1. Who is responsible for your personal data
AERTiCKET Sweden AB (“AERTiCKET”, “we”, “us”) is the controller for the processing of personal data described in this policy. We are part of the AERTiCKET Group.
AERTiCKET Sweden AB
Östergatan 21
211 25 Malmö, Sweden
Phone: +46 40 664 50 80
Email: helpdesk@aerticket.se
For questions about data protection or to exercise your rights, please email us and mark your message “Data protection”.
2. Who this policy covers
We are a business-to-business flight consolidator. This policy applies to personal data about:
- Business contacts and users – employees and representatives of travel agencies, tour operators, online portals, corporate customers, airlines and other partners, including users of AERTiCKET Flights and the AERTiCKET API;
- Travellers – passengers whose bookings are made through our services by a travel agency or another customer;
- Website visitors and enquirers – people who visit aerticket.se or contact us by phone, email or our contact form.
This policy does not cover websites or services run by airlines, payment providers or other third parties, even if you reach them through our services. Their own privacy policies apply.
3. Travel agencies and travellers
When a travel agency or other customer books through our services, it is the customer who has the relationship with the traveller. The customer is responsible for informing its travellers that their data will be shared with us and with airlines and other suppliers, and for having a lawful basis to do so.
We process traveller data as an independent controller to the extent necessary to make and issue the booking, handle changes, refunds and disruptions, settle the booking with airlines and comply with our legal obligations. Where we process personal data on a customer’s behalf for other purposes, we do so as a processor under a data processing agreement.
4. Personal data we process
| Category | Examples |
|---|---|
| Identity data | Name, title, date of birth, gender, nationality, frequent-flyer numbers |
| Travel document data | Passport or national ID details and visa information, where required by the airline or destination |
| Contact data | Email address, phone number, postal address, emergency contact |
| Booking data | Itineraries, booking references (PNR), ticket numbers, fares, seat, meal and baggage requests, changes, refunds |
| Business contact data | Company, role, work email and phone, authorisations, contract and customer numbers |
| Account and technical data | Usernames, login history, API credentials, IP address, browser and device information, log files |
| Payment and invoicing data | Invoices, payment history, bank details for refunds, limited card data processed by payment providers |
| Communication data | Emails, helpdesk tickets, contact form messages, notes from phone calls |
Special categories of data. In some cases a booking includes data that reveals health (for example a request for wheelchair assistance) or religious beliefs (for example a meal preference). We only process such data when it is necessary for the requested service and based on the traveller’s explicit consent, which the booking customer obtains, or where it is needed to protect the traveller’s vital interests.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Searching, booking and issuing tickets and ancillary services; handling changes, cancellations, refunds and disruptions | Performance of the travel contract concluded for the traveller (Art. 6(1)(b)) and our legitimate interest in fulfilling our contract with the booking customer (Art. 6(1)(f)) |
| Registering and administering customer accounts, users and API access | Legitimate interest in administering our business relationship with the customer (Art. 6(1)(f)); contract, where the customer is a sole trader (Art. 6(1)(b)) |
| Invoicing, payments, credit assessment and debt collection | Contract (Art. 6(1)(b)) and legitimate interest in managing credit risk (Art. 6(1)(f)) |
| Bookkeeping and tax | Legal obligation under the Swedish Bookkeeping Act (bokföringslagen 1999:1078) and tax legislation (Art. 6(1)(c)) |
| Helpdesk, emergency service and answering enquiries | Contract (Art. 6(1)(b)) or legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Preventing fraud and misuse, handling airline debit memos (ADMs), IT security and logging | Legitimate interest in protecting our customers, suppliers and systems (Art. 6(1)(f)) |
| Sanctions screening and responding to requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Sending news and offers to business contacts | Legitimate interest in marketing our services to business customers (Art. 6(1)(f)). You can unsubscribe at any time. |
| Improving our services and producing statistics | Legitimate interest (Art. 6(1)(f)); we use aggregated or anonymised data wherever possible |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You can request more information about this assessment. We do not make decisions based solely on automated processing that have legal or similarly significant effects for you.
