Privacy Notice

AIR INDIA PRIVACY NOTICE

Air India Limited values your privacy. Our privacy notice (“Privacy Notice") applies to all the Personal Data we gather, and you share with us when you visit our websites, use our apps, and utilise any services provided by Air India, including our loyalty programme and live chat options. Once you choose to provide us with Personal Data, Air India will only use your information in accordance with this Privacy Notice.

This Privacy Notice is issued on behalf of Air India Limited and is hereinafter referred to as “Air India”, “we”, “us”, or “our” in this Privacy Notice. Air India is the Controller or data fiduciary and is responsible for this website.

To provide you with our services, we as Controller may process (including collect, store, and transfer) your Personal Data.

We may also collect your personal data from other airlines for the purpose of code sharing. Each party shall act as an independent Controller. Please note that other airlines have their own privacy policies. Air India recommends that you read the policies of other airlines if your travel plans include travel with them, as those policies may differ from Air India’s.

If you have any questions or comments, please contact our Data Protection Team/Data Protection Officer as per the details available in Section XV of this Privacy Notice.

I. Terms used in this Notice

In this Privacy Notice, the following terms shall have the meanings as ascribed to them below:

  • Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing of Personal Data.
  • Personal Data means any information about an individual that can be used to identify them – for instance, name, contact information, Government-issued identification number, etc.
  • Process or Processing means any operation(s) performed on Personal Data, including collection, recording, structuring, storage, use, sharing, disclosure, dissemination, restriction, erasure or destruction.

II. The Types of Personal Data We Collect and Process

As per Air India’s business practices, we currently collect and process Personal Data, which includes:

  • General Personal Data: We collect your Personal Data during the course of account creation on our website/application as well as while booking our services. This information includes your title, full name, phone number, gender, email ID, date of birth, address, and nationality.
  • Travel Information: To facilitate your bookings with us, we process your flight details, Booking Reference Number (PNR), ticket number, baggage details and baggage tags, booking ID and any interactions with our staff during your journey, etc.
  • Financial Information: This information includes payment data, transactional data, masked credit/debit card information, bank account number, GSTIN, etc.
  • Identification Document/Information: We may collect advance passenger information such as visa details, passport details or identity card details, including your identification document number, the country it was issued in and the expiry date (if applicable).
  • Health Information: To offer better services to you, we may collect certain health information such as allergies, medical information, disabilities, health notes, etc.
  • Information related to Children: We only process the Personal Data of minors with the prior consent of their parents or legal guardians. ID cards issued by colleges/universities are used for fare assessment (Please refer to Section IV for more details.)
  • Location and Device Information: This information includes your device location (where you have permitted access to such location), operating system, IP address, browser information, etc.
  • Loyalty Account: This information includes your Maharaja Club account number, tier level, points and miles data, your preferences and hobbies, language preferences, address information etc.
  • Details Pertaining to the Services Booked with Us: During our interactions and to facilitate the services you have booked with us, we may gain insight into some Personal Data, such as your mode of booking, onward travel details, meal preferences, travel preferences, check in date and time, seat upgrades, excess baggage, Wi-Fi usage, etc.
  • Queries and Feedback: This includes the data you choose to share with us by means of interacting with our social media pages or our chatbot, or by completing a flight satisfaction survey.
  • Recruitment Data: In case you apply to any of our openings, we shall process your Personal Data to assess if you are suitable for the position. In such scenarios, we shall collect your educational qualifications, professional history, contact details, etc.
  • In case you share Personal Data with us which relates to another person provisioning a service from us, you are responsible for ensuring the person knows and has consented to us collecting and processing their Personal Data in accordance with the provision of this Privacy Notice.

Subject to applicable laws, we may monitor or record your phone conversations for training and customer service purposes, to comply with relevant legal obligations, and to make and defend claims. If you visit one of our Reservations and Ticketing Offices or an Air India Lounge, you may be monitored by closed-circuit television for security purposes.

We also collect, use, and share aggregated data such as statistical or demographic data for various purposes. Aggregated data could be derived from your Personal Data but is not considered Personal Data under law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website, mobile application, or service feature. However, if we combine or connect aggregated data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Privacy Notice.

Where we need to collect Personal Data by law, or as part of the services offered by us, and you fail to provide that data when requested, where permitted by applicable law, we may not be able to provide the service you are trying to avail.

