Flying Blue Privacy Policy
In this privacy policy, we explain how we collect and use your personal data in
relation to our Flying Blue loyalty programme. This privacy policy applies to all
personal data that Air France and KLM process if you become a member to our
Flying Blue loyalty programme, use our Flying Blue website or mobile apps, or
contact us. We process your personal data primarily to take care of yourmembership and let you benefit from rewards. We may also use your data to send
you advertisements and offers tailored to your interests and preferences. In thisprivacy policy, we provide more information about the personal data we collect anduse and what your rights are.
For more information on the personal data that Air France or KLM process if you fly
with us, use our airline website or mobile apps, or contact us about your booking or
flight, please check the privacy policy of Air France or KLM, which is available on our
websites.
1. Who we are
Flying Blue is the loyalty programme of:

Air France (formally Société Air France, S.A.), a French airline with offices
at 45, rue de Paris, F-95747, Roissy CDG Cedex, France (‘Air France’).
Koninklijke Luchtvaart Maatschappij NV (also known as KLM Royal Dutch
Airlines or KLM), a Dutch airline with offices at Amsterdamseweg 55, 1182
GP in Amstelveen, The Netherlands (‘KLM’).

We are jointly responsible for the processing of your personal data concerning
the Flying Blue loyalty programme. We have an arrangement in place that setsout our respective responsibilities for complying with applicable privacy
legislation. In short, we have agreed that you can contact either KLM’s or Air
France’s Privacy Office (please see ‘Your rights’ below) if you wish to exercise
your rights or have any complaints about the processing of your personal data.
Air France and KLM will assist each other where necessary to ensure that you
can exercise your rights and your questions and complaints are properly
addressed.
2. Types of personal data we process
2.1 General
We may collect and process the following categories of personal data:

(A) Name and contact details
When you become a member of Flying Blue, we may record your name, contact
details, gender and date of birth. Your contact details may include your address,
telephone number and e-mail address. When you create a personal account, we
may also record your sign-in details and the information you fill out on yourpersonal account. If you create a family account, we also process the personal
data about your family that you add to your account.
(B) Membership data
When you become a member of Flying Blue, we process your membershipnumber, membership tier, and Miles and XP balance. We also process thetransactions with which you earn or spend Miles. We register, amongst others,
the type of transaction (e.g. webshop purchase, flight, hotel, car rental, Flying
Blue branded credit card transaction), transaction date, Miles or XP amountearned or debited, and vendor (Air France, KLM , participating airline or Flying
Blue partner). For flights, we also register your place of departure, destination,
travel date, flight number, booking class, cabin and fare paid.
(C) Our communication with you
When you send us an e-mail or chat with us online or via social media, weregister your communication with us. We also register your communicationpreferences, for example when you subscribe to one of our newsletters. When
you call us, our customer support will register your questions or complaints in our
database. We may also record telephone calls for training purposes or to preventor combat fraud.
(D) Information we collect when you use our websites or mobile apps
 When you visit our website, we may register your IP address, browser type,
operating system, referring website, web-browsing behaviour and app use.
 We also collect information via cookies and similar technologies when you
visit our website. For more information please read our cookie policy on thewebsite. If you visit our website via a link in an e-mail or when you are logged
in to your Flying Blue account, we may link the information we collect via
cookies and similar technologies to other data we process about you.
 We receive an automatic notification when you open our e-mails or click on alink in such e-mails. We may combine this information with other data weprocess about you, such as your membership information.
 With your permission, we may also receive your location data.
 You can also agree to provide us with access to certain data stored on yourmobile phone (such as photos and contacts).

(E) Information in relation to social media
Depending on your social network settings, we may receive information from yoursocial network provider. For example, when you sign in to your Flying Blueaccount using a social network account, we may receive your social network
profile including your contact details, interests and contacts. For more informationon the personal data that we receive from your social network provider and how
to change your settings, please check the website and privacy policy of yoursocial network provider.
(F) Customer data
Flying Blue is a loyalty programme of Air France and KLM. We may use thepersonal data we collect for our Flying Blue loyalty programme if you fly with us,use our airline websites or mobile apps, or contact us about your flight. Pleasecheck the Air France privacy policy and KLM privacy policy for more informationon the personal data we collect in this context. You can find our privacy policies
on our websites.
(G) Information you choose to share with us
You may choose to share information with us, for example when you share yourinterests and preferences with us, leave a comment on our Facebook page, fillout a customer survey or submit an entry for a contest.
2.2 Children younger than 16
We collect data about children if you provide us with information about your childin relation to your Flying Blue membership. For example, if you create a family
account.
2.3 Specific services, mobile apps, events, contests or campaigns
For specific services, mobile apps, events, contests or campaigns, we may
collect other types of data than those described in this privacy policy. We will
inform you about this when you register for the service, event, contest, or
campaign, or when you download the app.
3. How we collect your data
We collect the categories of personal data referred to above in the following
ways:(A) Personal data provided by you
For example, when you register for our loyalty programme, contact our customer

