Privacy Notice

VistaJet is committed to respecting your privacy and protecting your personal data.

In this Privacy Notice (this “Notice”), “VistaJet”, “we”, “us” or “our” means VistaJet Group Holding Limited (a company incorporated in Malta, with registration number C-73543, and with principal offices at Sky Parks Business Centre, Malta International Airport, LQA 4000. Malta) and its subsidiaries, “you” or “your” means you, the person who provides us with personal data; and “personal data” shall have the meaning assigned to it in Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council.

All personal data are obtained, held, and processed by VistaJet, in compliance with this Notice, any and all data protection related laws and regulations that are applicable to VistaJet (including without limitation, Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, the California Consumer Privacy Act (the “CCPA”) as amended by the California Privacy Rights Act (the “CPRA”) and any other data protection legislation VistaJet may be subject to), and any and all data protection related terms in any agreement or contract in force between you and VistaJet in relation to the supply by us to you of services and/or products.

The main establishment of VistaJet for purposes of the GDPR shall be Malta (Europe). You can contact us at privacy@vistaglobal.com.

We have appointed a Data Protection Officer, who can be contacted at privacy@vistaglobal.com If you are not in the EEA, our EU Representative is VistaJet Limited, who can be contacted at privacy@vistaglobal.com.

When we ask you to provide certain personal data, then you can be assured that these will only be used in accordance with this Notice. This Notice applies to personal data about you that we collect, use and otherwise process in connection with your relationship with us as a client or potential client, including when you travel with us or use our other services, use our websites or mobile apps, service agents or call centers and book to use our services through third parties (such as agents, brokers and other carriers).

This Notice applies to you whether you use our services or products on a casual basis or have registered to use any of our services or products or have entered into a contract with us in relation to the supply by us to you of services and/or products. Any products and/or services acquired by you from us will be subject to their own terms and conditions which you must also read and accepted. In the event of any conflict between this Notice and the terms and conditions of any such products or services (such as, without limitation, those terms and conditions in any VistaJet On-Demand Agreement, or any VistaJet Program Partnership Agreement, or in the VistaJet General Terms and Conditions of Carriage, or in the VistaJet Direct Mobile Program Terms and Conditions of Use and Privacy Notice), then the terms and conditions of those products or services shall prevail.

This Notice is effective as of the “Last Revised and Effective Date” which appears at the top of this Notice. We reserve the right, at our sole and absolute discretion, to change or modify this Notice at any time. Any such changes or modifications will become effective when posted on this page. Please check this page periodically to ensure that you are happy with any such changes or modifications. It is in your own interest to access this page regularly to view the latest version of this Notice. If we make a change or modification to this Notice, we may, where appropriate and where possible in our sole discretion, alert you with a notice on our website or with any other means of notification we deem fit.

Your access to or use of any our services or products and your purchase of any of our products or services is entirely voluntary. Please read this Notice carefully, as your access to or use of any our services or products and your purchase of any of our products or services constitutes your acceptance of all of the terms and practices described in this Notice, including without limitation, the collection, use, processing, and disclosure of your personal data as described in this Notice. Please do not access or use any of our services or products or purchase any of our services or products if you disagree with any part of this Notice.

If you have any questions or concerns about this Notice or its implementation, you are invited to contact us at privacy@vistaglobal.com or alternatively at VistaJet, Level 4, Sky Parks Business Centre, Malta International Airport, LQA4000. Malta.

We collect personal data about you, about your travel arrangements, about how you use our services and products, and about how you use our websites, call centers and mobile applications, and such personal data so collected includes without limitation:

• Your name and surname;
• Contact information including address of residence, email address, telephone number, and fax number;
• Your date of birth, nationality, and passport information when you book a flight with us;
• Personal description and photograph (including passport and other identification documents) when you book a flight with us;
• Personal tastes (e.g., food and beverages) and dietary requirements;
• Medical condition (e.g., allergies for catering purposes, and disabilities);
• Information about your travel arrangements, such as details of your bookings, travel itinerary, details of any additional assistance you require, and other information related to your travel with us.
• Information about the services we have provided to you in the past, including your previous travel arrangements, such as flights and other bookings, and related matters, such as upgrades, etc.
• Your geographical position;
• Information about your use of our websites, call centers and mobile applications, including information about which pages you view;
• Information about interactions you have with us and our staff;
• Your financial and credit card information (including such information as received from third party banks and other credit institutions and credit rating institutions) which are necessary for us to provide you with the requested product or service; and,
• Other information that may be required by us, to carry out obligations arising from any contracts entered between you and us, and/or to carry out client surveys and/or offers.

