Valid from February 2025

Dear User:

IBERIA is committed to respecting your privacy and protecting your personal data. 

- We will be fully transparent about the data we collect and the use we make of it.  

- We will use the information you provide for the purposes described in this Privacy Policy, including providing you with the services you request through Iberiagencias and improving your experience with IBERIA.

- We will send you electronic communications that are relevant or necessary for the product or service you have requested through Iberiagencias. 

- We will adopt the necessary measures to protect and keep your information safe.

- We will respect your data protection rights and will try to give you control over your own information. 

The following Privacy Policy can help you better understand how we use your personal data in the Iberiagencias platform environment. It explains in more detail the types of personal data we collect, how we collect it, for what purposes we may use it and with whom we may share it.

Throughout the Privacy Policy you will find a number of specific examples of why and how we use your personal data. If you have any questions, please contact us by writing to our Data Protection Office by email at OficinaDPO@iberia.es. Thank you very much.

II.- Who is responsible for the processing of your personal data?

The data controller is Iberia Líneas Aéreas de España, S.A. Operadora, Sociedad Unipersonal, with registered office in Madrid, Calle Martínez Villergas 49, 28027 and Tax Identification Code A85850394 (hereinafter, ‘IBERIA’). 

You can contact IBERIA's Data Protection Office by e-mail to OficinaDPO@iberia.es or by post to ‘Oficina de Protección de Datos de Iberia Líneas Aéreas de España, S.A. Operadora, Sociedad Unipersonal’ at Calle Martínez Villergas 49, 28027 Madrid.

III.- When does this policy apply?

This Policy is applicable to the personal data that we collect, use and process in the context of the relationship between Users and IBERIA in connection with their access to Iberiagencias and the use of the functionalities available therein.

IV.- Preliminary information on Data Protection

The only personal data to which IBERIA will have access will be that which the User voluntarily provides. In those cases and with respect to the data in which the User is expressly indicated, if he/she does not provide such data, we will not be able to offer him/her the services requested.

In compliance with the regulations in force (fundamentally, EU Regulation 2016/679 General Personal Data Protection Regulation, Organic Law 3/2018 of 5 December, on Personal Data Protection and Guarantee of Digital Rights and the other European or national regulations that complement or develop it from time to time), IBERIA has adopted the necessary technical and organisational measures to maintain the required level of security in relation to the personal data processed. Likewise, it is equipped with the precise mechanisms within its reach to avoid, as far as possible, unauthorised access, theft and illicit modifications and the loss of data.

In Iberiagencias:

- The typology of Users (i.e. employees of travel agencies and collaborating entities) assumes that all of them are of legal age;

- We do not process Users' sensitive data; and 

- We do not carry out automated processing of Users' data; and

- We do not sell Users' personal data to third parties.

V.- ‘Cookies’ in Iberiagencias

Access to and navigation through Iberiagencias may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by each User so that the server remembers certain information that later only the server that implemented it will read. The purpose of these cookies is to facilitate your navigation through the different pages of Iberiagencias and to help IBERIA to improve the service provided. Cookies generally have a limited duration in time. No cookie allows the user's telephone number, e-mail address or any other means of contact to be contacted. No cookie can extract information from the user's hard drive or steal personal information. These cookies are only associated with an anonymous user and their computer, and do not in themselves provide the name and surname of the user. These data are used for statistical purposes in aggregated and consolidated form. Among other things, it will record data such as dates, browser, URLs visited and those provided by your browser. 

IBERIA records IP addresses (which every visitor has at the time of accessing the website) for internal purposes only, such as access statistics and market segmentation. IBERIA does not associate IP addresses with personally identifiable information, and may provide third parties with informative extracts of the traffic on Iberiagencias that do not affect the anonymity of the User, with data on the number of visits to a certain section of the site, traffic flows and trends, etc.

VI.- What types of personal data do we collect and keep in Iberiagencias?

When a User registers with, or subsequently uses, Iberiagencias services, he/she will have to provide us with certain personal data.

- Information about your online registration with Iberiagencias. We will retain your data to verify your identity each time you log on to the Website and to ensure proper interaction with the User.