support, subscribe to receive our e-mails, fill out a customer survey, register for
one of our events or participate in a promotional contest.
(B) Personal data collected when you earn or spend Miles with us
When you book a flight or purchase ancillaries with Air France or KLM, you canearn or spend Miles. Air France and KLM share the booking details collected aspart of their airline booking procedures (see 2.1 (B) above) so as to take care ofyour membership in our Flying Blue loyalty programme (see 4.1 (B) below).
(C) Personal data received from partners that participate in our loyalty
programmes
The Flying Blue loyalty programme is offered by KLM and Air France (see 1 ‘Who
we are’ above). In a number of countries, we offer the Flying Blue programme inpartnership with our participating airlines. Our loyalty programme allows you toearn and spend Miles and XP with us, participating airlines and other Flying Blue
loyalty partners (including hotels and car rental companies). We may share yourpersonal data with the participating airlines and our Flying Blue loyalty partners
for that purpose. If, for example, you purchase a service from one of our loyalty
partners, they will share the Miles you have earned with us so that we can update
your Miles balance. You can find a list of participating airlines and loyalty partners
on our Flying Blue website. They are independently responsible for processing
your personal data. You can find more information on how they handle yourpersonal data in their respective privacy policies.
(D) If you use social networks, we may also receive information from yoursocial network provider
For more information, see 2.1(E) above.

4. Purposes for which we use your personal data
4.1. General
The main purposes for which we use your personal data are:(A) To take care of your membership in our loyalty programme
We process the personal data under 2.1 (A) and (C) to enrol you in our Flying
Blue programme, to maintain your membership, to administer the Miles andXP that you earn and spend, manage your tier, and to provide you withrewards.
(B) To provide you with our online services and mobile apps and aseamless digital experience
i. To offer you the best possible digital experience, we may analyse your useof our website or apps, so that we can tailor our communication towards thedigital channel or device that you use most (please see 2.1 (D)).
ii. Some of our digital services may use your location, for example, to show
you the nearest location of interest.
(C) For statistical researchi. General: We research general trends in the use of our Flying Blue loyalty
programme, websites, mobile apps and social media, and trends in the
behaviour and preferences of our members. We use our research results toimprove our loyalty programme, develop better services and offers for ourcustomers, provide better customer service, and improve the design andcontent of our websites and mobile apps.
ii. Categories of data: To perform our research, we may use the categories of
personal data described at 2.1 (A) to (E). We only use ‘aggregated data’ or‘pseudonymised data’ for our research. This is data that cannot be traced
back directly to you because all directly identifiable elements (e.g. names ande-mail addresses) are removed or encoded and given a number. We takeappropriate measures to ensure that only a limited group of employees hasaccess to the analyses.
iii. Legal basis and right to object: We process your personal data for ourlegitimate interests described above (please see (i) ‘General’). You have theright to object, on grounds relating to your particular situation, at any time tothe processing of your personal data for statistical research (please see 8‘Your rights’ below).
(D) For marketing purposesi. General: If you become a member of our Flying Blue loyalty programme andsubscribe to Flying Blue updates, we will send you updates about ourprogramme and personal advertisements and offers for our products andservices and those of our participating airlines and loyalty partners (see (v)below).
ii. Types of communication:– E-mails: If you subscribe to our Flying Blue updates, we will send you email
updates about your membership (such as your Miles overview), news about
our programme (such as our newsletter) and offers tailored to your interestsand preferences. These Flying Blue offers may relate to our loyalty
programme (such as promo awards), products and services of Air France,
KLM or participating airlines (such as earning or spending Miles with us orparticipating airlines) and the products and services of our Flying Blue
partners (such as earning or spending Miles with hotels, rental cars, shoppingand lifestyle partners). For more information on participating airlines andFlying Blue partners, see 3.1 (C) above.
– Airline updates: When you become a Flying Blue member, you may
subscribe to airline updates by email or via social media. Please see the Air
France and KLM privacy policies for more information about our airline
updates. The Flying Blue programme is offered by Air France and KLM incooperation with our participating airlines (see 3.1 (C) above), which include
Kenya Airways, Aircalin, Tarom, and Transavia. If you reside in a country
where these participating airlines operate or if you enrol in our Flying Blue
programme via their websites, Air France and KLM may also send you emails with offers for and updates about their services if you have subscribedto airline updates. For example, if you reside in Romania, you may receive an
email from us with news and offers from Tarom.
– Direct messages through other communication channels: We may use othercommunication channels to send you direct messages with personalised
advertisements and special offers, such as postal mail or, with your consent,
mobile push notifications or social channels (e.g. Messenger, WhatsApp, or
WeChat).
– Display relevant information and personalised advertisements on websites:
please see our cookie statement. We may also use your personal data to
exclude you from advertisements which are no longer relevant for you.
iv. Personalised advertisements and offers: We aim to make advertisements
and offers as relevant as possible for you. To that end, we may use andcombine the categories of personal data described at 2.1 and 4.1 (C)(statistical research data). For example, in our e-mails we may include a
specific offer from a hotel partner based on your recent bookings with Air
France or KLM.
v. Legal basis and right to object: We send you updates based on yourconsent. We personalise your advertisements and offers on the basis of ourlegitimate interest and the interests of third parties so as to send you relevant
updates and offers. You have the right to object to the use of your personal
data for direct marketing purposes at any time (please see 8 ‘Your rights’
below).
vi. Unsubscribe: You may unsubscribe from our Flying Blue updates andparticipating airline emails at any time by clicking on the unsubscribe link in
the e-mail. You will then unsubscribe from that particular type of email update.
If you would like to unsubscribe from all types of Flying Blue updates orparticipating airline emails, you can change your communication preferences
in your account. In that case, you will only receive e-mails necessary to beable to participate in our loyalty programme (e.g. request to update yourpassword). You may also unsubscribe by contacting us (please see 8 ‘Your
rights’ below). For unsubscribing from the Air France and KLM airline emails,

