Plusgrade provides a software product and services (together, “services”) that enable travel industry companies (i.e., Plusgrade’s “business partners”) to offer their customers (“travelers”) the opportunity to upgrade their travel experience, subject to each business partners' individual discretion and the availability of the offering.
Protecting privacy is important to us and to our business partners. This is why we are committed to ensuring the security and confidentiality of the personal data we receive and process from our business partners as part of the services we provide to them. We are also committed to providing a software product that meets industry best practices and regulatory requirements for privacy and data protection.
- Plusgrade’s contact details, including its Data Protection Officer and representative in the European Union;
- The purposes for which we process personal data and our legal bases for the processing;
- The types of personal data we process;
- The categories of third parties to whom we may disclose the data;
- Jurisdictions in which we process personal data and safeguards in place for international transfers of personal data;
- The criteria used to determine the period for which we store personal data; and
- The privacy rights that apply to travelers from which Plusgrade process personal data on behalf of its business partners, including the right to lodge a complaint with the competent Privacy authority.
What personal data does Plusgrade process?+
As a third-party service provider to travel industry companies (i.e., Plusgrade’s “business partners”), Plusgrade generally receives personal data that was initially disclosed by travelers to our business partners in connection with a travel booking or purchase, for the purpose of providing the Services to our business partners in accordance with the applicable service contract.
We collect from our business partners, prospects and Site visitors information that is entered on our Site or sent to us electronically, for example when business partners purchase our Services or when our Site visitors request more information. We may also collect personal data that you provide to us when you attend one of our events, during phone calls with sales representatives or when you contact customer support.Learn more +
a) Personal Data About Travelers:
We process personal data provided by travelers in connection with a booking or purchase of travel services from travel industry companies (i.e., Plusgrade’s “business partners”), on behalf of our business partners. This typically includes or may include the following categories of personal data:
- Contact Information, which may include name and email address
- Authentication information, which may include passport information, and loyalty program number
- Trip related preferences and loyalty level information
- Communications with our business partners, including email communications
- Location Data, including departure and destination airport or port
- Online identifiers, including IP address
b) Personal Data About Business Partners, Prospects, Site Visitors:
Personal Data That You Provide To Us. We collect information that you enter on our Site or send to us electronically, for example, when you request information, including a product demo, register for a webinar or other event, or subscribe to emailing lists. While the type of data we collect depends on the nature of the inquiry, this typically includes your name and contact details, company information, and phone number. We may also collect personal data that you provide to us when you attend one of our events (such as your contact details), during phone calls with sales representatives, or when you contact our customer support.
Automatically Collected Data.
Log Data. When you visit our Site, our servers record information (“log data”), including information that your browser automatically sends whenever you visit the Site. This log data includes your Internet Protocol (“IP”) address (from which we understand the country you are connecting from at the time you visit the Site), browser type and settings, the date and time of your request.
Cookies. When you visit the Site, we and our service providers acting on our behalf will automatically collect information about you through cookies (small text files placed on your device).
From where does Plusgrade obtain personal data?+
a) Personal Data About Travelers:
Plusgrade obtains personal data provided by travelers in connection with a booking or purchase of travel services from travel industry companies (i.e., Plusgrade’s “business partners”), for the purpose of enabling travelers to participate in booking upgrades and related services provided by Plusgrade in accordance with the applicable service contract.
b) Personal Data About Business Partners, Prospects, Site Visitors:
Plusgrade obtains the personal data that it processes, stores and discloses when this data is provided to us or collected as described under the “What personal data does Plusgrade process?” paragraph.
What are the legal basis and purposes for which Plusgrade processes personal data?+
We use travelers’ information to provide the Services to the travel industry companies we work with (i.e., Plusgrade’s “business partners”). We will also use this information to help improve product features or provide service enhancements and support our business partners in their current program and ongoing growth pursuant to our service contract.
The use of an individual's personal data will be limited to the purposes for which it was collected by our business partners - to provide the booking upgrades and related services - as agreed to in our service agreement with our business partners.
It is the responsibility of our business partners to ensure that they lawfully obtain personal data from travelers. As Plusgrade provides the technology upon which our business partners provide services to travelers, when travelers wish to change their options regarding their personal data, Plusgrade will process such wishes on behalf of our business partners and pursuant to their instructions.
