PRIVACY POLICY

Effective April 17, 2023

Our Commitment to Privacy

LEVEL is committed to respecting your privacy and protecting your personal data. We will be fully transparent about the data we collect and how we use it.

We will use the data you provide for the purposes described in our Privacy Policy, including providing you with the services you have requested and improving your experience with LEVEL. We will also use the data to get to know you better so we can send you relevant offers.
If you tell us you do not want to receive marketing communications, we will stop sending them. Of course, we will continue to send you important information related to any product or service you have purchased to keep you updated on your booking and travel itinerary.
We will take the necessary measures to protect and keep your information safe. We will respect your data protection rights and strive to give you control over your own information.

Below, you can access our Privacy Policy to better understand how we use your personal data. It explains in more detail the types of personal data we collect, how we collect it, the purposes for which we may use it, and with whom we may share it.
Throughout the Privacy Policy, you will find specific examples of why and how we use your personal data. If you have any questions, please contact our Data Protection Officer by emailing DPO@flylevel.com.
Without prejudice to your rights under applicable law, the Privacy Policy and the information above are not contractual and do not form part of your contract with LEVEL.

Responsibility for the Processing of Personal Data

All personal data processed by LEVEL in relation to this Privacy Policy is the responsibility of Fly LEVEL Barcelona LH, S.L., which is considered the “data controller” under European Union data protection laws.

Our address is: Calle Catalunya 83, 08840 Vildecans, Barcelona, Spain.

If you have made a booking with LEVEL but one or more of your flights are operated by other airlines, each of those airlines will also be independently responsible for processing your data under European Union data protection laws, as well as under any applicable local data protection laws.
Any service provider, such as a hotel or car rental company, will also be individually responsible for processing your data. You can access the privacy policies of these companies by contacting them directly.

What do we mean by personal data?

Personal data is any information that identifies you or could be used to identify you, such as your name, contact details, and travel and purchase history. It may also include information about how you use our website.

When does this policy apply?

This policy applies to the personal data we collect, use, and process in connection with your relationship with LEVEL as a customer or potential customer, including when you travel on our planes or use our other services, when you browse our website, when you contact our customer service or call centers, and when you book our services through third parties (such as travel agencies and other airlines).

When we refer to other data controllers in the sections "Data Controller" or "Who do we share your personal data with?", you should consult their privacy policies for more information.

If you choose to purchase additional services from LEVEL, such as making an onboard purchase, using our in-flight entertainment system, or participating in a competition held by LEVEL with third-party partners, additional terms and conditions may apply in addition to those outlined in this policy.

How can you protect your personal data?

We take great care to protect the personal data you provide us.

Below are some additional steps you can take to keep your data safe.

Do not share your booking code or locator.

When you make a booking, you are given a booking code (also known as a PNR or Passenger Name Record). This reference will appear on the confirmation email or ticket for each passenger on your booking.

Always keep your booking code confidential. If you share your booking code with others, they will be able to access your booking details through our system.

If you are traveling with others and do not want them to have access to your booking details, it may be preferable for each person to make a separate booking.

Take precautions and protect yourself against online fraud and phishing.

There is an online fraud practice known as phishing, which involves the illegal acquisition of personal data through deception. Unsolicited emails are sent to people on lists obtained illegally by third parties, asking them to enter or confirm bank details or passwords on a cloned or fake website.

When do we collect your personal data?

We collect personal data about you whenever you use our services (whether provided by LEVEL or by other companies or agents acting on our behalf), including when you travel with LEVEL, use our website, or interact with us electronically or through our help and support centers.

For more information, please see “What types of personal data do we collect and retain?” below.

In addition, we may receive personal data about you from third parties, such as:

Companies we have contracted to provide you with a service.
Companies involved in your travel plans, including airlines involved in your previous or subsequent trip, airport operators, and customs and immigration authorities.
Companies that participate in our loyalty and other add-on programs (for example, car rental companies and hotels).

What types of personal data do we collect and store?

When you use our services, you will need to provide us with your personal data or the data of the person or people who will be traveling.

We collect the following categories of personal data:

Data you provide to LEVEL to complete and manage a booking you have made with LEVEL or a service you have requested from us.

Your name, address, email address, date of birth, gender, passport number, account details, and payment information.

If you purchase tickets for a third party, we may collect your billing information but contact the other person directly regarding the flight.

We will know if you booked your flight on flylevel.com or if you used another sales channel, such as a travel agency or our call center.

Data collected during your trip with LEVEL.

We may collect certain information, such as your interactions with staff and cabin crew before and during the flight.

Information about your travel program.

Details relating to your booking, travel itinerary, details of any additional assistance you request, and other information related to your trip, such as special dietary requirements.

