Privacy policy

Collection and Use of Personal Information

In collecting personal information, the Company clarifies the purpose and acquires such information to the extent of such purpose. In addition, the Company will use such personal information only for the intended purpose.

Management and Protection of Personal Information

The Company will manage personal information carefully and will not disclose or provide personal customer information to any third parties except for cases where consent is obtained from customers. In addition, the Company will take appropriate preventive and correction measures to prevent unauthorized access to or loss, destruction, alteration, or leakage of personal information.

Governing Laws and Others

The Company will comply with laws and other regulations applicable to personal information.

Continuous Improvement in the System and Functions for Management of the Protection of Personal Information

The Company will strive to continuously improve the system and functions for management concerning the protection of personal information.

1. Introduction

This Privacy Policy explains how we handle the personal information we receive from our customers. Please read this Privacy Policy carefully before providing personal information to us or using our products or services.
Chapter 1 of this Privacy Policy outlines how your personal information is used within the Company.
Other policies may also apply to our products and services**.** Details of such policies will be separately stated in the terms and conditions for those products and services.
For customers who reside in Japan, personal information in this chapter refers to information about a living individual that can identify the specific individual by name, date of birth, or other description, or information that contains a personal identification code.

2. Scope of application

This Privacy Policy applies when you provide us with your personal information, or when you use our products and services.

3. Purpose of using personal information

The Company utilizes personal information obtained from customers for the following purposes.However, even within the intended scope, the Company will not use customers’ personal information in a way that may encourage or induce illegal or improper conduct:

1. Reservation, sale, shipping, and payment processing for products and services in online shopping
2. Reservation, sale, shipping, and payment processing for physical store products and services
3. Providing ANA Mileage Club services
4. Providing information on other products and services handled by the Company and the provision and management thereof
5. Research and analysis of the use status of other products and services handled by the Company
6. Any other operations incidental to and related to (1) to (5) above
7. Conducting surveys on our products and services
8. Development of new products and services
9. Announcement of products and services, events and campaigns provided by companies belonging to the ANA Group (hereinafter referred to as “ANA Group companies”) and affiliated companies, the operation and management of those activities, and providing other information
10. Communication regarding our products and services
11. Delivering personalized announcements, direct mail, email newsletters, and advertisements regarding products, services, events, and campaigns offered by ANA Group companies and affiliated companies. These communications are tailored to your inferred interests and preferences based on an analysis of your purchase history and browsing behavior on our online shopping website.
12. Recruitment activities on the recruitment page
13. Response to inquiries or requests

*Otherwise, the personal information is used for purposes as provided in “10. Data-sharing concerning personal information.”

4. Acquisition of personal information

The Company will obtain customers’ personal information by fair and appropriate means.

• Customer information, contact information, payment information, etc.
  The customer’s name, address, telephone number, fax number, email address, business contact information (company, department, section, position, address, telephone number, fax number), mailing address, passport information, payment information including credit/debit card or other details on means of payment, etc.
• Information on ANA Mileage Club membership and information related to the usage of applicable services, etc.
  The customer’s ANA Mileage Club membership number, member card type, member service qualification, membership area, mileage status, credit card number, expiration date, credit card usage history and related information and need for wheelchair or other special arrangements, flight reservation and cancelation information, boarding status, etc.
• Details of enquiries and complaints to the company
  Voice recordings, etc. that include information such as the customer’s name to identify a specific individual.*The Company monitors, records, and stores communications with customers, including telephone calls and emails, to confirm instructions from the customer, conduct training, prevent crime, and improve the quality of customer services.
• IT and system data, including usage of our website and mobile apps
  Information regarding your use of our website and mobile apps from which the Company can identify a specific individual. This includes cookies, advertising identifiers (IDFA/GAID), location information, unique device IDs, IP addresses, operating systems, browser types, and activity logs on our website.
  The Company shall never obtain or use information of a sensitive nature to the customer (hereinafter, “sensitive information”), such as information on race, creed, social status, history of illness, criminal record, or history of being a victim of crime, unless otherwise required by laws and regulations or by the consent of the customer.

5. Acquisition of information Related to Personal Information

We may obtain information related to personal information directly from you, or from third parties or ANA Group companies. In this Chapter, “information related to personal information” refers to information relating to a living individual that does not fall under personal information, pseudonymized personal information, or anonymized personal information as defined in Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003).
Examples of information related to personal Information:
Among information such as cookies, advertising identifiers (IDFA/GAID), location information, device unique ID, IP address, operating system and browser type exemplified in “4. Acquisition of personal information, (4) IT and system data, including usage of our website and mobile apps,” information by which the Company cannot identify a specific individual
Example of cases where we receive information related to personal information:
Obtaining advertising identifiers from third parties or ANA Group companies for advertisement delivery
When using such information related to personal information combined with personal information of customers held by the Company or ANA Group companies, the Company will obtain consent from the customers and handle the information appropriately in accordance with the purposes specified in “3. Purposes of Use of Personal Information” unless a specific purpose is indicated.

6. Use of cookies

The Company’s website uses cookies to improve site usability and service, and to provide individual customers with more personalized services.

• What are cookies?
  Cookies are small data files placed on your device (computer, tablet, smartphone, and other devices) that allow a website to remember the details of your visit. Each time you visit a website, a cookie identifies your device and stores information about the time and the visitor on the website. The information stored may include your IP address, the device, and your click history (such as the web pages you visited).
• Purpose of use of cookies
  The Company uses cookies for the following purposes:
  • To help improve the usability, structure and content of our website
  • To provide online services and optimize services
  • To develop new services at ANA Group companies
  • To carry out marketing activities including announcement of events and campaigns
• Types of cookies

  1. 1) Essential cookies
     Essential cookies are necessary for online services to function, for safe website viewing, and for providing products and services to customers. Essential cookies cannot be disabled. Essential cookies are necessary for an effective and secure connection to online services. They are set in response to actions you take to request goods and services (e.g., booking and order processing, logging in and maintaining your logged-in status, and filling out web forms). Essential cookies are automatically stored on your device when you visit our website.