We use our business partners’, prospects’ and Site visitors’ personal data as necessary to respond to inquiries regarding our services, fulfil the relevant contract, send promotional emails and other communications (so long as you agree to receiving these communications) and as necessary for our legitimate interests in the processing.Learn more +
a) Personal Data About Travelers:Plusgrade uses travelers’ personal data in the course of providing services to its business partners for the purpose of providing the services to the business partners in accordance with the applicable service contract: To the extent necessary for those purposes, we take reasonable steps to ensure that personal data is accurate, complete, current and reliable for its intended use. Such steps include following Plusgrade’s internal processes to manage our business partners’ requests to update, in a timely and effective manner, travelers’ personal data received from them.
b) Personal Data About Business Partners, Prospects, Site Visitors:
To provide the Services to you and respond to your requests. When you ask for information about the Services (for example, when you request a demo or ask us to send you offers or price information), or register to a webinar or an event, we will use your contact information to respond to your request. For EU data subjects, such use is necessary to respond to or implement your request.
We use account-related data provided by our business partners in connection with the purchase, sign-up, use or support of the business partner account (such as usernames, email address and billing information) to provide you with access to the Services and/or the Site, contact you regarding your use of the Services and/or the Site or to notify you of important changes to the Services and/or the Site. For EU data subjects, such use is necessary for the performance of the contract between you and us.
For marketing purposes. We will use your email address to send you information about new products and services, upcoming events or other promotions. You may opt-out of receiving such emails by following the instructions contained in each promotional email we send you. Our sales representatives may also use your phone number to contact you directly by phone, in connection with such new products and services, upcoming events or other promotions.
Where required by applicable law (for example, if you are an EU data subject), we will only send you marketing information by email or mail, or contact you by phone, if you consent to us doing so at the time you provide us with your personal data (in such case, our legal basis for the processing of your Personal Data will be your consent). When you provide us with your consent to be contacted for marketing purposes, you have the right to withdraw your consent at any time by following the instructions to “opt-out” of receiving marketing communication in each marketing email we send you. In addition, if at any time you do not wish to receive future marketing communications or wish to have your name deleted from our mailing or calling lists, please contact us at firstname.lastname@example.org. Please note that if you opt out from marketing communications, we may still contact you regarding issues related to our Services and to respond to your requests.
To analyze, administer, support, improve use of the Site and the Services. We use data relating to your use of and interaction with the Site and the Services, including information that we obtain through cookies, to analyze, administer, support and improve your access to and use of the Site and the Services. We may also compile, anonymize and/or aggregate your Personal Data and other data and use such anonymized and/or aggregated data for our business purposes, including sharing it with affiliates and business partners. This aggregate information does not identify you. For EU data subjects, this use of your Personal Data is necessary for our legitimate interests in understanding how the Site and our Services are being used by you and to improve your experience on it. You have a right to object to the processing of your personal data based on our legitimate interest, as described under the “What privacy rights do individuals have regarding their own personal data?” section below.
If you are an EU data subject, please see the “What privacy rights do individuals have regarding their own personal data?” section below for information on your rights in relation to the personal data we hold about you.
How long does Plusgrade retain personal data?+
Plusgrade retains travelers’ personal data for the duration of our service agreement with our business partners, unless a longer or shorter retention period is requested, required or permitted by applicable laws.
To which countries does Plusgrade transfer personal data as part of offering its services?+
As part of our service offering and to meet our contractual obligations, we transfer personal data from the EU to Canada, the United States, and travel industry companies’ (i.e., Plusgrade’s “business partners”) residential countries. We may also subcontract processing to, or share, travelers’ personal data with third parties located in countries other than their home country.
We protect this information during cross-border transfers and comply with rules around cross-border data transfer in in the following ways:
- The European Commission has found that Canada offers an adequate level of protection for personal data transferred from the EU. This means that personal data can lawfully flow from the EU to Plusgrade in Canada without being subject to transfer rules;
- To comply with restrictions on EU-US data transfers, we use “standard contractual clauses” (also known as "model clauses") approved by the European Commission.
If you wish to obtain more information regarding Plusgrade’s safeguards used for international transfers of personal data, please contact us as indicated under the “How to contact Plusgrade?” section below.
Does Plusgrade share personal data with third parties?+
Plusgrade shares travelers’ personal data to third parties only as necessary to fulfil our service contract with travel industry companies we work with (i.e., Plusgrade’s “business partners”) and pursuant to our business partners’ instructions, or otherwise required by the applicable law.
Plusgrade shares our business partners’, prospects’ and Site Visitors’ personal data with third parties who support our business operations or as required or permitted by the applicable law.Learn more +
Plusgrade may share personal data with third parties in circumstances described below:
- Third Party Service Providers: in order to provide our business partners with certain services, Plusgrade may share personal data with third parties, for example: to provide information technology services; to conduct fraud protection services; to handle credit card transactions; to provide client service; or to perform marketing services. The service providers are only given the information needed to perform those services and they are bound contractually to protect the privacy and security of the information we provide and to limit the use of the information to the services being provided.
