Download the app today and Get £30 off your next booking (T&C's apply)
We prioritize your safety and security when using Vuelo for payments or any of our other services. For this reason, we are committed to providing you with complete information about how we handle and utilize your personal data in this privacy notice. Your privacy is of utmost importance to us, and we want you to feel confident and informed about how your data is handled within our services.
LV 001 Limited, a company registered in England and Wales under company number 14645298, with its registered office located at 222 Regent Street London, W1B 5TR, is the data controller in accordance with the UK data protection laws. This includes regulations such as the EU Regulation 2016/679 as incorporated and amended into UK domestic law (the "UK GDPR") and the Data Protection Act 2018.
If you have any queries or concerns regarding the processing of your personal data, please feel free to reach out to our data protection team by writing to privacy@getvuelo.com. They will be happy to assist you with any questions you may have related to the handling of your personal data.
Under the UK GDPR, you have various rights that empower you to have control over your personal data and receive information directly from us about how we process your personal data. Below are your rights explained:
Right to Access: You have the right to access the personal data we hold about you. If you wish to exercise this right or have any queries, the easiest way is to email us at privacy@getvuelo.com and submit a request for subject access or data deletion.
Right to Rectification: You can request the correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure: You have the right to ask us to delete your personal data in certain circumstances.
Right to Restriction of Processing: You can request the restriction of processing your personal data in specific situations.
Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
Right to Object: You can object to the processing of your personal data for certain purposes, such as direct marketing.
Right not to be Subject to Automated Decision Making: You have the right to object to automated decision-making, including profiling, which significantly affects you. If you have any questions or need to exercise your rights, please use the contact details provided in section 12 or email us at privacy@getvuelo.com. We are here to help you with any inquiries you may have related to your personal data and your rights under the UK GDPR.
Right to have personal data deleted ("Right to be forgotten"): In certain circumstances, you have the right to request the deletion of your personal data from our records. For example, if the data is no longer necessary for the purpose it was collected, or if you withdraw your consent for processing based on consent. However, there may be situations where we are unable to delete your data due to legal obligations, overriding interests, or other valid reasons. More information on our legal obligations regarding data retention can be found in sections 4 and 9 of the Privacy Notice.
Right to be informed: You have the right to be informed about how we process your personal data. We provide this information through our Privacy Notice, service-specific FAQs, and by answering any questions you may have.
Right to receive access to your personal data ("Data Subject access"): You have the right to know whether Vuelo processes personal data about you and to receive a copy of such data (data extract) through data subject access. This data extract will contain information about the personal data we hold about you and how we process it. Right to access and request a transfer of your personal data to another recipient ("Data portability"): You can request a copy of the personal data that Vuelo holds about you for performance of a contract or based on your consent in a machine-readable format. This enables you to use your data elsewhere, such as transferring it to another controller or recipient.
Right to rectification: You can request that we correct any inaccurate or incomplete information about you.
Right to restrict processing: If you believe your personal data is inaccurate, unlawfully processed, or no longer needed for a specific purpose, you have the right to request a restriction of its processing. You can also request that we stop processing your data while we assess your request. If you object to our processing as described in the right below, you can also request a restriction of processing while we assess your objection.
Right to object to our processing of your personal data: You have the right to object to the processing of your personal data based on our legitimate interests. You can also object to our use of your personal data for direct marketing purposes, and we will stop sending you marketing materials upon receiving your objection.
Right to object to an automated decision: You have the right to object to automated decisions made by Vuelo if they have legal effects or significantly affect you. More information on Vuelo's use of automated decisions can be found in section 6 of the Privacy Notice.
Right to withdraw your consent: If we process your personal data based on your consent, you have the right to withdraw that consent at any time. Upon revoking your consent, we will stop processing your data for such purposes.
Right to lodge a complaint: If you have concerns about Vuelo's processing of your personal data, you can lodge a complaint with the Information Commissioner's Office, the supervisory data protection authority, using this link: https://ico.org.uk/.
Vuelo mobile application settings: In the Vuelo mobile application, you have the ability to customize your preferences for certain services, such as notifications or auto-fill of your information during purchases.
In this section, we provide a comprehensive list of the types of personal data that we collect or create in relation to our services:
Contact and identification data: Name, date of birth, social security number, title, occupation, gender, billing and delivery address, email address, mobile phone number, nationality, age, employment and employment history, audio recordings, photos, and video recordings of you and your ID card, etc.
Information about goods/services: Details concerning the goods/services you have bought or ordered, such as the type of item or delivery tracking number.
Information about your financial standing: Information about your income, any credits, negative payment history, and previous credit approvals.
Payment information: Credit and debit card details (card number, expiry date, and CVV code), bank account number, bank name.
Information about your use of Vuelo's services: Which service(s) and different functions in these services you have used and how you have used them. This includes information about outstanding and historical debt, your repayment history, and your personal preferences.
