Japan Airlines Vacations: GDPR Privacy Policy
This Privacy Policy sets out how JALPAK Co., Ltd. (trading as Japan Airlines Vacations) processes personal data of its customers in connection with its website at https://uk.jalvacations.jal.co.jp/ (link below) (“Site”), including the products and services that are offered through the Site
This Privacy Policy should be read in conjunction with the Japan Airlines Vacations Cookie Policy (link below) and Booking Conditions (link below).
1. JAL Group Airlines
Japan Airlines Vacations is a part of the JAL Group Airlines which processes personal data pursuant to the JAL Group's Basic Policies for Information Security and Personal Data Protection, a copy of which can be found here:
2. Data Controller, Data Protection Officer and Representatives
Full details, including contact details, of Japan Airlines Vacations and its Data Protection Officer and UK Representative are set out here:
- Personal Data Controller
JALPAK Co., Ltd.
Address: 2-4-11 Higashishinagawa, Shinagawa-ku, Tokyo, 140-8658
E-mail: security.jpk@jal.com - Data Protection Officer
Japan Airlines Group Data Protection Officer
Address: 2-4-11 Higashishinagawa, Shinagawa-ku, Tokyo, 140-8637
E-mail: dpo@jal.com - UK Representative
Address: Euro Creative Tours (U.K.) Ltd, Standon House, 21 Mansell Street, London E1 8AA
E-mail: pdc@ectuk.com
3. Purpose and Legal Basis for Processing Personal Data
Japan Airlines Vacations will process customers' personal data for the following purposes:
Please scroll horizontally.
| Purpose of Processing | Legal Basis | |
|---|---|---|
| (1) | To provide air transportation services (reservations, sales, check-in, airport handling, cabin services, etc., including cases of interline transportations, joint operations, code-sharing, contract operations, etc., in addition to normal transportation services) | Contract performance |
| (2) | To provide other products and services requested by the customer, including JAL Mileage Bank (hereinafter referred to as "JMB") | Contract performance |
| (3) | To provide information and communications and; to conduct questionnaires relating to products, services, events and prize draws, prize competitions and other promotions that we may run; to handle customer enquiries in respect of the same and to train staff | Legitimate interests |
| (4) | To conduct Site and sales analysis, investigations and research; to learn more about our customers; to develop and improve services and products. To do this we may use cookies and other similar technologies - please see our Cookie Policy (link below) for more information. | Legitimate interests |
| (5) | To conduct operations and business administration and to ensure compliance with our legal obligations. | Contract performance Legal obligations Legitimate interests |
| (6) | To conduct advertising and marketing activities, including email marketing to our customers and to display advertisements to our customers and prospects on other websites, including social media. To do this we may use cookies and other similar technologies - please see our Cookie Policy (link below) for more information. | Consent (where required) Legitimate Interests |
4. Personal Data Categories
Japan Airlines Vacations process customers' personal data necessary for the above purposes, including:
- Basic Data
Name, address, contact details (TEL/FAX numbers, e-mail address), gender, date of birth, country/region of residence, passport number, credit card number, information on employment (company name, department, job title, address, TEL/FAX numbers), etc. - Data for Making Reservations and Itineraries
Reservation/boarding information (flight name, etc.), itinerary information, copy of e-ticket, EMD, (online) check-in, accompanying passengers, incidental services (upgrades, additional baggage, etc.), mailing address of items sent to customers, e.g. ticket, itinerary, etc. - JMB Membership Data
Membership number, member's service qualifications, membership region, accumulated mileage, data-related mileage awards, etc. - Communications Data
Records of communications with Japan Airlines Vacations (recordings of phone calls to the call center, records of responses to questions submitted via e-mail or web inquiry forms, etc. Where necessary, records of questions or complaints, etc. received at airport counters or when boarding may be kept) - Data Collected from Websites and Apps, etc.
Website access logs (IP address, Cookies, etc.) and data collected by apps, etc. Please see our Cookie Policy (link below) for further information.
Where a customer reserves the Japan Airlines Vacations' air transportation services via a third party such as travel agents or other airline companies, some of the above-stated personal data may be collected from such third party. This policy also applies to personal data collected in such ways.
Collection and Use of Sensitive Personal Data
Japan Airlines Vacations may sometimes collect and use 'special category' or 'sensitive' personal data (such as data relating to health) in order to provide air transportation services. The collection and use of such personal data is limited to cases in which customers request special assistance when using air transportation services, and such data is not used for any other purpose. We process such personal data to ensure that we provide our services in accordance with our health and safety obligations and to establish, exercise or defend any legal claim that may arise in relation to accidents or incidents. We may from time to time share this information with our insurance providers.
Examples of Processing Sensitive Personal Data
- Where requesting escort from check-in counter to departure gates for passengers that use a wheelchair or are visually impaired
- Where requesting rental medical oxygen bottles or permission to carry on a medical oxygen bottle
- When requesting permission to carry on syringes or other medical equipment for a chronic disease
- When a pregnant passenger requests to board a flight within 28 days of expected delivery date
- Where a customer requests a special inflight meal, etc., data may be processed that is not sensitive personal data but may indicate a customer's religious beliefs or state of health.
5. Refusal to Provide Personal Data
The provision of personal data on customers may in some cases be necessary for customers to be provided with services by Japan Airlines Vacations (air transportation services, JAL Mileage Bank services, etc.). Japan Airlines Vacations may not be able to provide a service in whole or in part if personal data is not provided.
