California Customer Privacy Act

1. Welcome

This notice only applies to individuals (“you”) who reside in the State of California. This Notice shall comply with the California Customer Privacy Act 2018 (“CCPA”).

The CCPA requires us to provide California residents certain information. An extended overview of how we process your personal information can be found on in our Privacy Notice this separate notice ensures we meet the CCPA’s requirements. This notice contains the following four sections:

• We Do Not Sell Your personal information.

• Your CCPA Rights.

• The CCPA Categories of personal information We Collect and the Sources

• The CCPA Categories of personal information We Share for a “Business Purpose”..

2. We do not sell your personal information

The CCPA requires us to disclose whether we sell your personal information. We do not sell your personal information.

3. Your CCPA rights

Under the CCPA, California residents also have rights relating to disclosure and access and deletion of their personal information. These rights are not absolute and are subject to certain exceptions. For instance, we cannot disclose or permit access to specific pieces of personal information if the disclosure or access would present a certain level of risk to the security of the personal information, your account with us or security of the business’s systems of networks.

If you make a request to exercise a consumer right, such as to obtain a data export or delete your data, we will respond within a reasonable timeframe. At a minimum we will acknowledge your request no later than 10 days after it is made and will fulfil it within forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.

If we cannot comply with a request, we will explain the reasons.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

1. Your right to request for information

You have the right to request that we disclosed to you, for the 12-month period preceding the date of your request.

1. The categories of personal information we have collected about you.

2. The categories of sources from which personal data is collected.

3. The business or commercial purpose for which the information was collected,

4. The categories of third parties with whom we have shared personal information, and

5. The specific pieces of personal information we hold about you. Please note that we are only required to fulfil Discloser and Access request from a consumer twice per every 12 months. You can submit such a request by sending an email to (the controller) or calling Customer service (controller).

Please note we may require you to provide identifying information to verify your identity.

2. Your right to opt-out of sales

Under California Laws, California consumers have the right to opt-out of having their personal information sold. For purposes of California Laws, the definition of “sale” includes sharing personal information with a third party in exchange for anything of value (money or otherwise). We do not sell your personal information.

3. Your right to notification

Under the CCPA, a company like us cannot collect new categories of personal information or use them for materially different purposes without first notifying you.

4. Non-discrimination for exercising your CCPA rights

California residents have a right not to be discriminated against do the exercise of their Rights. The CCPA prohibits businesses from discriminating against you for exercising your rights under the law. Such discrimination may include denying services, charging different prices or rates for services, providing a different level or quality of services, or suggesting that you will receive a different level or quality of goods or services as a result of exercising your rights.

5. Your right to delete personal information

You have the right to request that we delete the personal information we have collected or maintained in connection with your use of our service, subject to certain exceptions as provided for under California Laws. We will take reasonable measures to delete your personal information from our records. We will keep certain record (e.g. personal information relating to payments or customer service matters) where we need and have rights to, such as for legal or accounting purposes. We also keep information in order to exercise, defend or establish our rights. While fulfilling a valid deletion request, we will also endeavour to direct our service providers to delete your personal information from their records. You can submit such a request by sending an email to Data.protection@prioritypass.com or call Customer Service.

4. The CCPA categories of personal information we collect and the sources

Our Privacy Notice describes the information we collect and its sources. This notice organises that information around the personal information categories set forth in the CCPA.

5. How we use your personal information

The table outlines the lawful basis we can rely on to process your personal information.

6. The CCPA categories of personal information we share for business purposes

We may share your personal information outlined in section 4 with the following categories of third parties for business purposes as defined under the CCPA, to support us in the services we offer to you explained in section 5.

Companies we will share your personal information with include:

• IT service providers, data disposal service providers and data storage service providers.

• Companies within the Collinson Group acting as our processor, to help us provide our services to you e.g. our customer service function to handle your enquiries.

• Our providers, AWS, who host our Websites.

• Lounges or merchants’ providers which you visit, as part of your program benefit, so they can record and account for your visit.

• We also share your personal information with payment service providers and data analytics services.

• Companies within the Collinson Group to offer you services or products, where we have your consent.

• Other third parties outside the Collinson Group to offer you services or products, where we have your consent.

• Where service is a benefit of your payment card and therefore we act as processor for issuers, the Issuers as controllers may instruct us to share your personal data with themour partners or clients which provide joint marketing services.

To help protect you and us from fraud, to combat money laundering and protect our Website from illegal use, we will share your personal information with fraud prevention agencies, payment service providers, banks, financial institutions and similar third parties for checking your identity, monitoring your behaviour on our Website. These additional service providers are Controllers and will have their obligations to protect and secure your data under the CCPA.

We may also share your personal information with law enforcement and statutory authorities when required by the law in the following circumstances:

We may share your data with your Issuers:

• To comply with a request for information from a governmental body such as law enforcement (police) or other public authorities;

• To comply with a court order to disclose your personal information;

• To comply with a regulatory investigation; and

• The establishment, exercise or defence of a legal claim (including in connection with an investigation or enquiry by a competent regulatory authority).

  Where we are controllers and have contractual obligations to share your data with Issuers.

• Where we act as a processor for issuers, the Issuers as controllers may instruct us to share your data with them.

There are other circumstances where we share your personal information:

• The Collinson Group may transfer all your personal information to a third party if the operator of the Website changes, or if there is a sale of all or any part of its business or its assets or if we go out of business, enter bankruptcy, or go through some other change of control. In the event of any of these transfers occurring, the party who acquires the data will assume the rights and obligations described in this Privacy Notice.

• We may share your personal information with courts, law enforcement, and governmental authorities and other third parties if required by law, subpoena, a directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect our rights or property or those of third parties.

Geolocation

If you open or use our App on your mobile device and we have your consent, we will use the location data from your mobile device (e.g. latitude and longitude), to show you a list of our nearby airport experiences.

If you choose not to give us access to your location data, you can still use the App, but you will not receive notifications detailing our nearby airport experiences.

We will also use your mobile device's background location’ to send you notifications about our nearby airport experiences, such as, our contactless ordering options, ready2order. If you have ‘background location’ turned on, our app will, from time to time, tell us about your device’s location even if you are not directly interacting with the App.

Your location data will only be used for the above purposes. Only pseudonymised consumer ID will be shared with Google analytics and Mixpanel. For more information about location data please visit Apple’s Location Services & Privacy page for iOS and Google’s How it uses location information page for Androids.

• Personal in line with Applicable Data Protection Law and to this Privacy Notice.

Additional service providers: To help protect you and us from fraud, to combat money laundering and protect our Website from illegal use, we will share your personal information. We may have links to other sites promoting our partners and clients. Please read their Privacy Notices available on their website to find out how they process personal information. This Privacy Notice will not cover their use of personal information.

7. Contact details

We are Priority Pass part of a group of companies (the “Collinson Group”) owned by Collinson Group Limited. Our Company details are 3 More London Riverside, London SE1 2AQ with company number 02728518.

The Collinson Group has appointed a Group Data Protection Officer (“DPO”). If you have any questions about this Privacy Notice or would like to know how we handle your personal information, please contact the DPO or the Data Protection Team by post at The Data Protection Officer, 3 More London Riverside, London SE1 2AQ or by email at data.protection@collinsongroup.com.

8. Updates to the privacy notice

We keep our Privacy Notice under regular review, and we will make new versions available on our Privacy Notice page on our website. This Privacy Notice was last updated on 19^th March 2021.