These personal data may include information that you provide to us directly or through companies or agents we work with, as well as information which we collect when you use our products or services.

Certain categories of personal data, such as that about race, ethnicity, religion or health, are considered “sensitive personal data” in terms of applicable law. Sensitive personal data will only be processed where:

• You have chosen to provide such information to us (or a third party such as the agent or broker through which you made your booking), to allow us to provide a tailored service to you.
• you have requested specific medical assistance from us and/or an airport operator, such as the provision of wheelchair assistance or oxygen, or,
• you have sought clearance from us to fly with a medical condition or because you are pregnant, or,
• you have otherwise chosen to provide such information to us (or a third party such as the agent or broker through which you made your booking).

We store, handle, transmit and generally process personal data to provide you with the best service, and in particular for the following reasons:

• To fulfil your request and provide your: (i) flight if you choose to fly with us; and, (ii) other travel related arrangements if you choose to book them with us. This will include sharing your personal data with relevant authorities such as passport control and border agencies and where appropriate relevant police and customs authorities. We may also need to contact you if we have questions regarding your request. Additionally, there may be travel arrangements that are not provided by us but which nevertheless form part of your overall journey which need to be fulfilled, such as details of your arrangements at airports and customs and immigration formalities.
• To deal with the general enquiries you raise from time to time on our services;
• To ensure that you or any passenger is not the subject or target of any economic or trade sanction law or regulation or travel ban;
• For the purposes of accounting and billing, immigration and customs control, health and safety, security and legal compliance;
• To carry out obligations and/or enforce rights arising from any contracts entered between you and us;
• To carry out due diligence or other background checks on you (through sanction and enforcement list data) so as to protect our rights, interests, property and safety and the interests, rights, property and safety of our clients, or others;
• For internal record keeping and the general administration of your records by us which may include for example, accounting and billing, auditing, credit or other payment card verification, anti-fraud screening (including the use of credit reference agency searches and payment card validation checks), immigration and customs control, safety, security, health, administrative and legal purposes and systems testing, maintenance and development.
• For security purposes to protect your personal data held and/or processed by us;
• For training our employees in respect of providing our service and products to you;
• As part of our services, we may use your data for internal data analytics purposes. This may include aggregating and analyzing data in order to better understand our clients’ needs and preferences, and to improve our services to our clients. We may also use your data for research and development purposes and to improve our products. We will always obtain your consent to perform such activities where required by law.
• To improve our products and services;
• For our general marketing purposes if you have consented to receiving information about us and our services, products and offers, where required by law;
• From time to time, we may also use your personal data to contact you for feedback on our services and third-party supplier services so as to assist us in their improvement and development, and to provide services tailored to your requirements and treat you more personally, for example:
  • to deliver messages and information that we think is relevant and may be of interest to you, prior to, during, and after your travel with us;
  • to personalize and tailor your travel experience.

When you are travelling with us and using airports at which we operate, we may have the ability to monitor where you are within the airport, for example, based on your having passed through security checks. This information may be used to assist with flight connections and with the prompt and effective boarding of aircraft, as well as to provide a personalized service.

Please also be aware that in some airports where we operate, facial recognition and related biometric technology is used in order to facilitate passenger boarding.

We shall keep your personal data for the above purposes in accordance with those retention periods set by applicable law and our internal policies.

Failure to provide the personal data requested may prevent us from providing you with the Services you have requested from us.

To provide our services, and for the purpose of preventing illegitimate use of our services, we may carry out profiling of our customers and their activities using automated processes. If this occurs, we will always ensure that final decisions based on these profiles and information are taken by natural persons.