  2. 2) Analytical cookies
     Analytical cookies collect information to analyze and compile statistics on how the visitor uses our website (e.g., which pages you visit most often and when you visit). We use the collected information to understand which parts of the website you were interested in (e.g., statistical analysis of page views and churn rates, and access rates by device type) and to improve website quality based on that understanding.

  3. 3) Personalization cookies
     Personalization cookies are used to display advertisements tailored to your interests and preferences when you visit the website (e.g., showing advertisements based on the products you add to your cart when you place an order, or the device you use).
     If we change the type of cookies we use, we will notify you.

7. Choice by the customer

As a rule, the Company obtains personal information with the consent of the customer. Customers may experience disadvantages if they refuse to provide their personal information, such as being unable to make use of the various services provided by Company, or being unable to receive campaign notices or other Company information because some Company system functions become inoperable and thereby unavailable. Please note that customers may change their contact information as well as email newsletter settings at any time they wish, in a manner designated separately by the Company.

8. Disclosure and provision of information to a third party

• Circumstances under which the Company discloses or provides customers’ personal information to a third party

  The Company shall not disclose or provide personal customer information to any third parties except under the following circumstances. Also, personal information of customers that includes sensitive information shall not be disclosed or provided to third parties under any circumstances, unless allowed by laws and regulations or with the consent of the customer. Note that provision of information to data-sharing partners and contractors is not deemed to constitute disclosure or provision to third parties.

  1. 1) Customer consent has been obtained in advance.

  2. 2) Disclosure or provision is required by laws or regulations.

  3. 3) Disclosure is required to protect human life, body, or property in cases where obtaining customer consent is difficult.

  4. 4) Disclosure is required to cooperate with the public affairs of national or local governments, and when obtaining customer consent is likely to hinder the administration of public affairs.

  5. 5) Statistical data (i.e. anonymized information on the customer) is disclosed or provided.

  6. 6) Information is provided in a business succession via a merger, company split, transfer of business, or other means.

  7. 7) The Company may provide your personal information to third parties in accordance with the procedures stipulated by law, on condition that you can easily confirm the following items on the Company’s website and the website where the Company provides services and you have not expressed the intent to refuse such provision:

  • The purpose of use is to provide information to third parties
  • Items of personal data provided to third parties
  • Means or methods of provision to third parties
  • Provision to third parties will be suspended upon your request
  • The procedures to receive the request for suspension

  8. 8) The Company may provide your personal information to your credit card company in order to cooperate in its activities to detect and prevent unauthorized card use, or to a payment settlement company that provides deferred payment service or other settlement service for service user identification or for billing information verification and credit investigation.

• Third parties to whom the Company may provide your personal information:

  1. 1) Associated companies
     The Company may disclose your personal information to ANA Group companies and entities associated with ANA Group companies.

  2. 2) Employees
     The Company may disclose your personal information to its employees who have the authority and need to access it.

  3. 3) Service providers
     The Company may disclose your personal information to service providers, such as IT service providers (including data server and cloud service providers), information analysis service providers, advertising delivery service providers, and legal advisors.

  4. 4) Credit card companies and payment settlement companies
     The Company may disclose your personal information to credit card companies and payment settlement companies (hereinafter collectively referred to as “Card Companies”).
     If your Card Company is located in a foreign country, your personal information may be transferred to the country where the Card Company is located. Since we cannot identify the country where your Card Company is located from the information we collect from you, we are unable to identify and provide you with the following information related to personal information protection measures:

     • Name of the country where your Card Company is located
     • Information about the personal information protection system in the said country
     • Measures to protect personal information taken by the Card Company to whom we provide information
     For personal information protection systems of other countries, you may refer to the Personal Information Protection Commission’s website (https://www.ppc.go.jp/ ).
     If you are a minor, you must obtain the consent of your parent or guardian before using our products and services.

9. Entrusted handling of personal information

In providing products and services to customers, the Company may entrust a part of its business operations, and may provide personal information to contractors within the extent required to achieve the purpose of use. In these cases, the Company shall implement all appropriate measures in managing and supervising such third parties to safeguard the handling of customers’ personal information, including establishing agreements with these third parties on the handling of such personal information.

10. Data-sharing concerning personal information

The Company share customer information as follows.

Scope of Data Sharing	ANA Group Companies
Purpose of use by the user	For the provision of air transport services, travel services such as tours and hotels, and other goods and services handled by the Company or its affiliate companies In order for the Company or its affiliate companies to send direct mail, provide information on products and services, and conduct surveys, etc. In order for the Company or its affiliate companies to analyze sales, conduct other surveys and research, and develop new products and services, etc. In order to inform and hand over to the company in charge of products and services provided by the Company or its affiliate companies in the event of an inquiry, application or other request from a customer In order for the Company or its affiliate companies to properly and smoothly execute other transactions with customers For ANA Group management and internal management
Personal information items to be shared	ANA Mileage Club customer number, name, address, phone number, fax number, email address, business information (company name, department, title, address, phone number, fax number), mailing address, membership card type, membership service eligibility, region, mileage record, credit card number, credit card expiration date, credit card usage history and other related information, wheelchair assistance requirements, flight reservation/cancellation record, boarding and service usage record (order numbers, customer number, product names, quantities, amount, purchase date and time, payment method for purchased products and services, campaign application and usage records, coupon usage and availability, survey response date and content, review details), information included in communications with the customer, content of inquiries, requests, and comments, and information regarding your use of our website and mobile apps, including cookies and website activity logs.
Name, address, and representative of the party responsible for management of personal information	ANA HOLDINGS INC. Shiodome City Center, 1-5-2, Higashi-Shimbashi, Minato-ku, Tokyo, Japan 105-7140 Koji Shibata, President & Chief Executive Officer

11. Transfer to outside of Japan

If the Company provides customers’ personal information to third party business operators outside of Japan, including contractors and data-sharing partners, it will take necessary and appropriate measures in keeping with laws and regulations.