please see the Air France and KLM privacy policies.
(E) To communicate with you
We use your contact details to communicate with you about yourmembership, to answer your questions, or to address your complaints.
(F) To conduct our business operations or to comply with statutory
obligations
We collect, use, and retain your personal data to perform and administer ourloyalty programme, such as for record-keeping purposes, to prevent or
combat fraud, or to settle disputes. In the case of fraud or misuse of ourloyalty programme, we may enter your personal data in our internal airline
fraud control and warning systems. As a result, your bookings may be subject
to close scrutiny and, in particular cases, may be refused or cancelled or you
may no longer be welcome onboard our aircraft or only on certain conditions.
Please see our privacy policies for more information. In addition, we process
your personal data to comply with our legal and tax obligations.
4.2. Specific services, apps, events, contests, or campaigns
For specific services, apps, events, contests, or campaigns, we may use yourpersonal data for purposes other than those described in this privacy policy. We
will inform you about those purposes when you register for the service, event,contest, or campaign, or when you download the relevant app.
4.3. Legal basis
We may process your personal data only if we have a legal basis for doing so. Inmany cases, we need your personal data to take care of your membership (see
4.1 (A). In those cases, the legal basis for processing your data is ‘necessary forthe performance of a contract’. If you have consented to a processing activity(which consent you may withdraw at any time, please see 8 ‘Your rights’ below),
we will process your data based on that consent.
In certain cases, we may use your personal data if we or third parties have alegitimate interest in doing so. We will always consider all interests carefully: yourinterests, the interests of others, and the interests of Air France and KLM. Basedon that legal basis, we will process your data for, for instance, combatting fraud,
statistical research, or personalising offers and advertising (see 4.1 (C), (D) and(F) above for more information).
We may have a legal obligation to process your data, for example for tax
reasons. If you refuse to provide the personal data we need to perform thecontract we have concluded with you or to comply with a legal obligation, we may
not be able to provide all the services you have requested from us.
5. Granting access to or sharing data with third parties
5.1. General
We may share your personal data with third parties in the following cases:(A) For our loyalty programmes and benefits
For more information, see 1 and 3.1 (B) and (C) above.
(B) For support or additional services
To operate our loyalty programme, we use support or additional services ofthird parties, such as IT suppliers, social media providers, marketing
agencies, and screening service providers. All such third parties are required
to adequately safeguard your personal data and only process them inaccordance with our instructions.
5.2. Specific services, apps, events, contests, or campaigns
For specific services, apps, events, contests, or campaigns, we may shareyour data with third parties other than those described in this privacy policy,
for example, when we organise a campaign or an event in collaboration witha Flying Blue partner. We will inform you about this when you register for theservice, event, contest, or campaign, or when you download the app.
5.3. Third-party websites
Our website contain links to third-party websites. If you follow those links, youwill leave our website. This privacy policy does not apply to the websites ofthird parties. For more information on how they handle your personal data,
please check their privacy or cookie policies (if available).
6. Security and retention
6.1. Security(A) Our commitment
Ensuring the security and confidentiality of your personal data is our priority.
Taking into account the nature of your personal data and the risk ofprocessing, we have put in place all appropriate technical and organisational
measures as required by applicable legal provisions (in particular Article 32of the General Data Protection Regulation (GDPR)) so as to ensure an
appropriate level of security and, in particular, to prevent any accidental or
unlawful destruction, loss, alteration, disclosure, intrusion of or unauthorised
access to these data.
(B) The security measures we have taken(i) Banking transactions. We are required to comply with the Data Security
Standard for the Payment Card Industry (the PCI DSS standard) issued by
the PCI Security Standards Council (PCI SSC). This standard was created toincrease control over cardholder information with the aim of reducing thefraudulent use of payment instruments. All Air France or KLM service
providers required to process bank card data must comply with the PCI DSS
standard. We strive to combat identity theft on the Internet. For this reason,
we use, for example, a device for detecting fraudulent payments designed toprotect you in the event of loss or theft of your bank card.
(ii) Organisational measures. We have implemented and maintain variousorganisational measures intended to strengthen the awareness andaccountability of our employees. We have programmes in place designed
both to ensure awareness and to promote the sharing of good practices andsafety standards. In this context, a rich collection of documents on
information security challenges and privacy protection have been madeavailable to employees.
(iii) Technical measures. We strictly control physical and logical access tointernal servers hosting or processing your personal data. We protect our
network with state-of-the-art hardware devices (Firewall, IDS, DLP etc.) as
well as architectures (including secure protocols like TLS 1.2) in order toprevent and limit the risk of cybercrime.
(B) The evolution of our security systems
In order to maintain an appropriate level of security, we have internal
processes in place based on the best standards (in particular, the ISO 27000
family of standards). We rely on dedicated experts to guarantee the best
possible level of protection. In this regard, Air France maintains a privileged
relationship with l’ANSSI (Agence Nationale de Sécurité des Systèmesd’Information) and KLM with NCSC (National Cyber Security Centre).

