ANA X Privacy Policy

In ANA X’s business operations, our customers’ personal information is essential in providing fully satisfactory services and products. We recognize the importance of the information received from our customers, and make efforts to take the utmost care in handling such information. We educate our executives and employees thoroughly about laws and company regulations related to personal information, and have established our company's structure to include measures for safety, thereby making the maximum effort for appropriate management and use of each customerʼs personal information.

This Privacy Policy explains how the personal information of customers obtained by ANA X is used. Please read this Privacy Policy carefully before providing personal information to ANA X or using our products or services.

The Privacy Policy will apply when customers and other individuals provide personal information to ANA X or use ANA Xʼs services and products.

ANA X utilizes personal information obtained from its customers for the following purposes. However, even within the intended scope, it will not use customers’ personal information in a way that may encourage or induce illegal or improper conduct.

ANA X will obtain the following personal information by fair and appropriate means for the purpose of achieving the previously mentioned purposes.

The customerʼs name, address, telephone number, fax number, email address, employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number), mailing address, passport information, location information, payment information including details of credit/debit card, financial institution account and other payment methods, information related to transactions (including non-public financial information handled by bank agency services), etc.

Details of travel plans and arrangements, including flights with ANA and other airlines, accommodations, and other transportation arrangements, as well as application and usage history of our travel products and services such as hotels and optional plans, the customer’s physical and medical information relating to flying, dietary restrictions, need for wheelchair or other special arrangement, etc.

The customerʼs ANA Mileage Club membership number, type of membership card, membership status, membership area, history of mileage accrual and redemption, credit card number and expiration date, usage history of credit card and related information, flight reservation and cancellation information, usage history of flights and other services, information on reservation and cancellation of travel products, usage history of travel products, arrangement and other services, etc.

Voice recording information and other similar information that can identify a specific individual because it contains the individual's name or for other reasons

Information such as that on how customers use the ANA X website and mobile application, including details on cookies, advertising identifiers (IDFA/GAID), location information, unique device identifiers, IP address, details on OS and browser type, etc., and website activity logs by which ANA X may be able to identify a specific individual
(For details on the purpose of use of cookies and other related matters, please refer to “3. Purpose of use of cookies” in the ANA X Cookie Policy, etc.)

ANA X may receive information related to personal information about customers directly from customers or from third parties or ANA Group companies. "Information related to personal information" in this Chapter 1 means information relating to a living individual which doesn't fall under personal information, pseudonymized personal information or anonymized personal information defined in the Act on the Protection of Personal Information (Act No. 57 of 2003) of Japan.

As a rule, ANA X obtains personal information at the volition of the customer. Customers may experience disadvantages if they refuse to provide their personal information, such as being unable to make use of the various services provided by ANA X, or being unable to receive campaign notices and other ANA X information because part of the functions of ANA X’s system become inoperable and thereby unavailable. Please note that customers may change their contact information as well as their decision on whether or not they wish to receive email magazines at any time they wish, in a manner designated separately by ANA X.

ANA X will not disclose or provide personal customer information to any third parties except under the following circumstances. Also, customers’ personal information including sensitive information will not be disclosed or provided to third parties under any circumstances, unless allowed by laws and regulations or by consent of the customer. Note that provision of information to data-sharing partners and business-entrusted companies are not deemed to constitute disclosure or provision to third parties.

ANA X may disclose or provide customers' personal information to the following categories of recipients.

ANA X may share customer information as follows.

In providing products and services to customers, ANA X may entrust a part of its business operations to third parties to which personal information may also be disclosed to the extent required to achieve the purpose of the entrustment. In these cases, ANA X will implement appropriate measures in managing and supervising such third parties to safeguard the handling of customers’ personal information, including establishing agreements on the handling of such personal information.

We may transfer customers’ personal information (name, passport number, and travel details, etc.) to outside of Japan. The countries or regions to which customers’ personal information is transferred may not have a system for personal information protection equivalent to Japan’s.

In the case of "2." above, we will take necessary and appropriate measures to ensure that the third party takes the corresponding measures on an ongoing basis. If you wish to know the details of our measures, please make a request in accordance with “12. Request about handling of Personal Information”.

