Privacy policy
Our Privacy Policy explains how we process your personal data when you use our services – for example, when you book a trip, use our website or app, hold a Profile account, or are a EuroBonus member. Our goal is to be as transparent and clear as possible. If you still have questions about how we process your personal data, please do not hesitate to reach out to us.
Last updated: September 15, 2026
How do we process your personal data?
SAS collects personal data about you that you provide to us when you use our websites or our services, for example when you book a trip, fly with us, contact our customer service or use our mobile app. We may also collect personal data about you from the cookies on our website. You can read more about cookies in our Cookie Policy.
Activities where SAS handles personal data
Depending on how and to what extent you use SAS websites and SAS services, SAS may process different categories of information about you.
In below section, you can find information on SAS’ activities where we process your personal data, what types of data we process, the purpose of the processing, the legal basis of the processing and the retention time of the personal data.
Booking and travelling with SAS
Type of data
Identification and contact information, e.g. name, date of birth, gender, address, e-mail address, travel document information (passport number, nationality etc.)Travel information, e.g. flight number, travel class, departure and destination, meals, special service requests, baggage information, travel irregularities.Financial/payment information, e.g. credit card information, transaction data.Passenger name record (PNR) data is personal information provided by passengers and collected and held by air carriers. It includes the following personal information: name of the passenger, passport details, travel dates, itineraries, seats, baggage, contact details, frequent flyer number, means of payment and special service request (SSR) like special meal requirements and/or special assistance.
Purpose of processing
The purpose of processing the data in this activity is for SAS to administer and carry out the travel you have requested. This includes notifications and communication related to your travel. PNR data is necessary to process in order to perform our services as an airline.
We also process travel and booking data to detect and prevent misuse of ticketing practices, such as skiplagging (hidden city ticketing), which may violate SAS’s Conditions of Carriage and affect operational planning and pricing integrity.
We process personal data when handling insurance claims related to your travel. This includes sharing necessary information with insurance providers to verify coverage, assess claims, and comply with legal and contractual obligations.
In addition, we process data to manage cases involving disruptive or unruly behavior on board or at the airport. This is necessary to comply with aviation security regulations, protect the safety of passengers and crew, and fulfill legal obligations. Such data may be retained and shared with authorities and other airlines as required by law.
Legal basis
The legal basis of processing the personal data related to solely your booking, is in order to fulfil our contractual obligations to you when you book a trip with us, see GDPR art. 6 no 1 b.
The legal basis for e.g. check-in reminders, are our legitimate interest in providing you service, see GDPR art. 6 no 1 f. When SAS use the legal basis of legitimate interest, we document the legitimate interest of SAS to pursue the activity and the individual’s right to integrity in a legitimate interest assessment (LIA).
The legal basis for sharing some of your information with authorities for purposes related to, amongst others, immigration, law enforcement, aviation security, customs checks is our legal obligation, see GDPR art. 6 no 1 c. The legal basis for handling and saving financial information is our legal obligation towards accounting laws, see GDPR art. 6 no 1 c. The same legal basis’ applies for insurance claims.
The legal basis for processing data related to skiplagging is both the necessity for the performance of a contract and SAS’s legitimate interest in protecting its commercial operations and ensuring compliance with its Conditions of Carriage, see GDPR art. 6 no. 1 b and f.
Retention time
If you book a trip with SAS, we will save your data for ten years after the trip is completed in order to meet legal requirements and process any grievances and complaints.
Data related to suspected misuse, including skiplagging, is retained for as long as necessary to investigate and resolve the matter, and in accordance with SAS’s internal compliance and fraud prevention policies.
Information about SAS handling of unruly passengers and the processing of personal data related to these cases, can be found in article 24 in SAS Conditions of Carriage.
Engaging in skiplagging may result in actions including, but not limited to, cancellation of the remaining segments of your itinerary, denial of boarding, revocation of frequent flyer points or status, and restriction from future bookings with SAS.
Travel bookings with multiple passengers
When a booking includes more than one passenger under the same booking reference, certain personal data relating to the passengers included in that booking, such as name and itinerary details, may be visible to the other passengers associated with the reservation. This processing is necessary for SAS to administer the booking and provide the requested travel services to all passengers included in the reservation.
Marketing, profiling, customer support and service
Type of data
Communication, e.g. contact with customer support, phone call recordings, marketing messages, newsletter, feedback forms, complaints, refunds.
Purpose of processing
The purpose of this processing is to develop, analyze and market our services and support our customers in different errands. SAS also process personal data for marketing purposes, including sending offers and information tailored to your preferences. This may involve profiling based on your travel history, booking patterns, and interactions with SAS. Profiling helps us provide relevant services and offers, but you can opt out of marketing communications and object to profiling at any time.
SAS may consolidate personal data from different services, interactions, and systems within a customer data platform in order to maintain a unified view of customer relationships, administer services, improve customer experiences, perform analytics, provide relevant communications, and support business planning and operational activities.
SAS may record telephone calls, chat sessions, and other customer service interactions for quality assurance, training, dispute resolution, compliance, and security purposes where permitted by applicable law.
Legal basis
The legal basis of contacting you about our services after you recently booked a travel with us, is our legitimate interest in marketing our services, see GDPR art. 6 no 1 f. you will always have the option to opt out of this communication.
The legal basis for direct marketing and profiling is your consent, see GDPR art. 6 no 1 a.
The legal basis for processing your data in relation to customer support and customer service is our contractual obligation and regulatory demands, see gdpr art. 6 no 1 b and GDPR art. 6 no 1 c.
The legal basis for analyzing customer care data, is our legitimate interest in providing you service, see GDPR art. 6 no 1 f. when sas use the legal basis of legitimate interest, we document the legitimate interest of SAS to pursue the activity and the individual’s right to integrity in a legitimate interest assessment (lia).
The legal basis for processing personal data in connection with customer service interactions, including call recordings, chat sessions and correspondence, is SAS's legitimate interest in providing, maintaining and improving customer service, ensuring security and handling complaints and disputes, see GDPR Article 6(1)(f). When SAS uses the legal basis of legitimate interest, SAS documents the legitimate interest of SAS to pursue the activity and the individual's right to privacy in a legitimate interest assessment (LIA).