Information about services we have provided to you in the past.

Information about previous trips, such as the trips taken and all related matters, including upgrades, baggage requirements, airport issues, lost luggage, and your feedback as a customer.

Information about your online registration and other interactions.

We will retain your data if you have participated in any contest or promotional activity, or have interacted with us through social media such as Facebook, Instagram, or Twitter. We may also receive information when you click on one of our emails or browse our website. Additionally, we may receive information about how you found us online or the sites you have previously visited.

When and why do we collect “sensitive personal data”?

Certain categories of personal data, such as those relating to racial or ethnic origin, religion, health, sexual orientation, or biometric data, constitute special categories of personal data that require additional protection under European Union data protection law and are referred to as “sensitive personal data.” We generally try to limit the circumstances in which we collect and process data of this nature. The following are examples of situations in which we might collect and process sensitive personal data:

When you have requested specific medical assistance from LEVEL and/or an airport operator, such as a wheelchair or oxygen.
When you have requested authorization to fly with LEVEL due to a specific medical condition or because you are more than 28 weeks pregnant.
When you have chosen to provide us with this information for any other reason or it has been provided to us by a third party, such as the travel agency through which you made your booking.

Likewise, you may have requested a special service (such as a menu) that does not in itself constitute sensitive data but may imply or suggest information about your religion, your health or other data.

What do we use your personal data for, and on what legal grounds?

The main purposes for which we process your personal data are outlined below:

In certain cases, this purpose may also be based on the consent you have previously given us. For example, during the consultation or ticket booking process through our website, we may request your authorization to send you specific information electronically about your visit and the interests you expressed during it, even if you ultimately did not make a purchase during that visit.

Based on our contractual relationship with you, to process all matters related to your trip and provide you with the requested services.

We will need to use your name, address, email address, contact details, date of birth, gender, passport or national identity card number, and your payment information to process your bookings, manage travel-related services, collect payment for our services, provide information to the relevant authorities (such as tax, customs, and immigration authorities), and for LEVEL to know who has a flight reservation.

Based on our contractual relationship with you, we will also use your information to manage the boarding process and facilitate connecting flights at the airport.

If you do not show up at the gate for your flight, we may need to check whether you have passed through airport security or were on a connecting flight to determine how to contact you regarding your boarding.

At some airports where we operate, facial recognition technology is used (the use of this technology is voluntary unless required by law).

Based on our contractual relationship with you, we may send you status updates and service or operational communications regarding the contracted service, regardless of the channel (direct sale or through agencies/other airlines, online or in-person sales, etc.) through which you contracted our services.

We may send you communications informing you that check-in is open, that your flight has been delayed or canceled, or generally of any changes affecting services contracted with LEVEL or with airlines with which LEVEL has a transportation agreement.

We may also use the contact information you have provided to notify you of other operational communications.

Based on compliance with our legal obligations, we may use your contact information to manage immigration procedures and/or entry into or exit from the territory of a State, ensure your safety, and comply with other legal requirements applicable to LEVEL. Furthermore, in certain cases, we will be required to share your contact information with local or international health authorities.

As an airline, LEVEL is required to maintain passenger records for all passengers on board its aircraft.

The laws of certain countries, such as the U.S. and the European Union, require airlines to provide certain passenger information to customs and immigration authorities.

Furthermore, national regulations establishing entry requirements for passengers in certain countries often require airlines to verify compliance with these requirements before admitting or denying boarding.

In addition, if you have flown on one of our flights and a passenger on board has been found to have an infectious disease, we may be required to share your information with the relevant health authorities. This may be because we are legally obligated to do so, or for reasons of public interest related to public health and to safeguard your own vital interests, those of other passengers, and those of third parties in general.

Finally, the fight against fraud and major crimes (illegal trafficking of people, substances, or goods, terrorism, etc.) requires airlines to respond to information requests from the competent law enforcement agencies in the countries where they operate.

Based on our legitimate business interests, we may use your information to conduct direct marketing activities and keep you informed about LEVEL products and services that we believe best suit your needs and preferences.

We may send you information about our products and services via email.

We may tailor the content of our websites, emails, and other communications to ensure they are of the greatest possible interest to you, including information on past destinations with offers and/or services related to those or similar destinations.

We may also use your information to understand your flight preferences and needs when traveling with us and to provide you with information about offers, such as seat selection, additional baggage allowances, or upgrades.

In certain cases, this processing may also be based on your prior consent. For example, during the process of consulting or booking tickets through our website, we may ask for your authorization to send you specific information electronically about your visit and the interests you showed during it, even if you did not end up making any purchase during that visit.

