3. How we use your Customer Data

If you are an EU or Swiss or Chinese resident, we are required to disclose the legal basis for processing your data under the GDPR and the Swiss Data Protection Act and the PIPL. We are also required to disclose the purposes for processing your data under certain applicable laws, including the Singapore Personal Data Protection Act.  If you are based in Singapore, you consent to each of the purposes for processing your data as set out below. We will use the Customer Data in the following ways:

In accordance with our contract of carriage with you, we will use the Customer Data to:

• process and assist you with any transactions related to your booking (e.g., making a booking, providing services related to the booking (e.g., seat selection and upgrades, meal preferences, WiFi data and insurance purchased through our website, etc), fulfilling such booking and investigating potential fraudulent transactions);
• notify you about changes to our service, including through flight alert messages via our mobile services facility;
• facilitate airport, internet check-in and self check-in;
• provide airport services such as processing information relating to connecting flights, arrangements at airports, and customs and immigration facilities;
• provide baggage related services such as processing of any baggage related queries, including mishandled or missing baggage claims;
• provide in-flight catering and other services (e.g. to provide you with a personalised inflight experience);
• in accordance with our contract with you as a Scoot Registered User or KrisFlyer member we will use your Customer Data to:
  • maintain your account;
  • facilitate your transactions and services;
  • enable you to log in using your account on any of the platforms hosted by us; and
  • send you updates and other account related information.

  As it is in our legitimate interests to be responsive to you, to provide customised services and marketing, to ensure the success of our business and to ensure the proper functioning of our products, services and organisation, we will use your Customer Data to:

• improve our website and mobile application and to ensure content from the website and mobile application is presented in the most effective manner for you and your device;
• administer the website and mobile application, and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• monitor and record calls for quality, training, legal compliance, analysis and other related purposes in order to pursue our legitimate interest to improve service delivery;
• send you surveys by email (including surveys related to our Scoot Registered User Account or our KrisFlyer programmes, if you are a member, as detailed below). You can opt-out of receiving these surveys at any time by contacting us, via our website or our social media pages, or by clicking on the “Unsubscribe” link on an email from us;
• send you service emails, such as reminders when you have not checked out your purchases on our website or mobile application. You can opt-out of receiving service emails at any time by contacting us, via our website or social media pages, or by clicking on the “Unsubscribe” link on an email from us;
• respond to your enquiries, requests or feedback;
• enforce our terms, conditions and policies;
• allow you to participate in interactive features of the website and mobile application, when you choose to do so;
• customise our products and services to you, including by responding to and catering for your customer preferences;
• personalise the content you see on our website, mobile application and ScootHub, our inflight portal;
• keep the website and mobile application safe and secure;
• aggregate Customer Data into anonymised statistical data (such as number of passengers flown on a particular journey), which we will use for statistical analysis so that we can better understand our customers' profile and improve our service offering;
• to customise our marketing e.g. send you targeted marketing on places you would like to visit, based on your responses to optional questions on our website and mobile application and your prior travels. If you are an EU or Swiss resident, you can object to this profiling and opt-out of receiving such targeted marketing. For more information on this right, click here.
• share the Customer Data with selected partners to enable them to better tailor offers, promotions and other direct marketing to you. If you are an EU or Swiss resident, you can object to this profiling and opt-out of receiving such targeting marketing. For more information on this right, click here; and
• participate in industry studies conducted by public agencies or regulatory authorities in Singapore; and
• In relation to our Scoot Registered User Account and KrisFlyer programmes, we will use your Customer Data to:
• provide you with any information including promotions and offers from us and KrisFlyer partners, where applicable (with your consent where required by applicable laws);
• deliver programme-related benefits including, but not limited to, automatically enrolling you in lucky draw promotions;
• contact you regarding product and customer related surveys and market research;
• respond to your email and call enquiries;
• Further, as a Scoot Registered User Account or KrisFlyer member, Customer Data will be used to provide services to celebrate special occasions; sending you related news and e-statements and associated promotions and offers (with your consent where required by applicable laws)
• If you are an employee of an entity with a contractual relationship with us:
• to contact you to perform our services, and in particular, to monitor and record calls for quality, training, legal compliance, analysis and other related purposes in order to pursue our legitimate interest to improve service delivery,
• enforce our terms and conditions against your employer; and
• communicate with you about products, services, promotions, events and other news and information we think will be of interest to you.
• If you are an EU, Swiss or Chinese resident, you can object to this profiling and opt-out of receiving such targeted marketing. For more information on this right, click here.
• With your consent where required by applicable laws, we will use your Customer Data to:
• send you marketing and promotional materials in relation to products and services offered by us, our subsidiaries and affiliated airlines and service partners (such as accommodation partners or transportation partners), as well as our appointed agents, in relation to the KrisFlyer programmes;
• retarget you with advertisements (including adverts from the SIA Group) across multiple websites you visit, leveraging the cookies we have in place. The effect of this is that where you go to a different website after visiting the Scoot website, you may see tailored SIA Group advertisements on these websites. Please see our cookie policy for more information on our use of cookies (and similar technologies).
• retarget you with Scoot advertisements across multiple websites you visit, leveraging the cookies other SIA Group companies have in place on your device. The effect of this is that where you go to a different website after visiting the relevant SIA Group company website, you may see tailored Scoot advertisements on these websites. We only do this where you have consented to the relevant SIA Group company sharing your cookie information with us for these purposes. Please see our cookie policy for more information on our use of cookies (and similar technologies).
• serve you with customised advertising from the SIA Group that is relevant to you on social media platforms. We use audience targeting technologies to do this. For example, we may display interest-based advertising to you when you are using Facebook through a tool offered by Facebook called the Custom Audience tool. This tool allows email addresses to be hashed locally on our browser and then sent to Facebook. There, the email addresses are matched against Facebook’s existing list of Facebook users' hashed IDs and the matches are added to our Custom Audience for advertising. The matched and unmatched hashes are then deleted; and
• register you for a Scoot Registered User Account or KrisFlyer programmes.

