Personal information, also referred to as personal data, includes details that identifies you or can be used to identify you, such as your name and contact details, information about your flights, information about your participation in the Nomad Club loyalty program, etc. This information may also include information about your use of our web resources and mobile applications.

This Privacy Notice applies to your personal information that we collect, use and/or otherwise process. This includes circumstances when you travel on our flights, engage with our websites or mobile apps, reach out to our reservation and information center, or utilize any of our other services. By using our services, you acknowledge and agree to the terms of this Privacy Notice.

For any questions or concerns regarding your personal information, you may contact Air Astana JSC through the following communication channels:

• Email: data.privacy@airastana.com
• Postal address: Air Astana JSC, 4А Zakarpatskaya st., 050039, Almaty, Kazakhstan.

Air Astana JSC is fully responsible for the collection, storage, use, protection and confidentiality of your personal data in accordance with the Law of the Republic of Kazakhstan "On Personal Data and its Protection" and other applicable local and international legislation. Legal address of Air Astana JSC (BIN 010940000162): 4A Zakarpatskaya st., 050039, Almaty, Kazakhstan.

Air Astana JSC collects and processes your personal information to provide and improve our services, fulfill our contractual and legal obligations, and to ensure your safety during the flights. This information includes:

• Identification and contact information: name, date of birth, nationality, passport or other identification data, telephone number and e-mail address.
• Travel information: ticket numbers, destinations you are travelling to, flight details, special preferences for your flight and special requests (e.g. seat selection and meal preferences), and special assistance information.
• Financial information: payment information, such as credit or debit card information, including the cardholder's name, card number, and expiration date.
• Medical information: health information necessary for travel, including medical certificates, medical conditions, requests for special assistance or accommodation.
• Loyalty program information: information about participation in loyalty programs, including member numbers, miles balance and available privileges.
• Data on interactions with Air Astana JSC: Information acquired from interactions with our services, including inquiries, feedback, complaints and communication with staff.
• Cookies and online identifiers: data collected through cookies and similar technologies on our websites and mobile applications, including but not limited to IP addresses, location and language settings.
• Authorization information: data relating to login and password to provide access to our website or mobile applications.
• Information on the security of the physical environment: records in logs of entry to the physical environment of Air Astana JSC.
• Marketing information: data on travel preferences, results of satisfaction surveys, results of marketing campaigns and events.
• Audio-visual information: recordings from CCTV cameras in our offices, as well as voice recordings when you contact our reservation and information center.

The types and volume of personal data collected depend on the nature of your interaction with Air Astana JSC. This data is gathered directly from you during the use of our services and digital platforms, as well as from third parties, such as ticket sales agencies involved in organizing your flight.

Air Astana JSC collects and processes your personal data for the following purposes, ensuring compliance with local and applicable international legislation on personal data protection:

• Provision of services: personal information is collected and processed to provide services related to your travel, including ticketing, check-in, baggage handling, payments processing, special meals, and other services you may require. 
• Service quality Improvement: Personal data is used to enhance the quality of our services and products, as well as to understand the needs and preferences of our customers.
• Regulatory compliance: processing of personal data is necessary to fulfill our obligations under aviation, custom and other applicable local and international laws.
• Marketing and Communications: we use personal data for marketing purposes, to send information about new services, offers and promotions, and to learn about customers' preferences in order to provide personalized offers. You can opt-out of marketing mailings at any time using the integrated functionality of our web resources and mobile applications.

• Contractual obligations: The processing of personal data is necessary for the fulfillment of the terms of the contract, which is the flight ticket, between Air Astana JSC and the data subject.
• Regulatory obligations: The processing of personal data is carried out to fulfill regulatory obligations under aviation, custom and other applicable local and international laws.
• Consent to Processing: For certain types of processing, such as when you subscribe to marketing mailings, the processing will be based on your consent.
• Legitimate interests: In certain applicable cases, the processing of personal data is carried out on the basis of our legitimate interests, including to improve the quality of our services and/or to protect against fraud.

In case you make a reservation or purchase a flight ticket for another person, you need to obtain that person's permission to use their personal information.

We receive the categories of personal data mentioned above through various channels:

• Directly from you

We receive personal data directly from you when you make a reservation or purchase a flight ticket and/or other goods and services through our sales channels, check-in for a flight, create an online account, enroll in the Nomad Club loyalty program, submit an inquiry or complaint to us, answer questions in a questionnaire, leave us a message in social networks, contact our support team, communicate with a chatbot, sign up to receive our e-newsletters or mobile notifications, fill out medical forms.

• From your tour operator or travel agency, our airline partners or other companies involved in organizing and managing your flight

We receive your personal data from third parties when you purchase a flight ticket through a travel agency or third-party websites, or when you use the services of our partners in car rental, transfer, hotel booking. These third parties involved in organizing your flight are also responsible for processing your personal data. For more information on how they process your personal data, please refer to their appropriate privacy notices.

