WHAT IS PERSONAL DATA
Personal data is the data that directly or indirectly identifies and associates with individual natural persons.
THE ROLE STARLUX PLAYS
STARLUX is the data controller of the personal data processing activities described in this Policy. STARLUX is responsible for determining how to handle your personal data and the purpose of use.
PURPOSE OF PERSONAL DATA COLLECTION
STARLUX collects, processes and uses your personal data to fulfill the contractual content of both parties (including but not limited to booking tickets, seat reservation, ancillary services purchase, billing notices, travel information, travel changes, transportation services, baggage services, online or on-board shopping, consumer/membership services and management, etc.), and to provide personalized services, fulfill legal and management obligations, marketing advertising, data statistics and analysis, and to improve service quality.
HOW DOES STARLUX COLLECT YOUR PERSONAL DATA
STARLUX collects your personal data directly through the following methods:
When you use STARLUX's services.
When you apply for our membership, reservation, ticket purchase, billing, delivery of tickets, payment, refund, trip management (for example: meal selection, check-in and other services, or fill in entry/departure forms according to laws, regulations or government agencies, provision of travel plans (such as: package tour, car rental, Taiwan Railways/Taiwan High Speed Rail ticket ordering service and etc.), extra order service, airport operations process (including seat assignment, baggage service, transfer and etc.), online or on-board shopping, customer service, cargo transportation, claims and etc. The foregoing actions include but not limited to the registration, login or use of STARLUX's website, social media platform, application program (App), online service, email, facsimile, official website message, any contact to our customer service center, Live Chat, or in-person visit our airport counter or offices.
- When you fill out the forms, questionnaires or contracts STARLUX sends.
When you participate in, use or subscribe to our physical or online information and activities,
including but not limited to SMS logins, mileage activities, e-papers, facsimile, magazines, advertising, and marketing activities.
- When you provide any communication channels other than membership or consumer information.
- When you use STARLUX's services.
STARLUX may also collect your personal data by
- The travel agency, travel reservation system or any third party who is on behalf of you to book or reserve the flight tickets or travel plans.
Any third party authorized by STARLUX,
including but is not limited to the branches, travel agencies, service providers, agents, data processing centers, customer service centers, the airline companies in cooperation with us (such as code-sharing), travel service providers, vendors of membership or marketing activities (such as co-branded credit card issuers, the partner hotels, restaurants, retailers, etc.), websites, application program (App) or social media platform providers (hereinafter referred to as "the Authorized Persons").
Suppliers of non-cash transactions, such as financial cards, credit cards, debit cards, and electronic payments,
including but not limited to your issuing bank, credit information/investigation center and etc.
Airports or government agencies,
including but not limited to civil aviation authorities, departure and arrival authorities, customs, border security, police, airport companies/authorities, and any other administrative and judicial authorities.
In order to ensure the safety of personnel and operations, surveillance cameras may be installed in STARLUX's business premises, airport counters and nearby areas. STARLUX shall ensure that surveillance images are used only for the following purposes:
- To prevent, protect or trace any person's life, body and property damage and safety.
- To prevent, protect or trace STARLUX or our customers from becoming a victim of fraud or other criminal activity.
- STARLUX collects, processes and uses the personal data of the minors in accordance with the applicable laws. In the event that the guardian (such as the parent) of the minor does not agree the aforesaid collection, process and use of minor’s personal data made by STARLUX, please contact STARLUX as stated in "Contact Information ".
WHAT KIND OF PERSONAL DATA STARLUX MAY COLLECT
STARLUX may collect, process and use your personal data as follows:
- Personal information
Such as: name, gender, date of birth, place of birth, nationality, location, preferred language, passport and other personal identification number, other travel documents, login account name, photo, fingerprint and face recognition, signature, minor children/the person under guardianship and any other data which may identify an individual.
- Contact information
Such as: address, phone number, email.