12. Management of personal information

In receiving customers’ personal information, the Company will manage such information according to the strictest standards and take necessary safety management measures to prevent leaks, loss, or alterations. The Company ensures that the board members and employees are properly trained regarding appropriate handling to safeguard the security of information identifying individual customers. An appropriate retention period for personal information will be established in accordance with the purpose for which such information is used. After the purpose of the information has been achieved, the Company will dispose of the information in question by appropriate methods. If you wish to know the details of the safety management measures, please make a request in accordance with “13. Requests concerning the handling of personal information”.

13. Requests concerning the handling of personal information

If the Company receives a request from a customer, submitted in the manner specified, for the disclosure, correction, deletion, addition, discontinuance of use, or erasure, or information provision concerning the personal information protection measures referred to in “11. Transfer to outside of Japan” and “12. Management of personal information” (“disclosure, etc.”) with regard to the customer’s personal information stored in a database held by the Company, the request shall be handled according to the laws and regulations as follows, within a reasonable timeframe and scope, after confirming that the request was personally submitted by the customer.

• Request for disclosure
  The purpose of use, or personal information requested by the customer, or records on the provision of personal data to third parties, shall be disclosed.
• Request for correction, deletion, or addition
  Personal information shall be corrected, deleted, or added in accordance with the customer’s request, wherever possible and appropriate, after a due review of the request.
• Request for discontinuance or erasure
  Use of the personal information specified by the customer shall be discontinued in accordance with the customer’s request, and shall be erased if desired, wherever possible and appropriate. Please note that discontinuance and/or erasure may prevent the customer from receiving previously available services or may impede the provision of services the customer wishes to receive.
• Request for information provision concerning personal information protection measures
  The following information will be provided in accordance with the customer’s request.
  1. 1) Details of the safety management measures taken by the Company in receiving customers’ personal information
  2. 2) Details of the measures taken by the Company when providing customers’ personal information to third parties outside of Japan (in the case of “9. Transfer to outside of Japan”)

The Company may not be able to fulfill the customers’ requests if compliance with such requests would seriously impact the Company’s business operations, or result in a violation of laws and regulations.

14. How and where to submit a request for disclosure, etc.

The following provides information on how to request disclosure concerning personal information received by the Company from the customer, how to request notification on the purpose of use, as well as where to submit inquiries.

Requests for disclosure, etc.

• Contact information
  The customer may inquire about your personal information in the following ways I or II.

  1. I.Use the contact information below concerning the personal information of a customer stored in a database held by ANA Shopping A-style.

     ANA Shopping A-style Customer Support Desk Toll-free: 0120-283-250

     Business hours：Monday – Friday: 9:00 – 18:00 Saturday, December 30 – 31: 9:00 – 17:00
     Closed:Sunday, National Holidays, and January 1 – 3

  2. II.Check “(2) Submitting a request” below with regard to personal information of a customer stored in a database held by the Company but not by ANA Shopping A-style.

• Submitting a request
  Fill out an inquiry form at the Company’s website (https://www7.webcas.net/form/pub/anatchp/form ) to contact the controller of the personal data.

  Controller of personal data: ALL NIPPON AIRWAYS TRADING CO., LTD.
  Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan
  The Company’s personal information handing desk: ml_notice_privacy @ anatc.com (Please delete the spaces before and after the @ symbol.)
  Please note that this e-mail address is exclusively for inquiries about the handling of personal information; we will not be able to respond to any other inquiries sent to this address.

15. Modification of the Privacy Policy

The Company may make modifications to this Privacy Policy at any time. If modifications are made, details will be posted on the Company’s website, so please be sure to read carefully the contents of any changes that have been made.

ALL NIPPON AIRWAYS TRADING CO., LTD.
Junichiro Miyagawa, CEO and President
Shiodome City Center, 1-5-2, Higashi-shimbashi, Minato-ku, Tokyo, Japan

1. Introduction

Chapter 2 explains the handling of personal information belonging to customers who reside in the European Economic Area (EEA) and United Kingdom in accordance with the following data protection laws (hereinafter “data protection laws”): the General Data Protection Regulation 2016/679 (GDPR), the Data Protection Act 2018 (DPA 2018) in the U.K., and U.K. laws and regulations concerning domestic and international data protection and privacy.
Note that the U.K. act is similar to the EEA regulation and that the customer retains very similar rights in both places. Accordingly, the reader should consider the parts of this chapter that mention the GDPR as applying likewise to the U.K.
A guardian’s consent or permission must be obtained in the event that a customer under the age of 16 uses the Company’s service and others and consents to this Privacy Policy. The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member applies for the Company’s service on behalf of the data subject.
In the event that any provisions of this chapter contradict those of Chapter 1, the provisions of Chapter 2 shall prevail.

2. Controller of personal information

The Company is the controller of the customer’s personal information.
In accordance with data protection laws, the Company safeguards the personal information that is collected and used via controllers (i.e. those who decide the method and purpose for handling the customer’s personal information) and handlers (those who act according to the written directions of controllers).

3. Legal basis for handling personal information

In accordance with data protection laws, the Company safeguards the customer’s personal information by handling it only within the scope required for a specific purpose of use (as provided in Chapter 1, “3. Purpose of using personal information”).
The Company handles the customer’s personal information according to the following legal bases.