You have the right to withdraw your consent at any time by contacting us at privacy@flyscoot.com, via our website or social media pages, or for Scoot Registered Users and KrisFlyer members, by logging into your account on our website.

4. Disclosure of your Customer Data

With your consent where required by applicable laws, we will share your Customer Data with selected third parties in the situations set out below:

• our travel and freight service providers or travel-related businesses and service providers (including ground personnel, security personnel, travel insurance providers, insurance providers and providers of our inflight portal and WiFi (if available), if you elect to use this service), partner airlines, airport management, airport operators;
• our interline, code share and strategic alliance partners so that they can fulfil their contract of carriage for the flights you booked through us and, where applicable, provide you with the relevant benefits of their frequent flyer programme. Where Customer Data is shared with such partners, the Customer Data will be used by that partner in accordance their respective privacy policy. For a list of such privacy policies, click here.
• advertisers and advertising networks that require the data to select and serve relevant adverts to you and others, as well as other selected partners to enable them to better tailor offers, promotions and other direct marketing to you or others;
• our website or mobile application service providers, so that the services of the interactive features you choose to use may be provided to you;
• analytics and search engine providers that assist us in the improvement and optimisation of the website or mobile application.
• public agencies and regulatory authorities in Singapore and their subcontractors, for the purposes of participating in industry studies; and
• our payment processors or payment services providers, so that they can process the payments you make to or through Scoot.

We will share your Customer Data with any of the entities within the SIA Group, in the situations set out below:

• For the purposes of our contract with you, including to:
  
  (a) Fulfil bookings and facilitate flight transfers of passengers;
  (b) Manage passengers who travel on flights operated by SIA and airlines in the SIA group and are both Scoot Registered Users and KrisFlyer members;
  (c) Manage passengers during flight disruptions and provide necessary assistance and services;
• As it in our legitimate interests to be responsive to you, and to provide customised services and marketing, and to ensure the safety of passengers flying with entities in our group, including to:
  
  1. Respond to complaints or compliments received by us from passengers who are sharing their flight experience on flights operated by airlines in the SIA group;
  2. Provide an enhanced customer experience and personalise offers to passengers;
  3. Anticipate the servicing needs of passengers on flights with us;
  4. Understand customers better through analytics and research (including marketing research) to support personalisation;
  5. Contact customers about updates, surveys and offers on and relating to our Scoot Registered User Account and KrisFlyer membership programmes; and
  6. If necessary, prevent passengers who have been issued refusal of carriage or other similar or equivalent banning notices from flying with other airlines within our group.
• For the purposes of assisting other entities within the SIA Group to provide relevant services to you and to understand more about you. For example, if you have flown with one of the other airlines in the SIA Group, an entity within the SIA Group may use this information to understand more about the sorts of travel services you are likely to be interested in;
• For the purposes of setting up your membership account(s) with other entities within the SIA Group, provided we have your consent where required by applicable law. For instance, with your consent where required by applicable law, we will share your Customer Data with KrisShop in order to link your KrisFlyer account with the KrisShopper programme; and
• For the purposes of undertaking targeted direct marketing and other forms of marketing or advertisement, including marketing or advertisements for entities within the SIA Group provided we have the consent of the recipient and/or have provided the opportunity to opt-out, in each case where required by applicable law.

We will also use and disclose your Customer Data to persons who have been validly identified as being you or acting on your behalf pursuant to our security procedures, for the purposes of the relevant transaction or enquiry. In particular, each of the passengers who are grouped under the same Passenger Name Record (“PNR”) number shall be deemed to be authorised representatives of each of the other passengers under the same PNR number.

