Privacy policy

All personal data processed by Iberia Express in connection with this Privacy Policy are the responsibility of Iberia Express, which is considered "data controller" under European Union data protection laws. Our address is: Delegado de Protección de Datos, IBERIA EXPRESS, Calle Alcañiz, 23, Primera Planta. 28042 Madrid, España.

 If you have made a reservation with us but one or more of the flights are operated by other airlines, each of those airlines will also be independently responsible for data processing under European Union data protection laws, as well as under local data protection laws applicable to those airlines.

 Any service provider, such as a hotel or car rental company, will also be individually responsible for the processing of data. You can access the privacy policies of these providers by contacting them directly.

If you are a partner of Avios Group (AGL) Limited, it will also be independently responsible for the processing of your personal data. The address of Avios Group (AGL) Limited is: Astral Towers, Betts Way, Crawley RH10 9XX, United Kingdom.

Personal data means data that identifies you or could be used to identify you, such as your name, contact details and your travel and purchasing history. It may also include information about how you use our website and mobile applications.

This Policy applies to the personal data we collect, use and process in connection with your relationship with us as a customer or potential customer, including when you travel with us or use other services, when you browse our website, when you contact our service agents or call centres and when you book our services through third parties (such as travel agencies and other airlines).

 When we refer to which other parties are responsible for the processing of data in the section Personal Data Controller or Who do we share your personal data with? you should consult their privacy policies for more information.

 If you choose to contract additional services with us, such as making an on-board purchase, using our on-board entertainment system or participating in a contest held by Iberia Express with third party partners, other additional terms and conditions may apply in addition to those set forth in this policy.

We go to great efforts to protect the personal data you provide us with. Here are some steps you can take to keep your information safe.

Do not share your reservation code or booking reference

When you make a reservation, you are provided with a reservation code (also known as PRN or Passenger Registration Number). This reference will appear in the confirmation email or on the ticket of each passenger in your reservation.

 Always keep your reservation code confidential. If you share your reservation code with third parties, they will be able to access your reservation data through our system.

If you are travelling with other people and do not want them to have access to your booking details, it may be preferable for each person to make a separate booking.

Do not share your login details for access to the private area of Club Express

To safeguard your access to the private area of our website and mobile applications, do not share your passwords with anyone.  When you are finished using the website, online services or mobile applications, you should log out if someone may be able to access your computer or device. This is especially relevant if you use a publicly accessible computer.

Be cautious and protect yourself against online fraud and phishing 

There is a practice of fraud on the internet known as “phishing", which consists of illegally obtaining personal data through deception. Unsolicited emails are sent to people on lists illegally obtained by third parties, and recipients are asked to enter or confirm bank details or passwords on a cloned or fake website.

We collect personal information about you each time you use our services (whether provided by us or by other companies or agents acting on our behalf), including when you travel with us, use our website or interact with us electronically or through our customer service centres.

For more information, see “What types of personal data do we collect and retain?”

In addition, we may receive personal data about you from third parties, such as:

• Companies that we have contracted to provide you with a service.
• Companies involved in your travel plans, including airlines involved in your previous or subsequent trip, airport operators and customs and immigration authorities.
• Companies participating in our loyalty and other customer programs (e.g. car rental companies and hotels).

When you use our services you will have to provide us with your personal data or the data of the person or persons who are going to travel.

We collect the following categories of personal data:

•  Information you provide to Iberia Express to complete and manage a reservation you have made with us or a service you have requested
  Show Example
  X

  
  

  Your name, address, e-mail address, date of birth, gender, passport number, account details and payment information. If you purchase tickets for a third party, we may collect their check-in details but contact the passenger directly regarding the flight.
  We will know if you have booked your flight on iberiaexpress.com or if you have used another sales channel, such as a travel agency or our customer service centre.

• Data collected during your trip with us.
  Show Example.
  X

  
  

  We may collect certain information such as your interaction with cabin crew and personnel before and during the flight.

• Details about your travel schedule.
  Show Example.
  X

  
  

  Details of your booking, travel itinerary, details of any additional assistance you may request and other information relating to your journey, such as special dietary needs.

• Information about the services provided to you in the past.
  Show Example.
  X

  
  

  Data on previous trips, such as trips made and all related matters, including upgrades, baggage requirements, airport problems, lost baggage and your comments as a customer.

• Data about your online registration and other interactions
  
  Show Example.
  X

  
  

  We will retain your data to ensure proper interaction with you if you have registered with us, either through our Club Express or other loyalty program or customers.
  We will keep your details if you have participated in a contest or promotional event, or have interacted with us through social networks such as Facebook or Twitter.

