Legal & Privacy

Effective Date: December 2024

The Universal Air Travel Plan, Inc. (hereafter referred to as “UATP”) is committed to maintaining the privacy of personal information. This Privacy policy and notice (“Notice”) describes how UATP treats personal information received about you when you visit the UATP website and/or register for UATP’s Airline Distribution event or other UATP events. It also explains how UATP uses personal information it receives from its business customers to provide its products and services.

The description of our data practices in this Notice covers the twelve (12) months prior to the Effective Date and will be updated at least annually.

Scope and Nature of the Policy

Data Collected

UATP collects personal information from you and about you if you provide such information to UATP directly, including the email addresses of those who communicate via email, information volunteered by you, such as survey information and/or site registrations, and name and address, telephone number, and fax number. We also may collect information about your interests in and use of our various programs and services.

When providing any personal information to us, in each instance you will fully understand and clearly consent to the collection and processing of such information, and if applicable, to the transfer of such personal information to other countries or territories. Any such transfer and processing by us will be in accordance with applicable law, this policy and Notice.

For each visitor to our web pages, the UATP web server automatically recognizes the consumer’s domain name and email address (where possible or applicable). We also collect IP addresses and website usage information from you when you visit our website. This information helps us evaluate how our visitors use and navigate our website on an aggregate basis, including the number and frequency of visitors to each web page and the length of their visits.

Like many other websites, we use “cookies” to help us gather and store information about visitors to our websites. A cookie is a text-only string of information that a website transfers to the cookie file of the browser on your computer’s hard disk so that the website can remember who you are. A cookie will typically contain the name of the domain from which the cookie has come, the “lifetime” of the cookie, and a value, usually a randomly generated unique number.

We also use third party analytics providers to collect information about use of certain products and services, including Google Analytics, but with restricted data processing features enabled that ensure use of your data by Google is not shared with third party advertisers. Google uses cookies to collect information about the products and services usage and to report website trends to us, without identifying any individuals specifically (individual end-users or visitors) to UATP. Your information, if included, remains anonymous to us.

You can learn about how Google uses data by going to

https://policies.google.com/technologies/partner-sites and you can opt-out by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

We may from time to time use cookies to tailor information and advertising of our products and services to your interests based on the webpages and content you visit, but only after you agree to receive such communications. These cookies gather personal information such as your name, internet protocol address and location. We will not collect these nonessential cookies if you do not agree. We do not provide your information to third parties for advertising purposes.

You may accept or decline these cookies by clicking where indicated when you first visit our website. You may modify the settings in your browser to decline cookies at any time. However, you may not be able to use all features of our site if all cookies are disabled. There are several ways to manage cookies. Please refer to your browser instructions or help screen to learn more about these functions. For example, in Internet Explorer, you can go to the Tools/Internet Options/Security and Privacy Tabs to adapt the browser to your expectations. If you use different computers, you will need to ensure that each browser is adjusted to suit your cookie preferences.

How Your Information Is Used and Disclosed

We may use the personal information you provide to respond to your requests for information or to register for Airline Distribution or other events as requested. We also use information you provide to contact you regarding our programs, such as our conference, or to provide you with information about other UATP programs, events, and services in which you may be interested. We never sell your information to third parties. If you would like to request that we not use information we collect about you for such marketing purposes, please contact us at [email protected].

We may also use information we collect at this site to personalize the content, improve the content of our web page, and/or to provide you with UATP product or service offers.

We may disclose personal information in response to legal process, for example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement or other government agency’s request, or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, to comply with legal requirements, or as otherwise required by law. We may share personal information in the event of a bankruptcy, or a merger, acquisition, joint venture, or other business combination involving us.

Other than the uses set forth above, we will not disclose personally identifiable information to third parties without your permission. For certain uses set forth above, we may disclose your personal information to vendors who act as our service providers and are under contract to assist us with the provision of our services. Our contracts require these service providers to maintain the privacy and security of your data and comply with applicable data protection laws.

UATP As a Data Processor

UATP also collects personal information when it acts as a data processor on behalf of its business customers by operating its transaction processing system and in some cases, by streamlining billing and providing travel managers with detailed activity reports that track a traveler’s name and/or account number, carrier, destination and travel itinerary. In this capacity, UATP receives personal information from its business customers but does not collect it from you directly. UATP acts on the instructions of its business customers and does not own or have independent rights to control of the personal information it processes on their behalf. UATP business customers that employ or otherwise have a relationship with you will obtain consent from you, if applicable, prior to sending your information to UATP for processing. UATP will not sell the personal information it processes or disclose it to third parties, except as permitted or required by the agreement with our business customer or applicable law.