We may disclose your personal data (and any third-party personal data provided by you to us) to:

• air operators, the actual carrier (if VistaJet has the carriage to which you are entitled handled by another carrier, such other carrier is the actual carrier as defined in legislation governing carriage by air), and other third parties in order to give effect to our obligations under any contact entered into between you and us for the provision of flight services;
• companies which are part of the group of companies which we may be part of from time to time, and to our branch offices;
• our authorized representatives;
• third parties: (i) in the event that we sell our entire business or assets (in which event disclosure shall be to a prospective purchaser and their professional advisers only) or in the event of a due diligence exercise carried out on VistaJet by a potential investor or partner (in which event disclosure shall be to the potential investor or partner and his professional advisers, shall be limited to the extent required, and shall be subject to confidentiality protections to the extent practicable); (ii) if we are under a duty to disclose such personal data in order to comply with any legal or regulatory obligation or request (whether in Malta, in the United Kingdom, or elsewhere); (iii) in order to give effect to and/or enforce the terms and conditions of any contract entered into between you and us; (iv) so as to protect our rights, property and safety and the rights, property and safety of our clients, or others (including by way of exchange of information with third parties for the purposes of fraud protection and credit risk reduction); (v) to carry out due diligence or other background checks on you (through sanction and enforcement list data) so as to protect our rights, interests property and safety and the interests, rights, property and safety of our clients, or others; (vi) to facilitate your travel arrangements, including other carriers and airport operators, customs and immigration authorities, agents or brokers involved in making your travel arrangements, and global distribution systems service providers; and, (vii) who deliver services either to you or to us, such as companies that provide airport assistance, ground handling, catering, fuel, transportation, and air crew (pilots and cabin crew); (viii) we may share your personal data with our partners, including private dining partners and the like, where you have requested us to do so.

VistaJet and other carriers are required by laws in several countries to give border control agencies and other public authorities access to booking and travel information and other personal data (including data obtained from official photo identification documents). Therefore, any information we hold about you and your travel arrangements may be disclosed to the customs, immigration and public authorities of any country in your itinerary.

In addition, laws in several countries require VistaJet and other carriers to collect passport and associated information for all passengers prior to travel to or from those countries. When required, VistaJet will provide this information to the relevant customs and immigration authorities.

When do we collect personal data about you?

We collect personal data about you when you use our services or products (whether directly provided by us or by another company or agent), when you travel with us, and when you use our website, call centers or mobile applications. The following are examples of when we collect personal data about you:

- when you register an account on our website, as applicable;

- when you book or search for a flight or other products or services on our website or mobile applications;

- when you book or search for a flight or other products or services through our other sales channels, such as through an agent or broker;

- when you contact our call centers or service agents or sales representatives;

- when you travel with us and use airports where we operate;

- if you use lounge facilities provided by us or our agents;

- if you use our in-flight entertainment and communication services;

- if you complete a client survey or provide us with feedback;

- if you enter a competition or register for a promotion;

- if you choose to interact with us via social media.

In addition, we may receive personal data about you from third parties, such as:

- companies contracted by us to provide services to you;

- companies involved in your travel plans, including relevant airport operators and customs and immigration authorities;

- companies (e.g., car hire providers and hotels) that participate in our programs.

Cookies are a small amount of data sent from the server, which is then stored on your computer’s hard disk drive. Visit our Cookie Notice for information on the cookies we use.

When will we send you marketing communications?

You may receive marketing communications from us, or from third parties used by us to send marketing communication on our behalf, if you have opted in to receive such material where required by law. Our marketing communications will always include the option for you to unsubscribe from receiving any further marketing communications; alternatively, you can submit an opt out request at any time using our Webforms or by contacting us at privacy@vistaglobal.com.

If you have previously agreed to us using your information for direct marketing purposes, you may change your mind at any time by writing to us at privacy@vistaglobal.com.

We are committed to ensuring that your personal data are secure at all times. We have in place suitable physical, electronic and managerial procedures to safeguard and secure the personal data we collect online.

All of our employees and suppliers with access to your personal data and/or who are associated with the processing of that data are contractually obliged to respect the confidentiality of your personal data. As an example, if you are a passenger on a flight operated by us you can be assured that none of our crews, will take a photo of you whilst you are on our aircraft and then upload the photo on social media, or disclose to any person the fact that you are flying on our aircraft, or disclose any of your confidential information that they may become privy to during your flight (in each case, unless disclosure is required for any reason set out in this Notice).