6. Disclosure and Provision of Personal Data to other Companies
- Japan Airlines Vacations disclose and provide customers' personal data to JAL Group companies to achieve the purposes stated in this privacy policy.
Please refer to the following website for details on group companies. - Customers' data may be disclosed or provided to partner airlines or companies entrusted with ground handling and check-in operations to provide air transportation services such as when using code share flights or connecting flights, and to achieve purposes such as mileage accumulation.
- Where customers have made reservations via a travel agent, customer data is disclosed and provided to such travel agent in relation to the reservation.
- Japan Airlines Vacations share personal data with suppliers that assist it in processing payments and refunds.
- Customers' data is transmitted to third party suppliers who provide IT systems and services, including data hosting services.
- Japan Airlines Vacations may conduct surveys relating to their services, etc. using an external web service. When a customer answers a survey, some personal data on customers is disclosed or provided to the operator that provides the web service. When requesting a response to a survey Japan Airlines Vacations indicate the name of the operator and matters concerning the processing of personal data by the operator.
- Japan Airlines Vacations may share customer personal data with specialist suppliers who assist it in managing its marketing database and sending out marketing communications and account-related communications.
- Japan Airlines Vacations uses Google Analytics, a web analytics service provided by Google, Inc. (hereinafter referred to as "Google") to analyse use of its Site. Japan Airlines Vacations also uses third party advertising, marketing and data management service providers for persononalised advertising purposes. Cookies, web beacons, and other similar technology may be used to provide these services. The personal information that is colliected by these technologies may, as part of JMB and other services, be associated with information collected by services that identifies customers so as to develop a profile of customers and to provide more customized advertising. Japan Airlines Vacations use user attribute and interest category reporting functions that respond to Google's advertising functions. Customers can opt-out of these (suspend functions) at their discretion. Visit the following sites for an explanation of how to opt-out:
- Where JMB member customers request exchange of awards, etc., customer data necessary to provide awards (address, etc.) is disclosed and provided to related corporations (award providers, delivery companies, etc.).
- Where required by law, customer data relating to reservations and itineraries (including passport, visa, and API data) may be submitted to the customs authorities or immigration bureaus in the customers' countries to be flown from, into or over, or in countries of transit and transfer.
- Personal data is shared with professional services firms who advise and assist in relation to the lawful and effective management of Japan Airlines Vacations and in relation to any disputes that may arise.
- Customers' personal data may be disclosed or provided to law enforcement authorities, regulatory agencies or other third parties where necessary to comply with applicable laws and regulations and/or court order.
7. Transfer of Personal Data to Third Countries
Japan Airlines Vacations may transfer customers' personal data from within the United Kingdom and/or the EU/EEA to non-UK/EU/EEA countries and regions where there are establishments of JAL Group Airlines and/or its third party suppliers in order to achieve the purposes stated in this privacy policy.
In such case, except where the country or region is considered to have laws that adequately protect personal data, Japan Airlines Vacations uses standard data protection clauses to ensure that personal data is subject to appropriate protection.
8. Retention of Personal Data
Japan Airlines Vacations retain customers' personal data for the period necessary to achieve the purposes stated in this privacy policy. Records concerning boarding by customers, such as reservations records and ticket information, are normally retained after boarding for a maximum of three years.
For a JMB member, data is retained as membership data for a maximum 10 years after withdrawing membership, in addition to the period as a member. Furthermore, records concerning contracts and invoices are retained for the period necessary to meet legal obligations. If it is necessary for the establishment, exercise or defense of legal claims, we may keep personal data for a longer period.
9. Your rights and how to make enquiries
You may make the following requests concerning personal data retained by Japan Airlines Vacations:
- Right of access
If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies. - Right to rectification
If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them. - Right to erasure
You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly. - Right to restrict processing
You can ask us to “block” or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Right to data portability
You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party. - Right to object
You can ask us to stop processing your personal data, and we will do so, if we are: (i) relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct marketing purposes. - Rights in relation to automated decision-making and profiling
You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract between you and us. - Right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can exercise your right of withdrawal by contacting us as set out below (procedure for making requests) or by using any other opt-out mechanism we may provide, such as an unsubscribe link in an email. - Right to lodge a complaint with the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us using the contact details provided in Section 10 below. You can also report any issues or concerns to a national supervisory authority in the Member State of your residence or the place of the alleged infringement. You can find a list of contact details for all EU supervisory authorities at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm (link below) . If you are in the United Kingdom, you can report any issues to the Information Commissioner’s Office (“ICO”). Contact details for the ICO can be found on its website at https://ico.org.uk (link below) .
Procedure for Making Requests
Please send your request, including any applicable request form set out below, to Japan Airlines Vacations (or to its Data Protection Officer or its UK representative) using the contact details set out in Section 2 (Data Controller, Data Protection Officer and Representatives) above.
Download an application form from one of the following links:
10. Your rights and how to make enquiries
If you have any inquiries regarding "Japan Airlines Vacations : Processing of Personal Data in GDPR", please send your letter to the following address:
Personal Information Handling Desk
JALPAK Co., Ltd.
2-4-11 Higashishinagawa,
Shinagawa-ku, Tokyo, 140-8658
E-mail: security.jpk@jal.com