• If the customer consents to the handling (GDPR, Article 6 (1) (a))
  Consent normally only applies to handling related to promotions and marketing, as well as, depending on the situation, handling related to sensitive information.
• When necessary to take measures for the purpose of performing or concluding a contract (GDPR, Article 6 (1) (b))
  This normally serves as a basis for handling customer information (such as the customer’s identity, contact information, payment information, or itinerary) that is absolutely essential for the Company to provide a service.
• If the Company must handle the information to comply with a legal obligation (GDRP, Article 6 (1) (c))
  This includes the sharing of personal information with bodies such as customs authorities, immigration agencies, and law enforcement agencies, legal obligations to customers or employees of the Company, etc.
• If there is a medical emergency or other need to safeguard the life of the customer or a third party (GDPR, Article 6 (1) (d)).
• If the Company or a third party must handle personal data for the purpose of legitimate interests, and the rights of the customer under data protection laws do not supersede these interests.
  (GDPR, Article 6 (1) (f))
  This includes the use of personal information necessary for operating the Company’s business, as well as the use of personal information necessary to maintain, develop, and improve the Company’s products and services and to provide the customer with the best experience.

4. Requests concerning the handling of personal information

Data protection laws recognize the following legal rights for the customer.

1. 1) Requests for disclosure
   The customer may request a copy of the customer’s personal information in the possession of the Company and details on its handling.

2. 2) Requests for corrections and updates
   After reviewing the request, corrections and updates shall be performed, if possible.

3. 3) Requests for deletion
   The customer may request the full or partial deletion of the customer’s personal information in the possession of the Company. Upon reviewing the request, the Company shall delete the information if the information is unnecessary or the law precludes the continued storage of the information.

4. 4) Forwarding personal information
   The customer may request a copy of personal information that is structured and in a generally machine-readable format. The forwarding of personal information may be performed with personal information obtained from the customer by the Company and with the customer’s consent, and only with regard to individuals who are handled by automated means for the purpose of performing a contract.

5. 5) Formal objections to handling
   The customer may voice an objection to handling that is for the legitimate interests of the Company or a third party, or handling that is for the purpose of direct marketing. The Company shall discontinue the handling of the customer’s information, provided that the handling for the legitimate interests of the Company or a third party does not have a provable legitimate basis that prioritizes the interests of the customer. If the customer’s objection is against direct marketing, the Company shall discontinue handling.

6. 6) Limitations on methods of using personal information
   The customer may limit the use of the customer’s personal information by the Company under specific circumstances. If a limitation is applied, the handling of the customer’s personal information (excluding storage) shall be performed legitimately, provided that the customer’s consent is obtained or that doing so is necessary for a legal claim, protecting specified rights, or for the sake of an important public good.

7. 7) Right to withdraw consent
   If the customer’s personal information is handled with consent, the customer possesses the right to withdraw consent at any time.
   Note that the aforementioned right is not absolute and that it does not necessarily apply to all situations. In addition, depending on the circumstances, if a legal exception applies, then a request may be refused. If a request is refused, the reason therefore shall be provided with the response.
   Records of requests to the Company shall be kept so as to enable confirmation of the Company’s compliance with legal obligations.

• Submitting a request
  The customer may exercise rights at no cost (unless a fee is charged or a request is refused in the event of an unreasonable, excessive, or repeated request). Below is the method for submitting a request.
  (Online)
  Fill out an inquiry form at the Company’s website (https://www7.webcas.net/form/pub/anatchp/form ) to contact the controller of the personal data (see Chapter 1, “14. How and where to submit a request for disclosure, etc.,” “(2) Submitting a request”).
• Responses to a request
  After receiving a request from the customer, the Company shall normally respond within one month. In addition, the Company may, as necessary, request identity verification or proof of authority to submit a request as a representative (in the event that the customer makes the request through a third-party representative). If the request is especially complex or there are multiple requests, a detailed response may take time. In addition, please note that there are exceptions to the aforementioned rights and there may be cases in which rights cannot be exercised.
  If the customer is not satisfied with the Company’s response to a request, or if it is believed that personal information has been handled inappropriately, the customer possesses the right to file a complaint with the competent authorities. For further details, see Chapter 2, “9. Lodging a complaint with an authority.”

5. Data sharing necessary to provide products and services

The Company’s products and services may be provided with the cooperation of other companies or organizations, and may involve the sharing of personal information with third parties in order to carry out operations. These third parties include the following:

• ANA Group companies
• Bodies with which the sharing of personal information is obligatory under laws and regulations
  Governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
• Service providers
  Companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, etc.
  If the Company entrusts a service provider with handling data, personal information shall be handled in accordance with an agreement that fulfills the requirements of applicable data protection laws.

6. Marketing communication

The Company sends marketing information as needed in order to inform customers who wish to receive news and details about products and services. Information is only sent to customers who consent to receiving marketing information, as well as customers who have purchased a product or service of the Company and have not selected to opt out of marketing despite having the opportunity to do so.

7. Retention and transfer of personal information

The Company is located in Japan. Many of the service providers and other organizations with whom the personal information of customers is shared are located within jurisdictions outside of the EEA and U.K. The European Commission has recognized that Japan has an adequate level of protection for personal information.
When the Company provides personal information to a third party, it occurs in compliance with the requirements of data protection laws, including the EU-Japan adequacy decision and the laws and regulations of Japan. However, note that in countries outside the EEA and U.K., the personal information of customers may not be protected under domestic law. If a customer wants further information on where their personal information is retained or to whom it is transferred, the customer should use the contact information provided in Chapter 1, “14. How and where to submit a request for disclosure, etc.”