Based, as applicable, either on our legitimate business interests or on the consent you have previously given us, we may record electronic communications and instructions generated during your use of any customer service channel. Therefore, we will process your personal data, including your voice when you contact us through these channels, to document the transactions carried out for any applicable legal purposes.

Based on our legitimate business interests, and unless you expressly object, we may also use the information you provide or that we obtain to enrich our customer database, defining market or customer segments, establishing or calculating different levels of customer engagement with LEVEL and/or its products or services. This will allow us to offer you a more personalized service proposal, such as inviting you to participate in campaigns or events that better suit your preferences, or developing products, services, or shopping interfaces that improve your shopping experience or increase your satisfaction.

Based on our contractual relationship with you, we may send you updated information and operational communications.

Even if you have opted out of receiving marketing communications, we may still send you operational communications about services you have already booked or contracted, such as your travel itinerary. These communications will help you obtain details of the services you have booked and may include options and add-ons to the services you will use (for example, advance seat selection, additional baggage, and advance meal booking).

Based on our legitimate business interests, we may use your information to improve our website, products, and services.

We may track how you and other customers use our website so that we can identify ways to improve your browsing experience. We may also use this information to define and compare common behavior patterns and distinguish them from those that may be considered malicious, to detect and prevent fraud, and to implement and improve our established security and cybersecurity protocols.

We will review the communications you make and send us through social media and other online channels to respond to you and take business actions that allow us to improve your perception of our brand or our services.

We may also invite you to participate in surveys to understand your level of satisfaction with the service and benefits you receive when traveling with LEVEL and using our services.

Based on our contractual relationship with you, we may use your data to manage transactions, operations, product and service purchases made through any means, or any inquiries, complaints, claims, or suggestions you may submit.

Based on compliance with our legal obligations, we may also use your data for other management and administrative purposes, as applicable.

We may use and retain your personal data, including your purchase history, for administrative purposes. This may include, for example, accounting and billing, auditing, credit card or other payment card verification, fraud prevention (including the use of credit reporting agencies, cross-referencing with financial institutions and other companies that process electronic payments, and payment card validation checks), and testing, maintenance, and system development.

Based on a legal obligation to properly manage emergency situations, disasters, or other force majeure events, we may need to share your data with various individuals, companies, or organizations whose cooperation is essential for LEVEL in these cases.

In what cases do we process your data automatically?

There are situations in which we will process your data fully or partially automatically. For example:

When you use our online bots and virtual assistants, which are based on artificial intelligence. The use of these interfaces is voluntary, and you can always choose to contact one of our agents at our customer service call center as an alternative.

When you make a purchase or book tickets on our website or app, several automated actions are performed, from recording your booking in our systems and sending you electronic communications to confirm it, to verifying the legality of the transaction with the payment method you used for the purchase.

When changes are made to your booking due to a flight disruption or a change in our flight schedule, we will send you an informational notification about these changes and the alternatives available to you, in order to comply with the terms of our contract of carriage and/or our legal obligations to you under that contract.

We will also process your data when we send you personalized information about products and services that we believe may be of particular interest to you, or when we suggest changes to your booking that, in our opinion, may better suit your needs or be of particular interest to you; either because you have given us your prior consent to do so, or because we have informed you of our intention and you have not objected.

Furthermore, we will process your data in the resolution of certain types of claims that you have submitted through our website (for example, requests for compensation for flight delays or cancellations), unless you have informed us of your objection to such automated processing.

When you use the biometric identification and boarding systems at some of the airports where we operate, provided you have consented to the use of your data when registering for these services through our applications or third-party applications (such as those of airport operators or any other airline associated with the same program).

In cases where any of our processing or automated decisions are based either on our legitimate business interests or on your prior consent, you may always object to the processing or withdraw your consent at any time thereafter – as applicable – without such objection or withdrawal having retroactive effect.

IMPORTANT: If the processing of your data is subject to regulations other than Spanish and/or European Union law, the legal basis for some of the processing activities listed above may differ from that indicated in each case; especially when the stated legal basis for processing is our legitimate business interests. In such cases, and unless the processing in question can be understood as being justified by the need to fulfill our contractual relationship with you, or by some legal obligation to which we are subject, such processing may only be justified by the consent you have given us in each case, and only to the extent that you have given it to us in compliance with the validity requirements established by the applicable data protection regulations.

When will we send you marketing communications?

When we collect data directly from you, we may ask whether or not you wish to receive our marketing communications. Please note that these marketing communications may be about our products and services that may be of interest to you, and occasionally, they may be marketing communications promoting the products and services of other companies in our group or a third party.

We only allow third parties or other companies in our group to send you marketing communications when we have obtained your consent.

We will respect your decision regarding which communications you wish to receive and through which channels you wish to receive them.