Technical information generated through your use of Vuelo's services: Technical data such as response time for web pages, download errors, and date and time when you used the service.
Information about your contacts with Vuelo's customer service: Recorded phone calls, chat conversations, and email correspondence.
Your contacts with the sites you shop at or visit: Information about how you interact with site’s, such as whether you have made bookings and the type of site’s you book at.
Device information: Device ID, IP address, language settings, browser settings, time zone, operating system, platform, screen resolution, and similar information about your device and device settings/usage.
Information from external sanction lists and PEP lists: Sanction lists and lists of politically exposed persons ("PEP") include information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the list in question.
Sensitive personal data: Data that reveal religious beliefs, political or philosophical views, trade union membership, or constitute information about health, sex life, sexual orientation, or biometric data.
Service-specific personal data: Within the framework of specific services, we may use additional personal data that are not covered by the types listed above. Detailed information on relevant personal data for each service can be found in the terms and conditions associated with each service.
The list above includes the main types of personal data we collect or create, but there may be other data collected for specific purposes within individual services. For detailed information on the personal data collected for each service, please refer to the respective terms and conditions provided on our website. If you have any questions or require further information about how your personal data is handled, please feel free to contact us through privacy@getvuelo.com.
In the tables below you can read about,
We will use your personal data for the following purposes:
a. Contact and identification data (provided directly by you).
b. Payment information (provided directly by you).
c. Sensitive personal data (may be provided directly by you or obtained from another source, indicated in brackets).
Our legal basis for processing your data is in accordance with current data protection legislation, such as the UK GDPR. The specific legal rights we rely upon for processing your data.
We will stop using your personal data for each purpose in accordance with applicable laws and regulations, or when the specific purpose for which the data was collected has been fulfilled.
| Purpose of the processing - what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. |
Legal basis for processing according to the UK GDPR. | When the purpose of using the personal data ends. See section 9 for when Vuelo deletes the data. |
|---|
If Vuelo processes your personal data based on your consent, you have the right to withdraw your consent at any time. To do this, you can send an email to privacy@getvuelo.com or use the contact information provided in section 12.
Additionally, you can delete any uploaded information from the Vuelo mobile application or terminate the service where personal data is processed. Upon doing so, we will promptly delete the relevant information. However, please be aware that if you withdraw your consent or delete uploaded information, it may affect your ability to use certain services that rely on your consent for data processing.
Furthermore, as explained in section 2, you have the right to object to specific personal data processing, such as opting out of marketing communications. You also have the right to request the erasure of certain personal data, as described in section 2. If you have any questions or wish to exercise these rights, please don't hesitate to contact us using the provided contact information.
"Profiling" entails the automated processing of personal data to assess specific personal aspects, such as analyzing or predicting your individual preferences, including buying interests. During this process, we compare your data with that of other customers who exhibit similar usage patterns of our services.
Detailed information regarding the purpose of Vuelo's profiling and the specific types of personal data used for each occasion and profiling can be found in section 4 above. It is essential to note that the profiling conducted for these purposes does not have a significant impact on you as a customer. We utilize profiling for the following objectives:
Customized Services: Profiling enables us to deliver tailored services that customize their content based on what we perceive as most appealing to you. This customization is applicable to the Vuelo mobile application, its various functions, and the order in which different payment methods appear.
Customized Marketing: Additionally, we utilize profiling to provide personalized marketing content to you across both our own platforms and external services. If you have any inquiries about the functioning of the profiling process, please feel free to contact us. You can find our contact information in section 12. Furthermore, you have the right to object to our marketing profiling at any time by contacting us, and upon your request, we will cease profiling for marketing purposes. Moreover, you have the option to discontinue our profiling for services by terminating the specific service you are using.
Automated Decisions with Legal Effect or Similarly Significant Impact
Automated decisions with legal effect or those that significantly affect you refer to certain decisions within our services that are entirely automated, without any involvement from our employees. These decisions have a substantial impact on you as a customer, comparable to legal effects. By employing such automated decisions, Vuelo aims to enhance objectivity and transparency in offering its services. However, it is important to note that you retain the right to object to these decisions at any time. Details on how to exercise this right are provided at the conclusion of this section (6.2).
The automated decisions that significantly affect you also involve profiling based on your data prior to the decision-making process. This profiling is conducted to assess your financial situation (before granting credit) or to determine if your use of our services poses a risk of fraud or money laundering. We analyze your user behavior and financial standing and compare this data with behaviors and conditions indicative of varying risk levels for us.
Various user behaviors and conditions are evaluated and weighted in our automated decision models, resulting in an overall score that determines either acceptance or rejection of your use of our services. In some cases, we may also request additional identification from you if uncertainty arises regarding your identity.
When does Vuelo take automated decisions that significantly affect you?
