Privacy Protection Policy
1. SummaryChina Airlines Limited (hereinafter referred to as "we" or "CAL") fully understand the importance of personal data. We wish to use this Privacy Protection Policy ("Policy") to explain how we process and use your personal data, and how to protect the rights and interests with respect to your personal data. This Policy applies to China Airlines official website, official App, Cargo website, SkyBoutique duty free website, eMall/Home delivery website, Mandarin Airlines and other CAL's business groups and organizations. In addition, this Policy is listed as one of the core beliefs in China Airlines Group Code of Conduct.
To implement privacy protection and compliance, pursuant to Taiwan's Personal Data Protection Act, General Data Protection Regulation (GDPR) and other applicable data protection laws/regulations, we prescribe this Policy to manage the privacy and security of personal data.
We will, in a reasonable manner, collect and use your personal data within the scope of specific purpose. We ensure that you have the rights and interests with respect to review, erasure, rectification, restriction of using your personal data and withdrawal of your consent, etc. In addition, we make the contingency strategy and plan for handling personal data being stolen, altered, disclosed or damaged. By way of establishing and maintaining appropriate personal data protection mechanism, we are committed to protecting the accuracy and security of your personal data.
This Policy applies when you use our services, you hereby entrust us with personal data. For processing your services, we will disclose or share your personal data to third parties other than China Airlines Group under certain circumstances, such as travel agents, alliance partners, subcontracting vendors, governmental authorities, etc. We will demand such third parties to comply with this Policy for protecting privacy and security of your personal data.
Privacy Protection Statement
We are committed to protecting privacy and security of your personal data pursuant to our Policy. To ensure that you can make informed decisions, please read this Privacy Protection Statement ("Statement") to understand who we share your Personal Data with and for what purposes, and the choices you have concerning how your personal data is collected and used by us. We expect you to feel comfortable to use all related services provided by us.
By continuing to use our services, you signify that you have read and understood this Statement. We may amend this Policy from time to time, the changes will be effective from the date of posting and replaces earlier versions. The updated version will be posted on our website www.china-airlines.com and App, and the date will be stamped so that you are aware of when the Statement was last updated.
The main content of this Statement includes:
- The types of personal data we process
- How we collect your personal data
- Why we collect and use your personal data
- Disclosing or sharing personal data with third parties
- Security and retention
- Your rights
- Data protection of minors
- Collection of IP address
- Data analysis and automated decision-making
- Update your personal data
- Contact us
- Link to other websites
1. The types of personal data we process
The types of personal data that we collect depend on the circumstances of collection and on the nature of the service requested or transaction undertaken.
1.1. General: we may collect and process the following categories of personal data:
- Personal data that can be used to identify an individual
We may record your name, gender, date of birth, your nationality, country of residence, passport number and other personal identification numbers, etc.
- Your contact details and personal account or registration details
Your contact details may include your address, telephone number and email address. When you create a personal account, or register for a service, we may also record your log in details and other information you fill out on your personal account or registration form. For cooperate/business members, we also collect information with respect to your company such as company name.
- Information about your reservations, bookings and purchases
When you make a reservation or book a flight with us, we process your reservation and booking information. These travel information may include ticket numbers, flight information. If your purchases made through our website or App, such as Dynasty Package, seat upgrades, excess baggage, duty-free products, we will also process these information in relation to ancillary services.
In addition, we may process your information relating to your use of our flight entertainment system or onboard WiFi service, our lounge service and cargo service, etc.
- Information about your travel arrangement
When you travel with us, we process information in relation to your journey. Such as your travel itinerary, online check-in with our website or App, check-in at the airport counter, check-in baggage, baggage tracking, etc. We may also record any specified medical needs or dietary requests you have and any additional assistance you require.
- Your payment details
Payment details you used to purchase our services and products, such as credit or debit card information, including name of card holder, card number, billing address and expiry date, etc.
- Your Dynasty Membership
When you become a member of our Dynasty Flyer Program, we will process your membership number, account name, membership tier, mileage, award and other information in relation to your membership.
- Your interests, preferences and options
When you use our service, you may choose to share information with us, such as your interests, preferences, services and products you purchased, your opinions, etc.
- Our communications and interactions with you
We will collect any interactions and correspondence between us, such as calls made through our call center, any interactions you have with our staff or employee, any interactions with us on social media. When you call us, our customer support will register your questions or complaints in our database. We may also record telephone calls for training purposes or to prevent fraud.
