Supplementary Notice for Korean Users
Supplementary Notice for Korean Users
If you are resident in South Korea, we are legally required to make you aware of the matters set out in this section.
Please note that the GDPR term “personal data” and “personal information”, which is used in this section, are synonymous.
Notification about the collection and use of personal information
Purpose of collection and use of personal information |
Items of personal information to be collected and used |
Retention/use period |
|---|---|---|
Facilitating and provision of travel, ancillary and related services |
Full name, date of birth, contact details, passport details, nationality, your itinerary, payment information, order history, PNR |
Up to 10 years after the end of travel or provision of the relevant services. |
Assessment and Verification of identity; regulatory purposes, including sanctions screening; medical clearance |
Full name, contact details, travel documents, date of birth, payment and credit information, meal preference, baggage details, health information, correspondence with us |
7 years after the date of the activity, unless a longer period is required by law. |
Dealing with requests, questions and complaints |
Personal information necessary to address the relevant request, question or complaint including full name, PNR, contact details, ticket number, frequent flyer number, country of residence, baggage information, special requests, health information, voice recording, CCTV images |
8 years after the date of the relevant activity. Subject to local regulations, the record may be maintained for a longer duration. |
Administration and management of your account, including Privilege Club account |
Full name, email address, title, telephone number, gender and date of birth, address, any other information you have added to your account (including related to your nominated family members, guests or travel co-ordinator) login data, display name, role, the details of your purchases and transactions and payment details |
Personal information is retained until the account holder requests deletion of the account to which the personal data relates. Some personal data are retained for up to 7 years post deletion, if required by law. |
Service development and improvement |
Name, date of birth, contact details, payment and credit information and any correspondence with us, IP address, web browsing activity, answers provided to surveys, including age, gender and travel destination preferences |
To the extent the information is personal information, that information is retained indefinitely until the individual requests its deletion. |
If there is an emergency |
Name, address, telephone number, gender, nationality, passport number, and name, address and contact details of nominated emergency contact and next of kin |
For a period of 7 years after the event or such period as may be required by law. |
With consent, information about special offers, news and marketing communications |
Name and email address, your disclosed and inferred preferences and interests, shopping history; web browsing activity |
Personal data information is retained indefinitely until the individual requests its deletion. Campaign data is deleted within 24 hours |
Management of the business of the Qatar Airways Group |
Contact details; personal details such as name and date of birth, payment and credit information, payment and order history, correspondence with the Qatar Airways Group, data generated during the performance of any agreement between you and the Qatar Airways Group such as a passenger transport contract; the information you provide when responding to our surveys |
To the extent the information is personal information, that information is retained indefinitely until the individual requests its deletion |
Outsourcing of personal information processing
To facilitate effective processing of personal information, Qatar Airways outsources certain activities as follows:
Name of outsourced processing party |
Outsourced activities |
|---|---|
Amadeus IT Group S.A |
Flight booking and retention of Privilege Club membership information for the purposes of enrolment and transacting on the account. |
PROS Holdings Inc. |
Flight forecasting, optimizing, and reporting |
Oracle Corporation (Responsys) |
Various digital marketing and acquisition activities |
Sitecore Ireland Limited |
Customer profiling and personalisation |
Qualtrics, LLC |
Customer surveys |
Adobe Systems Software Ireland Limited,
|
Web and App analytics |
Vibe Systems Limited |
Provision of a web-based booking engine and content management system and e-commerce platform |
J2 Martech Corp (i-contact) |
B2B - Electronic newsletter distribution |
ETrawler Unlimited Company (Cartrawler) |
Referral of individuals and agents to car rental and mobility solutions |
Plaza Premium Lounge Management Limited |
Airport hospitality experiences and passenger service solutions |
Bagpoint BV |
Luggage transport service |
Accelya Holding World S.L. Unipersonal |
Payments processing; billing and Settlement Plan (BSP) services |
Salesforce, Inc. |
Customer relationship management |
Al Jazeera Printing Press Co. L.L.C |
Membership card fulfillment |
Points.com Inc. |
Avios points transactions |
Cross-border Transfer of Personal Information
Qatar Airways transfers personal information to processers located overseas as per the table below.