Processing may also be necessary to comply with legal obligations or for the establishment, exercise or defense of legal claims, see GDPR Article 6(1)(c) and GDPR Article 6(1)(f).
Retention time
We will save your personal data as long as it is necessary with regard to the purpose of the processing.
We will save your data from a completed trip for 12 months, in order to offer you communication on similar services.
Analytics, statistics and user tests
Type of data
We may process your personal data such as travel history, booking information and customer care data. For user tests, we process your contact information and the answers provided in the user tests.
Purpose of processing
The purpose of the processing is that it is necessary to develop and optimize our customer offer, customer care, flight network, digital platforms, business model and pricing. Our use of information for statistical and analytical purposes will only occur on an aggregated level. This means that we do not analyze your information on an individual level.
The purpose of user tests is to enhance our products, services and offerings.
Legal basis
The legal basis for processing personal data for analytics and statistics purposes is our legitimate interest in optimizing our services and business model, see GDPR art. 6 no 1 f. When SAS use the legal basis of legitimate interest, we document the legitimate interest of SAS to pursue the activity and the individual’s right to integrity in a legitimate interest assessment (LIA).
The legal basis for user tests is your consent, which we collect before starting the user test, see GDPR art. 6 no 1 a, or the legal basis legitimate interest, in enhancing our products and services, see GDPR art. 6 no 1 f. When SAS uses the legal basis of legitimate interest, we document the legitimate interest of SAS to pursue the activity and the individual’s right to integrity in a legitimate interest assessment (LIA).
Retention time
We will save your personal data as long as it is necessary with regard to the purpose of the processing.
Web behavior
Type of data
Digital details and behavior, e.g. login information, IP address, web page usage (requires consent).
Purpose of processing
The purpose of this processing is to offer you a personalized experience on our website.
Legal basis
The legal basis is consent that you have actively given on our website, see GDPR art. 6 no 1 a.
Retention time
See our cookie policy for retention times.
Profile Account
Type of data
Information you provide us when registering a profile account, for example name, address, email, telephone number etc.
Purpose of processing
The purpose of the processing is to enable customers to register a profile account with SAS and administer the service.
Legal basis
The legal basis for this processing is our obligation to comply with the terms and conditions for profile account holders, see GDPR art. 6 no 1 b.
Retention time
SAS saves this data for as long as you have a profile account.
Recruitment
Type of data
Recruitment information when you apply for a job at SAS, e.g. contact information, prior experience and references.
Purpose of processing
The purpose of this processing is to facilitate the recruitment process.
Legal basis
The legal basis of processing recruitment data is the necessity for the performance of a contract to which the data subject is party or in order to take steps to fulfill a contract, see GDPR art 6 no 1 b.
Retention time
If you apply for a job at SAS, we store your application for 24 months, in accordance with regulatory demands.
Background Checks
Type of data
Personal data collected during background checks may include identity verification, criminal record information (where permitted by law), employment history, education verification, and references.
Purpose of processing
The purpose of this processing is to assess the suitability of candidates for specific roles that require a high level of trust, security clearance, or regulatory compliance, such as positions involving safety, finance, or access to sensitive systems.
Legal basis
The legal basis for processing background check data is the necessity for the performance of a contract to which the data subject is party, as well as compliance with legal obligations applicable to SAS, see GDPR art. 6 no. 1 b and c.
Retention time
Background check data is retained only for as long as necessary to complete the recruitment process and to comply with applicable legal or regulatory requirements. If the candidate is not hired, the data is typically deleted within 6 months unless a longer retention period is required by law.
Grants and retirement club
Type of data
Information when you seek grants from our foundations or information about your membership in the retirement club.
Purpose of processing
The purpose of processing this data is for SAS to administer and carry out the activities.
Legal basis
The legal basis of processing this personal data is because it is necessary to fulfil our terms of conditions of the grant applications and membership, see GDPR art. 6 no 1 b. For other activities, the legal basis is our legitimate interest in providing you service, see GDPR art. 6 no 1 f. When SAS uses the legal basis of legitimate interest, we document the legitimate interest of SAS to pursue the activity and the individual’s right to integrity in a legitimate interest assessment (LIA).
Retention time
SAS saves this data for 7 years, according to regulatory demands.
Security, compliance and incident management
Type of data
SAS may process customer identifiers, contact information, booking and travel information, payment-related information, correspondence, customer service records, technical logs, device and usage information, account information, and other information relevant to a security incident, complaint, claim, investigation, or legal or regulatory request.
Purpose of processing
SAS processes personal data to prevent, detect, investigate and respond to security incidents, fraud, misuse of services, complaints and claims, and to comply with legal and regulatory requirements.
Legal basis
The legal basis for processing your personal data for security, compliance and incident management is SAS's legitimate interest in protecting its customers, services, systems and business operations, see GDPR Article 6(1)(f). When SAS uses the legal basis of legitimate interest, SAS documents the legitimate interest of SAS to pursue the activity and the individual's right to privacy in a legitimate interest assessment (LIA). Processing may also be necessary to comply with legal obligations, or for the establishment, exercise or defence of legal claims, see GDPR Articles 6(1)(c) and 6(1)(f).
Retention time
Personal data processed for security, compliance and incident management purposes will be retained for as long as necessary to investigate, resolve and document the relevant matter, fulfil legal and regulatory requirements, or establish, exercise or defend legal claims. Thereafter, the data will be deleted or anonymized in accordance with SAS's retention procedures.
SAS for work
For details about SAS for Work and how we process personal data, visit Privacy policy for corporate customers
SAS Holidays
SAS Holidays is operated in collaboration with a third-party contractor who acts as an independent data controller. This means that the contractor is responsible for the processing of your personal data in accordance with their own privacy policy and legal obligations. For all processing of personal data related to SAS Holidays, the contractor’s privacy policy applies.
Wifi Services
Type of data
When you use SAS-provided wifi services, we may collect device identifiers (such as MAC address), connection timestamps, browsing activity (limited to network-level metadata), and technical data related to your session.
Purpose of processing
The purpose of this processing is to provide secure and reliable internet access, monitor network performance, prevent misuse, and ensure compliance with applicable laws and SAS policies.
Legal basis
The legal basis for processing this data is the necessity for the performance of a contract to which the data subject is party, as well as compliance with legal obligations applicable to SAS, see GDPR art. 6 no. 1 b and c.
