‍1. TO WHAT INFORMATION DOES THIS POLICY APPLY?

This policy applies to personal information. Personal information is information that relates to a natural person and allows them to be identified, directly or indirectly. For example, your home address, telephone number, email address, details about your transactions with Air Canada Vacations and method of payment.

2. WHAT PERSONAL INFORMATION DO WE COLLECT AND WHEN?

We collect personal information when you interact with us. For example:

• When you contact us, we collect information about that interaction, such as when and why you contacted us. This includes when you answer a survey or enter a contest or sweepstakes.
• When you browse our website or other online platforms, we collect information including your internet protocol address, device type and browsing activity – for more information please see the aircanada.com Cookies and Tracking Technologies Policy.
• When you create or use a travel agency or Friends & Family account, some information you provide (such as your contact information and preferred language of correspondence) is necessary for us to properly set up your account and other information to personalize your online experience.

We collect personal information when you book travel and vacation packages with us. For example:

• If you are booking travel or vacation packages, we collect personal information that you provide to us in order to: complete the transaction, ensure we can contact you as necessary, assess your fare eligibility, such as discounts for infants and children, and enable us to verify your identity for legal and security purposes. The personal information we collect for these purposes includes the following: name, address, telephone number, email address, payment card number and expiry date, passport or other government-issued identification information, date of birth. If a third party is booking your travel, see the "Third Party Bookings, Changes and Inquiries" section below..
• If you make any requests for special assistance – for a wheelchair, on-board oxygen, a meal preference – we collect the information needed to accommodate your request. This may include relevant medical information and will be apparent to you at the time of collection. If a third party is booking your travel, see the "Bookings, Changes and Inquiries" section below..

We collect personal information reasonably needed to fulfill our business purposes.

Refer to section 3 "Why do we use and share your personal information?" for more information.

If you are an Aeroplan member, we also collect your personal information about your activity in that program.

Refer to section 4 "Additional collection, use and disclosure of Aeroplan member personal information" for more information.

THIRD PARTY BOOKINGS, CHANGES AND INQUIRIES

If another person, including a family member, friend, work colleague or travel agent, seeks to book travel on your behalf, that person will be asked to provide us with the same personal information that we would normally collect from you directly to complete your booking.

We consider that person to have your consent to provide us with your personal information for relevant purposes described in this policy – unless and until we are advised otherwise. Collection, use and disclosure of your personal information by a travel agent is subject to the privacy policy of the agent.

Once a booking is made, we will only divulge information about it to a travel agent or member of the booking party who has your full name and booking reference, and we will only make changes to a booking if contacted by you, a travel agent or another member of your booking party.

3. WHY DO WE USE AND SHARE YOUR PERSONAL INFORMATION?

We use and share your personal information to respond to your requests or complete your transactions, including to:

• Communicate with you, such as to advise you of changes to your bookings or respond to your questions.
• Complete your bookings and fulfil your requests for our products and services, which may involve sharing your personal information with third party partners outside Quebec, such as travel agencies, airlines, car rental agencies or hotels you have booked through us. These third-party partners may have their own privacy policies. Before completing your bookings involving a third party-partner, you should review the privacy policy of that partner.

We also use and share your personal information to better serve you, including in order to:

• Administer our websites and other online platforms, and make them easier for you to use, such as by pre-populating forms with your contact information or other applicable personal information
• Address customer service matters, such as answering questions you may have about your bookings
• Monitor and maintain the quality of our operations, such as monitoring or recording telephone discussions with our representatives for quality assurance purposes

We also use and share your personal information to provide you with relevant offers for products and services, including to:

• Better understand your preferences, needs, and interests to develop and enhance offers, promotions, benefits, contests, products and services that are relevant to you
• Send you offers about travel opportunities, benefits, products and services that are most likely to be of interest to you. This includes serving you advertisements on other websites (for more information, see the aircanada.com Cookies and Tracking Technologies Policy), and sharing identifying information – for example, your hashed email address – with social media platforms to make relevant offers to you.

