UATP Is a Data Processor
Universal Air Travel Plan is a global payments network owned by airlines around the world. As a data processor, UATP processes data on behalf of its business customers through its transaction processing system and its related products and services that streamline billing and provide travel managers with detailed activity reports that track a traveler’s carrier, destination and travel itinerary. In this capacity, UATP acts on the instructions of its business customers and does not own or have independent rights to or control of the personal data it receives and/or processes on their behalf. For such data processing, UATP enters into agreements with its business customers in the EU, the UK and Switzerland, specifying that the business customer recognizes that it is a data controller or another data processor under data protection laws and is in compliance with all relevant and applicable data protection laws.
UATP Adheres to Data Privacy Framework Principles
UATP participates in the Data Privacy Framework (DPF) as set forth by the US Department of Commerce regarding the collection, use and retention of personal data from European Economic Area (“EEA”) member countries, including the European Union (EU), the United Kingdom (and Gibraltar) (“UK”) and Switzerland. Specifically, UATP has certified that it adheres to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) with respect to all personal data submitted by its business customers in reliance on the DPF. As such, UATP is committed to the DPF Principles of: notice; choice; accountability for onward transfer; security; data integrity and purpose limitation; access; and recourse, enforcement and liability, as well as sixteen supplemental principles (as applicable) that explain and augment those seven privacy principles. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Data Privacy Framework Principles
Notice and Choice
If you communicate with UATP, we may collect personally identifiable information from you and about you, including the e-mail addresses of those who communicate with us via e-mail, information volunteered by you, such as survey information and/or site registrations, name and business address, business telephone number, and potentially a business fax number. We also may collect information about your company’s interests in and use of our various programs and services. UATP does not collect any sensitive personal information. By providing any personal information to us by these means, you will fully understand and will clearly consent at the time of collection to the transfer of such personal information to, and the collection and processing of such information in, other countries or territories. Any such transfer and processing by us will be in accordance with our Privacy Policy and the DPF Principles.
We may also use information we collect on our website to personalize the content, improve the content of our web page, and/or to provide you with product or service offers. We use “cookies” to operate the website (“essential cookies”) and other cookies to help us evaluate how our visitors use and navigate our web site on an aggregate basis, including the number and frequency of visitors to each web page and the length of their visits. You may indicate your consent to nonessential cookies by clicking where indicated on your first visit to this website and agree to each use of such information.
A cookie is a text-only string of information that a website transfers to the cookie file of the browser on your computer’s hard disk so that the website can remember who you are. A cookie will typically contain the name of the domain from which the cookie has come, the “lifetime” of the cookie, and a value, usually a randomly generated unique number.
We also use a third party analytics provider to collect information about your use of certain products and services, Google Analytics. Google uses cookies to collect information about the products and services usage and to report website trends to us, without identifying individual end-users or visitors to UATP.
EU, UK and Swiss individuals have rights to access personal data about them and to limit use and disclosure of their personal data. With our DPF certification, UATP has committed to respect those rights. If you would like to request that we not continue to use information we collect about you for the marketing purposes described herein, please contact us at [email protected].
You also have the ability to change your mind and accept or decline cookies at any time by modifying the settings in your browser. Information on how to do this should be provided in the web browser’s help/reference section. You can learn about how Google uses data by going to www.google.com/policies/privacy/partners/ and you can opt-out by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout .
Where personal information is collected by UATP through means other than this website, the notice will be provided in clear and conspicuous language when you are first asked to provide such information. To the extent that UATP acts solely as a data processor when processing personal data on behalf of its business customers (EU, UK or Swiss data controllers) UATP acts only on the instructions of such controllers and does not control or share such personal data without direction from the relevant data controller. In those instances, and to the extent provided for by applicable law, UATP may rely on its data controllers to satisfy the notice and consent principles under relevant and applicable data protection law, and will only act on the instructions of that controller.
Accountability for Onward Transfers – Third Parties Who May Receive Personal Data.
UATP uses a limited number of third party service providers to assist us in providing services to our customers such as, helping with certain technical operations, transmission of data, and data storage services. These third parties may process or store personal data in the course of providing their services. UATP maintains contracts with these third parties restricting their access, use, and disclosure of personal data in compliance with our DPF obligations. To the extent provided by the DPF principles, UATP remains responsible and liable under the DPF if a third party that UATP engages to process personal information on its behalf does so in a manner inconsistent with the DPF Principles, unless UATP proves it is not responsible for the matter giving rise to the damage.
Security, Data Integrity and Purpose Limitation
UATP Handles EU, UK and Swiss citizens’ personal data with appropriate care and safeguards. UATP has security measures in place to help protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. UATP has a Privacy Administrator identified below who is responsible for the internal supervision of UATP’s privacy policies.
In addition, any data processing will be carried out with reasonable and appropriate security measures specified in the processing agreement between UATP and its customers. UATP will not disclose to third parties the personal data processed, except as permitted or required by the agreement between UATP and the third party, the EU DPF (and UK Extension), or Swiss DPF, or other applicable data protection law.
UATP may be required to disclose personal information collected at its website site or processed for UATP business purposes in response to legal process, for example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement or other government agency’s request, or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, to comply with legal requirements, or as otherwise required by or law.
In addition, we may share information in the event of a bankruptcy, or a merger, acquisition, joint venture, or other business combination involving us.
Recourse and Enforcement
The U.S. Federal Trade Commission has jurisdiction over UATP’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
UATP makes a specific commitment to remedy any problems that may arise from an alleged failure of compliance with the above Principals and to resolve complaints about our collection of or use of your personal information. EU, UK and/or Swiss individuals with inquiries or complaints regarding UATP compliance with the EU – U.S. DPF, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF Principles or this policy should first contact our company Data Protection Officer by mail, e-mail, or telephone at:
Universal Air Travel Plan, Inc.
Legal Department
1629 K Street, NW
Suite 300
Washington, DC 20006
+1 202 774 5065
[email protected] or [email protected]
UATP will respond within 45 days. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed such complaint to your satisfaction, you may contact JAMS, an independent third-party dispute resolution body based in the United States. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, UATP commits to refer to JAMS any unresolved complaints concerning our handling of personal data received in reliance on the DPF. You may visit https://www.jamsadr.com/eu-us-data-privacy-framework for more information or to file a complaint. JAMS has committed to provide recourse services at no cost to you.
Updated: September 2023