We make this kind of automated decision when we:
decide to approve your application to use a credit service.
In the event that your application to use a credit service is not approved, the decision is reached through an automated process that considers multiple factors. These factors encompass the data you provide to us, information from external sources like credit bureaus' creditworthiness reports, and Vuelo's internal records about you, particularly if we have previously provided you with a payment plan.
Moreover, Vuelo's credit model takes into account an extensive array of additional elements, including Vuelo's internal credit risk levels and the general repayment rates of our customers, which may be based on factors such as the current product category.
The automated credit decision process thoroughly analyzes and assesses all these factors to arrive at the decision regarding the approval of your credit service application. In the event that your application is not approved, you have the right to obtain further details about the decision and may contact us using the provided contact information for any inquiries or to seek clarification regarding the decision.
We employ automated processes to determine whether there is a risk of fraud associated with your conduct. This assessment is made when your behavior exhibits potential signs of fraudulent activities, inconsistency with your previous use of our services, or attempts to conceal your true identity.
To conduct these automated decisions, we rely on information provided by you, data from fraud prevention agencies (please refer to section 7.2.3 for details of the agencies we utilize), and Vuelo's own internal information.
As part of our commitment to maintaining secure services, Vuelo continuously enhances our fraud models. We closely investigate the tactics employed by fraudsters in various markets, such as identifying merchant categories or products that are frequently targeted for fraud attempts.
Please be assured that these measures are taken to safeguard the security of our services and protect both you and other users from potential fraudulent activities.
We utilize automated processes to assess the risk of money laundering associated with your behavior. If our processing indicates potential indications of money laundering, we thoroughly investigate the relevant cases.
Additionally, in specific instances, we examine whether any customers are listed on sanction lists to ensure compliance with applicable regulations.
These measures are implemented to prevent money laundering activities and comply with anti-money laundering laws and regulations, ensuring the integrity and security of our services.
The data categories employed in each decision are delineated in section 4. For further details regarding the individuals or entities with whom we exchange information concerning profiling in the context of automated decisions, please refer to section 7.
If your application is not approved through the automated decisions outlined above, access to Vuelo's services, including payment methods, will not be granted. Vuelo has implemented several safety mechanisms to ensure the fairness and appropriateness of these decisions. These mechanisms include regular reviews of our decision models and random sampling in specific cases. If you have any concerns about the outcome, please don't hesitate to contact us, and we will assess whether the procedure was conducted appropriately.
Additionally, you retain the right to object to any automated decision that holds legal consequences or significantly affects you (including relevant profiling). To exercise this right, you can send an email to privacy@getvuelo.com. A Vuelo team representative will then carefully review the decision, taking into account any additional information and circumstances you provide to us.
When Vuelo shares your personal data with recipients, we take significant steps to ensure that they handle the data in accordance with this privacy notice. These measures include entering into data transfer agreements or data processor agreements with the recipients. These agreements encompass various contractual, legal, technical, and organizational measures to guarantee that your information receives an adequate level of protection and is processed in line with applicable laws.
By establishing these agreements, we hold the recipients accountable for handling your personal data responsibly and in accordance with the standards set forth in this privacy notice. These measures are implemented to safeguard your data and maintain its confidentiality, integrity, and availability during any data sharing process. Our priority is to ensure that your personal data remains protected, regardless of its location or the entities involved in its processing.
Recipient Description: Suppliers and subcontractors, specifically entities categorized as data processors, who process personal data solely on behalf of Vuelo. These may include software and data storage providers, payment service providers, and business consultants.
Objective and Legal Justification: Vuelo engages with suppliers and subcontractors to perform specific tasks involving personal data, acting as data processors under Vuelo's instruction. This includes entities such as software and data storage providers, payment service providers, and business consultants.
Purpose and Legal Basis: Vuelo necessitates access to services and functionalities provided by external entities when it cannot fulfill these functions internally. Vuelo maintains a legitimate interest in obtaining and utilizing these services and functionalities (pursuant to Article 6(1)(f) of the UK GDPR). We ascertain that the processing involved is crucial to pursue this interest, and that our interest outweighs your right to abstain from having your information processed for this intent.
You possess the right to object to this processing, based on reasons connected to your specific circumstances. For further insight into your rights, please refer to section 2.
Recipient Description: Companies within the Vuelo Group.
Objective and Legal Justification: Data sharing with companies within the Vuelo Group is necessary to provide you with our services and functionalities. Vuelo holds a legitimate interest in delivering these services and functionalities, ensuring access and convenience (in accordance with Article 6(1)(f) of the UK GDPR). We guarantee that the processing involved is essential to pursue this interest, and that our interest prevails over your right to abstain from having your information processed for this purpose.
You have the right to object to this processing, grounded in reasons associated with your specific circumstances. Further details about your rights can be found in Section 2.