- Your use of our website, App and social media platforms
In addition, when you sign in for our services using a social media network account, we may receive your social network profile including your contact details, interests and hobbies.
Certain categories of personal information we collect and use can be considered "special categories of personal data" under applicable data protection law, such as health, religious or minors' data, we try to limit the circumstance where we collect these personal data in principle. Nevertheless, this can occasionally occur because you have made certain requests in connection with your travel arrangement or if you otherwise choose to provide such data to us through a third party (e.g. travel agents). For example, requesting a wheelchair from us and/or an airport operator, providing medical clearance form and medical certificate, requesting a particular type of meal.
1.2. Specific categories of data
In addition, under certain circumstances, we may collect and use your special categories personal data in accordance with the law to prevent your life, health and property rights due to public health emergencies, such as requiring you to check your previous travel, taking your body temperature or requesting you to provide a specific health certificate.
1.3. Specific services and survey information
1.4. Certain personal data are required for many of our services and products and if you fail to supply such personal data as requested for specific services, we may delay or be unable to deliver you the relevant services and products in full.
2. How we collect your personal data
For the performance of the contract of carriage with you, we may collect the aforementioned categories of personal data from you directly or through third parties. Please note that third parties may have their own privacy policies to explain how they collect and use your personal data. Such privacy policies do not constitute a part of this Policy. You need to carefully read and decide whether agree with their privacy policies or not.
2.1. We collect personal data you provide to us
2.2. We receive your personal data from your travel agent, our airlines partners and other parties involved in your travel arrangements
- The travel agent who handle your reservations and bookings, and if you use a third party platform to search and book a flight, we may receive your personal data from that provider. For example, your organization's corporate co-worker book a flight for you, we will verify whether he/she is validly identified as acting on your behalf or has been authorized by you pursuant to our security procedures.
- Our service providers and members of China Airlines group. Examples of such third parties include our ground handling agents who assist you with check-in and booking, or our catering provider to accommodate your special meal requests.
- Our airlines partners or third party partners for marketing purpose. For example, when you purchase our services from a participating airline of SkyTeam Airlines Alliance or other third party partners for marketing purpose, they share your earned mileage with us. And if you use a third party platform to search and book a flight, we may receive your identifying information and booking details from that provider.
- Our cooperating vendors for marketing activities, such as co-branded credit card issuers, the partner hotels, restaurants, retailers, etc.
2.3. When you use our website or App, we collect information via cookies and similar technologies
2.4. We receive information from your social network provider
2.5. We receive information from public authorities or governmental organizations
3. Why we collect and use your personal data
We will not process your personal data without any legal basis. When you agree to share your personal data with us, here are the lists of legal basis for which we use your personal data in our worldwide branch offices:
3.1. To perform the contract of carriage for the flights you booked with us and process your travel arrangements
- To handle your bookings and travel arrangements, we need to process most of the information mentioned above in accordance with our General Conditions of Carriage. For example, we need your name and other identifying information to handle your bookings, transmitting your information to worldwide branch offices in order to fulfill transportation services, or to confirm your booking and to inform you about the latest flight status, we need your contact details.
In addition, to ensure you receive the required care, we need to understand your specified medical requirements in order to provide you any necessary assistance.
- To provide our website and App services. For example, we use your name and flight details when you check-in your flight with our website or App, or some of our online services and Apps use your location.
3.2. To maintain your Dynasty membership's rights
3.3. To provide customer support
3.4. For marketing purpose
- To send you updates on our latest news, offers and promotions in connection to our services and products.
- To send you our travel services, co-branded credit card offer, duty-free sales, sweepstakes, travel insurances, hotel reservation and car rentals, etc.
- To send you special offers tailored to your preferences or interests, including posting commercials on our website or tracking your interactions with links from third party websites to our website. More information about our partners and the services and products they offer is provided, you may subscribe our newsletter or communication, and can be found on the concerning website.
3.5. For specific services and survey information
3.6. For aviation safety and security purposes
3.7. To comply with our legal obligations and for legal and management purposes
4. Disclosing or sharing personal data with third parties
For processing your services, in certain circumstances, we will disclose or share your personal data to third parties as set out below. Some of these third parties may locate in the country or area other than your residence.
4.1. Our subcontracting service providers and members of the China Airlines group who process on our behalf:Our travel and freight service providers or travel-related businesses and service providers may process your personal data on our behalf. For example, ground handling agents who assist you with check-in and boarding, our airport lounge operators, airport wheelchair service.