8. Retention of personal information

The Company retains customer’s personal information until the Company achieves the purpose for which it is used, and has established the following retention periods for personal information. With regard to other personal information, the retention period is determined according to the information’s properties and the purpose of retention, with consideration given to such matters as legal and accounting requirements and the operational needs of the Company.

• Personal information on ANA Mileage Club members
  Until the member leaves the ANA Mileage Club
• Other personal information
  The period necessary for the agreed purpose of use

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal data with the data protection authority having jurisdiction over their residence.
EEA residents: Contact the supervisory authority in your country of residence.
Details are on the European Data Protection Board’s website (https://edpb.europa.eu/about-edpb/board/members_en ).
U.K. residents should contact the Information Commissioner (www.ico.org.uk ).

10. The contact information of Controller of personal data and data protection officer

Controller of personal data: ALL NIPPON AIRWAYS TRADIG CO., LTD.
Address: Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan
The Company’s data protection officer: ml_notice_privacy @ anatc.com (Please delete the spaces before and after the @ symbol.)
Please note that this e-mail address is exclusively for inquiries about the handling of personal information; we will not be able to answer any other inquiries sent to this address.

1. Introduction

A guardian’s consent or permission must be obtained in the event that a customer under the age of 18 uses the Company’s service and consents to this Privacy Policy. The data subject’s consent (or the consent of their guardian, in the case the data subject is a minor under the age of 14) to this Privacy Policy must be obtained in the event that a person such as family member apply for the Company’s service on behalf of the data subject.

2. Acquisition of sensitive personal information

The Company may handle personal information that could be classified as sensitive personal information in PIPL, etc., such as passport information, health information, payment information, accommodation information, etc. for the purpose of use. The Company recognizes that the leakage or illegal use of customers’ sensitive personal information may adversely affect their interests (e.g., It could easily bring about damage to personal dignity, or harm the safety of body or property), and will therefore strictly manage and legally handle such information in order to prevent its leakage or illegal use.

3. Retention period for personal information

The Company retains customer’s personal information until the Company achieve the purpose for which it is used, and has established the following retention periods for personal information.

• Personal information on ANA Mileage Club members
  Until the member leaves the ANA Mileage Club
• Other personal information
  The minimum period necessary for the agreed purpose of use

4. Technology and measure to protect customers’ personal information

• The Company takes security measures to protect customers’ personal information from leakage, loss or damage.Specifically, the Company takes the following measures to protect customers’ personal information.

  • The Company has established and is implementing an internal control system and operation rules regarding the protection of personal information.
  • The Company manages the classification of personal information.
  • The Company develops website with https and sets SSL encryption to secure important customers’ data (credit card information, etc.) communication between the customers’ web browser and the server.
  • The Company uses encryption technology for protecting personal information.
  • The Company sets reasonable access rights and controls access so that unauthorized persons cannot access personal information.
  • In order to raise employee awareness of the importance of protecting personal information, the Company provides education and training on security and privacy protection.
  • The Company has established and is making arrangements for the operation of an emergency response plan to respond to incidents involving personal information.
• The Company will take all reasonable and practicable steps to ensure that no irrelevant personal information is collected. The Company will only retain customers’ personal information for the minimum period of time required to achieve the purposes stated in this Privacy Policy, unless an extension of the retention period is required or permitted by law.
• In the event of personal information being at risk, the Company will promptly inform customers of the relevant circumstances of the incident in accordance with the requirements of the PIPL, etc. and report to the regulatory authorities.

5. Requests concerning the handling of personal information

In the event that the Company receives a request for personal information held by the Company on a customer who is a resident of China, the request shall be handled as follows according to the PIPL, etc. within a reasonable timeframe and manners, in addition to the provisions of Chapter 1, “11. Requests concerning the handling of personal information”. And when handling such a request, the Company may first confirm that the request was personally submitted by the customer.

• Request for withdrawal
  If the Company is relying on consent to process your personal information, you have the right to withdraw that consent.
  The Company will erase the items of personal information specified by the customer in accordance with the customer’s request, wherever possible and appropriate.
  However, please note that such erasure may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes.
• Request for interpretation and explanation of our Privacy Policy
  You have the right to request interpretation and explanation of this Privacy Policy.
• Methods for submission of requests
  Customers may submit requests with the following method and contact information.

  • 1) Submission of requests
    (Online)
    Fill out an inquiry form at the Company’s website (https://www7.webcas.net/form/pub/anatchp/form ) to contact the controller of the personal data (see Chapter 1, “12. How and where to submit a request for disclosure, etc.,” “(2) Submitting a request”).

  • 2) Contact Us
    Email: ml_notice_privacy @ anatc.com (Please delete the spaces before and after the @ symbol.)
    Tel: Japan +81-3-6735-5011(charge)
    Please note that this inquiry desk’s e-mail address and telephone number are exclusively for inquiries about the handling of personal information; we will not be able to respond to any other inquiries sent to this address/telephone number.

6. Provision to third parties and transfer to outside of China

The Company will provide customers’ personal information to third parties (including provision to data sharing partners and to entrusted companies involving transfer outside of China) in accordance with the PIPL, etc.

7. Change of purposes of use of personal data

In the case of a change to the purposes of use of personal information, the Company will announce the revised Privacy Policy in advance on the Company website (https://www.anatc.com/privacy_policy/) and the Company will use personal information in accordance with the new purposes of personal information after obtaining consent from customers.

8. Basic information on the controller of personal information

ALL NIPPON AIRWAYS TRADING CO., LTD.
Address: Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan

1. Acquisition and use of personal information

The table below provides the established types of customers’ personal information that could be collected by the Company in the future or that has been so collected in the preceding 12 months. For the purpose established in Chapter 1, “3. Purpose of using personal information,” the Company utilizes these types of customers’ personal information. Also, the Company shall acquire these types of personal information directly from customers.

