Our commintment to privacy
Iberia Express is committed to respecting your privacy and protecting your personal data
- We will be completely transparent about the data we collect and the use we make of it.
- We will also use the information to try to get to know you better and send you relevant offers.
- If you let us know that you do not want to receive commercial communications, we will stop sending them to you. Of course, we will continue to send you important information regarding a product or service you have purchased to keep you informed about your reservation and travel itinerary.
- We will take the necessary steps to protect and secure your information.
- We will respect your data protection rights and try to give you control over your own information.
If you have made a reservation with us but one or more of the flights are operated by other airlines, each of those airlines will also be independently responsible for data processing under European Union data protection laws, as well as under local data protection laws applicable to those airlines.
Any service provider, such as a hotel or car rental company, will also be individually responsible for the processing of data. You can access the privacy policies of these providers by contacting them directly.
If you are a partner of Avios Group (AGL) Limited, it will also be independently responsible for the processing of your personal data. The address of Avios Group (AGL) Limited is: Astral Towers, Betts Way, Crawley RH10 9XX, United Kingdom.
Personal data means data that identifies you or could be used to identify you, such as your name, contact details and your travel and purchasing history. It may also include information about how you use our website and mobile applications.
This Policy applies to the personal data we collect, use and process in connection with your relationship with us as a customer or potential customer, including when you travel with us or use other services, when you browse our website, when you contact our service agents or call centres and when you book our services through third parties (such as travel agencies and other airlines).
When we refer to which other parties are responsible for the processing of data in the section Personal Data Controller or Who do we share your personal data with? you should consult their privacy policies for more information.
If you choose to contract additional services with us, such as making an on-board purchase, using our on-board entertainment system or participating in a contest held by Iberia Express with third party partners, other additional terms and conditions may apply in addition to those set forth in this policy.
We go to great efforts to protect the personal data you provide us with. Here are some steps you can take to keep your information safe.
Do not share your reservation code or booking reference
When you make a reservation, you are provided with a reservation code (also known as PRN or Passenger Registration Number). This reference will appear in the confirmation email or on the ticket of each passenger in your reservation.
Always keep your reservation code confidential. If you share your reservation code with third parties, they will be able to access your reservation data through our system.
If you are travelling with other people and do not want them to have access to your booking details, it may be preferable for each person to make a separate booking.
Do not share your login details for access to the private area of Club Express
To safeguard your access to the private area of our website and mobile applications, do not share your passwords with anyone. When you are finished using the website, online services or mobile applications, you should log out if someone may be able to access your computer or device. This is especially relevant if you use a publicly accessible computer.
Be cautious and protect yourself against online fraud and phishing
There is a practice of fraud on the internet known as “phishing", which consists of illegally obtaining personal data through deception. Unsolicited emails are sent to people on lists illegally obtained by third parties, and recipients are asked to enter or confirm bank details or passwords on a cloned or fake website.
We collect personal information about you each time you use our services (whether provided by us or by other companies or agents acting on our behalf), including when you travel with us, use our website or interact with us electronically or through our customer service centres.
For more information, see “What types of personal data do we collect and retain?”
In addition, we may receive personal data about you from third parties, such as:
- Companies that we have contracted to provide you with a service.
- Companies involved in your travel plans, including airlines involved in your previous or subsequent trip, airport operators and customs and immigration authorities.
- Companies participating in our loyalty and other customer programs (e.g. car rental companies and hotels).
When you use our services you will have to provide us with your personal data or the data of the person or persons who are going to travel.
We collect the following categories of personal data:
- Information you provide to Iberia Express to complete and manage a reservation you have made with us or a service you have requested
- Data collected during your trip with us.
- Details about your travel schedule.
- Information about the services provided to you in the past.
- Data about your online registration and other interactions
- Information about your use of our website, mobile applications and customer service centres. For more information, see .
- Information about the location of your device if you have been browsing iberiaexpress.com or using our mobile application. An IP address or Internet Protocol Address, is a numeric code that can act as a unique identifier for your computer or other device that can be disabled on your device.
When and why do we collect ‘sensitive personal data’?
Certain categories of personal data, such as those relating to racial origin, ethnicity, religion, health, sexual orientation or biometric data, constitute special categories of personal data which require additional protection in accordance with European Union data protection legislation and are referred to as “sensitive personal data”. Normally, we try to limit the circumstances in which we collect and process data of this nature. The following are examples of instances in which we may collect and process sensitive personal data:
- When you have asked Iberia Express and/or an airport operator for specific medical assistance, such as a wheelchair or oxygen.