Retention of Personal Information

The length of time that we retain personal information will depend on a number of criteria, including (i) the length of time we are required to retain such information to comply with applicable legal and regulatory requirements, (ii) the length of time we may need to retain personal information to accomplish the business or commercial purpose(s) for which such information is collected, used or disclosed, such as to complete transactions and provide our products and services, and (iii) whether you choose to exercise your right, subject to applicable exceptions, to request deletion of your personal information under applicable law. We maintain contact information for as long as you are employed by of our business customers. We maintain transaction data for three years.

Security

We have put in place appropriate administrative, technical, and physical procedures to safeguard and help prevent unauthorized use of or disclosure of the information we collect online or process for business purposes.

Links to Third Party Sites

UATP’s website may also have links to the sites of other companies. UATP is not responsible for those companies’ privacy practices nor do we monitor or control the information collected when you choose to access those websites. Since their treatment of personal information may differ from ours, we encourage you to learn about the privacy policies of those companies.

While our primary operations are in the US, UATP may transfer information provided by and about our business customers to deliver our services or information required to assist the customer. In order to provide our services, information provided by UATP may be made available to UATP business customers, partners and authorized users across the globe and to staff in our global offices that require access to the information for business purposes.

If you are located outside of the United States, please note that the information you provide to us may be transferred to the United States. When you register on the UATP website, you consent to this transfer.

EU, UK and Swiss Data Privacy Framework Policies

UATP has many international client relationships and as such has developed global practices designed to address applicable data protection requirements. For personal information transferred from Europe on behalf of our business customers, UATP participates in the Data Privacy Framework (DPF) as set forth by the US Department of Commerce regarding the collection, use and retention of personal data from European Economic Area (“EEA”) member countries, including the European Union (EU), the United Kingdom (and Gibraltar) (“UK”) and Switzerland. Specifically, UATP has certified that it adheres to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) Principles of: notice; choice; accountability for onward transfer; security; data integrity and purpose limitation; access; and recourse, enforcement and liability, as well as supplemental principles and FAQs (as applicable) that explain and augment those seven privacy principles. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

For more information on UATP’s privacy policy with respect to the Data Privacy Framework, please click here.

California Residents

This section is for California residents and serves as a supplement to the information in this Notice. While the uses and disclosures of personal information below describe our data practices for California residents, these practices also apply for all visitors of this website and users of UATP products and services, with the exception of the specific application of rights described below pursuant to the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act (CPRA), which apply solely to visitors and users who reside in the State of California.

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). A “consumer” is a natural person who is a California resident.

Under CCPA personal information does not include:

Publicly available information from government records.
De-identified or aggregated consumer information.
Information excluded from the CCPA’s scope, like:
personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Categories of Personal Information Collected and Disclosed

In the past twelve (12) months we have collected and disclosed the following categories of personal information:

Identifiers – Name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name.
Personal information (relevant categories from Cal. Civ. Code § 1798.80(e)) – Business contact details such as name, work address, work phone number; financial information such as UATP account balance; payment details such as UATP card/account number.
Commercial information – Records of products or services purchased, obtained, or considered, or other purchasing histories or tendencies.
Internet or other similar network activity – Browsing history or interactions with our website, applications, or marketing.
Inferences drawn from other personal information your preferences, trends from cookies or analytics, although aggregated and anonymous to us.
Sensitive Personal Information – While do not collect personal information that would allow a third-party access to your account, such as your password (as sensitive personal information is defined in CCPA), we can access account information.

Categories of Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

Directly from you, such as from forms you complete or meeting registrations, if you are a user of our products and services;
Indirectly from you, such as from observing your anonymous actions on our website;
Automatically from you, such as, through cookies we or our service providers set on your device as you navigate through our website or services.
From service providers such as analytics providers to monitor and analyze the use of our service; or
From our business customers with whom you are employed or interact.

UATP will not collect or use additional categories of personal information without providing you notice and obtaining consent when required.