(D) How to protect yourself
The personal data security and confidentiality data depends on everyone's
best practices. We advise you not to disclose the passwords you use toaccess our services to third parties, to log out of your profile and social
account systematically (especially in the case of linked accounts), and to
close the browser window at the end of your session, especially if you areaccessing the Internet from a public computer. This will prevent other users
from accessing your personal data. To avoid the risk of hacking, we
recommend using different passwords for every online service you use. We
cannot be held responsible for theft of your data on a platform which is not
managed by us.
In addition, we strongly recommend that you do not distribute to third parties
any document issued by Air France or KLM containing your personal data orother information related to your membership or to publish these on social
networks. If you decide to publish these documents on social media, you areresponsible for consulting and understanding the general conditions of use,
information security practices and privacy policies applicable to these thirdparty social networks. We cannot be held responsible for how data isprocessed, stored or disclosed on these platforms.
To find out more about our measures with regard IT security, please consult
Air France’s or KLM’s IT security portal.
(E) Management of security incidents
There is no such thing as ‘zero risk’ and even if we implement all the security
measures recognised as appropriate, unforeseen things can happen. We
have specific procedures and resources in place to manage security
incidents under the best possible conditions.
We have also set up a specific procedure for assessing possible breaches of
security that could lead to the accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of or access to your personal data, fornotifying the competent supervisory authority within the period provided forby applicable law, and for warning you when a breach is likely to result in ahigh risk to your rights and freedoms. Tests are carried out periodically toverify the functioning of the security installations and adequacy of theprocedures and devices deployed.