Additionally, when you make purchases from foreign stores (located outside the EU/EEA) under agreements with another company within the Vuelo Group, sharing your personal information between Vuelo companies is indispensable for managing your payment and allowing the foreign store to process your purchase. The legal basis for this processing is the performance of a contract (pursuant to Article 6(1)(b) of the UK GDPR).
The receiving Vuelo Group company will handle your personal data following the privacy notice applicable in your country (refer to the provided list). For additional information about how Vuelo safeguards your personal data when transferred outside of the EU/EEA, please review Section 8.
Recipient Description: Individuals possessing the legal right to access your personal information through a power of attorney.
Objective and Legal Justification: Vuelo may disclose your personal information to individuals who hold the authority to access it via a power of attorney.
Purpose and Legal Basis: This data sharing is executed to streamline your communication with us through authorized representatives. It operates on the foundation of your consent (pursuant to Article 6(1)(a) of the UK GDPR).
Recipient Description: Authorities such as the police, financial authorities, tax authorities, and other legal entities, including courts of law.
Objective and Legal Justification: Vuelo may furnish essential information to governmental bodies, including the police, financial authorities, tax authorities, and legal courts, as required.
Purpose and Legal Basis: Sharing of personal data with these authorities is necessitated by law, in accordance with legal obligations (pursuant to Article 6(1)(c) of the UK GDPR). Additionally, sharing may occur if you explicitly request such action or if it's essential for tax deductions or crime prevention. An instance of a legal mandate for sharing information is to combat money laundering and terrorism financing. Depending on the authority and purpose, the legal bases may involve compliance with legal obligations, fulfilling agreements with you, or Vuelo's legitimate interest in safeguarding against criminal activities.
Furthermore, there is a legal requirement under UK law to withhold taxes owed on payments. As part of our agreement with the UK tax office (HMRC), Vuelo will directly provide the necessary information to the tax office to facilitate this process. No action is required on your part. For inquiries concerning these arrangements, please communicate with the tax office.
Recipient Description: Potential buyers of Vuelo's business or assets, and third parties in the event of an acquisition of a significant portion of Vuelo's assets. Objective and Legal Justification: In scenarios where Vuelo intends to sell its business or assets, your personal information may be shared with potential buyers of said business or assets. Furthermore, if Vuelo or a substantial part of its assets is acquired by a third party, personal information about Vuelo's customers may also be disclosed.
Purpose and Legal Basis: Vuelo's motivation for sharing this information aligns with its legitimate business interest (in accordance with Article 6(1)(f) of the UK GDPR). This enables Vuelo to execute such transactions effectively. We ensure that the processing required for this purpose is essential to pursue our interest and that our interest prevails over your right to abstain from having your information processed for this intent.
You retain the right to object to this processing, grounded in reasons connected to your specific circumstances. Further details about your rights can be found in Section 2.
Recipient Description: "Stores" refers to the websites or online platforms you visit or shop at, which may encompass companies affiliated with the respective site (if you have received such notification from the site).
Objective and Legal Justification: The purpose of sharing your data with these stores is to facilitate and manage your purchases and interactions with the site or its affiliated group companies. This includes tasks such as verifying your identity, processing bookings, addressing queries and disputes, fraud prevention, and potentially delivering relevant marketing communications. The site's privacy notice governs the processing of your shared personal data that is subsequently processed by the site.
The legal basis for sharing your data with these stores stems from two factors:
The performance of a contract (as per Article 6(1)(b) of the UK GDPR) when data sharing is necessary to fulfill the contractual obligations between you and the site.
Vuelo's and the site's legitimate interest (as per Article 6(1)(f) of the UK GDPR) or your consent (as per Article 6(1)(a) of the UK GDPR). This processing is conducted to serve the interests of both parties and to ensure that our interest in data sharing is reasonable and surpasses your right to abstain from having your information processed for this intent.
You have the right to contest this processing, based on reasons associated with your specific circumstances. Additional information about your rights can be found in Section 2.
Recipient Description: Payment service providers and financial institutions.
Objective and Legal Justification: Payment service providers and financial institutions offer services to you, stores, and Vuelo, enabling the implementation and management of electronic payments utilizing various methods, including credit cards, direct debit, and bank transfers.
Purpose and Legal Basis: Certain stores collaborate with payment service providers to facilitate payment management, involving the sharing of your information with these providers. This sharing adheres to the respective privacy notices of the involved sites. Moreover, the site may permit Vuelo to share your information with the payment service provider used for processing your payment. Some payment service providers may also independently collect and use your information according to their own privacy protocols. This is notably applicable to electronic wallet providers.
Additionally, when conducting transactions involving your account to finalize the transactions, Vuelo may share your information with other financial institutions. This data sharing is executed to carry out a transaction initiated by you and is performed to fulfill the contractual commitment between you and Vuelo (pursuant to Article 6(1)(b) of the UK GDPR).