JSC "Air Astana" sets the retention periods for personal information taking into account applicable legislation and the specified purposes of personal data processing. Once the purpose of personal data processing is achieved, your personal information will be deleted or anonymized, except in cases mandated by law where personal data must be retained for a longer period.

Specifically, when you make a reservation or purchase flight ticket, we retain the relevant personal information to provide you with air travel services. After completing your flight, we will store the information for a period sufficient to address any of your inquiries or complaints related to your flight. The information may also be retained to ensure the provision of privileges under the Nomad Club frequent flyer program.

Please note that if your personal information is collected by a third party, such as a hotel or car rental company, it will be retained in accordance with their privacy policies.

In order to achieve the above-mentioned purposes of data processing and in accordance with the above-mentioned legal grounds (contractual performance, legitimate interests, consent or statutory processing obligations), your data may be transferred to the following categories of recipients:

• Other airlines (our codeshare and interline partners);
• Airport operators, lounge staff, and ground services;
• Authorized government authorities based on applicable country entry regulations and in response to a reasonable and lawful request, for example, as part of a criminal investigation;
• Travel agencies involved in the organization of your flight;
• Our frequent flyer program partners;
• Companies that conduct market research and analysis, provide marketing services, or conduct customer surveys on our behalf;
• Companies that provide services to process reports regarding violations of laws and/or Code of Conduct, including fraud, corruption, discrimination, unethical behavior and other violations related to Air Astana JSC's activities;
• Partners involved in the processes of providing transfer services, car rentals, hotel reservations;
• Companies providing information technology services, such as booking and ticketing systems, data storage systems, check-in systems;
• Other service providers, for example, for website operation, distribution of informational messages, and processing of feedback.

Ensuring the security and confidentiality of your personal data is of utmost importance to us. We adhere to the ISO/IEC 27000 series standards and have taken necessary measures to ensure an appropriate level of security, particularly to prevent any accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access to this data. These measures include:

• Organizational measures: we have implemented effective policies and procedures to protect information, which form the foundation of our operations and decision-making. Our approach to risk management focuses on identifying, assessing, and minimizing potential data security threats. Regular training of our employees helps them recognize and appropriately respond to information security threats. We have also developed incident response procedures to minimize their impact on the security of personal information. Additionally, we take measures to protect our physical facilities and resources from unauthorized access.
• Technical measures: In the technical aspect of data protection, we employ encryption to safeguard your information, both during storage and transmission. Protection of our systems is achieved through access control mechanisms, firewalls, and intrusion detection systems, which help prevent unauthorized access. Additionally, we continuously update our software to protect against information security threats and maintain the relevance of the technologies we use.

In accordance with the Law of the Republic of Kazakhstan "On Personal Data and its Protection", as well as applicable international law, you have certain rights regarding your personal information:

• Right to Access. You have the right to know if we hold your personal data, as well as to receive information containing: confirmation of the fact, purposes, sources, and methods of collecting and processing personal data; a list of the personal data; the durations of personal data processing, including their retention periods.
• Right to rectification. You have the right to amend and supplement your personal data stored by us, if there are grounds for doing so, confirmed by appropriate documents.
• Right to erasure. You have the right to request the deletion of your personal data stored by us, in accordance with local and applicable international legal norms.
• Right to restriction of processing. You have the right to restrict the processing of your personal data by us in accordance with local and applicable international law.
• Right to withdraw consent. You have the right to withdraw your consent to the processing of personal data to the extent that the processing of your personal data was originally based on consent.
• Right to data portability. You have the right to request that Air Astana JSC transfer the personal data we have collected to another organization or directly to you in accordance with applicable law.

If you wish to exercise any of these rights, please contact us by email: data.privacy@airastana.com

Air Astana JSC may ask for extra details from you to confirm your identity as the data subject associated with the rights request.

Air Astana JSC processes your personal data for marketing purposes including, for example, sending newsletters and offers, conducting marketing campaigns.

Where we ask for your consent, for example, when you subscribe to a newsletter, your consent will be the basis for sending marketing communications. If we process your personal data for information and marketing purposes without seeking consent, we have concluded in each case that our legitimate interests represent a sufficient basis for such processing.

• If you decide that you no longer wish to receive marketing communications, you can change your mind at any time. The ways in which you can stop receiving marketing communications are described below:
• If you are a registered user of https://airastana.com, you can change your marketing preferences at any time in the appropriate section of your account.
• In addition, each marketing email we send you will contain an unsubscribe option to stop receiving further marketing emails.

By using the https://airastana.com website or our mobile applications, you agree that we may place cookies on your device, access them and use other methods to collect data about your use of the website and mobile applications to improve your user experience.

For more information, please see our Cookie Policy.

Our website may contain links to other websites for your convenience and information. While we protect your personal information on our website and mobile applications, we are not responsible for your personal information that you may share when you use third-party web resources.  In this regard, please review the privacy policies of such websites.

We reserve the right to amend this Privacy Notice in order to provide accurate and up-to-date information regarding the protection of your personal data.

In the event of changes to this Privacy Notice, we will post the updated version on our website https://airastana.com/.