6. Where the data comes from
- From you, when you register, book, use our platform or API, or contact us;
- From your employer or the travel agency that makes a booking on your behalf;
- From airlines, global distribution systems (GDS) and other suppliers, for example schedule changes and ticket status;
- From credit reference agencies and public registers such as the Swedish Companies Registration Office (Bolagsverket), when we assess new customers.
7. Who we share data with
We only share personal data when necessary for the purposes above:
- Airlines and other travel suppliers, to make and service your booking;
- GDS and booking technology providers, through which bookings are made and tickets are issued;
- IATA’s Billing and Settlement Plan (BSP) and banks, for settlement of tickets and payments;
- Other companies in the AERTiCKET Group, for example for booking technology, purchasing and IT operations;
- IT, hosting and communication providers that process data on our behalf under data processing agreements;
- Payment providers, credit reference agencies and debt collection agencies;
- Auditors, legal advisers and insurers;
- Authorities, such as the Swedish Tax Agency or the police, when we are required to by law;
- A buyer or successor, if all or part of our business is reorganised or sold.
We never sell personal data.
8. Transfers outside the EU/EEA
Air travel is international. When your journey involves an airline or supplier outside the EU/EEA, we must transfer the booking data to it in order to perform the booking. Such transfers are based on Article 49(1)(b) and (c) GDPR (necessary for the performance of a contract with or in the interest of the traveller).
When our service providers process data outside the EU/EEA, we ensure that the transfer is covered by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where applicable) or by the European Commission’s standard contractual clauses together with any necessary supplementary measures. You can ask us for a copy of the relevant safeguards.
9. How long we keep data
We keep personal data only for as long as necessary for the purpose it was collected for, and then delete or anonymise it.
- Bookings and tickets: for as long as needed to handle the booking, changes, refunds, airline debit memos and possible claims.
- Accounting records (for example invoices and the booking data they contain): seven years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
- Customer accounts and business contacts: for as long as the business relationship lasts, and thereafter only as long as needed for follow-up or legal claims.
- Enquiries and helpdesk tickets: until the matter is closed and any follow-up is complete.
- Marketing: until you unsubscribe or object.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including access control, encryption in transit, multi-factor authentication where available, logging and monitoring, confidentiality obligations for our staff and data processing agreements with our suppliers. If a personal data breach occurs, we will notify the Swedish Authority for Privacy Protection within 72 hours where required, and inform those affected when the breach is likely to result in a high risk to them.
Please keep your login details and API credentials confidential and tell us immediately if you suspect unauthorised use of your account.
11. Your rights
Under the GDPR you have the right to:
- Access – receive confirmation of whether we process your data and a copy of it;
- Rectification – have inaccurate or incomplete data corrected;
- Erasure – have your data deleted, unless we must keep it, for example under the Bookkeeping Act;
- Restriction – ask us to limit processing in certain situations;
- Data portability – receive data you have provided to us in a machine-readable format, where processing is based on consent or contract;
- Object – object to processing based on legitimate interest. You can always object to direct marketing, and we will then stop;
- Withdraw consent – at any time, where processing is based on consent. This does not affect processing before the withdrawal.
Contact us at helpdesk@aerticket.se to exercise your rights. We will respond without undue delay and within one month. We may need to verify your identity before we can act on your request. If your booking was made by a travel agency, you can also contact the agency.
12. Complaints
If you are unhappy with how we process your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the supervisory authority:
Integritetsskyddsmyndigheten (IMY) – the Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
www.imy.se
13. Cookies
Cookies are small text files stored in your browser. Under the Swedish Electronic Communications Act (lagen (2022:482) om elektronisk kommunikation), we may only use cookies that are not strictly necessary if you have given your consent.
- aerticket.se does not use cookies for analytics or marketing. The website loads fonts from Google Fonts, which means that your IP address is sent to Google when the page loads.
- AERTiCKET Flights (b2b.aerticket.se) uses strictly necessary cookies and similar technologies, such as local storage, to keep you logged in, remember your settings and protect the platform. These do not require consent.
If we introduce analytics or marketing cookies, we will ask for your consent first. You can delete or block cookies in your browser settings, but parts of the platform may then stop working.
14. Changes to this policy
We may update this policy, for example when our services or the law change. The latest version is always available on this page, and the date at the top shows when it was last updated. We will inform registered customers of material changes by email or in the platform.