- Data about your use of Iberiagencias and the transactional functionalities available to you: to help us personalise your data and improve our website we use cookies and similar technologies to collect information about your searches and the content you have visited on Iberiagencias and to try to better understand you as a customer.

VII.- What do we use Iberiagencias Users' data for and on what grounds?

We will use Users' data for the following purposes:

- Based on our contractual relationship with the User, to manage their access to, and manage their participation in Iberiagencias and the functionalities it incorporates. 

- On the basis of our contractual relationship with the User, to send him/her by electronic means operational or service communications related to Iberiagencias (new products available, changes, important notices...) or with its transactional functionalities. 

- Based on our legitimate business and business interests, to carry out analytical work and market research and try to improve the services offered in Iberiagencias.

- Based on the consent you have previously given us for this purpose, to carry out direct marketing activities and keep you informed about Iberiagencias products and services and/or other IBERIA channels or service platforms that we believe may meet the User's needs or preferences. 

- Based on our legitimate business and corporate interest, to analyse and improve our processes and systems, as well as our website, products and services. For example, we may track how Users use the Iberiagencias website, so that we can identify ways to improve their browsing experience. We may also use this information to define and compare common patterns of behaviour and distinguish them from others that may be considered malicious, to detect and prevent suspected fraud, and to implement and improve established security and cybersecurity protocols.

- Based on our contractual relationship with the User, in order to manage transactions, operations, contracting of products and services that take place in Iberiagencias, or any type of query, complaint, claim or suggestion that could be made in this regard. 

- Based on compliance with our legal obligations, depending on the case, we may also use your data for other management and administration purposes. For example, we may use and retain data for administrative purposes, which may include, for example, accounting and billing, auditing, credit card or other payment card verification, fraud control (including the use of credit reporting agencies, matching against information from financial institutions and other companies operating electronic means of payment, and payment card validation checks), systems testing, maintenance and development.

- Based on the exercise of a legal obligation to correctly manage emergency situations, catastrophes or force majeure in general, we may need to communicate your data to different types of persons, companies or organisations whose collaboration is essential for Iberia in these cases.

VIII.- How long will we keep your data? 

We will process your personal data for as long as they are necessary for the purpose for which they were collected and for as long as their deletion is not requested by the interested party and they do not have to be deleted because they are necessary for compliance with a legal obligation or for the formulation, exercise and defence of claims.

In cases in which the User revokes their previously granted consent for any type of processing or exercises their right to delete their personal data, their personal data will be kept blocked at the disposal of the Courts, Tribunals and competent Authorities, during the legally established limitation periods in order to attend to possible liabilities arising from the processing of the same.

We will actively and periodically review the data in our possession and either securely delete it when there is no longer any legal, commercial or User-related need to keep it; or anonymise it in order to continue processing it for administrative, statistical or segmentation purposes and generic profiling to help us to better understand our type of users and their preferences or needs in general.

IX.- With whom do we share your personal data? 

We may share Users' data with the companies of the “IAG Group” to which IBERIA belongs, which includes International Consolidated Airlines Group S.A. (IAG), British Airways Plc, Compañía Operadora de Corto y Medio Radio Iberia Express S.A.U., Vueling S.A., Aer Lingus, Flylevel, British Airways Holidays, IAGL Ltd, IAG Connect and IAG GBS, among others. For more information about our group, please visit the website of our parent company IAG at http://www.iairgroup.com . We may share information with these companies so that they can help us provide services to you and get to know you better.

We may also disclose your personal information to the following third parties for the purposes described below:

- Credit and debit card companies, banks and financial institutions, credit reporting agencies and fraud prevention and control service providers, to process payments and perform such prevention and control tasks, respectively. In some cases, they may act as independent data controllers. Further information about each of them is available on request.