Recipient Description: Entities specializing in fraud prevention and identity verification services.
Objective and Legal Justification: Vuelo shares your personal data to validate your identity, ensure data accuracy, and counteract fraudulent and criminal activities. The entities we collaborate with can be found in the provided link. It's important to note that these entities process your data in accordance with their respective data privacy protocols.
Vuelo shares this data based on its legitimate business interest (as outlined in Article 6(1)(f) of the UK GDPR). Fraud prevention agencies and identity verification companies possess information crucial for detecting fraud activities and confirming identities. This data aids Vuelo in reducing the occurrence of fraudulent transactions. We assure that the processing required for this purpose is essential to pursue our interest and that our interest prevails over your right to refrain from having your information processed for this intent. You possess the right to contest this processing based on reasons associated with your specific circumstances. Additional information regarding your rights can be found in Section 2. You can also exercise these rights against the entities listed in the provided link.
Any instances of fraud or money laundering risk will be documented by fraud prevention agencies, which could lead to other entities declining to offer services, financing, or employment to you. For inquiries about this matter, please contact us using the details provided in Section 12.
Fraud prevention agencies may retain your personal data for varying timeframes, and if you're deemed a risk for fraud or money laundering, your data could be held for up to six years. Both Vuelo and fraud prevention agencies might enable law enforcement agencies to access and utilize your personal data to detect, investigate, and prevent criminal activities.
Recipient Description: Google, specifically Google Maps.
Objective and Legal Justification: When you utilize Google Maps during checkout or within the Vuelo App—such as by searching for your address in the address bar, exploring nearby stores, or inquiring about nearby deals and offers—your personal information will be shared with Google. Google will process your data in accordance with the terms of service and privacy policy outlined by Google Maps/Google Earth.
Purpose and Legal Basis: Vuelo shares this information guided by its legitimate interest in conducting its business (in accordance with Article 6(1)(f) of the UK GDPR). Google Maps enhances the checkout experience by providing address functionality and displaying maps and pertinent deals based on your current location within the Vuelo App. We ensure that the processing required for this purpose is vital to advance our interest and that our interest prevails over your right to abstain from having your information processed for this intent.
You retain the right to oppose this processing, with reasons connected to your specific circumstances. Additional information about your rights can be found in Section 2.
Description of the recipient: If you apply to use a service from Vuelo that involves us providing credit (see section 4), we will share your personal data with credit information bureaus. Sharing does not take place in the event of small amounts or where we already have sufficient information.
Purpose and legal basis: Your personal information is shared with credit bureaus in order to assess your creditworthiness, to confirm your identity and your contact information, and to protect you and other customers from fraud. This data sharing constitutes a credit report.
If you apply to use a credit Service (see Section 4), your personal data may be shared with Credit Reference Agencies (“CRAs”) to assess your creditworthiness in connection with your application, to confirm your identity and your contact information, and to protect you and other customers from fraud.
For Slice It, this sharing constitutes soft credit searches (or “soft credit lookups”) which does not affect your credit file nor credit score. The search is only visible to you and Vuelo. In order to perform these credit searches, Vuelo will send the CRAs your name, address, date of birth, phone number, as well as bank account number and sort code if relevant, in order to receive the lookups on you.
However, if you apply for one of our Financing products (fixed term loans or revolving account), a hard credit search (or “a hard credit lookup”) is performed in addition to soft searches. This is due to our Financing products constituting regulated credit products under UK credit legislation. This hard credit search will be recorded on your credit file and may impact your credit score as follows:
The CRA will keep a record of our enquiry against your name and which may be linked to your representatives (“associated records”). For the purposes of any application for Services from us, you may be assessed with reference to “associated records”. Where any search or application is completed, or agreement entered into, involving joint parties, we may record details about this at the CRAs. As a result an “association” will be created that will link your financial records. Details of which CRA we have used for a specific search are available on request.
In addition, if you open an agreement with one of our Financing products or Slice It, we will share further information on your agreement with the CRAs.
This will occur on a monthly basis until the agreement is closed. This will include details of your outstanding balance, payments made and any default or failure to meet the terms of your agreement. These records will remain on the CRAs’ files for 6 years after our agreement with you is settled or terminated, whether settled by you or, if applicable, your business or by way of default. This and other information about you (or, if applicable, your business and those with whom you are linked financially) may be used to make credit decisions about you in the future.
The ways in which CRAs use and share personal data are explained in more detail at; https://www.transunion.co.uk/crain and https://www.experian.co.uk/crain. The CRAs will process your information in accordance with their own privacy notices and you can find out which ones we cooperate with here.
Vuelo shares your information based on Vuelo’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), as the credit information bureaus have information on your financial standing which is important for Vuelo to use as input to ensure a correct credit assessment, and not grant credit to consumers who is unable to repay it. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. You can also contact the entities listed in the link above, to exercise the same rights as stated in section 2 also against those entities.
