Revised date: 2020-10-22
This Privacy Policy applies to the companies listed here ("Aimia", "we", "us", "our") and explains how we collect, record, hold, store, use, disclose or otherwise process (collectively "Process") personal information.
Personal information (also referred to as "personal data" in some jurisdictions) is any information, or a combination of pieces of information, that can be used to identify you or that we can link to you, including but not limited to a name, address, email address or telephone number.
Our primary activity is assisting our clients in relation to their own loyalty and rewards programs and other customer related marketing functions, and helping our retailer clients and their suppliers understand their business performance and customer behavior (together, "Programs"). Where you are a member of, or otherwise participate in a Program, or are interested in or eligible to become a member of a Program, we may have access to your personal information. We Process this personal information on behalf of our clients, and our clients are responsible for its collection and use. Where European data protection law applies, Aimia entities are 'processors' of this personal information and, where they are required to by applicable data protection law, our clients will explain more about how personal information is used in their Programs.
Despite the above, we collect some personal information for our own use and this Privacy Policy describes the purposes for which we carry out that Processing. Unless we inform you otherwise, the Aimia entity that you enquire about, communicate with, whose website you visit (where that website links to this Privacy Policy), or that you receive services from or provide services to is responsible for the collection and use of your personal information. Where European data protection law applies, this entity is known as the 'controller'.
This Privacy Policy does not apply to:
• Aimia Inc., its subsidiaries, and programs in which Aimia, Inc. has investments, such as Cardlytics and Club Premier - you can find out more about how personal information is used in these programs by visiting their respective websites; or
• the Air Miles Middle East program, which has its own distinct privacy policy available on the Air Miles Middle East website that describes how personal information is used in that program; or
• collection and use of information relating to our staff (including our employees, interns, consultants, and independent contractors). These individuals can obtain further information about the Processing of their personal information by contacting their local People & Culture department; or
• collection and use of personal information during our recruitment processes. Further information about the Processing of personal information during the recruitment process can be obtained by contacting your local People & Culture department.
To ask questions about our privacy practices, change your marketing preferences, issue a complaint or exercise any of the rights that applicable data protection law grants you in relation to your personal information, please contact us using the details at the end of this Privacy Policy.
1. COLLECTION OF PERSONAL INFORMATION
We will collect personal information about you for our own use from a variety of sources, including directly from you and from other sources, as described below.
We collect personal information directly from you when you:
• visit our website(s) which link to this Privacy Policy;
• enquire about, access or use our services;
• contact us with questions, requests or comments;
• submit requests for brochures, to join a mailing list or to be contacted for further information about our products or services;
• enter competitions or trade promotions conducted by us or on our behalf;
• contact our call centres or otherwise request support from us; respond to surveys or research conducted by us or on our behalf.
The types or categories of personal information we will collect and Process will depend on the circumstances, and may include:
• contact details (e.g., your name, address, email, phone numbers);
• in some cases, information required for you to do business with us, including bank account details, and any other relevant financial information;
• information on prior dealings with Aimia;
• age and information on personal lifestyle preferences;
• information that you have provided to us, for example, contact details, details of a question or request; and
• information we collect automatically from you, such as statistical information regarding the use of the Aimia websites, including cookies, website users' IP addresses and the dates and times of visits. Further information about our use of cookies and tracking technologies is available in our Cookie Policy, which can be found here.
• Where permitted by applicable law, we may also collect and Process personal information from other sources for our own use, including but not limited to information from:
o social media platforms (for example, when you interact with us on those platforms or access our social media content); and
o publicly available or publicly accessible sources.
The categories of information that we collect about you from other sources may include:
• personal details (e.g. name, date of birth); and
• contact details (e.g., your address, email, phone numbers).
• commercial information (e.g., your employer, position, experience)
Please note that we may be required by law, or as a result of a contractual or other relationship we have with you, to collect certain personal information about you. Failure to provide this information may prevent or delay the fulfilment of these obligations. Where required by law, we will inform you at the time your information is collected whether its provision is compulsory and of the consequences of the failure to provide such information.