- Governmental or Other Authorities: Plusgrade may, without notice to business partners, disclose personal data if required to do so by law, court order, as requested by other government or law enforcement authority, or in the good faith belief that disclosure is otherwise necessary or advisable including, without limitation:
- To protect the rights or properties of Plusgrade or its business partners;
- When we have reason to believe that disclosing the information is necessary to identify, contact or bring legal action against someone who may be causing interference with our rights or properties;
- When anyone else could be harmed by such activities.
- Business Transfers: if Plusgrade or substantially all of its assets are acquired, personal data residing in our databases will most likely also be transferred in connection with such acquisition. In the case of any other significant transaction or event such as a merger, amalgamation, financing, re-organization, liquidation, or insolvency, other parties to the transaction and their professional advisors may need to have access to the Plusgrade databases as part of the due diligence process. In this event, Plusgrade would only provide such access under terms of a confidentiality agreement. Under completion of the transaction or event, personal data would be transferred to the successor-in-interest company and would be used for the purposes for which it was collected.
What privacy rights do individuals have regarding their own personal data?+
Data subjects in the European Union (EU) have certain rights with respect to the processing of their personal data, described below (for these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein and Norway and, where applicable, Switzerland).
a) Travelers’ Rights:
Travelers have the right to submit the following requests regarding their personal data to the travel industry companies (i.e., Plusgrade’s “business partners”) to whom travelers have previously provided their personal data, subject to applicable law:
- Request access to and/or correction of their own personal data
- Request the erasure of their own personal data
- Request that Plusgrade’s business partners stop processing or restrict the processing of their own personal data
- Request that Plusgrade’s business partners provide them with their personal data in a structured, commonly used and machine-readable format and transmit those data to another organization
Upon notification from our business partners of a traveler’s request to exercise their rights, we will enable such requests to ensure our business partners’ compliance with applicable regulatory requirements in accordance with the service contract with the applicable business partner.
b) Business Partners’, Prospects’, Site Visitors’ Rights:
Subject to applicable law, you have the following rights in relation to your personal data:
- Right of access: If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data along with certain other details. If you require additional copies, we may need to charge a reasonable fee.
- Right to rectification: If your personal data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly.
- Right to erasure: You may ask us to delete or remove your personal data, such as where you withdraw your consent. If we shared your data with others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data with so you can contact them directly.
- Right to restrict processing: You may ask us to restrict or ‘block’ the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to us processing it. We will tell you before we lift any restriction on processing. If we shared your personal data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly.
- Right to data portability: You have the right to obtain your personal data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you. We will give you your personal data in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
- Right to object: You may ask us at any time to stop processing your personal data, and we will do so if we are relying on a legitimate interest to process your personal data (unless we demonstrate compelling legitimate grounds for the processing) or if we are processing your personal data for direct marketing.
- Right to withdraw consent: If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing of your data before we received notice that you wished to withdraw your consent.
- Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal data, you can report it to the data protection authority that is authorized to hear those concerns.
You may exercise your rights by contacting us as indicated under the “How to contact Plusgrade?” section below.
How does Plusgrade protect personal data?+
Plusgrade will take reasonable precautions, including the implementation of appropriate physical, electronic and administrative procedures, to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction. Although we employ technical safeguards, we cannot guarantee the security of personal data on or transmitted via the Internet.Learn more +
We have implemented strong security measures as part of our services to the travel and hospitality companies we work with (i.e., Plusgrade’s “business partners”). In particular, we have taken the appropriate measures to protect company resources and assets, including data, application architecture, application code, network access, location access, and hardware/device access. We have also taken appropriate measures to ensure timely availability and access to personal data in the event of a physical or technical incident, as well as implemented internal processes for regularly testing, assessing, and evaluating the effectiveness of the security measures.
How to contact Plusgrade? +
Plusgrade acts as the data processor for the processing of travelers’ personal data on behalf of travel industry companies (i.e., Plusgrade’s “business partners”), pursuant to our service contract with the applicable business partner.
If you feel you haven’t received a timely or satisfactory response from us to your question or complaint, please contact the applicable data protection authority below:EU Data Protection Authorities (DPAs) Swiss Federal Data Protection and Information Commissioner (FDPIC) Office of the Privacy Commissioner of Canada