- When you have requested permission to fly with us for a specific medical condition or if you are more than 28 weeks pregnant.
- When you have chosen to provide us with such information for any other reason or when it has been provided to us by a third party such as the travel agency through which you made your reservation.
You may also have requested a special service (such as a menu) that does not in itself constitute sensitive data but may involve or suggest information about your religion, health or other data.
The main purposes for which we process your personal data are as follows:
- To deal with all matters related to your trip and provide you with the services requested
- To manage the boarding process and facilitate connecting flights at the airport.
- To send you status updates and service or operational communications about the contracted service.
- To be in touch with you before your flight and at the airport.
- To ensure your safety and to comply with certain legal requirements applicable to Iberia Express as an airline company.
- To provide you with services that meet your needs and offer you a more personalised service.
- For analytical work and market research.
- To carry out marketing activities and keep you informed about Iberia Express products and services.
- To send you updated information and communications.
- To improve our website, products and services.
- For management and administration purposes. .
When we collect data directly from you, we may ask you whether or not you wish to receive our marketing communications or join Club Express. In this regard, please note that such commercial communications may be about our products and services that may be of interest to you and may sometimes be commercial communications that promote the products and services of other members of our group or of a third party (for example, our business partners).
We will respect your decision as to which communications you wish to receive and the means by which you will receive them.
How can you change the type of commercial communications you receive and how you receive them?
If you decide that you no longer want to receive commercial communications, you can change your mind at any time. The following is a description of the channels enabled to stop receiving commercial communications:
- If you are a Club Express member you can change your privacy preferences at any time by modifying your online profile, by accessing your personal area in the section “My Profile” at iberiaexpress.com or by writing to us at the postal address: Delegado de Protección de Datos, Iberia Express, Calle Alcañiz, 23, Primera Planta, 28042 Madrid, España.
In addition, all commercial communications that we send you by e-mail will have a "opt-out" option that will allow you to opt-out of receiving commercial electronic communications. We try to process requests to stop receiving commercial communications within 10 business days of receiving them, however, you may receive some commercial communications during that period.
Please note that if you notify us that you no longer wish to receive commercial communications, you will continue to receive communications (as described above) regarding the products and services you have purchased, such as confirming your reservation or sending you an update on the status of your reservation.
Iberia Express will only process your personal data when there is a legal basis for doing so. The legal basis will depend on the reason or reasons why Iberia Express collects and needs to use your data. Under EU data protection laws, as well as local data protection laws in almost all cases the legal basis will be:
- Because we have to use your data in order to process your booking, to fulfil your travel program and our contract with you.
- Because your personal information to operate and improve our business as an airline and travel provider is among the legitimate interests of Iberia Express as an airline.
- Because Iberia Express needs to use your personal data to comply with a legal obligation.
- To protect your vital interests or those of others.
- Because you have given your consent for Iberia Express to use your personal data for a specific purpose.
Additional information on each legal basis is provided below.
If the processing of your data is subject to any other law, the basis of the processing of your data may be different from that set out above, and in such circumstances may be based on your consent in all cases.
Fulfilling a contract with you
Iberia Express will have to use your personal data to complete any reservation you have made with us. For example, we may need to use information such as your contact details and payment information to provide you with the flight, stay and/or vehicle you have contracted.
As an airline company and transport service provider, Iberia Express has a legitimate business interest in processing the personal data we collect in order to provide an efficient service and develop our business
Fulfilment of legal obligations
There are situations where Iberia Express is subject to certain legal obligations and needs to use your personal data to comply with those obligations
To protect your vital interests or those of others
There are situations where we may need to use your personal information to protect your vital interests or those of others.
Alternatively, we may collect and process your personal data when you have specifically given your consent.
If the basis for processing your personal data is your consent, you may revoke it at any time by changing your preferences through your online profile or by contacting us at: Delegado de Protección de Datos Iberia Express, Calle Alcañiz, 23, Primera Planta, 28042 Madrid, España.
However, if you revoke your consent, in some circumstances we may not be able to provide all or part of the services you have requested and you may not be able to cancel your reservation or obtain a refund of any costs you have paid.
We will retain your personal data for as long as is necessary for the purpose for which they are being processed. For example, when you make a reservation with us, we will retain the information relating to your reservation so that we can process your specific travel services request and subsequently for as long as we are able to handle or respond to any claims or queries relating to your reservation. We may also retain such information to further enhance your experience with Iberia Express and ensure that you receive any benefits from our loyalty programs.