Your personal data will be stored on and processed by our systems and may also be stored on and processed by systems of a third-party data processor(s) appointed by us. The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA") or the United Kingdom, which destination has not deemed to have an adequate level of privacy legislation. It may also be processed by employees operating outside the EEA who work for us or for one of our suppliers. Such employees may be engaged in, amongst other things, the provision of support services. We will take all steps reasonably necessary to ensure that your personal data are treated securely and in accordance with this Notice, the GDPR, and any data protection related laws that are applicable to VistaJet, and we will ensure that adequate measures are in place such as the use of EU Commission’s standard contractual clauses (Commission Decision (EU) 2021/914 of 4 June 2021) in accordance with Art. 46 of the GPDR, or any contractual mechanism issued by the UK ICO, and any additional measures as may be required according to the jurisdiction we are transferring personal data to, or based on your explicit consent. If you wish to receive more information, you can do so by contacting us at privacy@vistaglobal.com.

We will only retain your information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of providing Services to you, and for satisfying any legal, regulatory, tax, accounting or reporting requirements.

We will retain the information that we collect about you while you are utilizing our services and accessing the application and, unless we are required to keep your information for longer to comply with any legal, regulatory, tax, accounting or reporting requirements, We will delete it in accordance with applicable law and regulations. If you wish to receive more information on how long we keep your data, please contact Us at privacy@vistaglobal.com.

In certain circumstances you have the right to ask us to delete your data sooner (see the section "Your Rights" below). Following receipt of such a request, we will delete all the information that we are not required to retain.

If you have any questions or queries about the retention period for certain information, you can simply contact us as described in the section “General Information”.

Where you have provided your consent, if you withdraw such consent to the processing of your personal data at any time, we may not be able to provide all or parts of the products or services you have requested from us (example: if you book a flight with us and prior to the flight you withdraw your consent to the processing of certain of your personal data which is necessary for the performance of that flight, then we will not be able to provide you with the flight). Please be aware that in these circumstances you will not be able to obtain a refund of any fees or monies you would have paid.

On the other hand, if for example you withdraw your consent to us sending you marketing communications, then such withdrawal will not have any effect on the service provided to you.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our services; any transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorized access.

Our websites, online services and mobile applications may, from time to time, contain links to and from websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services. You are advised to please check these policies before submitting any personal data to these websites or using these services.

We may monitor or record telephone conversations to enhance your security and ours, to enable us to handle complaints efficiently, improve our client service and for staff training purposes. If your telephone conversation with us will be recorded then you will receive a message to this effect prior to the start of your conversation with us.

If you are providing personal data to us about someone else you confirm that they have appointed you to act for them, to consent to the processing of their personal data, and that you have informed them of our identity, of this Notice, and of the purposes (as set out in this Notice) for which their personal data will be processed.

Some jurisdictions give you rights with respect to your personal information under certain circumstances,:

• Access. The right to obtain information regarding the processing of your personal information and the right to receive a copy of the information we hold about you;
• Rectification. The right to correct, amend, or update information that is inaccurate or incomplete (where you have an account with us, you can also do this by logging in and updating your information);
• Object to Processing. The right to object to our processing of your data where we are relying on a legitimate interest to process your information and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your rights and freedoms. This includes where we make automated decisions about you without any human intervention in the process, or where we process your information for direct marketing purposes;
• Deletion (the ‘right to be forgotten’) The right to request that your information be erased where there is no good reason for us continuing to process it;
• Restrict Processing. The right to restrict us from processing your information further in certain circumstances, such as where you want us to establish the data's accuracy or the reason for us processing it;
• Portability. The right to obtain from us some of your information in a structured, commonly used and machine-readable format and have the right to transmit that data to another data controller;
• Revoke Consent. Where we rely on your consent to process your personal information, you have the right to refuse to give your consent or to withdraw your consent at any time.
• Rights in relation to automated decision-making, including profiling. Where automated decision-making is performed, you have the right not to be subject to a decision based solely on automated processing, including profiling, which could affect you. If such decision is necessary for the performance of a contract or based on consent, you as a data subject have the right to obtain human intervention, to express your point of view and to contest the decision.
• Opt-Out of Targeted Advertising. The right to opt-out of online tracking based targeted advertising (e.g., cookies); You can do so via our Cookie Notice. Please note that if you change browsers or computers, or if you clear your browser’s cache, you may need to click the link again to apply your preference. You may also opt-out of other forms of targeted advertising by submitting a request as described below;
• Opt-Out of Sale. For California consumers (as defined in terms of the CCPA), the right to request that your personal information is not sold.