Retention time
Wifi usage data is retained only for as long as necessary to fulfill the purposes stated above, typically no longer than 12 months, unless a longer retention period is required by law or for the resolution of specific incidents.
Use of SAS mobile app
You can download our mobile app to search for flights and book your trip, hotel or rental car, manage your booking and check in easily among other things. We will process your personal data in our mobile app in the same ways and for the same purposes as described in this Privacy Policy and in our table above. The SAS mobile app (“SAS App”) however contains some additional features compared to the website which are described in Section 8. For most such additional features we have assessed that we have a legitimate interest in processing your personal data in order to deliver a useful app. Where an activity is instead based on your consent, this is collected prior to the function being used.
AI
SAS may use artificial intelligence, machine learning, and other automated technologies to improve customer service, enhance operational efficiency, develop and improve products and services, analyze customer interactions, and support business operations. Such processing will be subject to appropriate safeguards and will be carried out in accordance with applicable data protection laws. When AI tools are used, you will always receive information about this in connection with use.
Special categories of personal data
Some special categories of personal data are especially sensitive and needs extra protection, e.g. health data. The purpose of which SAS processes sensitive data provided by travelers is that so we can provide the same service to all travelers and deliver the services purchased. This means that SAS also shares sensitive information with third parties during travel. This data is called SSR (special service request) information and it follows an IATA standard used throughout the airline industry. The sensitive data processed is:
Need for wheelchair, stretcher or bed at airport and/or inflight
Medical needs and fitness for travel
Disabilities and need for special assistance and/or service animals
Special meals based on medical needs or religious beliefs
Passengers traveling incognito or in custody
Travelers that are deportees
This processing of personal data is necessary in order to fulfil our contractual obligations to you when you book a trip with us, see GDPR art. 6 no 1 b.
Data related to minors under 18
SAS does not process any data about travelers under 18 for any other purpose than a specific trip or to manage a profile account, or an EuroBonus account.
To whom will SAS disclose your personal data?
SAS will only share your personal data with companies within the SAS Group except in the exemption situations described below.
Foreign authorities and law enforcement bodies
Because of mandatory requirements from foreign authorities and to make possible the execution of the travel plans you have chosen, SAS may be under an obligation to provide foreign authorities access to certain PNR data and advanced passenger information (“API”), with respect to passengers who are flying to, from or over countries both within and outside the European Union (“EU”) and the European Economic Area (“EEA”), including the USA. Such data is used primarily to prevent and combat terrorism and other serious crime. In addition, PNR and API are governed through Directive 2016/681/EU.
Subcontractors and third-parties
If it is necessary in order for us to be able to carry out your flight in accordance with the terms and conditions for travel or otherwise perform our services to you, your personal data will also be shared with:
other airlines and other companies that are involved in the provision of the service that you will make use of, for example ground handlers;
companies that are part of the booking and performance of your flight, e.g. travel agencies, freight forwarders and agents;
IT providers and developer who ensure the operation and security of our IT systems on behalf of SAS;
credit card companies with which SAS collaborates to offer different payment solutions.
security companies and businesses that work with preventing and combating fraud and cyber investigations; and
other partners such as companies that provide such services that you may consider purchasing in association with your trip, such as hotel chains, car rental companies and travel insurance.
Foundations and organizations collaborating with SAS for service or operational purposes;
Codeshare and partner airlines that operate flights on your itinerary, to ensure booking, travel, and compliance with legal and security requirements including sharing data to relevant authorities;
Joint controllers
Personal data is also shared with our Business Partners to coordinate data, offers, activities and analysis. In some cases, we have joint control with our partners. This means that we and our partner jointly control your personal data and determine the purposes of the processing. Below, you can view our current joint controllerships and visit their privacy policies to learn more about their handling of personal data.
SAS and EuroBonus
If you book a trip with SAS via SAS website and/or channels or via a travel agency, SAS and SAS EuroBonus AB (“EB”) will process the email address you provided when making the booking, as joint controllers, to verify whether or not you are a member of the EuroBonus program. This limited processing of personal data is based on our legitimate interests in administrating the EuroBonus program, see GDPR art. 6 no 1 f. In case you are not a member of the EuroBonus program, no further processing will be made by SAS and EB as joint controllers.
Will your personal data be processed outside the EU/EEA?
Transfers of Personal Data Within the SAS Group
Personal data will be transferred between companies in the SAS Group, including for the implementation of our international flights, to administer and maintain your account and membership and for statistical purposes.
Transfers to Countries Outside the EU/EEA
Personal data that is shared within the SAS Group in this way or with subcontractors and third parties as described above in Section 4.2, will sometimes be transferred to countries that are not members of the EU or the EEA and that do not ensure a satisfactory level of security for personal data. Such transfers will be carried out in accordance with the prevailing law on data protection, such as adequacy decisions and additional contractual clauses. SAS Group transfers personal data to the following countries outside of EU/EEA for occasional services connected to our processes as an air carrier: USA, China, India, Indonesia, Brazil, UAE, Turkey, Albania, Montenegro, South Africa, Peru, Ethiopia, Ukraine, Lebanon, Colombia, El Salvador, Costa Rica, Mexico, Australia, Thailand, Egypt, Russia, Taiwan, and Singapore.
Safeguards for International Data Transfers
When personal data is transferred to a non-EU/EEA country without satisfactory levels of protection for personal data, we will apply appropriate measures, as a minimum by including a standard contractual clause that has been adopted by the European Commission. These standard contractual clauses can be found at the following link: Standard Contractual Clauses (SCC) (europa.eu)
Transfers Based on Contractual Necessity
If there is a lack of both a decision on adequate levels of protection by the European Commission and established appropriate security measures in the form of standard contractual clauses in accordance with the above, we will only transfer your personal data when it is necessary in order to fulfill our contractual obligations to you, see GDPR art. 49 no 1 b, for example in order to carry out your travel or to perform our obligations under the EuroBonus and Profile Account terms and conditions.
How do we protect your personal data?
We have taken extensive technical and organizational measures to protect your data from loss, abuse and unauthorized access. Processing and transfer of data between your web browser and our server is properly protected by encryption and we are continuously updating our security measures. When you pay for any of our services using a card, all information is sent via a secure connection to ensure that your personal data cannot be read by third parties. The actors with whom we collaborate in terms of card payments are all certified in accordance with the international security standard PCI-DSS, which means a very high level of security for the processing of your card details.