We also use and share your personal information to address our business and legal needs, including to:

• Ensure the safety and security of our operations
• Fulfil our legal requirements
• Protect our business or legal interests, such as to investigate, detect or prevent fraud or harm to our systems
• Measure the success or effectiveness of Air Canada Vacations offers, promotions, benefits contents, products and services
• De-identify it (so it no longer allows a person to be directly identified) and use it for analysis, such as to identify trends about our customers, including to support decisions about improvements to our products, services or operations
• Fulfil other purposes to which you may consent, or as permitted or required by applicable law

IF YOU ARE AN AEROPLAN MEMBER, WE ALSO USE AND SHARE YOUR PERSONAL INFORMATION AS PART OF THAT PROGRAM

Refer to Section 4 "Additional collection, use and disclosure of Aeroplan member personal information" for more information.

TRANSFERS TO OUR SERVICE PROVIDERS

We may transfer your personal information to service providers who support us with various functions including reservations, information security, data storage, research, customer relations, payment processing, data analysis, email delivery, IT, customer service, and marketing. These service providers, who may be located outside Quebec, process personal information on our behalf for our purposes only and must agree to certain privacy obligations in their contracts with us. These include complying with privacy laws, safeguarding the personal information, and only processing that information under our direction for permitted purposes.

4. ADDITIONAL COLLECTION, USE AND DISCLOSURE OF AEROPLAN MEMBER PERSONAL INFORMATION

SHARING BETWEEN AIR CANADA VACATIONS AND AEROPLAN

‍This section of the privacy policy only applies to Aeroplan members.

‍We want you to travel more and travel better. To maximize the value of your Aeroplan membership to you, and to serve you better, we collaborate extensively with Aeroplan. Part of this collaboration involves sharing relevant personal information between Air Canada Vacations and Aeroplan.

We may receive personal information from Aeroplan to support program administration and engagement

• When you redeem points for an Air Canada Vacations product or service, Aeroplan provides us with your name and contact information.
• To enable us to better tailor our offers to you and provide you with more opportunities to earn points and receive rewards, Aeroplan provides us with information about your interests, preferences, purchases and purchasing patterns.

We may receive personal information from Aeroplan to make it easier for you to book travel

• When you contact us to book travel and provide your Aeroplan number, we are provided with information about your preferences that you store in your Aeroplan profile, like your language, province, and default airport, and other information required to hold a booking.

We may share your personal information with Aeroplan when you interact with us, for example:

• When you make purchases with us, we provide information about the transaction to Aeroplan – such as transaction date, dates of travel, price, destination, products purchased (such as hotel or cruise), and any other information you provided as part of that transaction.
• When you receive our communications, we may share information with Aeroplan about how you engage with us, such as whether and when you open our emails – for more details, please see the aircanada.com Cookies and Tracking Technologies Policy.
• When you visit or use our website or any other online platform, we may share information about that visit or use with Aeroplan, such as the webpages you viewed, search queries, frequency of visits, time spent on the site or application, and location information (e.g. to identify where you will depart when you start the booking process) – for more details, please see the terms and conditions of the applicable website or mobile application, and the aircanada.com Cookies and Tracking Technologies Policy.
‍• When you interact with contests, we may share information about that interaction with Aeroplan.

Like us, Aeroplan uses that information to better tailor travel-related offers to you – giving you more opportunities to earn points and to receive rewards.

For more information on how Aeroplan handles personal information, see Aeroplan’s privacy policy.

AEROPLAN CREDIT CARDHOLDERS

‍This section of the privacy policy only applies to Aeroplan members who have been issued Aeroplan credit cards.

‍Aeroplan and Air Canada have partnered with financial institutions to issue Aeroplan credit cards. These credit cards afford members more opportunities to earn Aeroplan points for everyday activities, as well as a range of other travel rewards and benefits.

