This Privacy Policy is an overview of how we collect, use, and process your personal data when you use our website https://www.nuflights.com (from here on referred to as “Website”) and our web and mobile apps (from here on referred to as “Apps”). We will also jointly refer to Website and Apps as “Services” - if anything here only applies to one of our services, we will explicitly point this out to you.

Please read this Policy carefully, as it becomes legally binding when you use our Services. We take privacy and protection of your data very seriously and are committed to handling the personal information of those we engage with responsibly and in a way that meets the legal requirements of the countries in which we offer Services. This includes data related to customers, suppliers, colleagues and associates.

1. Responsible Authority

NuFlights LLC, (NuFlights, “us”, “we”, “our”) is the responsible authority for the collection, processing and use of personal data. NuFlights is an international business registered in Doha, Qatar (QFC number 01250) at the address 21st Floor, Office No. 21 DD BL 46, Doha Tower / Burj Doha, No. 15, Doha, Qatar. If you have any questions about how we protect or use your data, please email us at privacy@nuflights.com

2. Data we collect and process

We will collect and process the following data required to provide the Services:

2.1 Information you provide us

You may give us information about you when you sign up to use our Services, e.g. when you provide us with personal details like your name, email address and phone number. This also includes information you provide through your continued use of our Services, your participation in our community discussions or other social media functions on our Website or Apps, your participation in surveys, and by reporting problems with our Services. Right now, our services collect from you your name, email address, phone number and postal address and your chosen password which we use to identify you to provide our Services.

You may give us information about work colleagues who may use our Services, e.g. when you manage your organisation's account with NuFlights and you invite a colleague to use NuFlights. By inviting a colleague you confirm they are made aware of this privacy policy.Right now, our services collect from you names, email address, phone number of your colleage, to allow them to use our Services.

You may give us information about customers of your organisation, as a Data Controller, to provide them travel-related services to these customers. As a Data Processor, NuFlights will share this information with travel service providers of your choice, like Airlines, to enable them perform the services they offer. Right now, our services collect from you names, email addresses, phone numbers, title and gender, date of birth, nationality, passport numbers, and frequent flyer account numbers of the customers.

2.2 Information we collect about you

When you use our Services, we will automatically collect the following information:

• Details from your interaction with our Services, including your geographic location and language preference.

• Technical information, including the Internet protocol (IP) address used to connect your computer or mobile device to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;

• Information about your visit, including the full Uniform Resource Locators (URLs) through and from our Website or Apps (including date and time); features of Services you used and for how long; screen response times, download errors, length of visits to certain App pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and the email address used to contact our customer support.

2.3 Information we receive from other sources

We do not work with any third parties to collect information about you, for purposes other than providing you the Services.

2.4 Information from social media

We do not collect your personal information from social media.

2.5 Data about children

Our Services are exclusively for adults aged 18 or over, and not currently intended for children. We do not knowingly collect data from individuals below 18 years of age. When we are aware of our Services being used by children, we will terminate the services and delete the data.

Information you provide about customers of your organisation may include travellers who are not adults. In this case we will collect and process personal details, as described in section 2.1 above, exclusively for the performance of the travel related services.

3. How we protect your personal information

We take security of your personal information very seriously. All our Services process your data in well-designed data centres that use industry best-practices for data security, and adopt a number of measures to safeguard your data.

3.1 Security of services and data centres

• Our Apps are designed to collect and process personal data securely, and send personal data to our data centres only for essential service features.

• Communication over the Internet between our Services and NuFlights data centres is encrypted using strong encryption (SSL/TLS). This prevents any evesdropping on your personal data.

• All your data is strongly encrypted at rest, when it is not being actively processed by our Apps or data centres.

• Where possible our Services use servers patched and secured by our cloud data centre partner (called serverless processing). In the rare instances where we manage servers, we update and patch them regularly.

• Our data centres are designed to continously monitor and raise alarms for abnormal and malicious activity around and in our data centres. Our security team proactively intervenes to keep your data safe.

3.2 Accessing your data to provide services

• Our Services are designed for self-service by you, to limit our employees's need to access your personal information.

• Where our employees have a business reason for knowing your personal data, we use electronic and procedural safeguards to protect your personal information from unauthorised access.