Vuelo retains credit information about you that we have received from a credit information bureaus only in script data format. If you would like to have a readable version, we recommend that you directly contact the credit bureau that informed you that Vuelo requested a credit report.
Recipient Description: Third-party entities, including debt collection companies, engaged for the purpose of collecting unpaid overdue debts on behalf of Vuelo.
Objective and Legal Justification: Vuelo may find it necessary to share your information in instances where we sell or outsource the collection of unpaid overdue debts to external parties, such as debt collection agencies. The primary aim of this data sharing is to facilitate the recovery of outstanding debts. Debt collection companies process personal data in line with their individual privacy protocols, either as per their privacy notices or as data processors on behalf of Vuelo. It's important to note that these debt collection companies may also report your unsettled debts to credit information bureaus or relevant authorities, which could impact your creditworthiness and future credit applications.
This data sharing is grounded in our legitimate interest to collect and sell debts (pursuant to Article 6(1)(f) of the UK GDPR). In our assessment of interests, Vuelo has established a legitimate interest in the collection and sale of debts. We ensure that the processing required for this purpose is essential to fulfill that interest, and that our interest surpasses your right to abstain from having your data processed for this intent. You hold the right to oppose this processing, provided there are reasons connected to your particular circumstances. Additional details regarding your rights can be found in Section 2.
Recipient Description: Information shared includes details about you and your transactions when utilizing the Vuelo card in conjunction with VISA or Mastercard, and with entities within VISA or Mastercard's card network. Additionally, if you opt to add the Vuelo card to your digital wallet, your information may be shared with the wallet provider. In such instances, data processing will adhere to the privacy protocols of the wallet supplier.
Objective and Legal Justification: The sharing of information is executed to the extent required for facilitating card transactions, preventing fraudulent activities, and adhering to the regulations of VISA or Mastercard’s card network. If you undertake Vuelo card renewal or receive a new card, the pertinent information is communicated to VISA or Mastercard. This enables VISA or Mastercard to inform third parties with whom you have previously authorized the retention of your card details (for instance, for recurring transactions).
This sharing is performed to fulfill the contractual commitment between you and Vuelo (as stipulated in Article 6(1)(b) of the UK GDPR).
Recipient Description: Debt acquirers to whom Vuelo may assign your outstanding debt.
Objective and Legal Justification: Vuelo retains the authority to transfer your unresolved debt to debt acquirers. Following the transfer of your debt and persisting until the debt is settled, Vuelo will share specific contact and identification details (such as your name, date of birth, social security number, address, and phone number), financial status data (including remaining credit, repayments, and any adverse payment history linked to the existing debt), as well as particulars concerning the goods or services associated with the outstanding debt. The acquirer will process your personal information in accordance with their distinct privacy notice, which you will receive upon the debt's transfer.
The sharing of personal data with diverse acquirers is established on our legitimate interest in divesting unsettled debts as an integral aspect of our business operations (in accordance with Article 6(1)(f) of the UK GDPR). We assure that the processing required to achieve this interest is essential, and that our interest prevails over your right to abstain from having your personal data processed for this purpose. You hold the right to contest this processing, grounded in reasons linked to your specific circumstances. Additional details regarding your rights can be found in Section 2.
Recipient Description: Credit institutions and additional financial entities (including other banks) engaged in transaction processing and payments to external accounts.
Objective and Legal Justification: We collaborate with credit institutions and financial entities, such as other banks, in scenarios where you initiate transactions or payments to external accounts. If payments have been directed towards a Vuelo account, we will handle the data received from the bank involved in the transaction. This may include contact details, identification information, and payment particulars. For transactions or payments directed to accounts within other banks, we also share selected contact and identification data, along with payment information, with the recipient and their corresponding credit institution or financial entity. This sharing is executed to uphold the contractual commitment between you and Vuelo (pursuant to Article 6(1)(b) of the UK GDPR).
Recipient Description: External entities known as affiliate networks, which are intermediaries facilitating redirection from sponsored links in the Vuelo mobile application or website to third-party company websites.
Objective and Legal Justification: In the event that you opt to click on a sponsored link within the Vuelo mobile application or website, leading to a store, product, or service, you will be directed to an external company's website via a third-party intermediary known as an affiliate network. Information about the affiliate networks Vuelo collaborates with can be accessed in the provided link (presented in the left column). These affiliate networks will process details about your device in accordance with their distinct privacy notices (available in the right column of the same link mentioned above). The choice of which affiliate network processes your data is determined by the site you visit through the sponsored link. Generally, a store is affiliated with just one network. You can acquire additional details about the specific network by getting in touch with us (or the respective site).