While SAS implements appropriate technical and organizational measures to protect personal data, customers should be aware that information submitted through publicly accessible channels may not be protected in the same manner.
If you choose to publish, share, or otherwise make available personal data through publicly accessible websites, web pages, forms, forums, social media platforms, or by using a publicly accessible URL, such information may be accessed, copied, or further disclosed by third parties beyond SAS's control.
SAS cannot guarantee the security or confidentiality of personal data that customers voluntarily make publicly available through such channels and cannot prevent unauthorized access, use, or disclosure of information once it has entered the public domain. Customers are therefore encouraged not to share sensitive personal data through publicly accessible channels unless necessary.
Additional features in SAS app
Analytics and online behavior
We use certain technology features (similar to cookies) such as unique identifiers associated with your device in our SAS app with the purpose to help administer the app and to improve your experience and our services. Such features may be provided by third parties. After downloading the SAS app, we will ask for your consent to enable such features. If you choose to allow these types of features, you can control your settings at any time in the SAS app under Notifications. The legal basis for this processing is your consent, see GDPR art. 6 no 1 a. The data is saved for as long as we have your consent.
Mobile push notifications
With your consent, we use mobile push notifications to send you direct messages with flight related service information such as opening of check-in, change of gate or delays etc. as well as advertisement and special offers. You can control your settings at any time in the SAS app under Notifications. We will store your device ID backend to enable push notifications. The legal basis for this processing is your consent, see GDPR art. 6 no 1 a. The data is saved for as long as we have your consent.
Saved travelers
You have the option to store personal data regarding yourself and persons you are travelling with locally on your mobile device in the SAS app. This ensures that the necessary information is pre-filled during the booking or check-in process to enable a more convenient process. Such personal data stored on your device is only processed locally in the app and will not be collected by SAS.
Tech Support/App Support
We have an app support function to assist with any technical issues or errors occurring when you use the SAS app or to send feedback. We will only process your personal information to the extent necessary to solve your case. We will also store certain information regarding usage of the SAS App to be able to debug technical issues. The legal basis for this processing is our legitimate interest in providing you service and support, see GDPR art. 6 no 1 f. SAS save this data as long as we need in order to solve your case.
Historical flights
The SAS app has a feature which shows your flight history with SAS where you can view details of each flight such as origin and destination, date, flown kilometers, seat number and whether your boarded the flight. The legal basis for this processing is our legitimate interest in providing you this feature, see GDPR art. 6 no 1 f.
Bag tracking
With this feature you can track your checked-in luggage and view where your bag is located at the moment based on where the bag tag was last scanned.
Location
The SAS app may with your consent collect information about your geographical position. This feature is used when you book a flight in the SAS app to enable us to show you the closest airport for departure by using the location of your device. Such data is not collected or saved by SAS and you can control you consent in the SAS app settings of your device. The legal basis for this processing is your consent, see GDPR art. 6 no 1 a. The data is saved for as long as we have your consent.
What are your rights?
You have several rights related to your personal data. You can exercise your rights at Manage Personal Data.
Revocation of consent
If we process information about you based on your consent, for example through cookies or in the SAS App, you have the right to revoke your consent at any point in time. We will then terminate the processing of the personal data that is based on your consent.
Correction
If your personal data that SAS processes are incorrect or incomplete, you can call our customer service that will help you correct or complete your data. You can find the contact information to our customer service here.
Right to restrict the processing
In certain circumstances, you have the right to restrict our use of your personal data, which means you can limit the way SAS use your personal data. This is an alternative to requesting the erasure of your data, see below. This means that SAS will stop using the data except for storing it.
Right to access
You have the right to request a copy of your personal data Use following link to send a request for accessing your data. If you have any issues using the template online, contact the DPO that will assist you. You can read more about this process on our website under “manage my data”.
Right to complain
It is important for us that you feel confident that SAS process your personal data with the utmost respect. If you are uncertain as to how SAS is processing your personal data or have any complaints, you are welcome to contact our Data Protection Officer. You also have the possibility of submitting a grievance to the Swedish Data Protection Authority or the data protection authority of your country.
Right to object
You have the right to raise an objection at any point in time to the processing of your personal data that is based on our legitimate interest. If SAS cannot demonstrate compelling legitimate grounds for the processing of your data that outweighs your interests, rights and freedoms or that the processing is done for the establishment, exercise or defense of legal claims, then SAS will no longer process your personal data.
Right to data portability
You have the right to request to receive your personal data that we process in a machine-readable format, which you have the right to transfer to another company. This can be done if you want to reuse your personal data for your own purposes across different services.
Right to be forgotten
Your right to erasure means that you can request that we delete the personal data we have about you. We will do so without undue delay, unless we are legally required to process the information, e.g. for financial or accounting purposes, or we have another lawful reason to continue processing the data, e.g. for carrying out a requested travel. You can exercise your right here.
Right to lodge a complaint
If you consider that SAS's processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the relevant supervisory authority in the country where you reside, work, or where the alleged infringement occurred.
United Kingdom
You have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection issues. Information Commissioner's Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website: https://www.ico.org.uk
Sweden
Integritetsskyddsmyndigheten ("IMY") is the Swedish supervisory authority for data protection matters. Integritetsskyddsmyndigheten (IMY) Website: https://www.imy.se
Denmark
Datatilsynet is the Danish supervisory authority for data protection matters. Website: https://www.datatilsynet.dk
Norway
Datatilsynet is the Norwegian supervisory authority for data protection matters. Website: https://www.datatilsynet.no For information about supervisory authorities in other countries, please contact your local data protection authority or visit the European Data Protection Board website at https://edpb.europa.eu.
Changes in the Privacy Policy
We may update this Privacy Policy at our discretion every now and then. The latest version will always be available on SAS home pages.
Processing of personal data in China
Processing of personal data in china
This section is applicable to customers located in the People's Republic of China (hereafter China) and describes how we collect, use, store, share and disclose your personal data in China and supplements other generally applicable sections of this Privacy Policy. If any inconsistency or deviation occurs, the provisions provided in this China section take precedence over provisions set out in other generally applicable sections of this Privacy Policy. It applies to personal data we collect from or about you when you use SAS services, visit SAS websites, SAS WeChat official account or use any other internet sites operated by SAS that may be linked to this Privacy Policy, or contact our customer service team by calls, emails etc. By continuing to use our services, you agree to the collection and use of your personal data in accordance with the provisions of this Privacy Policy.
