Privacy Notice of FlyArystan JSC

General provisions

FlyArystan JSC places the utmost importance on maintaining the privacy and security of your personal information. Adhering to regulatory requirements and standards, this Policy details the personal information we gather, the purposes for its collection and processing, as well as your rights concerning personal data. You can be assured that your personal data will be used only for legitimate purposes related to FlyArystan JSC flights.

What do we mean by personal information?

Personal information, also referred to as personal data, includes details that identifies you or can be used to identify you, such as your name and contact details, information about your flights, etc. This information may also include information about your use of our web resources and mobile applications.

When this Privacy Notice applies?

This Privacy Notice applies to your personal information that we collect, use and/or otherwise process. This includes circumstances when you travel on our flights, engage with our websites or mobile apps, reach out to our reservation and information center, or utilize any of our other services. By using our services, you acknowledge and agree to the terms of this Privacy Notice.

How to contact us?

FlyArystan collects and uses your personal information for the sole purpose of delivering you the service you have requested and enhancing the quality of it by offering you the right product at the right time via the right channel. 

• Email: customer.relations@flyarystan.com 

Who is responsible for processing personal data?

FlyArystan JSC is fully responsible for the collection, storage, use, protection and confidentiality of your personal data in accordance with the Law of the Republic of Kazakhstan "On Personal Data and its Protection" and other applicable local and international legislation.

What personal information do we collect?

FlyArystan JSC collects and processes your personal information to provide and improve our services, fulfill our contractual and legal obligations, and to ensure your safety during the flights. This information includes:

• Identification and contact information: name, date of birth, nationality, passport or other identification data, telephone number and e-mail address.
• Travel information: ticket numbers, destinations you are traveling to, flight details, special preferences for your flight and special requests (g. seat selection and meal preferences), and special assistance information.
• Financial information: payment information, such as credit or debit card information, including the cardholder's name, card number, and expiration date.
• Medical information: health information necessary for travel, including medical certificates, medical conditions, requests for special assistance or accommodation.
• Data on interactions with FlyArystan JSC: Information acquired from interactions with our services, including inquiries, feedback, complaints and communication with staff.
• Cookies and online identifiers: data collected through cookies and similar technologies on our websites and mobile applications, including but not limited to IP addresses, location and language settings.
• Authorization information: data relating to login and password to provide access to our website or mobile applications.
• Information on the security of the physical environment: records in logs of entry to the physical environment of FlyArystan JSC.
• Marketing information: data on travel preferences, results of satisfaction surveys, results of marketing campaigns and events.
• Audio-visual information: recordings from CCTV cameras in our offices, as well as voice recordings when you contact our reservation and information center.

The types and volume of personal data collected depend on the nature of your interaction with FlyArystan JSC. This data is gathered directly from you during the use of our services and digital platforms, as well as from third parties, such as ticket sales agencies involved in organizing your flight. 

What are our purposes for processing personal data?

FlyArystan JSC collects and processes your personal data for the following purposes, ensuring compliance with local and applicable international legislation on personal data protection:

• Provision of services: personal information is collected and processed to provide services related to your travel, including ticketing, check-in, baggage handling, payments processing, special meals, and other services you may require.
• Service quality Improvement: Personal data is used to enhance the quality of our services and products, as well as to understand the needs and preferences of our customers.
• Regulatory compliance: processing of personal data is necessary to fulfill our obligations under aviation, custom and other applicable local and international laws.

• Marketing and Communications: we use personal data for marketing purposes, to send information about new services, offers and promotions, and to learn about customers' preferences in order to provide personalized offers. You can opt-out of marketing mailings at any time using the integrated functionality of our web resources and mobile applications.

What is the basis for personal data processing?

• Contractual obligations: The processing of personal data is necessary for the fulfillment of the terms of the contract, which is the flight ticket, between FlyArystan JSC and the data subject.
• Regulatory obligations: The processing of personal data is carried out to fulfill regulatory obligations under aviation, custom and other applicable local and international laws.
• Consent to Processing: For certain types of processing, such as when you subscribe to marketing mailings, the processing will be based on your consent.
• Legitimate interests: In certain applicable cases, the processing of personal data is carried out on the basis of our legitimate interests, including to improve the quality of our services and/or to protect against fraud.

In case you make a reservation or purchase a flight ticket for another person, you need to obtain that person's permission to use their personal information.

How do we collect your personal data?

We receive the categories of personal data mentioned above through various channels:

• Directly from you

We receive personal data directly from you when you make a reservation or purchase a flight ticket and/or other goods and services through our sales channels, check-in for a flight, create an online account, submit an inquiry or complaint to us, answer questions in a questionnaire, leave us a message in social networks, contact our support team, communicate with a chatbot, sign up to receive our e-newsletters or mobile notifications, fill out medical forms.

• From your tour operator or travel agency, our airline partners or other companies involved in organizing and managing your flight.

We receive your personal data from third parties when you purchase a flight ticket through a travel agency or third-party websites, or when you use the services of our partners in car rental, transfer, hotel booking. These third parties involved in organizing your flight are also responsible for processing your personal data. For more information on how they process your personal data, please refer to their appropriate privacy notices.