Objective and Legal Justification: The affiliate network may employ tracking technology on your device that contains information regarding your click on the Vuelo mobile application link. This data is then utilized to record your visit to the external site, aiming to calculate any potential commission owed to Vuelo.
This processing is predicated on a careful balancing of interests (in accordance with Article 6(1)(f) of the UK GDPR). In conducting this balancing, Vuelo has ascertained that it holds a legitimate interest in furnishing you with sponsored links to promote various shops within the Vuelo mobile application and website. We affirm that the processing requisite for this purpose is essential to fulfill said interest, and that our interest prevails over your right to abstain from having your information processed for this intent.
You possess the right to contest this processing, grounded in reasons associated with your specific circumstances. Additional information regarding your rights can be found in Section 2.
Recipient Description: Google, specifically Google's reCAPTCHA service.
Objective and Legal Justification: While using the Vuelo mobile application via our web portal, Google collects your device information through the reCAPTCHA service implemented there. This may also include additional information that you voluntarily input into the reCAPTCHA service.
Purpose and Legal Basis: Vuelo processes this information grounded in its legitimate business interest (as outlined in Article 6(1)(f) of the UK GDPR). The implementation of the reCAPTCHA service serves to safeguard against misuse of our services, such as preventing unauthorized access attempts by bots. Google handles this information in accordance with its terms of service and privacy policy.
We assure that the processing required for this purpose is vital to pursue our interest and that our interest outweighs your right to abstain from having your information processed for this intent.
You possess the right to contest this processing, grounded in reasons linked to your specific circumstances. Additional details about your rights can be found in Section 2.
Recipient Description: Entities involved in coordinating accommodation, flights, packages, and travel services, as well as travel companies offering various travel-related products and services.
Objective and Legal Justification: Vuelo will share your personal information to booking agents and travel companies responsible for fulfilling any requested purchases related to your travel arrangements. The shared information may encompass contact details, identification data, and travel-specific data.
The processing of your data by booking agents and travel companies adheres to their distinct privacy protocols. This sharing is undertaken to uphold the contractual commitment between you and Vuelo (in accordance with Article 6(1)(b) of the UK GDPR).
Recipient Description: External advertising services provided by third parties.
Objective and Legal Justification: Vuelo will share your personal details with third-party advertising services to present you with more pertinent advertisements beyond the Vuelo App. This customization is established upon your interactions with Vuelo's offerings, as well as your Vuelo profile. Furthermore, Vuelo will share this information to gauge the pertinence of specific third-party advertising services. Note that some third-party advertising services may utilize your data for their own purposes, adhering to their respective privacy policies, accessible here. For further insights into this sharing or guidance on exercising your rights concerning these entities, please don't hesitate to contact us.
This processing is grounded in your explicit consent (as per Article 6(1)(a) of the UK GDPR). You retain the ability to withdraw your consent at any juncture via the Tracking Technology settings in the Vuelo App. Similarly, you have the prerogative to object to this processing, with the same effect as withdrawing your consent. Detailed information regarding your rights can be found in Section 2.
It's important to acknowledge that this processing might encompass profiling, which endeavors to tailor marketing content based on your presumed interests. Additional insights regarding profiling can be found in Section 6.
Recipient Description: Your personal information is shared with entities specializing in fraud prevention and companies offering identity verification services.
Objective and Legal Justification: Vuelo shares your data to authenticate your identity, validate the accuracy of your provided information, and combat fraudulent and criminal activities. The entities we collaborate with are listed herein. Kindly note that these entities process your data according to their own privacy protocols.
Vuelo shares your data based on Vuelo's legitimate interest in conducting its business (as outlined in Article 6(1)(f) of the UK GDPR). The fraud prevention agencies and identity verification companies possess crucial information regarding fraudulent activities and identity confirmation, which Vuelo employs to mitigate its level of fraudulent transactions. We ensure that this processing is essential for pursuing said interest and that our interest surpasses your right to refrain from having your data processed for this purpose. You have the right to contest this processing for reasons linked to your specific circumstances. Additional details about your rights can be found in Section 2.
You also possess the ability to exercise the same rights against the entities listed in the aforementioned link. Records of any identified fraud or money laundering risk will be retained by the fraud prevention agencies and may lead to others declining to provide services, financing, or employment to you. If you have inquiries regarding this matter, please reach out to us using the contact information provided in Section 12 below.
Fraud prevention agencies may retain your personal data for varying durations, and if you are deemed to pose a risk of fraud or money laundering, your data can be held for a maximum of six years. Both we and fraud prevention agencies may collaborate with law enforcement entities to access and utilize your personal information for the purposes of crime detection, investigation, and prevention.
Recipient Description: Entities operating in the realm of social media, including but not limited to Facebook, Instagram, and Twitter.