We will disclose your Customer Data to law enforcement agencies, public or regulatory authorities, securities commissions or other organisations for security, health, customs and immigration purposes, if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

• comply with any applicable legal obligation, process or request;
• enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
• detect, prevent or otherwise address security, health, fraud or technical issues; or
• protect the rights, property, health or safety of us, our users, a third party or the public as required or permitted by law (including exchanging Customer Data with other companies and organisations for the purposes of fraud protection and credit risk reduction).

For example, we and other airlines are required by laws in the United States of America and other countries to provide border control agencies with access to your booking information or flight itinerary. Accordingly, relevant Customer Data (known as PNR or Advance Passenger Information (“API”)) will be disclosed to the appropriate customs and immigration authorities as required by law.

We will also disclose your Customer Data to third parties:

• in the event that we sell or buy any business or assets, in which case we may disclose your data to the prospective seller or buyer of such business or assets;
• if we or substantially all of our assets are acquired by a third party, in which case Customer Data held by us about our customers will be one of the transferred assets; or
• to comply with any applicable legal obligations, processes or requests (such as disclosing Customer Data to executors in response to court orders).

In addition, we may disclose Customer Data to our legal advisors for establishing, exercising or defending our legal rights, to our other professional advisors, or as otherwise authorised or required by law. We also reserve the right to share Customer Data as is necessary to prevent a threat to the life, health or security of an individual or corporate entities. Further, we will disclose Customer Data, as is necessary, to investigate suspected unlawful activities including but not limited to fraud, intellectual property infringement or privacy.

If you are a Chinese resident, please note that our mobile application uses the following third-party software development kits ("SDK"). During your use of our mobile application, we may disclose Customer Data to these SDK providers for the purposes listed here.

5. Transfer of information overseas

Our Head Office is based in Singapore. Customer Data will be transmitted to data storage facilities where we keep our central records. Customer Data will be transferred to Scoot’s foreign branch and representative offices and appointed agents, including ground handling agents, sales agents and contact centre agents, in Singapore and around the world in connection with our performance of the contract with you.

This means that Customer Data will be transferred to, and stored at, a destination outside of your country and outside China, the European Economic Area ("EEA ") and Switzerland, and in particular Singapore and Australia where we have data centres.

We will transfer Customer Data to airports and ground crew in destinations that you are flying to in and where we operate. The Customer Data will also be processed by staff operating outside China, the EEA and Switzerland who work for us, for our suppliers or our business partners. Such staff are engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. The Customer Data is transferred outside the EEA and Switzerland on the basis that it is necessary for the performance of our contract of carriage with you.

We will also transfer Customer Data to our code share, interline, and joint venture partners in strategic alliances in the Republic of Korea, the Philippines, Thailand, Japan, Australia, Germany, Switzerland, Austria, the United Kingdom, New Zealand and Greece for the purposes of performing any contract of carriage.

If you are an EU or Swiss resident, where we transfer Customer Data outside the EEA and Switzerland, this is done either on the basis that it is necessary for the performance of the contract of carriage between you and Scoot, or that the transfer is subject to the European Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses), pursuant to Decision 2004/915/EC and Decision 2010/87/EU as appropriate.

(If you are a Chinese resident, where we transfer Customer Data outside the territory of China, (i) this is done on the basis that the security assessment is conducted in accordance with the Personal Information Protection Law of PRC and relevant regulations, or that the model contract terms issued by the China Administration of Cyberspace (“CAC”) are concluded for the transfer, or that the transfer is necessary for the performance of our contract of carriage with you, or for the protection of your life and property safety; and (ii) if not already specified in this Privacy Policy, we will notify you about the transfer to the extent explicitly required by the PIPL (such as the name and contact of the recipient and purpose of processing) and obtain the consent from you.

6. General Data Subject Rights

If you are not a resident in the EU, UK, Switzerland or China, you may have certain rights in relation to the Customer Data we hold about you, which we detail below.

Access.

You have the right to know whether we process Customer Data about you, and if we do, to access Customer Data we hold about you and certain information about how we use it and who we share it with.

Where permitted by law, we reserve the right to charge a reasonable administrative fee for this service. In exceptional circumstances, we reserve the right to deny you access to your Customer Data and may provide an explanation as required by applicable laws.

Exceptional circumstances include (to the extent allowable under applicable law) where:

• an investigating authority or government institution objects to us complying with a customer’s request;
• the information may, in the exercise of our reasonable discretion and/or assessment, affect the life or security of an individual; and
• data is collected in connection with an investigation of a breach of contract, suspicion of fraudulent activities or contravention of law.

Correction.

You have the right to correct any Customer Data held about you that is inaccurate.

Feedback and complaints.

If you have any concerns, feedback or complaints about the use and/or sharing of your Customer Data, we are open to receiving your feedback or complaints.