In receiving customers’ personal information, we will manage such information according to the strictest standards and take necessary safety management measures to prevent leaks, loss, or alterations. ANA X ensures that the board members and employees are properly trained regarding appropriate handling to safeguard the security of information identifying individual customers. An appropriate retention period for personal information will be established in accordance with the purpose for which such information is used. After the purpose of the information has been achieved, ANA X will dispose of the information in question by appropriate methods.

If you wish to know the details of the safety management measures, please make a request in accordance with “12. Request about handling of Personal Information”.

If ANA X receives a request from a customer, submitted in the manner specified, for the disclosure, correction, deletion, addition, discontinuance of use, erasure, or information provision concerning the personal information protection measures referred to in “10. Transfer to outside of Japan” and “11. Management of personal information” (“disclosure, etc.”) with regard to the customer’s personal information stored in a database held by ANA X, the request will be handled according to the laws and regulations as follows, within a reasonable timeframe and scope, after confirming that the request was submitted by the customer themselves.

Personal information items, purpose of use, or records on the provision of personal data to third parties will be disclosed in accordance with the customers' request.

Correction, deletion, or addition of personal information will be undertaken wherever possible after due review of the request.

The use of personal information items designated by the customer will be discontinued, and the relevant information erased if so desired, in accordance with the submitted request. However, please note that such requests may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance to their wishes.

The following information will be provided in accordance with the customer's request.

ANA X may not be able to fulfill the customers’ requests if compliance with such requests would seriously impact ANA X’s business operations, result in a violation of laws and regulations, or disrupt the safety management of personal information.

Please contact us via the inquiry form on our website. (https://www.ana-x.co.jp/contact/) (Japanese only)

(1) Disabling cookies

Please refer to "5. Disabling Cookies" in the ANA X Cookie Policy.

(2) Disabling advertising identifiers

ANA X acquires and uses advertising identifiers (“Identification For Advertisers (IDFA)” for Apple’s iOS, “Google Advertising ID (GAID)” for Google’s Android OS, etc.)
Customers who wish to block advertisements using these advertiser identifiers are kindly requested to go to iOS (external website) or Android (external website) and configure the necessary settings on their device.

ANA X may make modifications to this Privacy Policy. If modifications are made, details will be posted on the ANA X website. Please be sure to read carefully the contents of any changes that have been made. (https://www.ana-x.co.jp/) (Japanese only)

This Chapter 2 provides additional information about the handling of personal information of customers and other individuals in the European Economic Area (“EEA”) and/or the United Kingdom (“UK”) in accordance with EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK Data Protection Act 2018 (“DPA 2018”) and other national and international data protection and privacy laws (together, “Data Protection Laws”).

Please note that the UK’s laws are similar to those in the EEA, and customers from both jurisdictions have very similar rights. Accordingly, references to the GDPR in this Chapter should also be read as references to corresponding UK law.

A guardian’s consent or permission must be obtained in the event that a customer under the age of 16 uses ANA X’s service and consents to this Privacy Policy. The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member applies for ANA X’s service on behalf of the data subject.

In the event that any provisions of this Chapter 2 contradict those of Chapter 1, the provisions of this Chapter 2 shall prevail.

The controller of your personal information is ANA X.

ANA X protects personal information which is collected and used by controllers (who make decisions about how and why your personal information is used) and processors (who act on the controller’s written instructions) on the basis of Data Protection Laws.

ANA X protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of Data Protection Laws.

ANA X may process customer personal data on one or more of the following lawful bases:

(1) When your consent is obtained to the processing (Article 6(1)(a) GDPR)

Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.

(2) When processing is necessary in order to perform or take steps to enter into a contract (Article 6(1)(b) GDPR).

This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.

(3) ANA X needs to process the information to comply with a lawful obligation (Article 6(1)(c) GDPR).

This includes the requirement to share personal information with customs and immigration authorities or law enforcement, as well ANA X’s legal duties towards its staff and customers.

(4) The information is required to protect your, or a third party’s, vital interests (Article 6(1)(d)), for example in the event of a medical emergency.