III. How we Collect/Receive Personal Data and the Use of such Personal Data

We use different methods to collect Personal Data about you, including through:

Direct Interactions: You may give us your Personal Data by filling in forms or corresponding with us by phone, email, on our website, through live chat, or otherwise. This includes Personal Data you provide when you:

  • Apply for or use our products or services.
  • Interact with ticketing counters and airport operations.
  • Apply for job openings available at Air India.
  • Create a loyalty account on our website or app.
  • Use our live chat option “Ask AI.g”.
  • Subscribe to our service or publications.
  • Request marketing communications to be sent to you.
  • Enter a competition, promotion, or survey.
  • Give us feedback or contact us.

Indirect Interactions: We may receive your Personal Data from third parties such as:

  • When you book our services using travel agents or third-party websites
  • Airport kiosks
  • Payment service providers
  • Partner Airlines and cooperation partners (such as Star Alliance Network)
  • Our loyalty partners
  • Our affiliates to provide you with services in case of our merger or amalgamation.
  • Referees and recruitment agencies in case you have applied with us for any job openings.

Automated technologies or interactions: As you interact with our website or our services, we will automatically collect technical data about your equipment, browsing actions, and patterns. We collect this Personal Data by using cookies, server logs, and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our Cookie Policy for further details.

IV. Purpose of Processing and Lawful Basis:

We may only process your Personal Data within the frameworks of the national and international data protection laws and regulations, and within the scope of the purposes listed below.

Fulfillment of our services:

We may process your Personal Data in order to provide the services you book with us. A contract exists between you and Air India when you utilise our services by booking a flight or cargo on our website, application or through any third party. In order to fulfill our services, we shall process your Personal Data for the purposes of identity verification, reservations, check-in, and cargo management.

In this respect, information may also be processed for providing ancillary services including but not limited to additional baggage reservation, seat preference, meal preference, cargo management, provision of wheelchair assistance and facilitate duty-free purchases.

We may also process your Personal Data to send communications relevant to the services you have opted for through us, such as flight tickets, gate change communication, changes to the flight plan, etc.

The legal basis for the above-mentioned processing is the performance of a contract with you and taking steps at your request prior to entering into a contract. Please note that in some jurisdictions, we may carry out the above-mentioned processing activities only based on your consent. If you withhold your consent, we may not be able to provide you with the requested services.

If you make a meal choice while travelling with us, you may provide us with additional Personal Data, such as when your choice may be used to infer your religion or health data. You may also provide us with Personal Data while submitting any health-related data (such as your vaccination certificate or any medical certificate), or when requesting any special assistance (such as the use of a wheelchair). We only process this information based on your consent, and solely to provide you with the services you have requested and assist you during your travel with us.

To carry out marketing activities:

We may process your Personal Data to carry out our marketing campaigns by sending you personalised offers and newsletters through various channels such as email, WhatsApp, Short Message Service (SMS), Rich Communication Service (RCS), push notifications or any other communication channel. We shall send such marketing communication only when you have opted-in or subscribed to receive them. You may opt out or unsubscribe from marketing emails through the unsubscribe link provided. Alternatively, if you are a Maharaja Club Member, you may update your marketing preferences through your account settings at any time. Additionally, you may also reach out to us at the details mentioned in Section XV to opt-out of such communications.

We may also process your Personal Data to carry out targeted or personalised advertisement on our websites or mobile applications to show personalised offers and products to you. We may profile you on the basis of the information you provide to us and automated decisions maybe made from such profiling activities to send you offers which may be relevant to you.

Please note: Opting out of receiving the marketing emails shall not stop our transactional communications sent for services availed with us.

The legal basis for the above-mentioned processing is your consent.

To detect and prevent fraud:

We may process Personal Data for the purpose of detecting, monitoring and preventing fraudulent activities including identity verification and transactions while receiving payments and during insurance claims.

The legal basis for the above-mentioned processing is our legitimate interest.

To improve our products and services:

We may analyse your Personal Data in order to understand you better and develop and improve our products and services. We may also send survey links, make calls and invites for usability testing and interviews to receive feedback from you on the services you have used from us. If you do not wish to receive the survey links from our side, you can raise a data subject request for the right to object.

The legal basis for the above-mentioned processing is our legitimate interest to improve our services.

To manage our loyalty programme:

We process your Personal Data to manage your Maharaja Club account with us. The processing shall be in accordance with the Maharaja Club terms and conditions We shall also process your data to determine offers and provide personalised services based on your tier. If you have shared your address information with us, we may use it to send gifts and hampers to you.

At times, the Personal Data may be processed to manage your flying points upon conducting transactions with our loyalty partners and affiliate members.