To further those opportunities, Aeroplan may share relevant insights with us about your Aeroplan credit card activity – such as your interest in certain travel experiences or your relative spending with certain travel operators. We only use these insights to market our products and services to you, and (if de-identified) to improve our products, services and operations – all with a view to maximizing the value of our products and services to you.

As part of this data sharing, we will not receive transaction-level data. Also, we do not use these insights about your credit card activity for other purposes, or disclose these insights, without your express consent or as permitted or required by law.

For more information about Aeroplan credit cards and privacy, review your cardholder documents and your financial institution’s privacy policy.

For more information on how Aeroplan handles this credit card information, see Aeroplan’s privacy policy.

5. WHAT ARE YOUR CHOICES WHEN IT COMES TO THE HANDLING OF YOUR PERSONAL INFORMATION?

CHANGING COMMUNICATIONS PREFERENCES

When you book travel with us, we may use your email address to send you offers that we feel will be of interest to you. You can modify your communications preferences by:

• using the unsubscribe mechanism in any SMS text or email marketing communications, or
• contacting the Air Canada Vacations Contact Centre (see section 9 "How can you ask questions or raise concerns about privacy?")

As permitted by law, some unsubscribe requests may take up to 10 business days to complete (e.g., if a campaign is underway, you may still receive marketing messages shortly after you unsubscribe).

If you withdraw your consent to receive these electronic marketing communications, you will continue to receive service communications related to your account or your bookings.

CHANGING BROWSER OR DEVICE SETTINGS

We use cookies, scripts, tracking pixels, local storage, and other tracking technologies on the website, mobile application and other online platforms to help administer them, to improve your experience, and to improve the program.

For more information on how we use these technologies, including how you may block or delete certain of these technologies, see the aircanada.com Cookies and Tracking Technologies Policy.

OTHER DATA HANDLING CHOICES

If you wish to withdraw from other collections, uses or disclosures of your personal information by Air Canada Vacations, please contact us (see Section 10 “How can you exercise your personal information rights?” and Section 11 "How can you ask questions or raise concerns about privacy?").

6. WHERE DO WE KEEP YOUR PERSONAL INFORMATION?

We generally store personal information at our offices in Toronto and Montreal, and at our data centres in Canada.

Some of our service providers access, use or store your personal information outside of your province or territory, including Quebec, or outside of Canada. The laws of those other places will then apply to that information, including laws that may permit or require disclosing that information to government, courts and law enforcement.

If you would like more information about our policies and practices regarding processing of personal information outside of Canada, please contact our Privacy Office directly, either by email or the postal address (see section 9 "How can you ask questions or raise concerns about privacy?").

7. HOW IS YOUR PERSONAL INFORMATION PROTECTED? HOW LONG IS IT KEPT?

Air Canada Vacations maintains appropriate organizational, technical, and physical safeguards to protect your personal information. These safeguards are intended to prevent the loss, theft or unauthorized access, use, disclosure, modification or destruction of your personal information. For example:

• your personal information is subject to restricted access
• electronic data is protected by technological means, such as firewalls, access controls, encryption and pseudonymization (de-identification of information with pseudonyms) – as well as the use of a Secure Socket Layer protocol that encrypts personal information, such as your payment card number, as it travels from your computer to Air Canada Vacations' booking system. We use multi-factor authentication for Aeroplan members using our Single Sign On authentication process to access Aeroplan and Air Canada Vacations applications with the same username and password.
• our website adopts the secure internet communication protocol (HTTPS) to provide encryption, data integrity, and authentication of the personal information you submit
• our personnel are sensitized and trained to the importance of safeguarding personal information from loss, theft or unauthorized access, use or disclosure

As many of our interactions with you are online or via email, we rely on you to take reasonable steps to safeguard your personal information. For example:

• we expect you to use unique passwords for your accounts with us, to safeguard those passwords, and to log-out of your account when you are finished so that your passwords, account or personal information is not accessed or used without your permission
• you should not provide us with an email account with us that you share with another person – if you do, then any email messages (including password resets) sent to that email account would be accessible to that other person

Also, when you book travel, you receive a confirmation number or passenger name record (PNR) for the reservation. The PNR number or information should not be shared as it may give others access to your travel itinerary and other personal information.

