The website is operated by [AIRLINE LEGAL ENTITY], trading as Global Air Scandinavia, with its headquarters in Stavanger, Norway ("Global Air", "we", "us"). Global Air is the controller of the personal information described in this Policy — that is, the organisation that decides why and how it is used.

Where a booking involves another carrier, an airport, a ground handler or a government authority, that organisation will normally be a separate controller of the information it receives, and its own privacy notice will apply to what it does with that information.

The information we hold about you depends on how you use the website and, in future, whether you fly with us. The main categories are set out below.

Identity and passenger information

Your name as it appears on your travel document and, where a booking or destination requires it, your date of birth, nationality, gender and passport or other travel-document details (number, issuing country and expiry date). Travel-document details are collected only when a route or regulation requires them, and are used to issue tickets and to meet advance-passenger-information obligations.

Contact information

Email address, telephone number and, where relevant, a postal or billing address. We use these to send booking confirmations, verification codes, schedule changes and other service messages, and to respond when you contact us.

Booking information

Booking reference, itinerary and flight details, ticket numbers, fare class, seat selection, baggage and other optional extras, special-service requests, the acknowledgements you give during the booking process, and any travel preferences you save to your account.

Payment information

No payment is taken through the website at present. When paid bookings become available, payment will be handled by a third-party payment processor. Global Air will receive confirmation of payment, the amount, the currency and the last four digits of the card used, so that we can match the payment to your booking and handle refunds. We will not store full card numbers or security codes on our own systems.

Account information

The email address and password you use to sign in (passwords are stored in hashed form and cannot be read by us), the one-time verification codes issued when you sign in and the results of those checks, your profile details and photograph if you add one, your notification preferences, and your loyalty-programme registration and, in future, membership status.

Communications

Messages you send to our customer-service team by email or through the channels on the Contact page, your conversations with the support assistant on the website, and any feedback or survey responses you give us.

Technical information

Information sent by your browser or device when you use the website, such as your IP address, browser type and version, operating system, device type, screen size, the pages you visit and the links you follow, referring pages, and approximate location inferred from your IP address. Some of this information is collected through cookies and similar technologies, described in section 7.

Preferences stored on your device

The website remembers your chosen language (English or Norwegian), your light-or-dark display preference and, if you tick "Remember me", the email address you sign in with. These settings are stored in your browser's local storage rather than on our servers, and you can clear them at any time through your browser.

Most of what an airline holds about its passengers is ordinary contact and travel information. Some requests, however, can involve information that is treated as sensitive under data-protection law — for example a request for wheelchair assistance, a medical clearance to fly, oxygen on board, a dietary requirement linked to a religious belief or medical condition, or the carriage of a service animal.

We collect information of this kind only when you give it to us in connection with such a request, or when it is needed to look after you during a journey. We use it for that purpose alone — to arrange the assistance, meal or clearance you asked for and to brief the staff who need to know — and we share it only with the airports, handling agents and other parties who have to act on it.

Where the law requires your explicit consent to handle this kind of information, we will ask for it at the point where you make the request. You can withdraw that consent at any time, although we may then be unable to provide the assistance concerned.

The website does not currently offer forms for these requests; they are handled through our customer-service team. This section will be updated if that changes.

Most of the information we hold comes directly from you — when you create an account, enter details into the booking tool, register for the loyalty programme, complete a contact form or write to us. Technical information is collected automatically by our systems and by the cookies described in section 7.

Once flights are operating, we may also receive information from:

• travel agents, online travel agencies and corporate booking tools that make reservations on your behalf;
• other airlines, where your itinerary includes a connection or codeshare;
• our payment processor, confirming that a payment has succeeded, failed or been reversed;
• airports, ground-handling companies and border authorities, in connection with check-in, baggage handling and travel-document checks;
• fraud-prevention services, where a booking or payment is flagged for review; and
• the person who made a booking that includes you as a passenger.

If you give us information about another passenger, please make sure they know you have done so and how we will use it.

We use personal information for the following purposes.

• Running the website and your account — creating and securing your account, sending sign-in verification codes, remembering your preferences and responding to your requests.
• Processing bookings — checking availability, recording passenger details, issuing tickets, taking payment through our processor, sending confirmations and managing changes, cancellations and refunds.
• Operating flights — producing passenger manifests, arranging seats, baggage and extras, providing any assistance you have requested, and meeting check-in, boarding and security requirements.
• Keeping you informed — telling you about schedule changes, delays, gate changes and other matters that affect a journey you have booked. Messages of this kind are part of the service and are sent regardless of your marketing preferences.
• Customer service — answering your questions, handling complaints and claims, and keeping a record of our correspondence so that we can deal with follow-up questions.
• The loyalty programme — recording your pre-launch registration and, when the programme starts, administering your membership, tier and benefits.
• Security and fraud prevention — detecting and preventing unauthorised access to accounts, fraudulent bookings and misuse of the website.
• Improving our services — understanding how the website is used so that we can fix problems, make it easier to use and plan what to build next. Where we can, we use aggregated or anonymised information for this.
• Legal and regulatory obligations — complying with aviation-security, immigration, customs, tax and accounting requirements, and responding to lawful requests from authorities.
• Marketing — sending you news, offers and travel inspiration where you have signed up to receive them or where the law otherwise allows, as described in section 13.