The legal basis for above-mentioned processing is the performance of contract with you and to take steps at your request prior to entering into a contract. Please note that in some jurisdictions, we may carry out the above-mentioned processing activities only based on your consent. If you withhold your consent, we may not be able to provide you with the requested services.

To manage your requests and complaints:

We may process your Personal Data under circumstances where you have initiated contact with us for queries, requests, or to address any grievances or feedback you may have pertaining to the services you have opted for.

When you call our customer service centre, we may record the calls to assess and make any necessary improvements within our services.

The legal basis for the abovementioned processing is the performance of contract. Please note that in some jurisdictions, we may carry out the above-mentioned processing activities in our legitimate interest.

To manage any dispute and defend our legal claims:

We may process your Personal Data in order to defend our legal claims in court. Additionally, we shall process your Personal Data in accordance with any tax and legal obligations.

We may be required to disclose your Personal Data in case of legal disputes or if queries are raised by authorities in order to prevent, investigate or prosecute crimes including identity fraud, terrorism, etc.

The legal basis for the above-mentioned processing is our legal obligation.

Flight planning and management:

We may process your Personal Data in order to plan and manage our fleet efficiently, which includes scheduling, route optimisation and crew allocation. This helps us to ensure better operations along with minimal disruption to passengers while using our services.

We may also process Personal Data to audit, monitor and improve our internal processes for smooth functioning of our website, mobile application, and internal procedure.

The legal basis for the above-mentioned processing is our legitimate interest to improve our services.

Processing job application:

We shall process your Personal Data in order to process the job applications submitted by you either through our website or through third-party agents or recruitment agencies.

The legal basis for the above-mentioned processing is your consent.

V. Personal Data of Minor

Due to the nature of our services as an airline, we may collect travel information, which may include Personal Data of persons below the age of majority (“Minor”) when it is required to comply with the law, or as otherwise required to provide transportation needs and services. For instance, Air India may offer special discounts to minors for which we need to assess fare eligibility, including verification at check-in, and sharing of data to another airline if a transfer is involved, or we may process minor data for transport of unaccompanied minor.

If you are a minor, you may use our services only with the involvement of a parent or authorised guardian. If Personal Data related to minors has been collected without the consent of their parents or legal guardians, the parents or authorised guardians have the right to object to processing and/or request deletion of such Personal Data (Please refer to Section VIII for more details on how to exercise these rights).

VI. Who We Share your Personal Data With

We may share this information with:

  • Other companies in the Air India Group, such as Air India Express.
  • Customs, border control, security, anti-terrorism and immigration authorities, which require by law access to booking and travel itinerary information.
  • Our marketing or advertisement partners for sending marketing communications.
  • Other airline partners, and partners connected with our Loyalty Programme, insurance companies, and payment gateway providers.
  • Our Service providers including those who are acting as our agent or sub-contractor, including, global distribution systems, ground handling service providers, caterers, credit card and credit reference agencies, campaign managers, IT and system administration services providers, and data analytics service providers.
  • Our legal and other professional advisors, including lawyers, bankers, auditors, and insurers.
  • Third parties in connection with financing, securitisation, insuring, restructuring, assignment or other disposal of all or part of our business or assets or in relation to defence of claims.
  • Official authorities, including law enforcement, governmental and regulatory authorities, including health authorities: (a) if we believe disclosure is required by any applicable law or regulation; (b) to protect and defend our rights, or the rights or safety of third parties; or (c) where it is in your interest.
  • Passengers travelling under the same booking as you, where you have made a travel booking.
  • Third parties we have onboarded for crisis and disaster management.
  • Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.
  • For recruitment purposes, we may also transfer your Personal Data to third-party service providers including but not limited to recruitment agencies, background verification agencies, and IT system providers.

VII. How we Retain and Erase your Personal Data

We retain your Personal Data for varying durations based on the category of Personal Data and our relationship with you. We shall delete, destroy, or anonymise your Personal Data once the purposes for processing cease, unless there is regulatory requirement or for defence of legal claims which allows the retention of such Personal Data. When erasing Personal Data, we will take commercially reasonable and technically possible measures as prescribed under applicable laws to make the Personal Data irrecoverable or irreproducible in accordance with the applicable laws.

VIII. Your Data Protection Rights

You have certain rights in relation to your Personal Data and how we process it, depending upon the jurisdiction you are in.