Name of recipients |
Contact information of the person in charge of the management of personal information |
Items of the personal information to be transferred |
Countries where the personal information is to be transferred |
Purposes of use |
Retention/use period |
|---|---|---|---|---|---|
AMADEUS IT GROUP, S.A |
dataprotection@amadeus.com |
· Flight Booking Information: Privilege Club membership number, name of passenger, date of birth, gender, phone number, email address, payment information, travel document details, travel itinerary · · Membership Information: Privilege Club membership number, name, date of birth, gender, telephone number, Avios points balance ·
|
· · EEA
|
Flight Booking Information: Retention of booking records in Qatar Airways booking system
Privilege Club Membership Information: Retention of frequent flyers information for the purposes of enrolment and transacting on the account
|
· Flight Booking Information : five years after the booking · · Membership Information : until cancellation of membership account
|
Salesforce.com,Inc |
Privilege Club Number, name, date of birth, contact info, email |
EEA |
Customer Relationship Management |
Personal information is retained until the account holder requests deletion of the account to which the personal data relates. Some personal data are retained for up to 7 years post deletion, if required by law. |
|
Adobe Systems Software Ireland Limited |
askprivacy@adobe.com, |
Online website tracking (cookies), language, Location using IP address, PNR metric use, attribution and commision payments to partners and PC Number for instances of customer redemption, issue resolution. |
Adobe Regional Data Collection Centers (RDCs) hosted in AWS world-wide locations and Adobe Data Processing Centers in (Oregon USA, London, Singapore (Asia Region). |
Web Analytics Processing |
For period commensurate with the term of the contract with outsourced service provider. In case of contract expiry, the data will be deleted within 30 days from the date of contract expiry or termination. |
PROS Holdings Inc. |
privacy@pros.com |
PNR, contact number, email address, name, ender; date of birth travel details such as date of travel, origin and destination, travel document details, credit card information, ticket number |
United States and EEA |
Flight forecasting, optimizing, and reporting |
Up to 10 years from creation of the data. |
Oracle Corporation |
Oracle Corporation Global Data Protection Officer Willis Tower 233 South Wacker Drive 45th Floor Chicago, IL 60606 U.S.A. |
Name, date of birth, email address, travel itinerary, online website tracking information, language, customer type, loyalty details, nationality, profession |
In accordance with Data Processing Agreement for Oracle Services (“Data Processing Agreement”) |
Digital marketing and acquisition activities |
Record is maintained for as long as the individual does not request to delete the account to which the personal information relates. |
Sitecore Ireland Limited
|
Names, date of birth, nationality, contact information, login data, IP address, online website tracking information, travel itinerary, language, job details, booking details |
EEA |
Digital marketing and acquisition activities |
For period commensurate with the term of the contract with outsourced service provider. In case of contract expiry, the data will be deleted within 30 days from the date of contract expiry or termination. |
|
Qualtrics, LLC |
privacy@qualtrics.com |
Name, date of birth, email address, contact number, travel document details, travel itinerary and other details, ticket number, customer ID, PNR, Privilege Club number |
EEA |
Voice of Customer Survey using Qualtrics Platform |
For period commensurate with the term of the contract with outsourced service provider. In case of contract expiry, the data will be deleted within 30 days from the date of contract expiry or termination. |
Vibe Systems Limited |
data.protection@ppgroup.travel |
Name, date of birth, drivers licence, passport details, address, telephone number email address, Privilege Club Number, employer details |
EEA |
Provision of a web-based booking engine and content management system and e-commerce platform |
Up to 4 years from the date of the booking. |
J2 Martech Corp |
privacy@icontact.com |
Name, email address |
US, EEA |
B2B - Electronic newsletter distribution |
Manual deletion based on end-customer request. |
ETrawler Unlimited Company |
dpo@cartrawler.com |
Name, date of birth, email address, contact number, credit card information, travel details, online website tracking information |
EEA |
Referral of individuals and agents to car rental and mobility solutions |
7 years after date of transaction. |
Plaza Premium Lounge Management Limited |
Privacy Data Officer – Plaza Premium Lounge Management Limited, 8/F Commercial Building, Airport Freight Forwarding Centre, 2 Chun Wan Road, Lantau Hong Kong. |
Name, email address, contact number, travel document details, credit card information, travel details, online website tracking information, certain personal data about family members (name, contact details) |
Hong Kong and location of relevant lounge/facility |
Airport hospitality experiences and passenger service solutions |
In accordance with Plaza Premium Lounge Management Limited Privacy & Security Policy |
Accelya Holding World S.L. Unipersonal |
privacy@accelya.com |
Name, email id, card number (credit/debit), card expiry date, flight details and DOB (in case of CHD/INF) and contact number |
India and Spain |
Payment processing; to perform transaction level reconciliation between sales and collections. |
10 years after the date of transaction |
Al Jazeera Printing Press Co. L.L.C |
Manager – Digital Accounts and IT P.O. Box 55347 Doha Qatar |
Full name, language preference, contact data, Privilege Club membership information (Privilege Club number, member tier and expiry) |
Qatar |
Printing and fulfilment of membership cards |
Within 1 month after fulfilment of membership card |
Points.com Inc. |
dpo@points.com |
Full name, contact details, billing address, payment information, program member ID(s), other program identifiers, transaction history, transaction particulars |
Canada, United States |
Buy, Gift and Transfer Avios points |
Retained until deletion of member account |
Retention and destruction of personal information
Qatar Airways will destroy without undue delay personal information processed once such personal information becomes unnecessary, including by reason of expiration of the retention period or satisfaction of the processing purposes.
If Qatar Airways continues to retain personal information under certain laws despite expiration of the retention period or satisfaction of the processing purposes, Qatar Airways will retain the personal information for a period prescribed under the relevant laws, examples of which are set out below. In this case Qatar Airways will ensure that the personal information is transferred to a separate database or any other separate place for its retention.
Applicable personal information |
Reason for retention (Relevant laws) |
Retention period |
|---|---|---|
The computer communications or Internet log records, and the data on tracing a location of connectors |
Protection of Communications Secrets Act (Korea) |
3 months |
Records on processing of consumer complaint or dispute resolution |
Consumer Protection in Electronic Commerce (Korea) |
3 years |
Records regarding contract or withdrawal from contract, Records regarding payments and provisions of goods |
Consumer Protection in Electronic Commerce (Korea) |
5 years |
Accounting books, registers and documents relating to commercial activities conducted in the State of Qatar |
Law No. 21 of 2009 The Income Tax Law (Qatar) |
10 years |
The procedures and methods of destroying personal information are as follows.
1. Destruction procedures
Qatar Airways will select such personal information subject to destruction and upon the approval of the Data Protection Officer (which may be by way of delegated authority under the retention policy), will destroy the personal information.
2. Destruction methods
Personal information recorded in an electronic form will be destroyed by any technological method which renders restoring the records impossible. Personal information recorded and saved in a physical form will be destroyed by shredding otherwise securely destroying the records.