Updates
SAS reserves the right to modify the China section of this Privacy Policy and will post updated version of this policy in accordance with laws and regulations regarding data protection of China. To the extent SAS materially changes the China section of this Privacy Policy, SAS will inform you of such changes and, to the extent this affects the purposes and processing for which we have obtained your consent, we will re-seek your consent. For the exercise of data protection rights and/or if you have any questions or comments regarding this China section of Privacy Policy, you are welcome to contact our Data Protection Officer at [email protected].
How does SAS collect & receive your information?
This part supplements “When and how do we process your personal data” of this Privacy Policy and section 3 of this China section. SAS may collect and receive personal data from the App users located in China through the Software Development Tools (SDKs) deployed on the SAS App. Depending on the SDK, the type of personal data collected and received via the SDKs may include, without limitation, the App user’s name, email address, phone number, mailing address, EuroBonus number, credit card information (to the extent a credit card transaction is being made through the App), passenger flight information, App usage metrics, and device information such as IP address. SAS may use such information to verify and authorize credit card transactions, to receive feedback about the App and services, and to track and analyze usage of the App. Please find below list of the SDKs that are currently deployed on the SAS App operating in China. SAS may update this list of SDKs from time to time if any changes take place.
List of the SDKs deployed on the SAS App operating in China as of November 1, 2021: SDKs
How sas uses your data
This part describes what personal data we collect about or from you, the purposes for which we use it, and why we use it for our basic and expanded business functions. Your personal data will be collected and processed in accordance with Personal Information Protection Law (“PIPL”) which came into force as of November 1, 2021, and any other laws and regulations of China that govern this area. Any processing of personal data that we perform is in accordance with the provisions of the privacy laws in China, and this data may only be used for the limited purposes discussed in this part. Scandinavian Airlines System Denmark-Norway-Sweden is responsible for the processing of your personal data via SAS websites and in association with the use of SAS services. In order to provide you with travel ticketing services and other SAS services and products, we need to collect and use certain personal data. Below lists the personal data that we may request you to provide to us or we may collect and use about you. Please understand that some service feature requires some personal data before it can be provided. After you exercise your right to object, we will be unable to continue providing the service corresponding to the personal data involved in the objection and we will no longer process your corresponding personal data. We may request you to provide to us the following personal data:
Identification and contact information
Your gender, date of birth, ID No., passport No., nationality; your name, address, phone No., E-mail address; and the personal data of any other persons that you travel with (including their contact information). Such information will be used to pass to you or your contact person messages on flights and orders (including flight departure, security check, boarding, reimbursement, flight delay, insurance services and notification of accident), organize your itinerary, e-mail itinerary or other products to you, verify your identity, receive your comments on service quality, receive your complaints and suggestions, provide you with SAS services and products, and push to you, if you agree to receive, promotional and marketing messages. Please be noted, when you book for others the relevant services, you need to provide such passengers’ personal data, and, before providing us with their information, please make sure such passengers understand and agree to this Privacy Policy.
EuroBonus information
Your EuroBonus member account No. and flight information, mileage redemption recipient’s information, and minor member’s guardian information. Such information will be used to maintain you as our EuroBonus member, verify member identity and process your accumulation, reward and redemption of points and other services.
Profile account holder information
Your site profile account No., name, age, address and contact information. Such information will be used to maintain you as our profile account holder and manage your account and travels.
Data and images of identity documents required in business processing
ID card, passport, visa page, papers required by authorities for taking a flight, validity period, authorities of issuance, age or date of birth, gender, and their corresponding images. Such information and images will be used, in accordance with laws and regulations, to verify your identity when you book a ticket, check in, take a flight, process entry/exit formalities, purchase air insurance, enjoy SAS services and any other services.
Payment information
Your credit card No., billing address, credit card validity, orders and operation records, log and risk control information. Such information will be used, when you purchase a ticket, to maintain your payment information, verify your identity and provide you with SAS services.
Information to improve travel and other services
Emergency contact person, special service requirements and personal likes and dislikes (in-flight meals, location of seats in cabin, in-flight services). Such information will be used to improve and promote our service so that we can provide you with services that better address your needs and may push to you, subject to your agreement, our promotional and marketing messages.
Information required by authorities or to assess your fitness to fly
Contact information, information regarding the presence or absence of possible COVID-19 or other global pandemic symptoms; information regarding potential exposure to COVID-19 or other global pandemic; information collected by our ground or reservations staff pursuant to directives by public health organizations or other government agencies. Such information will be used to comply with legal and regulatory requirements, determine your fitness to travel consistent with applicable government regulations and guidelines.
Any other personal data
We collect for the purpose of: making and operating connections between multiple flights and expediting baggage clearance across international borders; complying with certain regulatory requirements regarding emergencies and otherwise in relation to operating passenger flights; complying with certain regulatory requirements for verifying and authenticating your identity and have a legitimate business interest in complying with applicable legal and regulatory requirements; using this information to perform our contract with you; complying with certain requirements in the public interest such as to protect against risks to passenger and public health, and passenger and aircraft safety. Please be noted that we will collect, store, use, and transfer your sensitive personal data for the purposes for which it was provided and otherwise in accordance with the terms of this privacy policy if you provide your explicit consent at the time of collection.
On what legal basis does SAS process your personal data
Our legal basis for processing your personal data described above will depend on the personal data concerned and the specific circumstances where we process it. And we will generally collect personal data from you only where:
we have obtained your consent to do so;
such data is necessary for us to perform a contract with you;
the processing is in our legal interests and not overridden by your rights;
we have legal obligations to process your personal data from you or may otherwise need the personal data to protect your vital interest or that of other persons;
it is necessary for responding to a public health emergency or for protecting life, health and property safety of a natural person;
acts, such as news reporting and supervision by public opinions, are carried out for the public interest, and the processing of personal data is within a reasonable scope;
it is necessary to process the personal data disclosed by the individual concerned or other personal data that has been legally disclosed within a reasonable scope in accordance with the provisions of PIPL and related laws and regulations; and
other circumstances prescribed by laws and administrative regulations.