We do not sell personal information, and we do not use it for purposes unrelated to the ones above without telling you first.

Where data-protection law requires us to have a legal basis for using your information, we rely on one or more of the following, depending on the activity.

• Performance of a contract — most of what we do with booking, account and payment information is necessary to provide the services you have asked for.
• Legal obligation — aviation-security, border-control, tax and accounting rules require us to collect certain information and to keep it for defined periods.
• Legitimate interests — we rely on our legitimate interests in running a secure and well-functioning website, preventing fraud, improving our services, defending legal claims and, in some cases, keeping in touch with existing customers. When we rely on this basis we consider whether our interests are outweighed by yours.
• Consent — for non-essential cookies, for marketing communications where the law requires opt-in consent, and for sensitive information where consent is the appropriate basis. You can withdraw consent at any time.
• Vital interests — occasionally, for example in a medical emergency on board, we may need to share information to protect someone's life or health.

No single legal basis covers everything. If you would like to know which basis applies to a particular activity, contact us using the details in section 18.

Cookies are small files placed on your device by a website. Similar technologies include local storage and pixels. The website uses them in the following ways.

• Strictly necessary — required for the website to work, for example to keep you signed in, protect against cross-site request forgery and record your cookie choices. These cannot be switched off through the banner.
• Preferences — remember settings you have chosen, such as language and display mode.
• Analytics — help us understand how visitors use the website, which pages are popular and where people run into difficulty, so that we can improve it. Analytics cookies are set only if you allow them.
• Marketing — if introduced, would be used to measure the effectiveness of our advertising and show you relevant offers on other sites. We do not currently set marketing cookies, and if that changes they will be off unless you enable them.

When you first visit the website you will see a consent banner provided by Cookiebot. It lets you accept or decline each category of non-essential cookies, and it lists the individual cookies in use, who sets them and how long they last. You can change your choices at any time using the "Cookie Settings" link in the footer of every page, or by clearing cookies in your browser.

The interactive destination map loads map imagery from a third-party mapping provider. When the map is displayed, your browser requests those images directly from the provider, which therefore receives your IP address and standard browser information. The map is shown only on the Destinations page.

Blocking strictly necessary cookies may prevent parts of the website, including sign-in and the booking tool, from working.

We share personal information only where it is needed for one of the purposes in section 5, and only with the following categories of recipient.

• Service providers acting on our instructions — the hosting and platform provider that runs the website, the email service that delivers verification codes and booking notifications, reservation and departure-control technology providers, cloud storage, customer-support tools and IT-support providers. These providers are bound by contracts that limit what they can do with your information.
• Payment processors — when paid bookings are introduced, to take payment and handle refunds and chargebacks.
• Airports, ground handlers and other carriers — to check you in, handle your baggage, provide assistance you have requested and operate connecting or codeshare flights.
• Government and regulatory authorities — border-control, customs, aviation-security and other agencies in the countries you depart from, fly over, transit or arrive in, where the law requires us to transmit passenger information. Such transfers are compulsory and are not dependent on your consent.
• Law-enforcement bodies and courts — where we are required to do so by law or a valid legal process, or where disclosure is necessary to protect the safety of passengers, staff or the public.
• Fraud-prevention and identity-verification services — to check bookings and payments that show signs of fraud.
• Professional advisers — lawyers, auditors and insurers, where necessary to obtain advice, meet our obligations or handle a claim.
• A buyer or successor — if Global Air or part of its business is sold, merged or reorganised, personal information may be transferred to the new owner, who will be bound by this Policy until it is updated.

We do not sell personal information to third parties, and we do not allow our service providers to use it for their own marketing.

Air travel is international by nature. Operating a flight to another country means sharing information with airports, handlers and authorities in that country, and some of the technology providers that support the website are based, or process information, outside Norway and the European Economic Area.

Where personal information is transferred to a country whose data-protection laws are not recognised as providing an equivalent level of protection, we take steps to protect it in accordance with applicable law. Depending on the recipient, those steps may include contractual safeguards approved by the relevant authorities, reliance on an adequacy decision covering the destination country, or, for transfers to border and aviation authorities, reliance on the legal obligation to transmit passenger data.

You can ask us for more information about the safeguards that apply to a particular transfer using the details in section 18.

We keep personal information for as long as we need it for the purpose it was collected for, and for as long afterwards as the law or our legitimate business needs require. In practice that means:

• account information is kept while your account is open and for a period afterwards to handle any follow-up queries, unless you ask us to delete it sooner;
• booking and payment records are kept for the period required by accounting, tax and aviation regulations, and for as long as a claim relating to the journey could be brought;
• customer-service correspondence is kept for as long as needed to resolve the matter and to deal with related questions;
• sign-in verification records are kept for a short period for security and audit purposes and are then deleted;
• technical logs are kept for a limited period for security and troubleshooting; and
• marketing preferences are kept until you unsubscribe, and a record of your unsubscribe request is kept so that we can honour it.