4.2. Third parties facilitating your bookings and managing your travel arrangements:
4.3. Our interline, code share and strategic alliance partners:
4.4. Governmental authorities and regulatory organizations:
5. Security and retention
5.1. Data storage and security
All personal data we collect from you is stored on our secure servers or other safe locations, and we apply appropriate technical and organizational measures that meet the current industrial standards (in particular article 32 of the GDPR) to protect your personal data so as to ensure an appropriate level of security and prevent personal data from theft, tampering, loss or other infringement. We also comply with our security policies and regulations when accessing or using personal data, and restrict access to your personal data to those persons who need to use it for the purposes for which it was collected, and hold regular personnel security training to enhance the protection.
We will retain your personal data for as long as it is necessary to fulfill the purpose for which it was collected, our legal or business purposes, or as required by relevant laws.
5.2. International data transmission
Our Head Office is based in Taiwan and your personal data will be transmitted to data storage facilities where we keep our central records. Your personal data will be transferred to our worldwide branch offices and other third parties service providers (please refer to "Disclosing or sharing personal data with third parties" above) in Taiwan and around the world in connection with our performance of the contract of carriage with you. We will process your personal data in the aforementioned countries or area. Under this premise, your personal data may be transferred to countries or area other than your residence, including those countries or area with a lower level of data protection than your residence. We will use adequate safeguards to comply with requirements for the international transmission under applicable privacy and data protection laws.
If you are an EU resident, where we transfer your personal data outside the European Economic Area ("EEA"), this is done either on the basis that it is necessary for the performance of our contract of carriage with you, or that the transfer is subject to the European Commission's Standard Contractual Clauses ("SCC") for the transfer of personal data to third countries.
If you are a Chinese resident, where we transfer your personal data outside the territory of China, this is done on the basis that the security assessment is conducted in accordance with the Personal Information Protection Law of People's Republic of China and relevant laws/regulations, or that the model contract terms issued by the China Administration of Cyberspace are concluded for the transfer, or that transfer is necessary for the performance of our contract of carriage with you.
5.3. Data destroy
When the specific purpose of collecting your personal data is no longer exists or upon expiration of the relevant time period, we will adopt commercial reasonable and technical practicable measures either to secure destroy or irreversibly anonymize your personal data in accordance with applicable laws.
5.4. How to protect yourself
The Internet is a worldwide open global communication tool. We do not make any guarantee to the security of data transmissions or storage, even though we have used our best efforts to protect your personal data. The customers shall take their own risks on transmission of any data.
It is advisable to keep your account ID, password of membership and other personal data properly, and do not disclose such information to any other third parties. Please log out your Dynasty account and social media account (if you use social media account to log in Dynasty account) after use. If you use public computer or share computer with other persons, please log out your Dynasty account and close the browser window after use in order to prevent others from abusing your personal data. In addition, we cannot be held responsible for theft of your personal data on a platform that is not managed by us.
6. Your rights
Subject to applicable privacy and data protection laws, you may exercise your rights by providing the necessary information to help us to confirm your identity and submit the online form, or contact our branch offices or Data Protection Office/Personal Information Protection Officer (please see "Contact Us") to exercise any rights you are granted.
In some circumstances, we may require specific information form you to help us verify your identity and process your request. If you provide incorrect or incomplete information and prevents us from verifying your real identity, or we are not required by law to comply with your request, we may deny your right requests.
If the data subject is a Dynasty member and wish to update his or her personal data or withdraw their consent, you may click "Account Profile" > "Update Personal Profile" or "Membership Account Deletion" to exercise your rights after logging in to "Dynasty Flyer Service".
6.1. Right to access and request a copy
- Investigation agencies or governmental agencies object to our compliance with your requirements.
- According to our reasonable judgments and assessments, it is believed that providing such information would interfere with another's rights or affect a person's life or safety.
- The information collected is in relation to breach of contract, suspected fraudulent activities or illegal activities.
6.2. Right to supplement or rectification
6.3. Right to demand the discontinue of collection, processing or use
6.4. Right to restriction of processing
6.5. Right to restriction of automated individual decision making
6.6. Right to erasure
- You believe that it is no longer necessary for us to hold your personal data.
- We are processing your personal data on the basis of your consent and you wish to withdraw your consent and there is no other ground under which we can process such data.
- We are processing your personal data on the basis of our legitimate interest and you object to such processing.