With whom does SAS share your information?
We may share your personal data we collect or receive with:
Other airlines and other companies that are involved in the provision of the service that you will make use of;
Companies that are part of the booking and performance of your flight, e.g., travel agencies, freight forwarders and agents;
IT providers and developer who ensure the operation and security of our IT systems on behalf of SAS;
Credit card companies with which SAS collaborates to offer different payment solutions, such as MasterCard;
Security companies and businesses that work with preventing and combating fraud;
Companies within the SAS Group, including but not limited to SAS EuroBonus AB, SAS Link AB, Scandinavian Airlines Ireland Ltd, SAS Ground Handling A/S, SAS Ground Handling AS, SAS Ground Handling AB, SAS Cargo Group A/S, SAS Cargo Norway AS and SAS Cargo Sweden AB.
Government agencies and authorities, law enforcement officials, law courts; or
Third parties: (a) if we believe disclosure is required by applicable law, regulation or legal process (such as pursuant to judicial order); or (b) to protect and defend our rights, or the rights or safety of third parties, including to establish, make, or defend against legal claims.
Exercising your rights
SAS fully respects your right to know, access, rectify, restrict the processing of, delete your personal data etc.
Right of access
You have the right to obtain from us confirmation as to whether or not personal data about you is being processed, and, where that is the case, to request access to the personal data. The access information includes the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You have the right to obtain a copy of the personal data undergoing processing. For additional copies requested by you, we may charge a reasonable fee based on our costs.
Right to rectify
You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to delete
You have the right to request us to delete your personal data.
Right to object
You have the right to object at any time to the processing of your personal data by us for certain purposes. If you exercise this right to object, your personal data will no longer be processed for such purposes by us. Exercising this right will not incur any costs. However, such a right to object may not exist in certain circumstances, e.g., if the processing of your personal data is necessary to take steps prior to entering a contract or to perform a contract already concluded.
Right to cancel account
You have the right to cancel a previously registered account at any time. Once completion of the cancellation of your account, all information therein will be deleted or anonymized and we will no longer collect, use or provide to third parties the personal data relating to the account. Nevertheless, the information provided by you or generated during your use of our services will need to be retained by us for the period required by laws and regulations, and authorities will have the right to access such information according to law during that legal retention period. To exercise these rights, you can request erasure of personal data. For us to be able to verify your identity your written request should include your name and address and other such information that will help us identify you, such as:
Any email addresses that you have used in communication with SAS
EuroBonus number or TravelPass number
Any telephone number you have used in communication with SAS (for example customer service cases)
Booking number and/or flight number and date.
SAS must always ensure that it is the right person who is receiving the information about how we process their personal data. SAS will only disclose personal data if we can verify your identity in accordance with the above. After we receive a request to exercise one of these rights, we will provide information on the action we take on the request without undue delay and in any event within 30 days of receipt of the request. This time may be extended by a further 30 days in certain circumstances, for example, where requests are complex or numerous.
Security
Information security is important to SAS. We have adopted proper measures such as separate storage, encryption, access control, de-identification etc., in accordance with the requirements of data classification and categorization, to protect your information security from unauthorized access, disclosure, loss, misuse, alteration, and improper use of your information and avoid negative impact on your personal rights and interests.
Minors
SAS attaches great importance to the protection of minors' personal data. If you are a minor under the age of 14, you should obtain the written consent of your parents or legal guardians before using our products and/or services. For the collection of personal data of minors with the consent of their parents or legal guardians, we will only use or disclose this information with the permission of the law, the explicit consent of their parents or guardians or the necessary protection of the minors. If a minor has provided us with personal data without parental or guardian consent, the parent or guardian may contact us by emailing us at [email protected]. We will remove the information and unsubscribe the child from any of our electronic marketing lists.
EuroBonus members
Who is responsible for your personal data?
SAS EuroBonus AB ("EB") with corporate identity number 559224-9782, and Scandinavian Airlines System Denmark- Norway-Sweden, a consortium established under the laws of Denmark, Norway and Sweden, and having its principle office at Frösundaviks allé 1, SE-195 87 Stockholm, Sweden ("SAS"), will jointly determine the purposes and means of the processing of your personal data as so called joint controllers within the meaning of Article 26 of the General Data Protection Regulation (EU Regulation no. 2016/679) (the "GDPR"). For this purpose, EB and SAS have entered into a joint-controller agreement, the essence of which is set out in the joint-controller agreement summary.
EB and SAS as joint controllers (hereafter "we" or "us") are committed to ensuring your right to privacy and will only process your personal data as described in this Privacy Policy.
Below, we explain how we collect, use, transfer, store or otherwise process any personal data relating to you as a member of our EuroBonus program. Our aim is to be as clear, transparent, and candid as possible. However, do not hesitate to contact us should you still have any questions about how we process your personal data.
How do we collect your personal data?
Most of the personal data we hold on you will stem from you directly, e.g. when you register for a EuroBonus account or purchase flights and from your activities when using the SAS application or EB’s or SAS’ websites. Similarly, we obtain information from you when you use your EuroBonus card or your points, or when you use other offers and services from us or our business partners.
In addition, we obtain personal data about you from the following sources:
EB’s and SAS’ different departments and sales points, such as lounge visits and customer care contacts.
EB’s business partners ("Business Partners"), e.g. hotel reservations, rental car bookings, co-branded credit cards, and purchases using or earning EuroBonus points.
Our suppliers acting on behalf of EB, e.g. EuroBonus shop, card linking service, affiliate web shopping, security companies and businesses that work with preventing and combating fraud and cyber investigations; and IT providers and developer who ensure the operation and security of our IT systems on behalf of EB.
SAS partner airlines participating in the EuroBonus Program, for example other carriers in the Sky Team Alliance.
Based on your consent, we also create ‘new’ personal data from information collected from the above-mentioned data sources, in the form of predictive segmentations. These models and analyses are sometimes performed on our behalf by service providers contracted by us, such as customer insight and third-party data suppliers.