How long do we retain your personal information?

FlyArystan JSC sets the retention periods for personal information taking into account applicable legislation and the specified purposes of personal data processing. Once the purpose of personal data processing is achieved, your personal information will be deleted or anonymized, except in cases mandated by law where personal data must be retained for a longer period.

Specifically, when you make a reservation or purchase flight ticket, we retain the relevant personal information to provide you with air travel services. After completing your flight, we will store the information for a period sufficient to address any of your inquiries or complaints related to your flight.

Please note that if your personal information is collected by a third party, such as a hotel or car rental company, it will be retained in accordance with their privacy policies.

To whom can we disclose your personal information?

In order to achieve the above-mentioned purposes of data processing and in accordance with the above-mentioned legal grounds (contractual performance, legitimate interests, consent or statutory processing obligations), your data may be transferred to the following categories of recipients:

• Other airlines (our codeshare and interline partners);
• Airport operators, lounge staff, and ground services;
• Authorized government authorities based on applicable country entry regulations and in response to a reasonable and lawful request, for example, as part of a criminal investigation;
• Travel agencies involved in the organization of your flight;
• Companies that conduct market research and analysis, provide marketing services, or conduct customer surveys on our behalf;
• Companies that provide services to process reports regarding violations of laws and/or Code of Conduct, including fraud, corruption, discrimination, unethical behavior and other violations related to FlyArystan JSC's activities;
• Partners involved in the processes of providing transfer services, car rentals, hotel reservations;
• Companies providing information technology services, such as booking and ticketing systems, data storage systems, check-in systems;

Other service providers, for example, for website operation, distribution of informational messages, and processing of feedback.

How do we ensure the security of your personal information?

Ensuring the security and confidentiality of your personal data is of utmost importance to us. We have taken necessary measures to ensure an appropriate level of security, particularly to prevent any accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access to this data. These measures include:

• Organizational measures: we have implemented effective policies and procedures to protect information, which form the foundation of our operations and decision-making. Our approach to risk management focuses on identifying, assessing, and minimizing potential data security threats. Regular training of our employees helps them recognize and appropriately respond to information security threats. We have also developed incident response procedures to minimize their impact on the security of personal information. Additionally, we take measures to protect our physical facilities and resources from unauthorized access.

• Technical measures: In the technical aspect of data protection, we employ encryption to safeguard your information, both during storage and transmission. Protection of our systems is achieved through access control mechanisms, firewalls, and intrusion detection systems, which help prevent unauthorized access. Additionally, we continuously update our software to protect against information security threats and maintain the relevance of the technologies we use.

How do we respect your rights regarding personal data?

In accordance with the Law of the Republic of Kazakhstan "On Personal Data and its Protection", as well as applicable international law, you have certain rights regarding your personal information:

• Right to Access. You have the right to know if we hold your personal data, as well as to receive information containing: confirmation of the fact, purposes, sources, and methods of collecting and processing personal data; a list of the personal data; the durations of personal data processing, including their retention periods.
• Right to rectification. You have the right to amend and supplement your personal data stored by us, if there are grounds for doing so, confirmed by appropriate documents.
• Right to erasure. You have the right to request the deletion of your personal data stored by us, in accordance with local and applicable international legal norms.
• Right to restriction of processing. You have the right to restrict the processing of your personal data by us in accordance with local and applicable international law.
• Right to withdraw consent. You have the right to withdraw your consent to the processing of personal data to the extent that the processing of your personal data was originally based on consent.
• Right to data portability. You have the right to request that FlyArystan JSC transfer the personal data we have collected to another organization or directly to you in accordance with applicable law.

If you wish to exercise any of these rights, please contact us by email:customer.relations@flyarystan.com 

FlyArystan JSC may ask for extra details from you to confirm your identity as the data subject associated with the rights request.

How to opt out of receiving marketing messages?

FlyArystan JSC processes your personal data for marketing purposes including, for example, sending newsletters and offers, conducting marketing campaigns.

Where we ask for your consent, for example, when you subscribe to a newsletter, your consent will be the basis for sending marketing communications. If we process your personal data for information and marketing purposes without seeking consent, we have concluded in each case that our legitimate interests represent a sufficient basis for such processing.

If you decide that you no longer wish to receive marketing communications, you can change your mind at any time. The ways in which you can stop receiving marketing communications are described below:

• If you are a registered user of https://flyarystan.com, you can change your marketing preferences at any time in the appropriate section of your account.
• In addition, each marketing email we send you will contain an unsubscribe option to stop receiving further marketing emails.

How we use cookies?

By using the https://flyarystan.com website or our mobile applications, you agree that we may place cookies on your device, access them and use other methods to collect data about your use of the website and mobile applications to improve your user experience.

The privacy notices of other websites

Our website may contain links to other websites for your convenience and information. While we protect your personal information on our website and mobile applications, we are not responsible for your personal information that you may share when you use third-party web resources.  In this regard, please review the privacy policies of such websites.

Changes to this Privacy Notice

We reserve the right to amend this Privacy Notice in order to provide accurate and up-to-date information regarding the protection of your personal data.

In the event of changes to this Privacy Notice, we will post the updated version on our website https://flyarystan.com/.