- Payment information
Such as: account numbers, account names, credit card, debit card or finance card numbers, expiration dates, electronic payment information and billing address.
- Travel information
Such as: flight information, ticket numbers, passenger name record (PNR), paid seat or seat upgrade, baggage arrangement, travel plans, any travel insurance, car rental, package tour or arrangement purchased through STARLUX and related details.
- Membership information
Such as: the information you provided in membership application, membership number, username, cumulation and redemption records and etc.
- Your interests, preferences and opinions
Such as: food, seating, entertainment content, on-board Internet service information, shopping preference and content, your hobbies, places of interest, and opinions about our services.
- Health information
Such as: requirements of medical requirements or assistive devices, doctor's diagnostic certificate, medical certificate, medical condition and etc.
- Interaction between you and STARLUX
For example: any interactive information between you and our cabin crew, ground crew or customer service agents, details of customer complain, calls (including phone recordings), Live Chat, emails, posts, lost and found, marketing campaigns, questionnaires, the messages, posts and feedbacks in our official social media.
- Business information
For example: if you are an employee of our business or government customers, STARLUX will collect your employment relationship and related information which occurred during your business trip, such as name of employer, your job title, your working contact information and etc.
- Technical information
Such as: the device or technical information you provided us when using of our website, mobile app (App), and/or social media platform, including but not limited to IP addresses, COOKIES, your telecommunication carrier, operation system and platforms.
- Personal information
Special categories of data
STARLUX does not proactively collect or deal with any health, religion or any special or sensitive personal data. However, if you provide any special/sensitive personal data as aforesaid in order to procure our personalized services (such as assistive devices or special meals), STARLUX will collect, process and use such special/sensitive personal data provided by you according to the relevant legal requirements.
- You may choose not to provide STARLUX any personal data; however, STARLUX may not be able to provide the service or transaction as required if STARLUX is not receiving the required personal data during the service procedure. If the personal data you provided is incorrect or incomplete (for example, using nickname) and STARLUX cannot confirm your actual identity, STARLUX will not be able to cooperate with your claim of privacy.
LEGAL BASIS AND USE OF PERSONAL DATA
STARLUX collects, processes and uses your personal data in accordance with the following legal basis:
- For the performance of a contract
- The services required by you, including but not limited to booking, purchasing or delivering flight tickets, seat selection, meal selection, shopping, verification of financial transactions, collection of fees, handling of transportation operations (boarding, transfer, baggage/cargo transportation, etc.).
- Any membership management and services in accordance with the terms and conditions of membership.
- Legal obligations
- STARLUX collects, uses and processes your personal data in accordance with the relevant civil aviation, customs, and diplomatic laws and regulations of the countries where STARLUX's flight sites located.
- To provide passenger information to customs, departure/arrival, police or judicial authorities.
- Pursuing the legitimate interests of STARLUX or a third party
- Implementation of cooperation.
- Requirements of litigation.
- The right to express freedom of expression, including media freedom.
- To prevent fraud, abuse of Company information systems or money laundering.
- To operate the whistleblower mechanism.
- To ensure physical, information and network security.
- To conduct or provide internal calculation and analysis, marketing research, advertising messages and innovative services.
- To follow local laws and regulations.
- Mergers and acquisitions.
- Based on your consent
You may agree to carry out the personal data processing for one or several purposes. After obtaining your consent, STARLUX will process your personal data for the following purposes:
- To provide personalized services according to your preferences, such as special meals, assistive devices or medical requirements.
- STARLUX will seek your explicit consent in accordance with the special requirement stated in laws or regulations before collecting, processing, and using the special or sensitive personal data.
- To send you marketing messages and to inform you about our latest news, promotions, travel events or innovative services.
- To improve STARLUX's services, advertising and marketing.
- When collecting any personal data of a minor, the guardian of the minor shall confirm and agree to provide STARLUX such information.