Like most companies, we cannot guarantee that our safeguards are always effective or that online communications are always secure. A breach of security safeguards can result in such risks as phishing and identity theft. In such cases, we act promptly to mitigate the risks and to inform you where there is a real risk of significant harm, or as otherwise required by law.

We keep your personal information for as long as it is needed to fulfill the purposes for which it was collected, or a longer period if permitted or required by law. When no longer needed, personal information is destroyed, anonymized or disposed of using secure methods.

Please note that if your personal information is collected by a third party, such as a program partner, it will be kept in accordance with the privacy policies and records retention requirements of that third party.

8. HOW CAN YOU ACCESS OR CORRECT YOUR PERSONAL INFORMATION?

We keep your personal information for as long as it is needed to fulfill the purposes for which it was collected, or a longer period if permitted or required by law. When no longer needed, personal information is destroyed, anonymized or disposed of using secure methods.

Please note that if your personal information is collected by a third party, such as a program partner, it will be kept in accordance with the privacy policies and records retention requirements of that third party.

9. PRIVACY GOVERNANCE

Air Canada Vacations has adopted and implemented internal policies, processes and practices related to the management of personal information, including:

• The designation of a Principal Privacy Officer for overseeing and monitoring compliance with this policy and privacy laws (see Section 11 "How can you ask questions or raise concerns about privacy?");
• Procedures for responding to inquiries and complaints, including one for handling requests from individuals who wish to exercise their rights (see Section 10 “How can you exercise your personal information rights?”);
• A Records Retention Guide that sets out how long data or documents, must be kept, and it provides specific retention periods applicable to specific categories of documents or specific data classification types;
• A policy and related procedures for ensuring data security (see Section 7 “How is your personal information protected?”);
• A data breach response plan for dealing with confidentiality incidents;
• A policy that sets the roles and responsibilities of employees, and restricts access to personal information to employees who need it to do their job; and
• A process to select responsible service providers.

10. HOW CAN YOU EXERCISE YOUR PERSONAL INFORMATION RIGHTS?

• You have the right to withdraw your consent to the use and sharing of your personal information. If that use or sharing is necessary for us to complete your bookings and fulfil your requests for our products and services, then we will be unable to do so.
• You have the right to access your personal information and, if the information is inaccurate, to correct it. In certain circumstances, you also have the right to deletion and portability of your personal information.
• You have right to be informed of the personal information collected about you, the categories of persons who have access to the information within the company, and how long the information may be kept.

You can make a formal request to exercise any of these rights by contacting our Privacy Office (see Section 11 "How can you ask questions or raise concerns about privacy?"). In that case, we will respond to your request within 30 days.

If your personal information in our records is inaccurate or incomplete, we will amend the personal information as required. Where appropriate, we will transmit the amended information to third parties having access to your personal information.

It is your responsibility to provide and maintain accurate and complete information.

11. HOW CAN YOU ASK QUESTIONS OR RAISE CONCERNS ABOUT PRIVACY?

Our Principal Privacy Officer is responsible for overseeing what we do with your information and for monitoring compliance with this policy and data protection laws. If you have concerns or further questions about how we handle your personal information or wish to make a formal access or correction request, please contact the Principal Privacy Officer using the contact information below.

Email: privacy_vieprivee@vacv.com

‍Address:
Air Canada Vacations Privacy Office
1440 St. Catherine St. West, Suite 600,
Montreal, Quebec, H3G 1R8

Please note that we will take reasonable steps as necessary to validate your identity prior to disclosing any personal information via the above communications channels.

‍