Data protection
This page describes how the aifly platform handles the personal data that travel agencies enter into it — chiefly customer and passenger data. In that processing the agency is the controller and aifly acts as a processor.
Last updated:
Roles of the parties
The agency decides what data it collects from its customers, for what purposes and for how long. aifly processes that data only on the agency’s documented instructions and under the processing agreement signed between them, in line with Article 28 GDPR.
Categories of data processed
- Customer and passenger identification: name, date of birth, contact details
- Travel documents: passport or ID card number and expiry
- Booking data: itineraries, PNRs, tickets, vouchers and policies
- Tax and invoicing details of the agency and its customers
- Technical access and audit logs
Isolation between agencies
Each agency’s data is isolated from every other agency’s. No agency reaches another’s customers, bookings or margins. The separation sits in the data model and is enforced on every request.
Access control
- Two-step authentication for accounts that can reach passenger data
- Permissions by user role and by branch, set by the agency
- Passport numbers masked by default, revealed only to authorised roles
- A log of who accessed which record and when, available to the agency
Payment data
The platform does not store full payment card numbers. Payments are processed by a PCI DSS certified provider, which receives card details directly from the cardholder.
Transfers outside the European Economic Area
Operating a trip requires passenger data to be sent to suppliers — airlines, GDSs, hotels, insurers — that may sit outside the EEA. That transfer is necessary to perform the travel contract, under Article 49(1)(b) GDPR.
For everything else we rely on standard contractual clauses approved by the European Commission.
Sub-processors
To be confirmed before publication
aifly uses sub-processors for hosting, messaging and payment processing. The named, current list with locations and purposes is made available to contracting agencies and is to be inserted here before publication.
Retention and deletion
Data is kept for the duration of the contract with the agency and, after that, for the period required by tax and accounting duties. Once that period ends, it is deleted or anonymised.
The agency can export customers, bookings and documents at any time, in a structured format.
Data breaches
In the event of a personal data breach, aifly notifies the agency without undue delay and supplies the information it needs to meet its own notification duties towards the supervisory authority and, where applicable, the data subjects.
Contact
To be confirmed before publication
Questions about data protection on the platform should go to agencias@aifly.com. A data protection officer is to be appointed and named here, should one become mandatory.