Objective and Legal Justification: Should you engage with us through social media platforms such as Facebook or Twitter, your personal information shall likewise be gathered and managed by these entities, aligning with their respective privacy protocols. This sharing is executed to honor our contractual obligations to you (as stipulated in Article 6(1)(b) of the UK GDPR).
We always strive to process your personal data within the EU/EEA area. However, there are situations where your data may be transferred outside the EU/EEA. Such instances can occur when sharing information within the Vuelo Group or with a supplier, subcontractor, or store operating outside the EU/EEA. In such cases, Vuelo ensures that your personal data receives the same high level of protection in accordance with the UK GDPR, even when transferred outside the EU/EEA. Importantly, your rights regarding your personal data, as described in detail in section 2 of the privacy notice, remain unaffected during such transfers. More information about the recipients with whom Vuelo shares your data can be found in section 7.
When you shop with a store located outside the EU/EEA, sharing your personal data with that store entails the transfer of your data to that country outside the EU/EEA.
Vuelo takes safety measures to ensure the protection of personal data when transferring it outside the EU/EEA. This includes:
Ensuring that the country outside the EU/EEA to which your personal data is transferred has an "adequate level of protection," as determined by the European Commission. This ensures that your data is still protected and your rights regarding your personal data remain intact.
Implementing the European Commission's standard clauses between Vuelo and the recipient of the personal data outside the EU/EEA. This ensures that the level of protection provided by the UK GDPR remains applicable, and your rights are safeguarded. In these cases, an assessment is made to ascertain whether the laws in the recipient country affect the protection of your personal data. Technical and organizational measures are taken to protect your data during the transfer to the relevant country outside the EU/EEA.
It is important to note that if you choose to shop at a store located outside the EU/EEA, data sharing with that store and the relevant Vuelo entity means that your personal data will be transferred and processed in that country outside the EU/EEA. Vuelo relies primarily on the European Commission's standard clauses to ensure data protection for such transfers. However, it's possible that the laws in the foreign store's country may prevent efficient protection via the standard clauses. Nonetheless, your personal data will still be transferred to the foreign store (or the foreign store's local Vuelo entity) as long as it is necessary to administer your specific purchase.
The duration for which Vuelo stores your personal data depends on the specific purposes for which the data is used:
Personal data used for the contractual relationship between you and Vuelo will generally be retained for the duration of the contractual relationship. Afterward, it will be kept for a maximum of 10 years, based on statutes of limitations.
Personal data that Vuelo is legally obligated to retain, such as under anti-money laundering laws or bookkeeping laws, will typically be kept for 5 and 7 years, respectively.
Recordings of telephone conversations are processed for quality assurance purposes and will be stored for 90 days. Additionally, recordings of inbound and outbound calls, along with Vuelo employees' notations from these calls, will be retained for up to three years to document the discussions and decisions made during the calls.
Personal data not used for the purposes of your contractual relationship with Vuelo or not subject to any legal obligation is retained only for as long as necessary to fulfill the specific purpose of data processing, typically around 3 months. More detailed information can be found in the table in section 4 of the privacy notice.
In some limited cases, personal data may need to be stored for a longer period to comply with capital adequacy laws.
The existence of legal obligations may prevent Vuelo from deleting your personal data, even if you request its deletion (as described in section 2). In such cases, Vuelo will assess whether the data may be necessary to protect the company from legal claims.
It is important to note that just because Vuelo has a legal obligation to store your personal data, it does not mean that the data will be used for any other purpose. Vuelo will evaluate the appropriateness of using your personal data for each specific purpose, as detailed in section 4 of the privacy notice.
In order to offer you a personalized and seamless experience, Vuelo utilizes cookies and similar tracking technologies across various platforms, including our website and the Vuelo mobile application. Details about the specific tracking technology employed by Vuelo and information on how to accept or decline these tracking technologies can be found within each respective interface.
By using these tracking technologies, Vuelo aims to enhance your overall user experience and provide you with tailored services based on your preferences and interactions with our platforms.
Please review the information provided in each interface to understand how these technologies are utilized and how you can manage your preferences accordingly.
We are continuously striving to enhance our services to provide you with a seamless user experience. As part of this effort, we may make modifications to both existing and future services. If such improvements necessitate notice or consent in compliance with applicable laws, you will be informed accordingly, and you will have the opportunity to provide your consent.
It is essential that you review this privacy notice each time you utilize any of our services, as the processing of your personal data may differ from your previous interactions with the specific service. Staying informed about our privacy practices ensures that you are aware of any changes and how they may impact you.
Vuelo is a trading name of LV 001 Limited, registered office: 222 Regent Street London, W1B 5TR, United Kingdom. Registered in England and Wales No. 14645298.
Vuelo have a number of customer service teams that handle data protection issues. You can reach all of these individuals at privacy@getvuelo.com. If you specifically wish to contact Vuelo’s data protection officer, enter this on the subject line.
Please visit www.getvuelo.com for more information.