Among the latter, in our legitimate business interest, we may share the data collected during your purchase or booking flow of products or services on our website with Riskified Ltd., an Israeli entity that will process your data as an independent data controller and in accordance with its own privacy policy (available at www.riskified.com/terms/#privacy ) to: i) review your transactions to detect and prevent transactions that may constitute fraudulent activities; and ii) retain such information in its databases to increase its cross-referencing sources and improve the future accuracy of its fraud prevention and control services. Riskified will carry out automated processing of your data, cross-checking it against additional data relating to other transactions that you may have made in Iberia and/or in other e-commerce platforms with which Riskified has similar agreements, in order to analyse the regularity of your payment order according to previously defined criteria. To learn more about the processing carried out by Riskified, its purposes and bases of legitimacy, and/or about what your rights are before said entity in terms of data protection and how to exercise them, please consult the link to its privacy policy indicated above.

- Public Bodies, Judges and Courts and, in general, Competent Authorities, when Iberia is legally obliged to provide them; and in response to lawful and valid requests from governments and law enforcement agencies, such as customs and immigration authorities or the fight against fraud and major crimes.

- IBERIA has the collaboration of some third party service providers who have access to Users' personal data and who process the aforementioned data in the name and on behalf of Iberia as a consequence of their provision of services. IBERIA follows strict criteria for the selection of service providers in order to comply with its data protection obligations and undertakes to sign the corresponding data processing contract with them, imposing the following obligations, among others: to apply appropriate technical and organisational measures; to process the personal data for the agreed purposes and only in accordance with IBERIA's documented instructions; and to delete or return the data to IBERIA once the services have been provided.

- Third parties, such as law firms and courts, insurance companies, intermediary entities as well as experts and experts, to demand the fulfilment or application of a contract with the User or the Agency to which he/she belongs, or to defend our legitimate interests in the framework of legal, administrative, judicial or extrajudicial actions and processes.

- Third parties, such as the police and regulatory authorities, to protect our rights, property, or the safety of our employees, suppliers, customers, employees and assets.

X.- To which countries will your personal data be sent?

It is NOT FORESEEN that Users' personal data will be sent to third parties located outside the country in which you are located and outside the European Economic Area.

XI.- What are your rights when you provide us with your data? 

The User may exercise, if he/she so wishes, the rights of access, rectification and deletion of data, as well as request that the processing of his/her personal data be limited, oppose the processing, request the portability of his/her data, as well as not be subject to automated individual decisions, by the following means:

- By e-mail to oficinaDPO@iberia.es; or

- By post addressed to ‘IBERIA Oficina de Protección de Datos’, Calle Martínez Villergas 49, 28027 Madrid, Spain.

In these cases, in order to process your request, you must provide us with the information and documentation indicated below:

- Applicant's full name

- Identity document

- Contact details (at least e-mail address)

- Data subject of your request

- Include a reference that you are an Iberiagencias Registered User.

- A photocopy of your identity document, so that we can verify your identity.

- If you are submitting the request on behalf of another person, you will need to provide an authorisation signed by that person together with their corresponding identity document.

XII.- Before which authority can you exercise your claims?

Interested parties may in any case file a complaint with the Spanish Data Protection Agency, especially when they have not obtained satisfaction in the exercise of their rights, through the website www.aepd.es.

XIII.- Special reference to IBERIA's processing of customer/passenger data entered by Users in the transactional functionalities.

The incorporation of personal data of the clients of the Agencies in the transactional functionalities of Iberiagencias constitutes a communication of data between the said Agency and Iberia.

Given that the Agency to which the User belongs and IBERIA are, in the context of the transactional functionalities of Iberiagencias and from the point of view of the regulations on personal data protection, two independent data controllers, the User guarantees to IBERIA, on behalf of the Agency, that prior to said communication of data:

- It shall have obtained from each of the data subject passengers, directly or indirectly, their consent to the communication of their data to Iberia; and 

- It shall have informed such passengers in detail of the content of Iberia's Personal Data Protection Policy that will govern Iberia's processing of their personal data, available through the route https://www.iberia.com/es/informacion-sobre-privacidad/ (the ‘Iberia Customer Privacy Policy’).

For its part, IBERIA guarantees that it has adopted the necessary technical and organisational measures prior to such communication of data to guarantee the security and integrity of passenger data, as well as to avoid its alteration, loss, unauthorised processing or access.