(5) It is in ANA X’s or a third party’s legitimate interests to process the personal data, and these interests are not overridden by your rights under Data Protection Laws (Article 6(1)(f) GDPR).

This includes the use of personal information necessary to operate ANA X’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience.

(1) Data Protection Laws provide you with the following legal rights:

Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused we will inform you of the reasons for this when we respond.

Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.

(2) Method for submitting request

You can exercise your rights free of charge (except in the case of unreasonable, excessive or repeated requests in which case we may charge a fee or refuse the request). The method for submitting request and contact information are as follows.

Submission of requests prescribed in articles (1) to (3) is pursuant to Chapter 1, Article 13 “Submission of request for disclosure, etc. and inquiries.” The following request forms are available for this case.

(3) Responding to a request

We will respond without delay and usually within one month. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.

If you are not satisfied with our response to a data protection request or if you think your personal information has been mishandled, then you have the right to complain to a supervisory authority. Please see Part 9 of this Chapter 2 (“Lodging a complaint with an authority”) for further details.

ANA X’s products and services are provided with the assistance of other companies and organizations and often ANA X will need to share personal information with third parties in order to run its business. These third parties include:

(1) Other companies in the ANA Group

(2) Organizations with which ANA X is legally required to share personal information

including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.

(3) Service providers

Various service providers, providers with whom we have a marketing partnership, etc.

Where ANA X instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of applicable Data Protection Laws.

ANA X sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. ANA X will only do this if the recipient has consented to receive marketing or if they are an existing customer who purchased products or services from ANA X and were given the opportunity to opt-out from marketing at the time but chose not to do so.

ANA X is located in Japan and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside the EEA and UK. It should be noted that Japan has been recognized by the European Commission as providing adequate protection for personal information.

When transferring personal information to third parties ANA X will ensure that it complies with the requirements of Data Protection Laws, including the onward transfer requirements of the EU-Japan adequacy decision and related Japanese laws. However, you should be aware that recipients outside the EEA and UK may be subject to national laws which do not necessarily provide equivalent protection for your personal data. If you would like more information regarding where your personal information is stored and transferred please contact ANA X using the details set out in Part 13 of this Chapter 1 (“Submission of request for disclosure, etc.”).

ANA X retains customers’ personal information until the purpose of use is achieved. Particularly, ANA X has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

(1) Personal information of ANA Mileage Club membership

Until withdrawal of the ANA Mileage Club membership

(2) Other personal information

Required period for the purpose which customers have consented

Customers have the right to lodge a complaint on the processing of their personal information with the data protection authority having jurisdiction over their residence.

(1) EEA residents: Please contact your national supervisory authority, details of which can be found on the European Data Protection Board’s website (https://edpb.europa.eu/about-edpb/board/members_en).

(2) UK residents: Please contact the Information Commissioner’s Office (www.ico.org.uk).

Controller: ANA X CO., LTD.

Address: Front Place Nihonbashi, 2-14-1, Nihonbashi, Chuo-ku, Tokyo, Japan

The data protection officer of ANA X is the Personal Information Administrator, and you can contact him/her at privacy@ana-x.co.jp.

Besides Chapter 1, Chapter 3 also shall be applied to the handling of personal information of persons residing in the People's Republic of China (hereinafter, "China") based on the Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法) and related regulations (hereinafter, "PIPL, etc."). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

A guardian's consent or permission must be obtained in the event that a customer under the age of 18 uses ANA X's service and consents to this Privacy Policy. The data subject's consent (or the consent of their guardian, in the case the data subject is a minor under the age of 14) to this Privacy Policy must be obtained in the event that a person such as a family member applies for ANA X's service on behalf of the data subject.

We may handle personal information that could be classified as sensitive personal information in PIPL, etc., such as passport information, health information, payment information, accommodation information, etc. for the purpose of use.

We recognize that the leakage or illegal use of customers' sensitive personal information may adversely affect their interests (e.g., It could easily bring about damage to personal dignity, or harm the safety of body or property), and will therefore strictly manage and legally handle such information in order to prevent its leakage or illegal use.

ANA X will retain the customer's personal information until the purpose of use is achieved. In particular, ANA X sets the retention period for personal information as follows.