• Information about your use of our website, mobile applications and customer service centres. For more information, see . 
  Show Example.
  X

  
  

  To help us personalise your data and improve our website, we use cookies and similar technologies to collect information about your searches and the content you have visited on our website, such as the website that you came from, or banners and links that appear on the websites of our business partners.
  We will use the web usage data stored in the cookies to understand you as a customer. This information may include, if you have entered it on our website, details of any reservation or passenger name, in case of use of your registration data associated with your Club Express account.
  From your usage data we will be able to know that you have visited iberiaexpress.com and searched for a flight, but that you have not formalised your reservation.

• Information about the location of your device if you have been browsing iberiaexpress.com or using our mobile application. An IP address or Internet Protocol Address, is a numeric code that can act as a unique identifier for your computer or other device that can be disabled on your device.
  Show Example.
  X

  
  

  Identifying the country from which you access the website or application, which will allow us to offer you more relevant content and to use the appropriate language.

When and why do we collect ‘sensitive personal data’?

Certain categories of personal data, such as those relating to racial origin, ethnicity, religion, health, sexual orientation or biometric data, constitute special categories of personal data which require additional protection in accordance with European Union data protection legislation and are referred to as “sensitive personal data”. Normally, we try to limit the circumstances in which we collect and process data of this nature. The following are examples of instances in which we may collect and process sensitive personal data:

• When you have asked Iberia Express and/or an airport operator for specific medical assistance, such as a wheelchair or oxygen.
• When you have requested permission to fly with us for a specific medical condition or if you are more than 28 weeks pregnant.
• When you have chosen to provide us with such information for any other reason or when it has been provided to us by a third party such as the travel agency through which you made your reservation.

You may also have requested a special service (such as a menu) that does not in itself constitute sensitive data but may involve or suggest information about your religion, health or other data.

The main purposes for which we process your personal data are as follows:

• To deal with all matters related to your trip and provide you with the services requested
  
  Show Example.
  X

  
  

  We will need to use your name, address, email address, contact details, date of birth, gender, passport number, account details and payment information in order to process your reservations, process your travel-related services, collect payment, provide information to the appropriate authorities (such as tax, customs and immigration authorities) and for Iberia Express to know who has a reservation on a flight.

• To manage the boarding process and facilitate connecting flights at the airport.
  
  Show Example.
  X

  
  

  If you do not show up at the boarding gate to board your flight, we may need to check whether you have passed through airport security or were on a connecting flight to find out how to contact you to inform you of your flight’s boarding.
  In some airports where we operate, a facial recognition system is used (the use of this technology, unless required by law, is voluntary).

• To send you status updates and service or operational communications about the contracted service.
  Show Example.
  X

  
  

  We may send you a communication informing you that your check-in is open or that your flight has been delayed.

• To be in touch with you before your flight and at the airport.
  Show Example.
  X

  
  

  Every time you travel with us and use the airports where we operate, we will be able to track your situation at the airport to assist you with your flight connections and to board the aircraft, as well as to provide you with a personalised service.
  If you have presented your boarding pass to access one of our lounges.

• To ensure your safety and to comply with certain legal requirements applicable to Iberia Express as an airline company.
  Show example.
  X

  
  

  As an airline, Iberia Express is obliged to keep a register with information on passengers on board its aircraft.
  The laws of certain countries, such as the United States and those in the European Union, require airlines to provide certain information about their passengers to customs and immigration authorities.

• To provide you with services that meet your needs and offer you a more personalised service.
  Show Example.
  X

  
  

  If you are a member of Club Express we can customise your experience when you travel with us. For example, a member of our crew can welcome you back aboard an Iberia Express flight.

• For analytical work and market research.
  Show Example.
  X

  
  

  We will analyse how customers use our sales channels, products and services to learn how to improve the service we offer and encourage customers to use the full range of our products and services.

• To carry out marketing activities and keep you informed about Iberia Express products and services.
  Show example
  X

  
  

  We may send you information about our products and services by e-mail.
  We may adapt the content of our websites, applications, e-mails and other communications to ensure that they are of the greatest possible interest to you, including previous destinations with offers and/or services relating to such or similar destinations.
  To understand your flight preferences and provide you with information about offers, such as upgrades.

• To send you updated information and communications.
  Show Example.
  X

  
  

  Even if you have chosen to stop receiving commercial information, we may still send you communications about the services you have booked, such as your travel itinerary. These communications will help you obtain the details of the services contracted and may include options and complements to the services you are going to use (for example, early seat selection, additional luggage and early menu booking)..
  We may also send you communications about services you have used, for example, if you have had any difficulties or problems and we want to contact you proactively to resolve them.