When information is no longer needed we delete it or anonymise it so that it can no longer be linked to you. We are preparing a detailed retention schedule, and specific periods will be added to this Policy once it is finalised.

We use technical, organisational and administrative measures that are appropriate to the sensitivity of the information we hold. They include encryption of data in transit, hashed storage of passwords, a one-time email code as a second step when signing in, access controls that limit who within Global Air and its providers can see personal information, security review of the systems the website depends on, and logging so that we can investigate incidents.

No method of transmitting or storing information over the internet is completely secure, and we cannot guarantee that unauthorised access will never occur. If we become aware of a breach that affects your information and is likely to put you at risk, we will tell you and the relevant supervisory authority as the law requires.

You can help protect your account by choosing a strong password that you do not use elsewhere, by keeping it to yourself, and by telling us straight away if you suspect someone else has used your account.

Depending on where you live and which law applies, you may have some or all of the following rights in relation to your personal information.

• Access — to be told whether we hold information about you and to receive a copy of it.
• Correction — to have inaccurate or incomplete information corrected. You can update most account details yourself in the account area.
• Deletion — to ask us to delete information we no longer have a reason to keep.
• Restriction — to ask us to limit how we use your information in certain circumstances, for example while a dispute about its accuracy is resolved.
• Objection — to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Portability — to receive information you provided to us in a structured, machine-readable format, and to have it sent to another organisation where that is technically feasible.
• Withdrawal of consent — where we rely on consent, to withdraw it at any time without affecting the lawfulness of what was done before.
• Complaint — to lodge a complaint with the data-protection supervisory authority in the country where you live, work or where you believe a breach has occurred.

These rights are not absolute. We may need to keep information that you ask us to delete, for example because a regulation requires us to retain booking records, and we may ask you to verify your identity before acting on a request so that we do not disclose information to the wrong person.

To exercise any of these rights, contact us using the details in section 18. We will respond within the time limit set by applicable law and will not charge a fee unless a request is clearly unfounded or excessive.

If you sign up for our newsletter, register for the loyalty programme or otherwise agree to hear from us, we may send you news about the launch of Global Air, new routes, fares, offers and travel inspiration by email. Where the law requires it, we will ask for your consent before sending marketing messages.

Every marketing email includes an unsubscribe link. You can also opt out through the notification settings in your account or by contacting us. We will act on an opt-out promptly, although you may receive a message that was already scheduled before your request took effect.

Opting out of marketing does not stop service messages — booking confirmations, verification codes, schedule changes, safety information and similar communications — because these are part of providing the service you have asked for.

The newsletter sign-up in the website footer is being prepared and does not yet subscribe you to a mailing list. This section will apply in full once it does.

The website is designed for adults arranging their own travel or travel for their family. It is not directed at children, and we do not knowingly allow children to create accounts or register for the loyalty programme on their own where the law that applies to them does not permit it.

Information about children travelling as passengers is collected from the adult making the booking and is used only to process that booking and provide the journey. If you believe a child has provided personal information to us directly without appropriate permission, please contact us and we will delete it.

The website contains links to sites and services run by other organisations — including our LinkedIn page, the personal website of our founder, and, in future, our payment processor. Those sites have their own privacy notices, which apply instead of this Policy once you leave our website. We encourage you to read them.

We are not responsible for the content or privacy practices of third-party sites, even where we have chosen to link to them.

We do not currently make decisions about you that have legal or similarly significant effects based solely on automated processing. The support assistant on the website uses automated technology to answer questions, but it does not make decisions about your bookings, account or eligibility for anything.

Some routine processes are automated — for example verifying a sign-in code or, in future, screening payments for signs of fraud. Where such a process could lead to a booking being declined, a member of our team reviews the case before a final decision is taken, and you can ask us to explain and reconsider the outcome.

If this changes we will update this Policy and, where the law requires, seek your consent or provide additional safeguards.

We will update this Policy as the airline moves from planning to operation, as we add features to the website, and when the law changes. The current version is always published on this page, with the "Last updated" date shown at the top.

If a change significantly affects how we use your information, we will let you know in advance — by notice on the website, by email to account holders, or both — so that you can review the change before it takes effect.

Questions, requests and complaints about privacy can be sent to:

• Email: info@globalairscandinavia.com
• Telephone: +47 973 09 373
• Post: Global Air Scandinavia, Stavanger, Norway
• Privacy team: [DATA PROTECTION OFFICER / PRIVACY TEAM CONTACT]

Please mark privacy requests clearly so that they reach the right team. You can also reach us through the Contact & Support page. If you are not satisfied with our response, you have the right to complain to the supervisory authority described in section 12.