If you are in the EEA or in the UK, you also have the right to lodge a complaint with a supervisory authority established within the EEA. A list of contact details of supervisory authorities within the EEA is available here. If you are in the UK, your supervisory authority is the Information Commissioner’s Office.

If you wish to exercise your rights, please visit this page, or contact us at privacy@vistaglobal.com.

Any dispute arising from or related to the acceptance, interpretation or observance of this Notice shall be submitted to the exclusive jurisdiction of the competent Court of Malta (Europe) which shall apply the laws of Malta; provided however, that:

1. any dispute concerning VistaJet International Limited shall be submitted to the exclusive jurisdiction of the competent Court of England which shall apply the laws of England; and
2. if this Notice is incorporated by reference into a contract having its own choice of law and jurisdiction, then any dispute arising from or related to the acceptance, interpretation or observance of this Notice shall be submitted to the jurisdiction, and shall be subject to the governing law, of that contract.

If any portion of this Notice is held to be invalid or unenforceable for any reason by a court or governmental authority of competent jurisdiction or by a supervisory authority, then such portion will be deemed to be stricken and the remainder of this Notice shall continue in full force and effect.

California law requires us to disclose the following additional information related to our privacy practices. If you are a California consumer, the following privacy disclosures apply to you in addition to the rest of the Privacy Notice.

California Shine the Light. If you are a California resident, you have the right to request certain information regarding our disclosure of your Information to third parties for direct marketing purposes pursuant to Section 1798.83 of California Civil Code. If you would like more information concerning the categories of personal information (if any) we share with third parties or affiliates for those parties to use for direct marketing, please submit a written request to us using the information in the “General information” section above. If you or your authorized agent wish to opt-out of the sale of your personal information, or of targeted advertising, please raise a request using this form.

“Do Not Track” Disclosure. We do not currently recognize the “Do Not Track” signal.

California Notice of Financial Incentive. We may offer programs that provide certain perks, such as discounts and exclusive offers (the “Loyalty Programs”). When you sign up for a Loyalty Program, we will ask you to provide your name, email address, and in some cases your telephone number. Under California law, our Loyalty Programs might be interpreted as “financial incentive” programs as they involve the collection of personal information. We do not assign a monetary value to the information we collect. Based on our reasonable estimate, the value of your personal information to us is related to the value of the free or discounted products or services that you obtain. This value is based on the expense related to offering those free or discounted products or services. You may withdraw from participating in the Loyalty Programs at any time by contacting us at the address described in the program terms and conditions. If you wish to receive more information, please contact us using the details in the section “General Information” above.

California Information Disclosure. The table below describes the categories of personal information collected, disclosed for a business purpose, “sold” and/or “shared” in the past 12 months (as those terms are defined by California law). We do not knowingly sell the information of minors less than 16 years of age without affirmative authorization. Please note, that in addition to the recipients identified below, we may disclose any of the categories of personal information we collect with government entities, as may be needed to comply with law or prevent illegal activity. For details regarding how we use personal information, please see the “What types of personal data do we collect?” section of this Notice. For information regarding how long we retain personal information, please refer to the “Our Retention of Your Data” section of this Notice.

California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): driver’s license, passport information, state identification card, social security number, precise geolocation, account log-in, debit card or credit card number in combination with any required security to access code, password, and health information. This information is collected in order to process transactions, comply with laws, manage our business, or provide you with services. Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121. We do not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising.

Non-Discrimination. If you choose to exercise any of your rights under the CCPA/CPRA, we will not deny the services you requested or provide a different quality of service.

This Notice may be supplemented or amended from time to time by specific “Privacy Notices.” Generally, Privacy Notices provide details about the personal data we collect in particular instances. Our Privacy Notices are part of this Notice and are deemed incorporated into this Notice. Currently the following Privacy Notices are effective:

• COVID-19 Privacy Notice