We will actively review the data in our possession and securely delete or, in some cases, anonymise it when there is no longer any legal, commercial or customer-related need to retain it.
Your personal information may be shared with the companies within our group, which includes International Consolidated Airlines Group S.A (IAG), British Airways, Vueling, Aer Lingus, OpenSkies, British Airways Holidays, Avios, British Airways CityFlyer, IAG Connect and IAG GBS. For more details about our group please visit the website of our parent company, IAG. We share information with them, so they can assist us in providing services to you and to understand more about you. For example, if you have flown with one of the other airlines in the IAG Group we may use this information to understand more about the sorts of travel services you are likely to be interested in.
You will only be sent marketing emails from other companies within our group where you have provided your consent to those companies.
We may also disclose your personal information to the following third parties for the purpose described here:
- Customs and immigration authorities of any country included in your itinerary or over which your flight may fly. Iberia Express and other airlines are required by the laws of the EU, the US and other countries to provide border control and customs authorities with access to booking and travel information when the flight is to or from those countries, including stopovers, and when it overflies to reach its destination
- Air carriers and other service providers necessary for the provision of the services requested by you when, for example, part of your travel itinerary includes a flight operated by a different airline or includes the rental of a vehicle or a hotel reservation. Such carriers and service providers will be identified at the time you make a reservation
- Credit and debit card companies, credit reporting agencies, and fraud control service providers to process payments and (where necessary) perform fraud checks.
- In response to legal and valid requests from governments and law enforcement, such as customs and immigration authorities.
- External service providers that we hire to provide services, such as to conduct marketing initiatives or conduct customer surveys on our behalf.
- Third parties, such as law firms and courts, to enforce or fulfil a contract with you.
- Third parties, such as police and regulatory authorities, to protect our rights, property, or the safety of our customers, employees and assets.
- Where necessary to comply with a legal obligation in any jurisdiction, including where such obligation arises from an act or omission by Iberia Express (for example, our decision to operate in a particular country or a decision relating thereto).
We do not sell your personal data and only allow third parties to send you commercial communications if you have given your consent to do so.
Which countries will your personal data be sent to?
Your personal data may be sent to third parties outside the country in which you are located and outside the European Economic Area.
The nature of our business means that it is often necessary to send your personal data outside the European Economic Area in order to manage your travel-related services. This is because our business and the third parties identified in the section “Who do we share your personal information with? operate in countries all over the world. For example, when you fly outside the European Economic Area, your personal data will be transferred to border control and immigration authorities outside those territories.
We may also transfer your personal data to third parties outside the country in which you are located to provide us with services related to the products and services you have requested.
Pursuant to European data protection regulations and local data protection regulations, you have the following rights:
You may request a copy of all your personal data saved by Iberia Express. No charge is applied for this request.
You may change your personal data when they are inaccurate.
You may ask for your personal data to be erased.
You may request that your personal data not be processed.
Restriction of processing
You may request restriction of processing in the following cases:
- While verifications are being made concerning the contested accuracy of your data.
- When processing is unlawful, yet you oppose the erasure of your data.
- When Iberia Express no longer needs to process your data but you need them to establish, exercise or defend yourself from legal claims.
- While verifications are being made as to whether there are compelling legitimate grounds for the processing which override your interests, rights and freedoms when you have objected to the processing of your data for the performance of a task of public interest or to satisfy a legitimate interest.
You may receive the personal data concerning you, which you have provided to us and those which have been obtained due to your contractual relationship with Iberia Express, in electronic format and have the right to transmit those data to another entity.
The request must be made in writing and include the following information:
- Your full name and postal address.
- The details subject of your request.
- Any information that may help us locate the data subject in your request, such as:
- A locator or flight numbers and dates.
- Telephone records (identifier number, number from which you called and the option chosen, the date and time of your call or calls).
You must also provide:
- A photocopy of your passport or driving licence, so we can verify your identity.
- Your signature and the date of your request.
- If you are submitting the request on behalf of another person, you will need signed authorisation from that person.
Send you request to:
Data Protection Officer (DPO)
Calle Alcañiz, 23
You may contact the Data Protection Officer by email at firstname.lastname@example.org.
A complaint may be filed with the Data Protection Authority when the data subject believes the exercise of their rights has not been duly satisfied.