Our websites are not directed toward individuals under the age of 16 and we do not knowingly or intentionally collect or process personal information from individuals under the age of 16.
Our website does not honour “do not track” settings on web browsers and does not offer you the opportunity to request that we not track your use of its services except as otherwise stated in this Privacy Policy or our Cookie Policy.
2. USE AND DISCLOSURE OF PERSONAL INFORMATION
We Process your personal information to:
• Communicate with you regarding our companies, products and services;
• supply products or services to you and our clients;
• obtain products and services from our suppliers;
• respond to enquiries from existing or prospective clients seeking information about our products or services;
• facilitate the transactions that you have or may have with Aimia;
• maintain our internal records and the security of our systems, services and premises;
• enforce agreements between you and Aimia;
• undertake research, conduct surveys and analyse statistical information, including about the use of our websites;
• conduct competitions and trade promotions;
• comply with legislative and our policy requirements, including in relation to occupational health and safety and environmental matters;
• respond to the enquiries, questions or requests you have contacted us with; and
• where permitted by applicable law, contact you with or display marketing and offers relating to products and services offered by us, and personalise the marketing messages we send you to make them more relevant and interesting.
We may automatically Process your personal information to evaluate personal aspects and predict outcomes. For example, we may make automated decisions about you based on your personal information to show tailored content on our websites. These types of decisions will not have legal or similar effects for you, but you can still contact us for further information.
European data protection law requires us to have a legal basis to Process your personal information. In most cases where we need a legal basis, it will be one of the following:
• to fulfil our contractual obligations to you, for example to provide the services you have requested. Failure to provide this information may prevent or delay the fulfilment of these contractual obligations;
• to comply with our legal obligations; or
• to meet our legitimate interests, for example to understand how you use our services and to enable us to derive knowledge from that information to develop new services. When we Process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
We may also obtain your consent to collect and Process certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, our use of cookies and similar technologies (for more information please see our Cookie Policy)). If we ask for your consent to Process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Policy.
In carrying out our business, we may share your personal information with third parties, For example:
• Affiliated companies: we may share personal information, including for example, information relating to your inquiry about our services, between with and among our affiliated companies.
• Service providers: like most large organisations we use a range of service providers to help us maximise the quality and efficiency of our services and our business operations. This means that individuals and organisations outside of Aimia, such as primary and secondary research providers, analytics, insight and consultancy providers, reward fulfilment suppliers and mail houses, will sometimes have access to personal information held by us and may use it on our behalf.
• Law enforcement agencies, courts, regulators, government authorities or other third parties: we may share personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
• Asset purchasers: we may share personal information with any third party that purchases, or to which we transfer, any of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this Privacy Policy.
3. TRANSFERRING PERSONAL INFORMATION OUTSIDE THE JURISDICTION IN WHICH IT WAS COLLECTED
We may disclose personal information to destinations outside the jurisdiction from which it was collected.
In the conduct of our business, we disclose to, hold or access personal information from various countries, including without limitation, Australia, Bahrain, Canada, Hong Kong, South Korea, Japan, Malaysia, Singapore, Qatar, United Arab Emirates, Sweden, Portugal, United Kingdom, and the United States of America.
The privacy laws of the countries to which we transfer personal information may not provide the same level of protection as the privacy laws of the country from which the personal information was collected or be regarded as ensuring an adequate level of protection for personal information under European data protection law. However, this does not change our commitments to safeguard your privacy and we will put in place appropriate safeguards in accordance with applicable legal requirements to ensure that your personal information is adequately safeguarded. For more information on the appropriate safeguards in place, please contact us using the details below.
4. BUTTONS AND LINKS TO OTHER WEBSITES
Our websites may contain links to third party websites, content embedded in our websites that comes from or relates to other websites and services, and buttons from other websites and services such as social media websites. These third-party websites and services may use cookies or other tracking devices to collect and track information about you across the Internet - please see our Cookie Policy for further information. As well, these third party websites and services are not under our control and we are not responsible for the content of those websites or services, their data collection practices, nor their privacy practices, and those websites and services are not subject to this Privacy Policy. Before disclosing your personal information on any other website or service we recommend that you examine the terms and conditions and privacy policy of that website or service. Aimia is not responsible for any practices on third party website or service that might breach your privacy.
5. YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION
Subject to local applicable law, you have a number of rights in relation to your personal information, including the right to:
• access your personal information;
• rectify the personal information we hold about you;
• erase your personal information;
• restrict our use of your personal information;
• object to our use of your personal information;
• receive your personal information in a usable electronic format and transmit it to a third party (this is known as the 'right to data portability'); and
• lodge a complaint with your local data protection supervisory authority.
If you would like to discuss or exercise such rights, please contact us at the details below.
We encourage you to contact us to update or correct your personal information if it changes or if the personal information we hold about you is inaccurate.
We will contact you if we need additional information from you in order to honour your requests.
Nevada Residents: If you are a Nevada resident, you have the right under Nevada law to request that we do not sell your personal information for monetary consideration to certain other parties. This right applies even if your personal information is not currently being sold.
California Residents: If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA) described below:
• Do Not Sell My Personal Information: You have the right to opt-out of the sale of your personal information. We do not currently sell (as sell defined in the CCPA) any personal information.
• Your Right to Disclosures: You have the right to know and may request from us:
• The categories of personal information we have collected about you.
• The categories of sources from which we collect personal information.
• Our business or commercial purpose for collecting personal information.
• The categories of personal information that we disclosed about you for a business purpose.
• The categories of third parties with whom we share personal information.
• The specific pieces of personal information we collected about you.
• Your Right to Data Deletion: You have the right to request that we delete any personal information about you that we have collected. The CCPA does not obligate us to delete information under all circumstances, including where we need the information to provide our services to you, to detect security incidents, to identify errors in our services, or to comply with legal obligations. We will also maintain a record of your requests to exercise your rights under the CCPA.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
6. SECURITY OF YOUR PERSONAL INFORMATION
We will endeavour to take all reasonable steps to keep secure any personal information which we hold about you, and to keep this personal information accurate, up to date and complete. We require our employees and service providers to respect the confidentiality of any personal information held by us, and implement appropriate safeguards as required under local applicable law.
7. RETENTION OF PERSONAL INFORMATION
We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:
• maintain business records for analysis and/or audit purposes;
• comply with record retention requirements in accordance with applicable law;
• defend or bring any existing or potential legal claims; and
• deal with any complaints regarding the products and services we provide.
We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the information.
8. CONTACTING US
If you have any concerns or complaints about how we Process your personal information, or if you have any questions about this Privacy Policy, please contact us at DPO@Aimia.com
Aimia has appointed a data protection officer. The data protection officer can be contacted at: DPO@aimia.com.
Subject to local applicable law you also have the right to lodge a complaint with your data protection supervisory authority. For individuals in Europe, the relevant data protection supervisory authority will be that in the European country where you work, reside or where the subject-matter of your complaint arises.
Nevada Residents: If you are a Nevada resident and wish to exercise your rights under Nevada law (see Section 5 above), you may submit your request by sending an email to DPO@aimia.com. We will need to verify your identity in order to process your request.
California Residents: If you are a California resident and wish to exercise your rights under the CCPA, you may do so via an interactive web form, or via the toll-free number 1-866-467-8688 (enter service code #947). We will need to verify your identity in order to process your requests.
9. FUTURE CHANGES TO THIS PRIVACY POLICY
We operate in a dynamic business environment. Over time, aspects of our business may change as we respond to changing market conditions. This may require our policies to be reviewed and revised. We may change this Privacy Policy at any time. The most current version of this policy will govern our use of your information and will always be available via a link from our website. Please check this link often for changes. Where changes to this Privacy Policy will have a fundamental impact on the nature of the Processing or otherwise have a substantial impact on you, we will give you sufficient advance notice on our website so that you have the opportunity to exercise your rights (e.g. to object to the Processing).