Types of personal information acquired	Examples of personal information
Identifiers (names, codes, etc. used to uniquely differentiate between specified persons)	The customer’s name, address, telephone number, fax number, mailing address, email address, passport information, ANA Mileage Club membership number (10-digit number), personal online ID, etc.
	Information on the customer’s body or illnesses in relation to boarding, credit card number, payment information including credit/debit card or other details on means of payment, etc.
Characteristics of classification under California state law and federal law	Dietary restrictions, etc.
Commercial information	ANA Mileage Club card type; member service qualification; membership area; mileage status; credit card expiration date; credit card usage history and related information; need for a wheelchair or other special arrangements; flight reservation and cancellation information; boarding status and service use; boarding information and destination from ANA and other airlines; itineraries and other arrangements and details on status of arrangements from other transportation systems; information in communications with customers; contents of inquiries, requests, and opinions; etc.
Information on activity on the internet and other digital networks	Information such as that on how the customer uses the Company’s website and others, including information gained through cookies, advertising identifiers (IDFA and GAID), location information, terminal-specific IDs, OS and browser types and website activity logs
Information on occupation or employment	The customer’s business contact information (company, department, section, position, address, telephone number, fax number), etc.
Sensitive personal information	The customer’s passport details, information on the customer’s body or illnesses in relation to boarding, dietary restrictions, information about whether or not the customer needs any special arrangements, such as that for the use of a wheelchair, and location information

2. Disclosure of personal information

• Sale of personal information
  The Company does not sell customers’ personal information (including the personal information of minors) to third parties and has not sold personal information in the past 12 months.
• Sharing of personal information
  The table below provides the types of customers’ personal information that the Company might share with third parties, the types of customers’ personal information that the Company shared with third parties and the types of third parties with whom the Company shared customers’ personal information in the past 12 months. The Company shall share these types of customers’ personal information for the purpose of holding various events, sending campaign information, and conducting other marketing activities (including personalized advertising). The Company shall not share with third parties any personal information that it recognizes as information on a minor.

  Types of information shared	Examples of personal information	Types of third parties with whom the Company shared customers’ personal information in the past 12 months
  Information about Internet and other electronic network activities	Information such as that on how the customer uses the Company’s website and others, including information gained through cookies, advertising identifiers (IDFA and GAID), location information, terminal-specific IDs, OS and browser types and website activity logs	Ad Network

• Disclosure of personal information for business purposes
  The table below provides the types of customers’ personal information disclosed for business purposes in the past 12 months and the third parties to whom it is disclosed. The Company shall disclose these types of personal information for the purposes as described in Chapter 1, “3. Purpose of using personal information” and “8. Data-sharing concerning personal information.”

Types of personal information disclosed	Examples of personal information	Types of third parties to whom the Company disclosed personal information in the past 12 months
Identifiers (names, codes, etc. used to uniquely differentiate between specified persons)	The customer’s name, address, telephone number, fax number, mailing address, email address, passport information, ANA Mileage Club membership number, etc.	ANA Group companies, companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
All types of personal data subject to California Customer Records Act (Cal. Civ. Code Sec. 1798.80 (e))	Information on the customer’s body or illnesses in relation to boarding, credit card number, payment information including credit/debit card or other details on means of payment, etc.	ANA Group companies, companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
Characteristics of classification under California state law and federal law	Dietary restrictions, etc.	ANA Group companies, companies contracted for handling for ANA flights
Commercial information	ANA Mileage Club card type; member service qualification; membership area; mileage status; credit card expiration date; credit card usage history and related information; need for a wheelchair or other special arrangements; flight reservation and cancellation information; boarding status and service use; boarding information and destination from ANA and other airlines; itineraries and other arrangements and details on status of arrangements from other transportation systems; information in communications with customers; contents of inquiries, requests, and opinions; etc.	ANA Group companies, companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
Information on activity on the internet and other digital networks	Information such as that on how the customer uses the Company’s website and others, including information gained through cookies, advertising identifiers (IDFA and GAID), location information, terminal-specific IDs, OS and browser types and website activity logs	ANA Group companies, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
Information on occupation or employment	The customer’s business contact information (company, department, section, position, address, telephone number, fax number), etc.	ANA Group companies, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
Sensitive personal information	The customer’s passport details, information on the customer’s body or illnesses in relation to boarding, dietary restrictions, information about whether or not the customer needs any special arrangements, such as that for the use of a wheelchair, and location information	ANA Group companies, companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.

3. Sensitive personal information

The Company shall not use or disclose customers’ sensitive personal information for purposes other than certain purposes approved under the CCPA. The Company shall not acquire or process customers’ sensitive personal information for the purpose of inferring the customer’s personal features.

4. Retention of personal information

The Company retains customer’s personal information until the Company achieves the purpose for which it is used, and has established the following retention periods for personal information. With regard to other personal information, the retention period is determined according to the information’s properties and the purpose of retention, with consideration given to such matters as legal and accounting requirements and the operational needs of the Company.

• Personal information on ANA Mileage Club members
  Until the member leaves the ANA Mileage Club
• Personal information on passengers
  Until the transportation and related services are completed as provided for in the Conditions of Carraige for Domestic Passengers and Baggage and the Conditions for Carriage for International Passengers and Baggage.
• Other personal information
  The period necessary for the agreed purpose of use

5. Requests concerning the handling of personal information

Residents of California possess the following rights concerning their personal information.

