Your Privacy Matters
How Airnexa collects, uses, and protects your personal information when you book travel with us.
Quick Summary
- We collect only what's needed to book your travel
- We never sell your personal data
- Data shared only with airlines/suppliers for your booking
- You control your data: access, correct, or delete anytime
1. Data Controller
Airnexa ("we," "us," or "our") is the data controller for personal information collected through this website, our phone booking line, and related services.
Company: Airnexa
Address: 123 Aviation Boulevard, Suite 400, Denver, CO 80202, USA
Phone: +1 (800) 555-0196
2. Information We Collect
a) Information You Provide Directly
- Full legal name (as it appears on government ID)
- Date of birth
- Gender (as required by airlines/TSA)
- Contact information: phone, email, mailing address
- Passport/national ID details (for international travel)
- Payment information (processed securely via PCI-DSS compliant processors)
- Special service requests (wheelchair, dietary, medical, etc.)
- Frequent flyer/loyalty program numbers
b) Information Collected Automatically
- IP address, browser type, operating system
- Pages visited, time spent, referral source
- Device identifiers (for fraud prevention)
- Call recordings (for quality, training, and dispute resolution - disclosed at start of call)
c) Information from Third Parties
We may receive information from airline partners, GDS providers, payment processors, and fraud prevention services to complete your booking and prevent unauthorized transactions.
3. How We Use Your Information
4. Legal Basis for Processing (GDPR/UK GDPR)
Contract Performance: Processing is necessary to fulfill your booking contract.
Legal Obligation: Required by aviation security laws (TSA Secure Flight, APIS), tax laws, and DOT regulations.
Legitimate Interest: Fraud prevention, service improvement, security.
Consent: Marketing communications, optional services (seat selection, baggage pre-pay).
5. Data Sharing & Disclosure
Airlines & Travel Suppliers (Required)
We share booking data with the operating carrier, GDS, and wholesalers to issue tickets and manage reservations. This is required to fulfill your travel contract.
Government Authorities (Required by Law)
TSA (Secure Flight), CBP (APIS), and other agencies receive passenger data as mandated by aviation security laws.
Payment Processors
PCI-DSS compliant processors (e.g., Stripe, Braintree) handle payments. We do not store full card details.
Service Providers
Trusted vendors for call recording, CRM, analytics, fraud prevention—bound by data processing agreements.
Business Transfers
In a merger, acquisition, or asset sale, your data may transfer with appropriate protections.
We do not sell your personal information to third parties for their marketing purposes.
6. Data Retention
Booking Records: Retained for 7 years after travel completion (tax, legal, DOT requirements).
Call Recordings: Retained for 2 years (quality, training, dispute resolution).
Marketing Data: Retained until you opt out or 2 years of inactivity.
Website Analytics: Aggregated data retained indefinitely; personal identifiers removed after 14 months.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") - subject to legal retention obligations
- Restrict or object to processing
- Data portability (receive your data in structured format)
- Withdraw consent (for marketing) at any time
- Lodge a complaint with a supervisory authority
To exercise these rights, call +1 (800) 555-0196 or write to us at 123 Aviation Boulevard, Suite 400, Denver, CO 80202, USA. You may also submit a request through our contact form. We respond within 30 days (GDPR) or 45 days (CCPA).
8. Data Security
We implement appropriate technical and organizational measures:
- TLS 1.2+ encryption for all data in transit
- Encryption at rest for stored personal data
- PCI-DSS Level 1 compliant payment processing
- Role-based access controls and regular security training
- Annual third-party penetration testing
- Incident response plan with 72-hour breach notification (where required)
No internet transmission is 100% secure. We cannot guarantee absolute security.
9. International Data Transfers
Your data may be processed in countries outside your jurisdiction (e.g., airline systems in the US, GDS servers globally). We ensure appropriate safeguards: EU Standard Contractual Clauses, UK IDTA, or adequacy decisions. By booking international travel, you consent to necessary cross-border transfers.
10. Children's Privacy
Our services are not directed to children under 13 (or 16 in EEA/UK). We do not knowingly collect personal data from children. If a minor's data is collected for a booking (by a parent/guardian), it is processed solely for that travel arrangement.
11. California Residents - CCPA/CPRA Rights
California residents have additional rights:
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information (with exceptions)
- Right to opt-out of "sale" or "sharing" of personal information
- Right to non-discrimination for exercising privacy rights
- Right to limit use of sensitive personal information
We do not "sell" personal information as defined by CCPA. To submit a request, call +1 (800) 555-0196 and ask for the privacy team, or submit a request through our contact form.
12. Cookies & Similar Technologies
We use cookies for:
- Essential: Session management, security, fraud prevention
- Analytics: Google Analytics (anonymized IP) for site improvement
- Marketing: Google Ads conversion tracking (with consent)
You can manage cookie preferences via your browser settings. Disabling essential cookies may break booking functionality.
13. Changes to This Policy
We may update this policy to reflect legal, operational, or regulatory changes. Material changes will be posted on this page with a revised "Last Updated" date. Continued use of our services after changes constitutes acceptance.
14. Contact Us
Questions about this Privacy Policy or our data practices?
Last updated: January 15, 2025