How can you change the type of marketing communications you receive and how you receive them?

If you decide you no longer wish to receive marketing communications, you can change your mind at any time. All marketing communications we send you by email include an "unsubscribe" option that will allow you to stop receiving marketing emails.

Please note that if you inform us that you no longer wish to receive marketing communications, you will still receive communications (such as those described above) related to the products and services you have booked, such as confirmations or updates on the status of your reservation.

How long do we keep personal data?

We will keep your personal data for as long as necessary for the purpose for which it is being processed. For example, when you make a reservation with LEVEL, we will keep the information related to it in order to process the specific travel services you have requested and, subsequently, for as long as it allows us to manage or respond to any claims or inquiries related to the reservation. We may also keep this information to continue improving your experience with LEVEL and ensure you receive any benefits from our loyalty programs.

We will actively review the data we hold and securely delete it, or in some cases, anonymize it, when there is no longer a legal, commercial, or customer-related need to retain it.

Who do we share your personal data with?

We may share your personal data with companies in our group, including International Consolidated Airlines Group S.A. (IAG), British Airways, Iberia, Iberia Express, Vueling, Aer Lingus, British Airways Holidays, Avios, BA CityFlyer, IAG Connect, and IAG GBS. For more information about our group, please visit the website of our parent company, IAG.

We share information with these companies so they can help us provide you with services and get to know you better. For example, if you have flown with any of the other IAG group companies, we may use that information to better understand the types of travel services that might interest you.

You will only receive marketing emails from other companies in our group if you have given them your consent.

We may also disclose your personal data to the following third parties for the purposes described below:

Customs and immigration authorities of any country included in your itinerary or over which your flight may fly.

LEVEL and other airlines are required by EU, US, and other national laws to provide border control and customs authorities with access to booking and travel information when your flight originates in or is destined for these countries, including layovers, and when it flies over them to reach its destination. If your flight involves flying over the US, this information will be provided to the relevant US authorities.

Airlines and other service providers necessary for the provision of the services you request when, for example, part of your travel itinerary includes a flight operated by a different airline or includes car rental or a hotel reservation. These companies will be identified when you make a booking.

If your destination involves a connection from LEVEL to another airline, whether or not it belongs to the IAG group.

Our partner airlines, for example, to facilitate your connecting flights. Also, travel agencies and other third parties through whom you make your booking.

Credit and debit card companies, credit reporting agencies, and fraud control service providers, to process payments and (when necessary) perform fraud checks.
In response to legal and valid requests from governments and law enforcement agencies, such as customs and immigration authorities.
Third parties, such as law firms and courts, to enforce or require the performance of a contract with you.
Third parties, such as police and regulatory authorities, to protect our rights, property, or the safety of our customers, staff, and assets. Third parties to whom we provide website usage data (but not your personal data) so they know you have visited our website (see the section “How we use cookies and other methods to collect data on website usage” above).

We do not sell your personal data and only allow third parties to send you marketing communications if you have given your consent.

For the US and Canada only: Consent to participate in LEVEL’s SMS/mobile text messaging program is specific and voluntary for customers. LEVEL will not purchase any consent for this, and LEVEL will not sell, rent, or share this consent with third parties.

To which countries will your personal data be sent?

Your personal data may be sent to third parties located outside the country you are in and outside the European Economic Area and the United Kingdom.

The nature of our business means that it is often necessary to send your personal data outside the European Economic Area to manage services related to your trip. This is because our business and the companies identified in the section “Who do we share your personal data with?” operate in countries around the world. For example, when you fly outside the European Economic Area, your personal data will be transferred to border control and immigration authorities located outside those territories.

We may also transfer your personal data to third parties located outside the country you are in so that they can provide us with services related to the products and services you have requested.

What rights do you have regarding the data we hold about you?

In accordance with European data protection regulations and local regulations,

You may exercise your rights of access, rectification, and erasure of your data, as well as request the restriction of processing of your personal data, object to such processing, request data portability, and not be subject to automated individual decision-making by contacting us at DPO@flylevel.com.

To process your request, you must provide us with the information and documentation required in the aforementioned form:

Your full name
Identity document
Contact information (at least email address)
Data subject to your request
Any information that may help us locate the data subject to your request, such as booking references, flight numbers, and dates
A photocopy of your identity document or passport so that we can verify your identity.
If you are submitting the application on behalf of another person, you will need to provide an authorization signed by that person along with their corresponding identity document.

Which Data Protection Authority can you file a complaint with?

You can file a complaint with the Spanish Data Protection Agency (AEPD), especially if you have not received a satisfactory response regarding the exercise of your rights, through their website www.aepd.es.