Business and Commercial Purposes for the Collection, Use and Disclosure of Personal Information

We may use, or disclose the personal information we collect for one or more of the following “business purposes” or “commercial purposes” as defined under the CCPA:

Providing our products and services – to fulfill your request for information; to process transactions; to create, maintain, customize, and secure your account with us; for customer service; or to participate in a conference.
Improving our website, products and services – identifying issues with existing products and services; planning improvements to existing products and services; and creating new products and services.
Operation of our websites – operation and management of our website; providing content to you; and communicating and interacting with you via our website.
Support everyday operations – to support the ongoing management and maintenance of our products and services.
Marketing – communicating with you regarding content and product and service offerings relevant to your interests (including via email, social media) subject to ensuring that such communications are in compliance with applicable law; and maintaining and updating your contact information where appropriate.
IT operations – management of our systems; operation of IT security; and IT security audits.
Legal compliance – compliance with our legal and regulatory obligations under applicable law.
Fraud prevention – detecting, preventing and investigating fraud.
Security – to help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business.
Law enforcement – to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

UATP will not use the above personal information for materially different, unrelated, or incompatible purposes without providing you notice and obtaining consent when required.

We do not use sensitive personal information for reasons other than those permitted under the CCPA and its implementing regulations.

Disclosure of Personal Information

UATP will only disclose and may have disclosed in the last twelve (12) months the categories of personal information listed above to:

Our business customers – in connection with products, services and UATP accounts.
Service providers – in connection the categories of business or commercial purposes above that include providing, supporting and maintaining our products and services, processing transactions, improving our products and services, analytics, marketing, and storage of data. When we disclose personal information to our service providers, we enter into a contract that describes the purpose and requires the service provider to comply with applicable data protection laws and not use personal information for any purpose other than performing under the contract.
Government agencies – as needed to comply with legal requirements and law enforcement requests.

UATP does not sell or share your personal information as those terms are defined under the CCPA for any purpose; as such we have not sold or shared personal information of consumers under the age of 16. We do not disclose sensitive personal information for reasons other than those permitted under the CCPA and its implementing regulations.

Your California Rights and Choices

The CCPA provides California residents rights regarding personal information, specifically the rights to:

Know what personal information we collect about you, including the categories of personal information collected, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling or sharing personal information, the categories of parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you (“Right to Know”);
Request deletion of your personal information that we have collected or maintained, subject to certain exceptions;
Request that we correct inaccurate personal information that we maintain about you;
If applicable, to opt-out of the sale or sharing of your personal information;
Direct us to limit the use or disclosure of your sensitive personal information If we use or disclose your sensitive personal information for reasons other than those permitted under the CCPA; and
Not receive discriminatory treatment by us for the exercise of your privacy rights, including your right not to be retaliated against for the exercise of these rights.

Our responses to any requests pursuant to these rights will cover the categories of personal information we have collected and are maintaining for the 12-month period prior to the request date, and the purposes for which the information is being used. Once we receive and confirm your verifiable consumer request, we will disclose to you:

The categories of personal information we have collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting that personal information.
The categories of third parties with whom we share that personal information.
The specific pieces of personal information we collected about you (also called a data portability request).
If we have disclosed your personal information for a business purpose, a list disclosing all such disclosures, identifying the personal information categories that each category of recipient obtained. We do not sell or share your personal information.

You have the right to delete or correct any of your personal information that we collected from you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request to delete or correct, we will delete or correct (and direct our service providers to delete or correct) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us to complete the transaction for which we collected the personal information, perform our contract with our business customers with whom you have a relationship, to comply with the law, or carry out any actions for internal purposes that a consumer might reasonably expect such as to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

To exercise the rights described above, please submit a verifiable consumer request to us by emailing us at [email protected]. You may exercise these rights independently or through an authorized agent on your behalf and as permitted under California law. Requests are subject to an identification and verification process.

Updating Information

UATP makes reasonable efforts to ensure that the personal information we have about you is reliable for its intended uses, accurate, current and complete. You may request access to the personal information that UATP collects by sending a request to the below address with sufficient proof of identification. You may correct factual errors in that information by sending a request to us that credibly shows the error. Requests can be sent to us by email at the below address.

Contacting Us

If you have any questions about our privacy policy or practices or this Notice, you may contact the UATP Data Protection Officer at the following address or send an email.

1629 K Street, NW
Suite 300
Washington, DC 20006
[email protected]