedures for ensuring data security (see Section 7 “How is your personal information protected?”);
• A data breach response plan for dealing with confidentiality incidents; and
• A process to select responsible service providers.

If this policy does not answer all of your questions, please contact one of our agents at the Aeroplan Contact Centre at:

1 800 361 5373
for Canada, United States and the Caribbean
(see our website for other available telephone numbers)

Our Principal Privacy Officer is responsible for overseeing what we do with your information and for monitoring compliance with this policy and data protection laws. If you have concerns or further questions about how we handle your personal information or wish to make a formal access or correction request or terminate your Aeroplan membership, please contact the Principal Privacy Officer using the contact information below.

Email:
AeroplanPrivacy@aircanada.ca

Address:
Aeroplan Principal Privacy Officer
P.O. Box 23000
Station Pointe-Claire-Dorval
Pointe-Claire, QC H9Y 1K2

Please note that we will take reasonable steps as necessary to validate your identity prior to disclosing any personal information via the above communications channels.

1. How does this policy apply to you?
   

   Because of differences in applicable law, this policy applies to members in the EEA, UK and Switzerland with certain exceptions. Specifically, the sections of this policy that describe the data practices below do not apply to you unless you separately consent to them:

   • The collection or sharing of your personal data from or with other companies in the Air Canada Group, for analytics and marketing purposes
   • The detailed analysis of your behaviour in the program to understand your interests and preferences, except more limited analysis that is in our legitimate interests, as explained below under part 10(ii) “What are the legal bases for processing my personal data?”
   • The collection of details about the specific items you purchase from our eStore partners
   • The application to you of insights gained about groups of members from trusted third parties
2. What are the legal bases for processing your personal data?
   

   Aeroplan may legally process your personal data for the purposes described in this policy because:

   • It is necessary to perform our contract with you – for example, we will process:
     • your name and contact information to set up your account and to communicate with you about the program
     • information on your purchases or redemptions with partners to credit or debit your points balance
     • information needed to resolve any customer services issues
   • It is necessary for our legitimate interests – for example:
     • we de-identify information about your purchases and redemptions in the program for statistical or analytical purposes, for example, to understand the interests or preferences of segments of our members (not individual members) or to develop analytic models – this helps us with program strategy and development, member engagement, and service improvement
     • we use your general characteristics (such as your country of residence, age, gender and Aeroplan Elite Status) to send you more relevant offers
     • we use relevant personal data to ensure security and prevent fraud and to comply with laws outside of the EEA, UK and Switzerland
   • It is necessary to comply with laws in the EEA and/or UK and/or Switzerland — for example, to make disclosures to law enforcement
   • It is necessary for any other applicable legal basis

   Where no other legal basis applies, we will obtain your consent to process your personal data (for example, for the data practices described above at part 11(i) “How does this policy apply to me?”. That consent may be withdrawn at any time by contacting our Privacy Office (see part 10 “How can you ask questions or raise concerns about privacy?”).

3. What are your rights?
   

   In addition to the access and correction rights described in part 8 “How can you access or correct your personal information?”, you may be entitled to exercise the right to:

   • object to the processing of your personal data (for instance, where we base the processing on our legitimate interests, see part 11(ii) “What are the legal bases for processing my personal data?”), and we will stop processing your data. Except for processing related to direct marketing, we may resume processing if we can show legitimate grounds that override your rights.
   • request the restriction of processing of your personal data (for instance, if the data is not accurate and needs to be updated). This can also be done for data where the purposes of processing no longer apply, but you still need the data and do not want us to erase it.
   • request erasure of your personal data (for instance, if it’s no longer necessary for the purposes for which it was collected, if you have withdrawn consent or there is no other legal basis for processing, or if you have objected to the processing and our legitimate interests do not override your rights). Certain data may not be erased if we have a requirement to retain it for legal purposes.
   • request portability of your own personal data (the transfer of information you have provided to us, to another controller, in a structured, commonly used and machine-readable format), if such a request is technically possible to complete.

   To exercise these rights, please contact the Privacy Office at the addresses provided in part 10 “How can you ask questions or raise concerns about privacy?”. We will respond to your request within 30 days, subject to any legal exceptions, and otherwise in accordance with the law.

   You also have the right to file a complaint with the data protection authority in your country.

4. How is your data safeguarded?
   

   In addition to the safeguards described in part 7 “How is your personal information protected? How long is it kept?” and in part 4 “With whom do we share your personal information” in the section “Transfers to our Service Providers”, we use standard contractual clauses approved by the European Commission for transfers of personal data to countries not considered by the Commission to provide adequate protection for data, unless there is another legal basis for such transfers.