We may also collect personal data about you from the cookies on our website. You can read more about cookies in our Cookie Policy
Our processing of personal data
The basis and purpose of the EuroBonus program is for you to earn points and benefits from your activities with us and for us to provide you with a range of simple, useful and personalized services and offers. We are committed to getting to know you so that we can offer you the best personalized travel and lifestyle offers and features, and to continually improve our EuroBonus program. In this section, we describe the activities in which we process your personal data, the purposes of the processing, the types of personal data we process, the legal basis for the processing and the retention period of the personal data.
EuroBonus membership and account
Purposes and personal data
To administer and manage your EuroBonus membership and account, EuroBonus points earned and used, sending out EuroBonus cards as well as to update your contact details and cancel EuroBonus accounts of deceased members, we process the following personal data about you:
Membership Information: name, EuroBonus number, membership level.
Member details: Gender, date of birth, and country of residence.
To calculate your annual revenue from your EuroBonus membership to assess your membership level, tier and benefits, we process the following personal data about you:
Membership Information.
EuroBonus points and transactions (including, bookings, purchases, travels, upgrades, and award trips).
To provide relevant information on your My EuroBonus Profile about your membership and account, such as current EuroBonus points and transactions (including, bookings, purchases, travels, upgrades and award trips), points earned and used, membership level and point expiry date, including details on EuroBonus points and transactions relating to Business Partners, we process the following personal data about you:
Membership Information.
EuroBonus points and transactions (including, bookings, purchases, travels, upgrades, and award trips), and expiry date for EuroBonus points.
Business Partner information: purchases, flight transfers, hotel and/or car rental purchases. For instance, the destination of the trip, duration of stay, name and location of the hotel, type of room, car rented, rental time, time of purchase and amounts paid.
Information about your travels: destinations, airlines, ticket types, lounge visits, luggage information, flight seats and upgrades and payment information such as (time of purchase and amounts paid).
To provide contractually based offers, such as offers based on membership level, EuroBonus points, campaigns, or member events, we process the following personal data about you:
Membership Information.
Contact Information.
EuroBonus points.
To give correct and legal communication based on birthday (legal age for marketing), we process the following personal data about you:
Membership Information.
Date of birth.
Country of residence.
To offer contractually based benefits such as member gifts, family pooling, friends pooling and member give aways, we process the following personal data about you:
Membership Information.
Gender, date of birth, and country of residence.
Contact Information.
EuroBonus points and benefits.
Contact Information and Membership Information relating to family and friends.
To provide you with customer service and support (for example Membership Information is displayed to call center agents for member recognition or used to identify unknown or unidentified customers), we process the following personal data about you:
Membership Information.
Contact Information.
Customer service or support details
Personal data that you are contractually required to provide are marked as mandatory when you register as a member. Such personal data is necessary to become a EuroBonus member.
Legal basis
The legal basis for the processing of your personal data is to fulfil our contractual obligations (EuroBonus Terms & Conditions) to you as a EuroBonus member, see Article 6(1)(b) GDPR.
Retention time
We will process your personal data for as long as you are a EuroBonus member. Upon termination of your membership, your personal data will be deleted within one year of termination. As set out in Section 3.13 in the EuroBonus Terms & Conditions, we have the right to terminate your membership in case of inactivity for more than 24 months, if you have no valid, usable points in your EuroBonus account. Your personal data will then be deleted. However, personal data relating to purchases, claims, refunds, and compensations may be stored for a longer time if required by law or necessary for the exercise or defense of legal claims.
Communication and improvement of member services
Purposes and personal data
To analyze and store information on how you earn and use your EuroBonus points, and what products and services you decide to purchase and how, to create more tailored and relevant offers and activities for you alone or together with Business Partners, we process the following personal data about you:
Membership Information.
Your use of EuroBonus points, services and products from us or our Business Partners.
To send service emails to you, e.g., to inform you that your EuroBonus points are about to expire, we process the following personal data about you:
Membership Information.
Contact Information.
EuroBonus points.
To calculate your annual revenue from your EuroBonus membership to reward our loyal customers, we process the following personal data about you:
Membership Information.
EuroBonus points and transactions (including, bookings, purchases, travels, upgrades, and award trips).
Rewards and benefits.
To streamline our communication with you and minimize spam, e.g., by registering if you do not open our emails and administering requests to no longer receive such emails, and to remove unnecessary information, e.g., offers for purchasing extra baggage if you have already done so, we process the following personal data about you:
Membership Information.
Contact Information.
Your interactions with and responses to our communication with you. Read more about SAS usage of cookies and pixels in SAS’ Cookie Policy.
To invite you to exclusive events and activities based on your preferences and tier level, we process the following personal data about you:
Membership Information.
Demographic data.
To send out surveys and collect answers about customer experience,we process the following personal data about you:
Membership Information.
Email address.
Answers to surveys.
To train and develop our AI systems, we process the following personal data about you:
Input data from circumstances such as "your use of exemplified services".
To identify and analyze how you travel for work to communicate with and send targeted offers and promotions to EuroBonus corporate members in SAS for Work, if you are an employee of a company that is a EuroBonus corporate member, we process the following personal data about you:
Frequency of business travels.
Usage of our services.
Employer (i.e., the EuroBonus corporate member).
Legal basis
The legal basis for processing personal data for our communication and improvement of member services is our legitimate interest in optimizing our services for individual communication and improvement of member services, see Article (6)(1)(f) GDPR . We have concluded that the processing of your personal data is necessary to achieve the relevant purposes. We also conclude that these interests override any competing interests and fundamental rights and freedoms. You always have the right to object to this conclusion and can read more about your rights below.
Retention time
We will continuously process personal data about you throughout your EuroBonus membership. We carry out regular deletion of personal data that is no longer relevant for the purposes at 2-year intervals. Upon termination of your membership, your personal data will be deleted within one year of termination. Personalized communications, services and offers.
Purposes and personal data
To collect and analyze statistical data about your needs, preferences, buying patterns and purchasing power based on your history of purchasing products and services from us and our Business Partners, we process the following personal data about you:
Membership Information.
EuroBonus points and transactions.
Personal preferences and needs regarding EB, SAS and our Business Partners products and services.
Purchasing patterns and purchasing power.
Answers to surveys.