• Right to request disclosure
  The customer possesses the right to request from the Company the disclosure of the following information in relation to the Company’s acquisition, use, and disclosure of the customer’s personal information a maximum of two times within the 12 months preceding the request (hereinafter “right to request disclosure”).
  • The types of personal information on the customer which the Company obtained
  • Sources by which said personal information was obtained
  • The business or commercial purpose of acquiring said personal information
  • The types of third parties with whom said personal information was shared
  • The specific personal information on the customer obtained by the Company
  • The types of personal information on the customer which the Company has disclosed for business purposes
  • The types of third parties to whom each type of said personal information has been disclosed
• Right to request deletion
  The customer possesses the right to request the deletion of certain personal information obtained from the customer by the Company (hereinafter “right to request deletion”).
• Right to request correction
  The customer possesses the right to request the correction of inaccurate information that the Company has about the person (hereinafter “right to request correction”).
• Right of opt-out of sharing
  The customer possesses the right to request the Company to stop sharing the person’s personal information with third parties (hereinafter “right to opt-out of sharing”).

When exercising the right to request disclosure, right to request deletion and right to request correction among the aforementioned rights, submit your request or make contact as provided below. The Company shall respond to a customer request within a timeframe and manner in accordance with relevant laws and regulations. Requests shall be answered after verifying identity.

1. 1) Submission of requests
   (Online)
   Fill out an inquiry form at the Company’s website (https://www7.webcas.net/form/pub/anatchp/form ) to contact the controller of the personal data (see Chapter 1, “12. How and where to submit a request for disclosure, etc.,” “(2) Submitting a Request”).

   (Tel)
   Japan +81-3-6735-5011
   (Please make a collect call)

2. 2) Means of verifying identity

   <For the individual>
   If the customer exercises the right to request disclosure, right to request deletion or right to request correction, the Company shall first request that sufficient information be provided to verify the customer’s identity (e.g. the customer’s name and email address), then compare the information provided by the customer with the information which the Company already possesses to verify the customer’s identity.

   <For a representative>
   In addition to the identity verification of the individual described under “<For the individual>,” a certificate that states that the representative is authorized to exercise the customer’s right and is signed by the customer must be submitted. In addition, the Company may directly contact the customer for confirmation that the customer has granted the representative the authority to exercise the right to request disclosure, right to request deletion or right to request correction.

When exercising the right to opt-out of sharing among the aforementioned rights, contact the Company through the aforementioned means. The Company shall respond to a customer request within a timeframe and manner in accordance with relevant laws and regulations.

As a rule, the Company does not discriminate in its handling of customers who make requests, such as by altering the provision of service. However, please note that the deletion of personal information may prevent customers from receiving services which customers have been provided with, or may impede the provision of services in accordance with such requests.

1. Introduction

Chapter 5 explains the collection, use, or disclosure (hereinafter, collectively referred to as “handling” in this Chapter) of personal information belonging to customers who reside in the Kingdom of Thailand (“Thailand”) in accordance with the Personal Data Protection Act of Thailand B.E. 2562 (A.D. 2019) (“PDPA”).
If consent is required for handling of personal information relevant to the use of the Company’s services, etc. of a customer who is a minor, person with limited (qualified) legal capacity or legally incapacitated person under the law of Thailand and cannot lawfully give consent by themselves, consent or permission of the person exercising parental power, or the customer’s guardian or custodian (as the case may be), must also be obtained in addition to the consent of the customer. If the customer is under the age of 10, only the consent or permission of the person exercising parental power must be obtained.
If the Company is not aware that the customer is a minor, person with limited (qualified) legal capacity or legally incapacitated person prior to the collection of their personal information, upon learning that we have collected personal information of a minor without the consent of the person exercising parental power (when it is required and the minor cannot lawfully give consent by themselves), or from a person with limited (qualified) legal capacity or legally incapacitated person without the consent of their guardian and custodian, we will delete the personal information at the earliest convenience unless we can rely on other legal grounds apart from consent for such handling.
The customer’s consent to this Privacy Policy must be obtained even in the event that a family member of the customer, or an agent authorized to act on the customer’s behalf, applies for the Company’s service, etc. on behalf of the customer.
In the event that any provisions of this Chapter 5 contradict those of Chapter 1, the provisions of Chapter 5 shall prevail.

2. Controller of personal information

The Company is the controller of the customer’s personal information.
In accordance with the PDPA, the Company safeguards the personal information that is collected and used via controllers (i.e. those who decide the method and purpose for handling the customer’s personal information) and handlers (those who act according to the written directions of controllers).

3. Legal basis for handling personal information

In accordance with the PDPA, the Company safeguards the customer’s personal information by handling it only within the scope required for a specific purpose of use (as provided in Chapter 1, “3. Purpose of using personal information”).
The Company handles the customer’s personal information according to the following legal bases.

• If the customer consents to the handling (PDPA, Article 19): Consent normally only applies to handling related to promotions and marketing, as well as, depending on the situation, handling related to sensitive information.
• When necessary to take measures for the purpose of performing or concluding a contract (PDPA, Article 24 (3)): This normally serves as a basis for handling customer information (such as the customer’s identity, contact information, payment information, or itinerary) that is absolutely essential for the Company to provide a service, etc.
• If the Company must handle the information to comply with a legal obligation (PDPA, Article 24 (6)): This includes the sharing of personal information with bodies such as customs authorities, immigration agencies, and law enforcement agencies, legal obligations to customers or employees of the Company, etc.
• If there is a medical emergency or other need to safeguard the life of the customer or a third party (PDPA, Article 24 (2)).
• If the Company or a third party must handle personal information for the purpose of legitimate interests, and the basic rights relating to the customer’s personal information under laws and regulations do not supersede these interests. (PDPA, Article 24 (5))

This includes the use of personal information necessary for operating the Company’s business, as well as the use of personal information necessary to maintain, develop, and improve the Company’s products and services and to provide the customer with the best experience, within the scope permitted by the PDPA.