You have the following rights irrespective of the jurisdiction you belong to:

  • Right to access: The right to request copies of the Personal Data we hold about you at any time, or that we modify, update, or delete such data. This includes access to information about the processing, such as purpose, categories of data and recipients, duration of the processing, data subjects’ rights and appropriate safeguards in case of third-country transfers.
  • Right to rectification: The right to have your Personal Data rectified or updated if it is inaccurate or incomplete. Depending upon the nature of the request, you may be able to update certain sets of Personal Data on your own. For instance, if you are a Maharaja Club member, you can self-modify your phone number and email ID through the profile section of your account.
  • Right to erase: The right to request that we delete or remove your Personal Data from our systems.
  • Right to withdraw consent: The right to withdraw previously given consent to process your Personal Data.
  • Right to complain to supervisory authorities: If you wish to make a complaint or are unhappy with the way we process your Personal Data, you have the right to complain to the appropriate supervisory authority in your jurisdiction. However, we would suggest utilising our grievance redressal mechanism or writing to the Data Protection Officer before reaching out to the supervisory authorities.

If you belong to India, you have certain additional rights. The same has been listed below:

  • Right to nominate another person: You have the right to nominate any individual to act on your behalf in case of your death or incapacity to exercise applicable rights.

Depending on the jurisdiction you belong to, you may have certain additional data subject rights available to you such as:

  • Right to restrict our use of your Personal Data: The right to limit the way in which we can use or process your Personal Data.
  • Right to data portability: The right to request that we move, copy, or transfer your Personal Data to another data Controller in a machine-readable format.
  • Right to object: The right to object to our use or processing of your Personal Data including where we use it for our legitimate interests.

Please contact us at data.privacy@airindia.com if you wish to make a request for exercising the above rights or if you have a grievance related to the processing of your Personal Data. To help us confirm your identity and to ensure that the Personal Data is only disclosed to authorised individuals, we may request your full name, Maharaja Club ID, email ID, phone number or any other information required by us. If you are raising a data subject request on behalf of another individual, such requests shall be accompanied by appropriate proof of identity of the requester, details of relationship with the person on whose behalf the request is being made and proof of authority for making such a request.

Please note that in certain circumstances where we are legally permitted, we may not be able to honour your data subject requests, such as for establishment, exercise or defense of our legal claims, or where your request may infringe on someone else’s rights, or for compliance purposes as per relevant laws. If we refuse your request, we will inform you the reasons of such refusal within 7 business days.

IX. Existence of Automated Decision-Making such as Profiling

We may engage in automated decision-making using your Personal Data for marketing purposes in accordance with applicable laws. You have a right to object to such automated decision-making in certain instances, depending on applicable laws. Kindly refer to Section VIII to understand how to exercise your rights.

X. Links

For your information and convenience, our website or mobile application, may contain links to other websites or platforms that are managed by third parties. Please be aware that we are not responsible for the privacy practices of such third parties, and we encourage you to read the privacy statements of all websites or applications that collect your Personal Data.

XI. Cross Border Transfer of your Personal Data

We are an organisation based out of India, so your Personal Data shall be transferred outside the country where you are located. Your Personal Data may also be transferred to our offices, authorised agents, our partners to facilitate your travel with us. For example, we transfer your Personal Data with our business partner wherein you have booked a codeshare flight for your travel. We may also share your Personal Data with our processors and service providers.

We ensure that all cross-border data transfer complies with applicable data protection laws, and is safeguarded by appropriate contractual and technical measures, including the use of binding contractual obligations. For instance, if you are based in the EU, we rely on standard data protection clauses that are approved by the European Commission for the transfer of Personal Data outside the European Economic Area.

XII. Security

We strive to do our best to protect your Personal Data and undertake all appropriate technical and organisational measures to ensure the same. We constantly review our security practices to mitigate any risk arising out of unauthorised access, accidental data loss, or damage to your Personal Data.

Our security practices are in alignment with the industry-best practices, including storing your account details and Personal Data on secure servers and conducting regular security and privacy trainings for our employees to make them understand their responsibilities in looking after your information.

XIII. Notification of Breach

If you suspect any misuse or loss or unauthorised access to your Personal Data, please let us know immediately by contacting us via the contact details given in this Privacy Notice as provided in Section XV.

XIV. Changes to this Privacy Statement

We may amend the Privacy Notice and update the effective date when this Privacy Notice is updated. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

XV. Privacy Contact Information

If you have any questions regarding our Privacy Notice or if you want to exercise any of your rights, you can do so by contacting our Data Protection Officer at data.privacy@airindia.com.

XVI. Cookie Usage

Air India uses cookies to improve your experience of using our website. Please refer to our Cookie Policy for additional details.

March 2025