6.2. Retention
We do not keep your personal data for any longer than is necessary. Howlong your personal data is retained depends on the purposes for which thedata is processed and the applicable statutory retention periods.
7. International transfer of data
7.1. KLM and Air France may transfer your personal data to countries other thanyour country of residence (including countries outside the European
Economic Area). This is done because our participating airlines, Flying Blue
partners or service providers provide their services from other countries. You
can find a list of participating airlines and our loyalty partners on our Flying
Blue website. The laws of the countries to which we transfer your personal
data may not always offer the same level of personal data protection.
7.2. KLM and Air France will ensure that adequate safeguards are in place tocomply with the requirements for the international transfer of personal data
under applicable privacy laws. For transfers of personal data outside theEuropean Economic Area, KLM and Air France may use European
Commission-approved Standard Contractual Clauses as safeguards.
8. Your rights
8.1. You may contact Air France’s or KLM’s Privacy Office (please see 8.4 below)
to exercise any of the rights you are granted under applicable data protection
laws, including (A) the right to access your data, (B) to rectify your data, (C)to erase your data, (D) to restrict the processing of your data, (E) the right todata portability, and (F) the right to object to processing.
(A) Right to access
You may ask us whether we process any of your personal data and, if so, toreceive access to that data in the form of a copy.
(B) Right to rectification
You have the right to have your data rectified if it is inaccurate or incomplete.
Upon request, we will correct inaccurate personal data about you and, taking
into account the purposes of the processing, complete incomplete personaldata, which may include the provision of a supplementary statement.
(C) Right to erasure
You have the right to have your personal data erased. This means that wewill delete your data. Erasure of your personal data only takes place incertain cases, as prescribed by law and listed in Article 17 of the General
Data Protection Regulation (GDPR). This includes situations where yourpersonal data is no longer necessary in relation to the purposes for which it
was originally processed, and situations where the data was processedunlawfully. Due to the way in which we maintain certain services, it may takesome time before backup copies are erased.
(D) Right to restriction of processing
You have the right to obtain a restriction on the processing of your personal
data. This means that we will suspend the processing of your data for acertain period of time. Circumstances which may give rise to this right include
situations where the accuracy of your personal data is contested and weneed some time to verify its (in)accuracy. This right does not prevent us fromcontinuing to store your personal data. We will inform you before therestriction is lifted.
(E) Right to data portabilityYour right to data portability entails that you may ask us to provide you withyour personal data in a structured, commonly used and machine-readable
format, and have such data transmitted directly to another controller, where
technically feasible. Upon request and where this is technically feasible, wewill transmit your personal data directly to the other controller.
(F) Right to object
You have the right to object to the processing of your personal data. Thismeans that you may ask us to no longer process your personal data. This
only applies if the ‘legitimate interests’ ground (including profiling) constitutes
the legal basis for processing (see 4.3 ‘Legal basis’ above). You can object todirect marketing at any time and at no cost to you if your personal data isprocessed for this purpose, which includes profiling to the extent that it isrelated to direct marketing. If you exercise this right, we will no longer
process your personal data for such purposes.
8.2. Withdrawal of consent
You may withdraw your consent at any time by following the specificinstructions in relation to the processing for which you provided your consent.
For example, you can withdraw consent by clicking the unsubscribe link in
the e-mail or adjusting your communication preferences in your account (ifavailable).
You can also contact Air France’s or KLM’s Privacy Office. For more
information on how you can withdraw your consent for cookies and similar

technologies we use when you use our website, please check our cookie
policy.
8.3. Denial or restriction of rights
There may be situations where we are entitled to deny or restrict your rights
as described in 8.2 above. In all cases, we will carefully assess whether suchan exemption applies and inform you accordingly. We may, for example,
deny your request for access when necessary to protect the rights andfreedoms of other individuals, or refuse to delete your personal data if theprocessing of such data is necessary for compliance with legal obligations.
The right to data portability, for example, does not apply if the personal data
was not provided by you or if we process the data on grounds other than yourconsent or for the performance of a contract.
8.4. Privacy Office
If you wish to exercise your rights, all you have to do is send a request to Air
France’s or KLM’s Privacy Office:
Air France
Délégué à la Protection des Données / Data Protection Officer - ST.AJ IL
45, rue de Paris 95747 Roissy CDG Cedex
FranceE-mail: mail.data.protection@airfrance.fr
KLM Royal Dutch Airlines
Privacy Office - AMSPIPO Box 7700
NL-1117 ZL Luchthaven Schiphol
The Netherlands
E-mail: KLMPrivacyOffice@klm.com
8.5. Questions, comments or complaints
If you have any questions, comments or complaints, please feel free tocontact us. If your concerns have not been addressed to your satisfaction,
you have the right to file a complaint with the competent supervisory
authority. In France, the French Data Protection Authority (Commission
Nationale de l'Informatique et des Libertés) is responsible for monitoring
compliance with privacy regulations. In the Netherlands, the Dutch Data
Protection Authority (Autoriteit Persoonsgegevens) is responsible formonitoring compliance with privacy regulations.

9. How this privacy policy is updated
9.1. This privacy policy took effect on 20 August 2020. It is amended from time totime. We will notify you of any changes before they take effect.