DISCLOSURE OF PERSONAL DATA
STARLUX may share your personal data to the selected third parties subject to the above-mentioned legal basis:
- The airports and operating locations where STARLUX's flight sites and transportation services are located.
- The internal units of STARLUX, Authorized Persons, airports, administrative, judicial and police authorities which are detecting and handling personal data protection claims, money laundering, illegal activities and fraud, or maintaining the integrity of STARLUX's information system.
- A third party authorized by STARLUX under the performance of the contract and the obligations stipulated in this Policy, such as cloud service company or marketing media company.
- The airport, customs, administrative and judicial authorities which may be provided for the purpose of fulfilling STARLUX's statutory obligations, implementing and maintaining STARLUX policies or contracts, complying with the requests or investigations by the administrative or judicial authorities, and handling litigation or non-litigation cases.
- The service content, official website, application or social media platform of STARLUX may be linked to a third party’s websites, applications or services. The third party may have different privacy statements and policies. Please note to read the privacy statements and policies of other sites when you leave our site and STARLUX is not entitled to control such third party’s websites, applications or services.
RETENTION PERIOD OF PERSONAL DATA
STARLUX will retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, STARLUX's legal interests or service purposes, or as required by relevant laws:
- The necessary period for collecting, processing, and utilizing the specific purpose of the personal data.
- The necessary retention period required to perform the business.
- The retention period indicated in individual agreements.
- Within the time limit specified by applicable laws and regulations.
- During the investigation period made by government and judicial authorities, or during the time period in which a civil, criminal or administrative lawsuit proceeds.
- If none of the above conditions exists, STARLUX will delete or destroy the personal data in a secure manner in accordance with this Policy.
COOKIES AND IP USE
Collection of IP Address
An Internet Protocol Address (IP address) is a numerical label assigned automatically by the Internet service provider (ISP) to each user’s device participating in internet that uses the Internet Protocol for communication. When an user accesses our website and mobile services, the user’s IP address, visiting time and webpages will be stored. For the purpose of advertising marketing, evaluation or maintenance of our website and mobile services, STARLUX may store and use such IP address.
You may exercise the following rights on your personal data:
- Request a copy of your personal data.
- Request to correct or to supplement your personal data.
- Request to delete your personal data; but if the processing of your personal data is necessary, and such personal data shall not be deleted in accordance with relevant laws and regulations, STARLUX will not conduct the operation of deletion.
- Inquire or request to read.
- Request to restrict the processing of your personal data.
- Request to withdraw the consent on STARLUX's right to process your personal data.
- Request STARLUX to provide you with your personal data, or, if it is practicable, to transmit your personal data directly to the designated third party at your request. Such personal data processing, based on your consent or the necessity for the performance of contract with you, is operated automatically. Once the third party receives your personal data, STARLUX will not be responsible for the security and use of the information. If the provision of your personal data may impede any other person’s rights, STARLUX will not be able to provide your personal data.
- If there is any dispute about the accuracy or legality of STARLUX's processing of personal data, you may request to restrict the processing of your data.
- Refuse STARLUX's to use your personal data for marketing purpose.
- The rights to file a complaint with the competent authority.
STARLUX will not be able to delete some of your personal data if:
- STARLUX processes or retains your personal data in accordance with relevant laws and regulations.
- STARLUX needs such necessary information to deal with compensation, litigation, and non-litigation cases.
Exercise your rights
- If you intend to exercise the above-mentioned rights in this article, please provide the following information to help us to confirm your identity. The guardian of a minor may also exercise the rights pursuant to this article. STARLUX will evaluate and inform you how STARLUX will process your request.
Please submit the following information to STARLUX as stated in ”web form” “Enquiry & Requests”, and click the topic of “Others”, and indicate "Privacy Protection":
- The Chinese and English full name of the subject person.
- Details of request.
- If you are on behalf of another person (including your minor children) to apply the request, please provide a proof of authorization or a document to prove the guardianship between you and the minor children.
- If the subject person is STARLUX's member, please provide the number of memberships.