(1) Personal information of ANA Mileage Club membership

Until ANA Mileage Club membership cancellation.

(2) Other personal information

Required period for the purpose which customers have consented.

(1) ANA X takes security measures to protect customers' personal information from leakage, alteration or loss. Specifically, ANA X takes the following measures to protect customers' personal information.

(2) ANA X will take all reasonable and practicable steps to ensure that no irrelevant personal information is collected. ANA X will only retain customers' personal information for the minimum period of time required to achieve the purposes stated in this Privacy Policy, unless an extension of the retention period is required or permitted by law.

(3) In the event of personal information being at risk, ANA X will promptly inform customers of the relevant circumstances of the incident in accordance with the requirements of the PIPL, etc. and report to the regulatory authorities.

In the event that ANA X receives a request relating to the personal information of a customer who is a resident of China, the request will be handled according to the PIPL, etc. in addition to the provisions of Chapter 1 "12. Request about handling of Personal Information", within a reasonable timeframe and scope. And when handling such a request, ANA X may first confirm that the request was personally submitted by the customer.

(1) Request for withdrawal of consent

If we are relying on consent to process your personal information, you have the right to withdraw that consent.

ANA X will erase the items of personal information specified by the customer in accordance with the customer's request, wherever possible and appropriate.

However, please note that such erasure may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes.

(2) Request for interpretation and explanation of our Privacy Policy

You have the right to request interpretation and explanation of this Privacy Policy.

(3)Methods for submission of requests

Customers may submit requests by following methods.

1) Submission of requests

Website:

Please contact us via the webform on this website (https://www.ana-x.co.jp/contact/)(Japanese only)

2) Required documents

We will provide customers' personal information to third parties (including provision to data sharing partners and to entrusted companies involving transfer outside of China) in accordance with the PIPL, etc.

In the case of a change to the purposes of use of personal information, ANA X will announce the revised Privacy Policy in advance on ANA X website (https://www.ana-x.co.jp/) (Japanese only) and ANA X will use personal information in accordance with the new purposes of use of personal information after obtaining consent from customers.

ANA X CO., LTD.

Address: Front Place Nihonbashi, 2-14-1, Nihonbashi, Chuo-ku, Tokyo, Japan

Besides Chapter 1, Chapter 4 also shall be applied to the handling of personal information of persons residing in California, United States of America based on the California Consumer Privacy Act of 2018 as amended under the California Privacy Rights Act of 2020 (hereinafter “CCPA”). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

Personal information collected by ANA X in the preceding 12 months or likely to be collected in the future is classified as defined in the following table. ANA X uses such information for the purposes set forth in Chapter 1, Article 3 (Purpose of using personal information). It will acquire such personal information directly from customers.

ANA X does not use or disclose sensitive personal information of customers for any purpose other than certain purposes permitted under the CCPA. ANA X does not collect or process sensitive personal information of customers for the purpose of inferring characteristics about customers.

ANA X retains customers’ personal information until the purpose of use is achieved. Particularly, ANA X has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

Customers living in California have the following rights concerning their personal information:

When among the rights set out above, exercising the right to know, the right to delete or the right to correct, please contact us using any of the following methods. Once ANA X receives such a request, it will be handled according to the related laws and regulations within a reasonable timeframe and manner, after confirming, through the procedures for individual identification described below, that the request was submitted by the customer himself/herself.

When, among the rights set out above, exercising the right to opt-out of sharing, please contact us using any of the following methods. Once ANA X receives such a request, it will be handled according to the related laws and regulations within a reasonable timeframe and manner.

This Chapter 5 provides additional information about the collection, use, or disclosure (“processing”) of personal information of customers and other individuals in the Kingdom of Thailand (“Thailand”) in accordance with the Personal Data Protection Act of Thailand B.E. 2562 (A.D. 2019) (“PDPA”).

If consent is required for processing of personal information relevant to the use of ANA X’s services of data subjects who are minors, quasi-incompetents or incompetents under the law of Thailand and cannot lawfully give consent by themselves, consent or permission of the persons exercising parental power, their curators or custodians (as the case may be) must also be obtained. If data subjects are under the age of 10, only consent or permission of the persons exercising parental power must be obtained.