- You no longer wish us to use your personal data for marketing and promotional purposes.
- You believe that your personal data is being unlawfully processed by us.
6.7. Right to data portability
Subject to the scope of your consent, we will use your personal data to provide promotion and personalized service information. If you do not want to receive our marketing messages, you may withdraw your consent at any time pursuant to this article, and change the relevant features in your Dynasty Flyer Service by clicking "Account Profile" > "eDM Subscribe/Unsubscribe", or use the "Unsubscribe" feature in the email we sends, or Contact Us either online or by phone.
6.8 Opt-out or unsubscribe from marketing
In the event of the death of a natural person, if you are a Chinese resident and as a close relatives of the deceased of our passenger, for their own lawful and legitimate interests, you may exercise the rights to access, copy, correct and delete the relevant personal data of the deceased, unless the deceased had otherwise arranged prior to his/her death. If you wish to exercise the said rights on behalf of the deceased, please provide proof of your identity and the deceased's identity, as well as proof of the relationship, such as death (presumption) certificate of the deceased.
6.9. Rights of the deceased
7. Data protection of minors
7.1. Here are the age limits (calculating based on the boarding date) of passengers who book our flights through CAL website, App and travel agents:
- Infants (under than 2 years old): tickets for infants will not occupy a set are available for purchase. To book a seat for an infant who will occupy a seat, please contact our customer service center.
- Children between 2 and 11 years old: these children cannot travel alone without the company of over 18 years old passenger. If needed special service, please contact the nearby branch office of your residence for assistance. For detailed information of our worldwide branch offices, please find here. An unaccompanied minor we accept is any young passenger aged between 5 to 12 years old and not travelling with parents or guardians who are at least 18 years old on the same flight and class of travel. To apply for this service, parents or legal guardians must sign the "Consent & Release for Carriage of Unaccompanied Minors" and attached copies of their identity and proof of the relationship with the unaccompanied minors, such as household register or its copy.
- Teenagers between 12 and 17 years old: these teenage passengers can travel alone but need visa and other travel documents and notify the relevant branch offices. The other passengers who travel together shall not less than 12 years old.
- Passengers over 18 years old: can travel alone and are eligible to travel with children under 12 years old.
We protect minors' personal data in accordance with applicable laws/regulations. Please be advised that we cannot distinguish the age of persons who access and use our website. If you are regarded as a minor (according to your local domestic law or other applicable laws), please be sure to read this Policy and Statement under the guidance of your parents or other guardians and obtain their consent before using our services or products.
7.2. How we protect minors' personal data
For collecting minors' personal data with parental or guardian consent, we will only process or use these data when permitted by law, express consent of parents or other guardians, or necessary to protect the rights and interests of minors, and make sure to take appropriate security measures. If a minor (according to applicable laws) has provided us with his/her personal data without parental or guardian consent, the parent or guardian should contact us to remove the relevant personal data and unsubscribe the minor.
If we become aware that personal data has been collected from a person under a minor without parental or guardian consent, we will delete this personal data and terminate the minor's account, if that minor has an account.
8. Collection of IP address
An Internet Protocol address (IP address) is a numerical label assigned to each device participating in internet that uses the Internet Protocol for communication from service provider. We collect your IP address when you access our website, mobile services and App.
We store this information to help us manage security, analyze how our website, mobile services and App interact with you.
9. Data analysis and automated decision-making
We and our affiliates or other business cooperation agencies will use the aforementioned data to include but not limited to transaction amount and travel itinerary to obtain specific information to observe customer behavior and may send this information to our service providers to provide better and more personalized transactions and services.
10. Update your personal data
We need your assistance to ensure that your personal data is current, complete and accurate. Please kindly inform us of changes to your personal data. If you are a registered Dynasty Member, you may update your personal data at any time by logging on to your account.
Your booking information or flight itinerary will be disclosed to the appropriate customs and immigration authorities as required by law. As such, your personal data is very important to ensure that personal data contained in your booking information or flight itinerary is current, completed and accurate. Therefore, we will request personal data updates from you from time to time.
We will amend this Policy and Statement from time to time, and the changes will be effective from the date of posting; and the updated version will replace the earlier versions. We will publish the updated Policy on www.china-airlines.com or App, and the date will be stamped so that you are aware of when the Policy was last updated.
12. Contact us
China Airlines Limited
Data Protection Officer/Personal Information Protection Officer
No.1 Hangzhan S. Rd. Dayuan Dist.