4. Ways we use your information

We use your information:

• to carry out our obligations relating to your contract with us and to provide you with the information and Services;

• to combine information you provide us with the information we collect about you. We use this information exclusively to provide our Services using purposes listed in section 2.1 above.

• to personalise how you interact with our services, when you choose to do so, by adapting to your preferred device and time of day for such interactions

• to notify you about changes to our Services and as part of our efforts to keep our Services safe and secure;

• to administer our Services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

• to generate non-personal analytical data that cannot be traced back to you. Our services rely on this information for their effectiveness to you and others.

• to comply with any applicable legal and/or regulatory requirements;

5. Legal basis for processing

Current legislation requires us to explain the legal basis we use to collect and process your information. These are as follows:

• Where it is necessary for entering into or performing a contract with you;

• Where we have a legitimate interest to do so, provided your rights do not override those interests;

• Where you have consented to its uses;

• Where required to comply with our legal obligations.

6. Disclosing your information

We do not disclose your personal information to third parties, unless it's essential for us to provide you our Services or we have a legal obligation to share such data. Specifically,

6.1 We will share your information with third parties

• where this third party is an affiliate, business partner, sub-contractor or supplier directly related to the Service you are using and requires this data for providing the service;

• where this third party is an analytics provider that assists us in the improvement and optimisation of our Services; We carefully choose our partners and, where possible, share data only in anonymised form.

6.2 We will disclose your information with other parties

• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

• in response to a subpoena, warrant, court order, or as otherwise required by law;

• to develop customer relationships, services and systems. We will make reasonable efforts to make information regarding such third parties publicly available.

6.3 List of third parties we share data with

This section will provide you specific information of the third parties we use.

• Each travel service provider (e.g. airlines) you have asked us to create a NuFlights subscription for.

• Amazon Web Services (AWS), which is our primary cloud data centre provider.

7. Location of your personal data

We transfer and store your personal data only in European Economic Area (EEA), securely and in accordance with this Privacy Policy.

8. Using your personal profile

• We use the information you provide us and information we collect about you to create your profile exclusively to provide personalised features in our Services.

• We do not use or share such a profile for marketing purposes, but may share the profile with third parties for purposes listed in section 6.1.

9. Cookies

• We use small files (known as cookies) to distinguish you from other users, see how you use our site and products while providing you with the best experience.

• We do not use cookies to track you for marketing purposes.

• For more information see our Cookies Policy.

10. Data Retention

• You personal data with us is deleted within 90 days from the end of your organisation's contract with us. Your organisation's contract with us ends on the day when the subscription for the Service is cancelled under the terms of the Service.

• We may retain non-personal anonymous analytics data for upto 3 years, to help us provide better services to you and others.

• We will always delete data that is no longer required by a relevant law or jurisdiction in which we operate.

11. Your rights

We respect your rights over your data, and build some of Services to help you enforce them. You should find easy self-service options to exercise these rights in our Services. Where they don't exist, you can always contact us.

11.1 Access your information

You have the right to access your information we hold about you and to exercise these rights in accordance with the relevant data protection legislation. Use features in our Services or contact us to

• provide you with further details on the use we make of your information;

• provide you with a copy of the information that you have provided to us;

• update any inaccurate, incorrect, or out of date personal information we hold;

• delete any personal information that is no longer necessary;

• where processing is based on consent, to withdraw your consent so that we stop that particular processing;

• change what you are notified of and how we do it, by adjusting your notification preferences in the settings section of your Service;

11.2 How quickly you can access your information

In most cases you should have same day access to your data when you are using the self-service features in our Services. If you had to contact us to access your data, subject to us validating your identity and entitlement to the data, we will provide you access to your data within 30 days.

12. Third Party Services

Our Services display third party links, which have their own privacy policies. When you choose to follow these links to services not provided by us, we do not accept any responsibility for them. We encourage you to check the third party's privacy policy, before submitting personal data to them.

13. Changes to this Policy

We may revise this policy at any time, to keep up with legislation, best practise and changes in how we process your personal information. We will make reasonable efforts to publish this information to you, but you should check back this page periodically to stay up to date on changes.

14. Contact Us

• Please send your questions, comments or requests regarding this privacy policy to our privacy team at privacy@nuflights.com

• Write to us at the address - NuFlights LLC, 21st Floor, Office No. 21 DD BL 46, Doha Tower / Burj Doha, No. 15, Doha, Qatar.