If ANA X is not aware that the data subjects are minors, quasi-incompetent persons or incompetent persons prior to the collection of their personal information, upon learning that we have collected personal information of minors without the consent of persons exercising parental power (when it is required and the minors cannot lawfully give consent by themselves), or from quasi-incompetent persons and incompetent persons without the consent of their legal curator and custodian, we will delete the personal information at the earliest convenience unless we can rely on other legal grounds apart from consent for such processing.

The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member or an agent authorized to act on its behalf applies for ANA X’s service on behalf of the data subject.

In the event that any provisions of this Chapter 5 contradict those of Chapter 1, the provisions of this Chapter 5 shall prevail.

The controller of your personal information is ANA X.

ANA X protects personal information which is collected and used by controllers (who make decisions about how and why your personal information is used) and processors (who act on the controller’s written instructions) on the basis of the PDPA.

ANA X protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of the PDPA.

ANA X may process customer personal information on one or more of the following lawful bases:

(1) When your consent is obtained to the processing (Article 19 PDPA)

Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal information.

(2) When processing is necessary in order to perform or take steps to enter into a contract (Article 24(3) PDPA).

This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.

(3) ANA X needs to process the information to comply with a lawful obligation (Article 24(6) PDPA).

This includes the requirement to share personal information with law enforcement, as well ANA X’s legal duties towards its staff and customers.

(4) The information is required to protect your, or a third party’s, vital interests (Article 24(2) PDPA), for example in the event of a medical emergency.

(5) It is in ANA X’s or a third party’s legitimate interests to process the personal information, and these interests are not overridden by your fundamental rights regarding your personal information under the law (Article 24(5) PDPA).

This includes the use of personal information necessary to operate ANA X’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience to the extent permissible under the PDPA.

Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused we will inform you of the reasons for this when we respond.

Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.

You can exercise your rights free of charge (except in the case where expenses may be chargeable under the PDPA). The method for submitting a request and contact information are as follows.

(Website)

Please contact us via the webform on this website (https://www.ana-x.co.jp/contact/)(Japanese only)

We will respond without delay and usually within thirty (30) days. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.

If you are not satisfied with our response to a data protection request or if you think your personal information has not been processed appropriately, then you have the right to file a complaint with the Personal Data Protection Committee of Thailand. Please see Part 9 of this Chapter 5 (“Lodging a complaint with an authority”) for further details.

ANA X’s products and services are provided with the assistance of other companies and organizations and often ANA X will need to share personal information with third parties in order to run its business. These third parties include:

(1) Other companies in the ANA Group

(2) Organizations with which ANA X is legally required to share personal information

including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.

(3) Service providers

including: various service providers, providers with whom we have a marketing partnership, etc.

Where ANA X instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of PDPA.

ANA X sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. ANA X will only do this if the recipient has consented to receive marketing communications.

ANA X is located in Japan and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside Thailand.

When transferring personal information to third parties, ANA X will ensure that it complies with the requirements of the PDPA and related Japanese laws.

However, you should be aware that recipients outside Thailand may be subject to national laws which do not necessarily provide equivalent protection for your personal information. If you would like more information regarding where your personal information is stored and transferred please contact ANA X using the details set out in Part 13 of this Chapter 1 (“Submission of request for disclosure, etc.”).

ANA X retains customers’ personal information until the purpose of use is achieved. Particularly, ANA X has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

(1) Personal information of ANA Mileage Club membership

Until withdrawal of the ANA Mileage Club membership

(2) Other personal information

Required period for the purpose which customers have consented.

Please note that ANA X may retain your personal information for a longer period than mentioned above if it is for the purposes of the establishment, compliance, or exercise of legal claims, the defense of legal claims, or the purpose for compliance with the law.

Customers have the right to lodge a complaint on the processing of their personal information with the Personal Data Protection Committee of Thailand.

Controller: ANA X CO., LTD.

Address: 2-14-1 Nihonbashi, Chuo-ku, Tokyo, Japan

Data Protection Officer email: privacy@ana-x.co.jp