Taoyuan City, 33758 Taiwan
For any requirements or questions of your bookings, tickets or other services, you may Contact Us either online or by phone, our customer support will get you back soon. If the data subject is a Dynasty member and wish to update his or her personal data or withdraw their consent, you may click "Account Profile" > "Update Personal Profile" or "Membership Account Deletion" to exercise your rights after logging in to "Dynasty Flyer Service".
13. Link to other websites
This Policy and Statement is translated from Chinese and may be translated into other languages. In the event of any inconsistency between the Chinese version and the translated version of this Policy and Statement, the Chinese version shall prevail.
Notice to California Residents: California Consumer Privacy Act (CCPA)
The California Consumer Privacy Act ("CCPA") provides some California residents with the following rights. If you are a California resident, you can make certain requests with respect to your personal information. To the extent CCPA apply, we will comply with such applicable law.
1. What information we collect about you
California residents have the right to know what personal information we have collected, corresponding to the following categories of personal information:
- Identifiers: such as name, address, email address, IP address, account name, passport numbers, your Dynasty Member ID number, cookie information or other similar identifiers.
- Customer records: such as phone number, billing address, credit or debit card information or employment.
- Demographic information: such as age, gender, medical condition, marital status or disability. This category of information will also be protected under classification characteristics under applicable laws/regulations.
- Commercial information: such as services and products purchased or opinions you shared with us.
- Internet activity: such as browsing type, browsing history, search history and other information collected automatically.
- Inferences: such as interests, preferences, favorites, psychological trends and behaviors.
For more information on what we collect, including the sources form which we receive information and the business or commercial purposes we use these categories of information, please refer to "How we collect your personal data" section and "For which purpose we use your personal data" section.
2. Right to know
To the extent required by applicable law, you may have the right to request to know what personal information we have about you in the preceding 12 months, including a list of categories of your personal information that we shared with another company for business purposes. In particular, a "right to know" may entail providing you with the following based on the details of your request:
- The categories of personal information we have collected about you.
- The categories of sources from which the personal information we collected.
- The business or commercial purpose for collecting or selling your personal information.
- The categories of third parties with whom we shared your personal information for business purposes.
- The specific pieces of personal information we have collected about you.
Once we receive your request, we will verify and confirm accordingly, and will endeavor to disclose to you the information you requested.
3. Right to delete
If the applicable law grants you a right to request the deletion of any of your personal information that we hold about you. Once we receive your request, verify and confirm your request, we will delete your personal information from our records and direct our outsourcing service providers to do the same, unless an exception applies.
We may not able to erase your personal data to the extent processing is necessary to service requirements and the right to erasure shall not be applied in accordance with applicable data protection laws/regulations, such as travel information has its statutory retention period; or the necessary information for handling compensation, litigation or non-litigation cases.
4. Right to opt-out of sale: Do Not Sell My Personal Information
We do not generally sell or share your personal information for monetary consideration. However, to the extent "sell" or "sale" under CCPA is interpreted to include the transfer or communication of personal information by a business to another business or a third party in such a way that conveys value to the recipient, even if that value is not monetary. This means some advertising technology activities and sharing information for common business activities may be considered a "sale" under the CCPA, such as the participation in certain ad networks and advertising on social media platforms can constitute sharing/using your personal information for digital advertising and a "sale" of personal information under CCPA, even there is no exchange of money.
To the extent CCPA applies and we sell your personal information as the term "sell" is defined under the CCPA, you have the right to request us to stop "selling" your personal information by completing the online form. You may also refer to "Contact Us" section for further details.
5. Right to non-discrimination
We assure you will not to receive any discriminatory treatment by us for the exercise of your rights. To be specifically, it means we will not deny you services, charge different rates or fees, or provide different level of service or quality of goods.
6. How to exercise your CCPA privacy rights
Please complete the online form the necessary information to help us to confirm your identity, or you may refer to "Contact Us" section to exercise your above rights. When you contacting us, please specify what kind of request you are seeking to make and the scope of the request. In some circumstances, we may require specific information from you to help us verify your identity and process your request. If you provide incorrect or incomplete information and prevents us from verifying your real identity, or we are not required by law to comply with such your request, we may deny your right requests.
If the data subject is a Dynasty member and wish to update his or her personal data or withdraw their consent, you may click "Account Profile" > "Update Personal Profile" or "Membership Account Deletion" to exercise your rights after logging in to "Dynasty Flyer Service".