• To improve our website, products and services.
  Show Example.
  X

  
  

  We will be able to track how you and other customers use our site, so that we can identify ways to improve your browsing experience.

• For management and administration purposes. .
  Show Example.
  X

  
  

  We may use and retain your personal data, including your purchase history, for administrative purposes, which may include, for example, accounting and billing, auditing, credit card or other payment card verification, fraud control (including the use of credit reporting agencies and payment card validation checks), testing, maintenance and system development.

When we collect data directly from you, we may ask you whether or not you wish to receive our marketing communications or join Club Express. In this regard, please note that such commercial communications may be about our products and services that may be of interest to you and may sometimes be commercial communications that promote the products and services of other members of our group or of a third party (for example, our business partners).

We will respect your decision as to which communications you wish to receive and the means by which you will receive them.

How can you change the type of commercial communications you receive and how you receive them?

If you decide that you no longer want to receive commercial communications, you can change your mind at any time. The following is a description of the channels enabled to stop receiving commercial communications: 

• If you are a Club Express member you can change your privacy preferences at any time by modifying your online profile, by accessing your personal area in the section “My Profile” at iberiaexpress.com or by writing to us at the postal address: Delegado de Protección de Datos, Iberia Express, Calle Alcañiz, 23, Primera Planta, 28042 Madrid, España.

 In addition, all commercial communications that we send you by e-mail will have a "opt-out" option that will allow you to opt-out of receiving commercial electronic communications. We try to process requests to stop receiving commercial communications within 10 business days of receiving them, however, you may receive some commercial communications during that period.

 Please note that if you notify us that you no longer wish to receive commercial communications, you will continue to receive communications (as described above) regarding the products and services you have purchased, such as confirming your reservation or sending you an update on the status of your reservation.

Iberia Express will only process your personal data when there is a legal basis for doing so. The legal basis will depend on the reason or reasons why Iberia Express collects and needs to use your data. Under EU data protection laws, as well as local data protection laws in almost all cases the legal basis will be:

• Because we have to use your data in order to process your booking, to fulfil your travel program and our contract with you.
• Because your personal information to operate and improve our business as an airline and travel provider is among the legitimate interests of Iberia Express as an airline.
• Because Iberia Express needs to use your personal data to comply with a legal obligation.
• To protect your vital interests or those of others.
• Because you have given your consent for Iberia Express to use your personal data for a specific purpose.

Additional information on each legal basis is provided below.

 If the processing of your data is subject to any other law, the basis of the processing of your data may be different from that set out above, and in such circumstances may be based on your consent in all cases.

Fulfilling a contract with you 

Iberia Express will have to use your personal data to complete any reservation you have made with us. For example, we may need to use information such as your contact details and payment information to provide you with the flight, stay and/or vehicle you have contracted.

Legitimate interests

As an airline company and transport service provider, Iberia Express has a legitimate business interest in processing the personal data we collect in order to provide an efficient service and develop our business

Fulfilment of legal obligations

There are situations where Iberia Express is subject to certain legal obligations and needs to use your personal data to comply with those obligations

To protect your vital interests or those of others

There are situations where we may need to use your personal information to protect your vital interests or those of others.

Consent

Alternatively, we may collect and process your personal data when you have specifically given your consent.

If the basis for processing your personal data is your consent, you may revoke it at any time by changing your preferences through your online profile or by contacting us at: Delegado de Protección de Datos Iberia Express, Calle Alcañiz, 23, Primera Planta, 28042 Madrid, España.

However, if you revoke your consent, in some circumstances we may not be able to provide all or part of the services you have requested and you may not be able to cancel your reservation or obtain a refund of any costs you have paid.

We will retain your personal data for as long as is necessary for the purpose for which they are being processed. For example, when you make a reservation with us, we will retain the information relating to your reservation so that we can process your specific travel services request and subsequently for as long as we are able to handle or respond to any claims or queries relating to your reservation. We may also retain such information to further enhance your experience with Iberia Express and ensure that you receive any benefits from our loyalty programs.

We will actively review the data in our possession and securely delete or, in some cases, anonymise it when there is no longer any legal, commercial or customer-related need to retain it.