- If the subject person is a STARLUX member, the member may change his or her personal data or withdraw their consent by clicking on "Account Content" > "Change Personal Data" after logging in to STARLUX's website for members. If you have any questions or comments, please contact " STARLUX Customer Service Center".
- Subject to the scope of your consent, STARLUX will use your personal data (such as membership status, tickets booking or purchase, boarding history, baggage delivery, cargo delivery and etc.), preferences and website behaviors (e.g. searching travel tours) to provide personalized service information. For example, STARLUX may provide the information of local weather, transportation, attractions, other service recommendations, and other reference materials based on your flight tickets or travel plans. STARLUX may also use your personal data to send marketing information or questionnaires, including but not limited to advertisements, e-papers, messages, emails, and App push notification services to provide the latest information and improve our service quality.
- If you do not want to receive our marketing messages, you may withdraw your consent at any time pursuant to the article of "YOUR RIGHTS">"Exercise your rights", or change the relevant features in your member account, or use the "unsubscribe" feature in the email STARLUX sends, or contact STARLUX in accordance with the article of "Contact Information".
OVERSEAS TRANSMISSION, THE SECURITY OF DATA STORAGE AND PROCESSING
- STARLUX headquarter is located in Taipei, Taiwan. Your personal data will be transferred to the data storage facility where STARLUX applied to store the files of main records.
- In order to fulfill the rights and obligations of the contract between you and STARLUX, your personal data will be transferred to STARLUX's worldwide operating locations or to an Authorized Person. STARLUX will ensure that the data transmission is secured and protected under applicable legal requirements upon transmission. If STARLUX transfers data to a country or jurisdiction that cannot guarantee the level of security protection, STARLUX will strengthen the information security and other appropriate protection methods, and shall request the receiving party to comply with the level of information security and personal data protection as same as ours.
If STARLUX intends to use your personal data for any other purpose which is not covered by this Policy, before the data processing, STARLUX will inform you such additional purpose and process methods. In this case, STARLUX shall confirm the legal basis and request your prior written consent if necessary.
- STARLUX will use the security technology that meets the current industrial standards to protect your personal data, and prevent the personal data from theft, tampering, loss or other infringement, including but not limited to the protection of personal data by means of "encryption", "de-identification", information disclosure minimization, external intrusions prevention, regular personnel security training, and other technical, administrative, institutional, and environmental security measures.
- The Internet is an open and global communication tool. STARLUX does not make any guarantee to the security of data transmission or storage, even though STARLUX has used our best efforts to protect your personal data. The customers have to take their own risks on transmission of any data.
- Please keep your personal data, account ID and password of membership properly, and do not provide your account ID and password to any person. Please log out your account after use. If you share your computer with other persons or use a public computer, please log out your account and close the browser window after use in order to prevent others from abusing your personal data.
- If you believe that your personal data has been compromised, please contact " STARLUX Customer Service Center".
- If you have any question about this Policy, intend to exercise any right under this Policy, or have any complaint, please contact us using one of following methods:
If you have any different opinion related to our processing of your personal data, you may request mediation or other administrative procedures to the personal data protection authority of our flight sites, or contact the following authority:
CIVIL AERONAUTICS ADMINISTRATION, MOTC
Tel: +886 2 2349-6280
Webpage of Director General's Mailbox:https://www.caa.gov.tw/Suggestions.aspx?a=210&lang=2
STARLUX may amend this Policy from time to time and the amended content will be presented on this webpage. If STARLUX makes material changes to the rules of personal data usage, STARLUX will announce on webpages or send emails to notify the passengers. STARLUX will also review this Policy on a regular basis to comply with relevant laws and regulations.
GOVERNING LAW AND JURISDICTION
This Policy shall be governed by and construed in accordance with the laws of Taiwan. Any dispute arising out of or in connection with this Policy shall be submitted to the exclusive jurisdiction of the Taiwan Taipei District Court.