Exercise of Rights.

In order to process your request promptly, we kindly ask you to include the necessary identification details with your request as well as any other information necessary to confirm your identity or to process your request. Such information may include the following:

• Full Name;
• Mailing Address;
• Email Address;
• Contact Number;
• A copy of an official identity document (e.g. Identity Card or Passport information) with all information apart from your full name and address redacted (if applicable); and
• Scoot Registered User or KrisFlyer number (if applicable).

All data privacy requests should be sent to privacy@flyscoot.com. Please note that requests sent in via other channels or which do not contain sufficient supporting information may take longer to process and/or we may not be able to respond within the prescribed timelines.

For Scoot Registered Users, you may correct any Customer Data by logging into your account under the section titled “Profile”.

7. Rights of Data Subjects Who Reside in the EU, UK and Switzerland

If you are resident in the EU, UK or Switzerland, you may have certain rights in relation to the Customer Data we hold about you, which we detail below. Some of these only apply in certain circumstances as set out in more detail below. We also set out how to exercise those rights.

These rights include:

• The right of access. More Information
• The right of data portability. More Information
• The right of rectification. More Information
• The right of erasure. More Information
• The right to restrict processing. More Information
• The right to object. More Information

Please note that we will require you to provide us with proof of identity before responding to any requests to exercise your rights. We will respond to a request by you to exercise those rights without undue delay and at least within one month (although this may be extended by a further two months in certain circumstances).

In order to process your request promptly, we kindly ask you to include the necessary identification details with your request as well as any other information necessary to confirm your identity or to process your request. Such information may include the following:

• Full Name;
• Mailing Address;
• Email Address;
• Contact Number;
• A copy of an official identity document (e.g. Identity Card or Passport information) with all information apart from your full name and address redacted (if applicable); and
• Scoot Registered User or KrisFlyer number (if applicable).

All data privacy requests should be sent to privacy@flyscoot.com. Please note that requests sent in via other channels or which do not contain sufficient supporting information may take longer to process and/or we may not be able to respond within the prescribed timelines.

Complaints.

In the event that you wish to make a complaint about how we process your Customer Data, please contact us and we will endeavour to deal with your request as soon as possible. This is without prejudice to your right to lodge a claim with your data protection authority.

You may object where:

• we are processing the Customer Data we hold about you (including where the processing is profiling) on the basis of our legitimate interest and you object to such processing (please see here for the types of Customer Data we process on that basis: How we use your Customer Data).

Please provide us with detail as to your reasoning so that we can assess whether there is a compelling overriding interest in us continuing to process such data or we need to process it in relation to legal claims. Also note that you may exercise your right to request that we stop processing the Customer Data whilst we make the assessment on an overriding interest by indicating this in our Data Privacy Rights form.

10. Accuracy

We need your assistance to ensure that your Customer Data is current, complete and accurate. As such, please inform us of changes to your Customer Data by submitting your updated particulars to Scoot (see Section 14). If you are a Scoot Registered User, you may update your Customer Data at any time by logging into your account under the section titled “Profile”.

We will also request Customer Data updates from you from time to time. As detailed above, your booking information or flight itinerary will be disclosed to the appropriate customs and immigration authorities as required by law. As such, it is important to ensure that the Customer Data contained in your booking information or flight itinerary is current, complete and accurate.

11. Security safeguards

Scoot takes the protection of your Customer Data seriously but, unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Customer Data, we cannot guarantee the security of your Customer Data transmitted through the website or mobile application; any transmission is at your own risk.

12. Other websites and services

We may, from time to time, provide you with links to other websites for your convenience and information. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. You access these websites at your own risk and we are not responsible for these websites. Whilst we will protect your Customer Data on our website and mobile application, we cannot control or be responsible for the policies of other sites we may link to, or the use of any Customer Data you may share with them. Please note that our Privacy Policy does not cover these other websites, and we would recommend that you are apprised of their specific policies.

In addition, some features on our website and mobile application rely on 3rd party services, including Application Programming Interface (“API”) services provided by Google LLC and/or any of its subsidiary companies (collectively, “Google”). Where you choose to use any feature on our website or mobile application that relies on a service provided by Google, you consent to the disclosure of information, including Customer Data, necessary for such use to Google, and agree that the information so disclosed may be processed in accordance with the Google Privacy Policy.

13. Minors

Our website and mobile application are not directed at children under the age of 16 and Scoot cannot distinguish the age of persons who access and use the same. If a minor (according to applicable laws) has provided us with Customer Data without parental or guardian consent, the parent or guardian should contact us (see Section 14) to remove the relevant Customer Data and unsubscribe the minor. If we become aware that Customer Data has been collected from a person under the age of 16 without parental or guardian consent, we will delete this Customer Data and, where that minor has an account, terminate the minor’s account.