Your personal information may be shared with the companies within our group, which includes International Consolidated Airlines Group S.A (IAG), British Airways, Vueling, Aer Lingus, OpenSkies, British Airways Holidays, Avios, British Airways CityFlyer, IAG Connect and IAG GBS. For more details about our group please visit the website of our parent company, IAG. We share information with them, so they can assist us in providing services to you and to understand more about you. For example, if you have flown with one of the other airlines in the IAG Group we may use this information to understand more about the sorts of travel services you are likely to be interested in.

You will only be sent marketing emails from other companies within our group where you have provided your consent to those companies.

We may also disclose your personal information to the following third parties for the purpose described here:

• Customs and immigration authorities of any country included in your itinerary or over which your flight may fly. Iberia Express and other airlines are required by the laws of the EU, the US and other countries to provide border control and customs authorities with access to booking and travel information when the flight is to or from those countries, including stopovers, and when it overflies to reach its destination
  
  Show example.
  X

  
  

  •If you’re flight involves flying over the USA, then the information will be supplied to the relevant authority in the USA.

• Air carriers and other service providers necessary for the provision of the services requested by you when, for example, part of your travel itinerary includes a flight operated by a different airline or includes the rental of a vehicle or a hotel reservation. Such carriers and service providers will be identified at the time you make a reservation
  
  Show example.
• Our airline partners and franchisees, for example, to facilitate their connecting flights or to manage benefits from collaboration between loyalty programmes. Also, travel agencies and other third parties through which you book trips.
• Credit and debit card companies, credit reporting agencies, and fraud control service providers to process payments and (where necessary) perform fraud checks.
• In response to legal and valid requests from governments and law enforcement, such as customs and immigration authorities.
• External service providers that we hire to provide services, such as to conduct marketing initiatives or conduct customer surveys on our behalf.
• Third parties, such as law firms and courts, to enforce or fulfil a contract with you.
• Third parties, such as police and regulatory authorities, to protect our rights, property, or the safety of our customers, employees and assets.
• Third parties to whom we provide data about your use of the website (but not your personal data) so that they are aware that you have visited our websites (see the section “How we use cookies and other methods to collect data about the use of websites” above).
• Where necessary to comply with a legal obligation in any jurisdiction, including where such obligation arises from an act or omission by Iberia Express (for example, our decision to operate in a particular country or a decision relating thereto).

We do not sell your personal data and only allow third parties to send you commercial communications if you have given your consent to do so.

Which countries will your personal data be sent to?

Your personal data may be sent to third parties outside the country in which you are located and outside the European Economic Area.

The nature of our business means that it is often necessary to send your personal data outside the European Economic Area in order to manage your travel-related services. This is because our business and the third parties identified in the section “Who do we share your personal information with? operate in countries all over the world. For example, when you fly outside the European Economic Area, your personal data will be transferred to border control and immigration authorities outside those territories.

We may also transfer your personal data to third parties outside the country in which you are located to provide us with services related to the products and services you have requested.

Pursuant to European data protection regulations and local data protection regulations, you have the following rights:

Access

You may request a copy of all your personal data saved by Iberia Express. No charge is applied for this request.

Rectification

You may change your personal data when they are inaccurate.

Erasure

You may ask for your personal data to be erased.

Objection

You may request that your personal data not be processed.

Restriction of processing

You may request restriction of processing in the following cases:

• While verifications are being made concerning the contested accuracy of your data.
• When processing is unlawful, yet you oppose the erasure of your data.
• When Iberia Express no longer needs to process your data but you need them to establish, exercise or defend yourself from legal claims.
• While verifications are being made as to whether there are compelling legitimate grounds for the processing which override your interests, rights and freedoms when you have objected to the processing of your data for the performance of a task of public interest or to satisfy a legitimate interest.

Portability

You may receive the personal data concerning you, which you have provided to us and those which have been obtained due to your contractual relationship with Iberia Express, in electronic format and have the right to transmit those data to another entity.

The request must be made in writing and include the following information:

• Your full name and postal address.
• The details subject of your request.
• Any information that may help us locate the data subject in your request, such as:
• A locator or flight numbers and dates.
• Telephone records (identifier number, number from which you called and the option chosen, the date and time of your call or calls).

You must also provide:

• A photocopy of your passport or driving licence, so we can verify your identity.
• Your signature and the date of your request.
• If you are submitting the request on behalf of another person, you will need signed authorisation from that person.

Send you request to:

Data Protection Officer (DPO)

Iberia Express

Calle Alcañiz, 23

28042 Madrid

Spain

You may contact the Data Protection Officer by email at dpo@iberiaexpress.com.

A complaint may be filed with the Data Protection Authority when the data subject believes the exercise of their rights has not been duly satisfied.