4. Requests concerning the handling of personal information

• The PDPA recognizes the following legal rights for the customer.
  • A) Requests for disclosure
    The customer may request a copy of the customer’s personal information in the possession of the Company and details on its handling.
  • B) Requests for corrections and updates
    After reviewing the request, corrections and updates shall be performed, if possible.
  • C) Requests for deletion
    The customer may request the full or partial deletion, destruction or anonymization of the customer’s personal information in the possession of the Company. Upon reviewing the request, the Company shall delete the information if the information is unnecessary or the law precludes the continued storage of the information.
  • D) Forwarding personal information
    The customer may request a copy of personal information that is structured and in a generally machine-readable format. The request to forward personal information may be made only with respect to personal information obtained from the customer by the Company that is handled by automated means based on the consent of the customer or for the purpose of performing a contract.
  • E) Formal objections to handling
    The customer may voice an objection to handling that is for the legitimate interests of the Company or a third party, or handling that is for the purpose of direct marketing. The Company shall discontinue the handling of the customer’s information, provided that the handling for the legitimate interests of the Company or a third party does not have a provable legitimate basis that prioritizes the interests of the customer. If the customer’s objection is against direct marketing, the Company shall discontinue handling.
  • F) Limitations on methods of using personal information
    The customer may limit the use of the customer’s personal information by the Company under specific circumstances. If a limitation is applied, the handling of the customer’s personal information (excluding storage) shall be performed legitimately, provided that the customer’s consent is obtained or that doing so is necessary for a legal claim, protecting specified rights, or for the sake of an important public good.
  • G) Right to withdraw consent
    If the customer’s personal information is handled with consent, the customer possesses the right to withdraw consent at any time. However, the withdrawal of consent shall not retroactively affect the handling of the customer’s personal information for which they had already legally consented prior to the withdrawal of such consent.

  Note that the aforementioned right is not absolute and that it does not necessarily apply to all situations. In addition, depending on the circumstances, if a legal exception applies, then a request may be refused. If a request is refused, the reason therefore shall be provided with the response.
  Records of requests to the Company shall be kept so as to enable confirmation of the Company’s compliance with legal obligations.

• Submitting a request

  The customer may exercise rights at no cost (unless the Company is permitted under the PDPA to charge the customer a fee). Below are the method for submitting a request and contact information.
  (Web)
  Fill out an inquiry form at the Company’s website (https://www7.webcas.net/form/pub/anatchp/form ) to contact the controller of the personal data (see Chapter 1, “12. How and where to submit a request for disclosure, etc.,” “(2) Submitting a request”).

• Responses to a request

  After receiving a request from the customer, the Company shall normally respond within one month. In addition, the Company may, as necessary, request identity verification or proof of authority to submit a request as a representative (in the event that the customer makes the request through a third-party representative). If the request is especially complex or there are multiple requests, a detailed response may take time. In addition, please note that there are exceptions to the aforementioned rights and there may be cases in which rights cannot be exercised.
  If the customer is not satisfied with the Company’s response to a request, or if it is believed that personal information has been handled inappropriately, the customer possesses the right to file a complaint with the Personal Data Protection Committee of Thailand. For further details, see Chapter 5, “9. Lodging a complaint with an authority.”

5. Data sharing necessary to provide products and services

The Company’s products and services may be provided with the cooperation of other companies or organizations, and may involve the sharing of personal information with third parties in order to carry out operations. These third parties include the following:

• ANA Group companies
• Bodies with which the sharing of personal information is obligatory under laws and regulations: Governmental organizations, law enforcement agencies, courts, customs authorities, immigration agencies, third-party bodies, etc.
• Service providers: Companies contracted for handling for ANA flights, partner airports and airlines, service providers, marketing partner companies, etc.

If the Company entrusts a service provider with handling data, personal information shall be handled in accordance with an agreement that fulfills the requirements of the PDPA.

6. Marketing communication

The Company sends marketing information as needed in order to inform customers who wish to receive news and details about products and services. Information is only sent to customers who consent to receiving marketing information.

7. Retention and transfer of personal information

The Company is located in Japan. Many of the service providers and other organizations with whom the personal information of customers is shared are located within jurisdictions outside of Thailand.
When the Company provides personal information to a third party, it occurs in compliance with the requirements of the relevant laws and regulations of Japan and the PDPA. However, note that in countries outside Thailand, the personal information of customers may not be equally protected under domestic law. If a customer wants further information on where their personal information is retained or to whom it is transferred, the customer should use the contact information provided in Chapter 1, “14. How and where to submit a request for disclosure, etc.”

8. Retention of personal information

The Company retains customer’s personal information until the Company achieves the purpose for which it is used, and has established the following retention periods for personal information. With regard to other personal information, the retention period is determined according to the information’s properties and the purpose of retention, with consideration given to such matters as legal and accounting requirements and the operational needs of the Company.

• Personal information on ANA Mileage Club members
  Until the member leaves the ANA Mileage Club
• Other personal information
  The period necessary for the agreed purpose of use

Please note that the Company may retain the customer’s personal information for a longer period than mentioned above if it is for the purpose of filing legal claims or raising the defense of legal claims, or the purpose for compliance with laws and regulations.

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal data with the Personal Data Protection Committee of Thailand.

10. The contact information of Controller of personal data and data protection officer

Controller of personal data: ALL NIPPON AIRWAYS TRADING CO., LTD.
Address: Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan
The Company’s data protection officer: ml_notice_privacy @ anatc.com (Please delete the spaces before and after the @ symbol.)
Please note that this e-mail address is exclusively for inquiries about the handling of personal information; we will not be able to answer any other inquiries sent to this address.