We process the following of your personal data to add value to the EuroBonus program and to understand your preferences, needs and (online) behavior, and to create a personal profile of you, based on which we will provide you with personalized offers and services. By using predictive models and segmentation based on demography, gender and purchasing patterns, and performing analysis based on customer segmentation, we try to understand which products and services you value and highlight those products and services to you. Such models include the use of automatic tools and systems, such as AI.
Membership Information.
Contact Information.
EuroBonus points and transactions.
Personal preferences and needs regarding EB, SAS and our Business Partners products and services.
Online behavior, e.g., how you use of SAS’ applications and EB’s/SAS’ websites.
Answers to surveys.
We process the following of your personal data to predict other services and offers that may interest you based on member data. We examine and generalize needs, preferences, buying patterns and purchasing power to understand customer behavior and segments. For example, we analyze what other customers tend to buy according to different attributes (e.g. when they booked their trip, where they are going, how long they are away) and try to predict what products or services you might be interested in buying based on the behavior of other customers.
Membership Information.
Contact Information.
EuroBonus points and transactions.
Personal preferences and needs regarding EB, SAS and our Business Partners products and services.
Answers to surveys
Online behavior, e.g., how you use of SAS’ applications and EB’s/SAS’ websites.
Aggregated segmented information relating to your membership.
To provide you with personalized offers, recommendations, products, services, information and travel tips from us or our Business Partners, based on our profile on you and/or our predictions about your interests and preferences, we process the following personal data about you:
Membership Information.
Contact Information.
EuroBonus points and transactions.
Personal preferences and needs regarding EB, SAS and our Business Partners products and services.
Online behavior, e.g., how you use of SAS’ applications and EB’s/SAS’ websites.
Aggregated segmented information relating to your membership.
Answers to surveys
We process the following of your personal data to track paid media campaigns, such as information on impressions, clicks and conversion rates, for analysis and to create platforms for communication. We monitor our campaigns at both an aggregate and individual level (where cookies are accepted) and receive personal data from a number of sources, including Facebook and Google.
Membership Information.
Contact Information.
EuroBonus points and transactions.
Information on impressions, clicks and conversion rates.
To enable us to advertise to you on social media platforms, such as Facebook and Instagram, through customer match and customer match lookalike, we process the following personal data about you: Hashed email address.
To share your personal data with our Business Partners for analytical, marketing and profiling purposes, for example to deliver products and services used by you within the EuroBonus program, follow up on partnerships, develop new relevant products and services and to tailor our offers depending on your interests, we process the following personal data about you:
Membership Information.
Contact Information.
EuroBonus points and transactions.
Preferences and needs regarding EB, SAS and our Business Partners products and services.
Legal basis
The legal basis for the processing of your personal data is your consent, see Article 6(1)(a) GDPR. Retention time Your personal data is processed as long as we have your consent. You are free to withdraw your consent at any time via your settings in your EuroBonus account. We will continuously process personal data about you throughout your EuroBonus membership. We carry out regular deletion of personal data that is no longer relevant for the purposes at 3-year intervals.Upon termination of your membership, your personal data will be deleted within 1 year of termination.
Cookies and online behavior
We process your personal data for the following purposes:
We process your personal data through strictly necessary cookies to provide necessary functionality and maintain security. Please see our Cookie Policy for details regarding personal data for necessary cookies.
We process your personal data to collect, store and analyze online behaviour, alone or in combination with other personal data for which we are the controller or which we have received from a third party, and to provide you with targeted offers on our, our Business Partners’ and third-party applications and/or websites. Please see our Cookie Policy for details regarding personal data for marketing cookies.
We process your personal data to identify abandoned baskets and send you reminders to complete your purchase or booking. Please see our Cookie Policy for details regarding personal data for performance and marketing cookies.
We process your personal data to perform aggregated analysis of data, alone or in combination with other data for which we are the controller or which we have received from a third party, on app behavior such as searches, clicks, purchases. Please see our Cookie Policy for details regarding personal data for statistical and analysis cookies.
Legal basis
The legal basis for the processing of your personal data through cookies is your consent, see Article 6(1)(a) GDPR, if you consent to the use of cookies on EB’s and SAS’ websites or SAS’ applications. The legal basis for processing personal data through our necessary cookies is our legitimate interest in providing necessary functionality and maintaining security, see Article (6)(1)(f) GDPR. We have concluded that the processing of your personal data is necessary to achieve the relevant purposes. We also conclude that these interests override any competing interests and fundamental rights and freedoms. You always have the right to object to this conclusion and can read more about your rights below.
Retention time
Please find detailed retention periods in our cookie policy or until you withdraw your consent. You are free to withdraw your consent at any time via your cookie settings. Please read more about our use of cookies in SAS’ Cookie Policy.
Fraud and crime prevention and legal claims
Purposes and personal data
To prevent, investigate, or report cases of fraud or safety/security issues and to cooperate with law enforcement agencies, we process the following personal data about you:
On award trips: Membership Information and credit card details.
Contact Information.
EuroBonus points and transactions (including, bookings, purchases, travels, upgrades and award trips).
To detect fraudulent behavior detection online through, e.g., device fingerprinting, we process the following personal data about you:
IP address and device information.
To establish, exercise, and defend against legal claims, where applicable, we process the following personal data about you:
Membership Information.
Contact Information.
Correspondence, payment information, descriptions of course of events, or other relevant circumstances or data.
Legal basis
The legal basis for processing personal data is strictly necessary for the purposes of preventing, investigating, or reporting cases of fraud, as well as to establish, exercise, and defend against legal claims, see Article 6(1)(f) GDPR. We have concluded that the processing of your personal data is necessary to achieve the relevant purposes. We also conclude that these interests override any competing interests and fundamental rights and freedoms. You always have the right to object to this conclusion and can read more about your rights below.
Retention time
The personal data that is caught by our filters, due to anomalous activities giving rise to suspicions of fraud and/or safety or security breaches, and which are processed for the establishment, exercise or defense of legal claims, will be retained until the matter is closed and cannot be appealed. Personal data that is not caught by our filters will be deleted immediately. Credit card details relating to a purchase are stored for seven years in accordance with accounting legislation.
Statistics, analysis and improvement of our products, services, and features
We process any personal data we hold about you for the purpose of aggregation. The aggregated data is used to compile statistics and to analyze and improve our products, services, and features. Once your personal data is aggregated, you can no longer be identified, and it is no longer considered personal data.
Additional features in SAS app
As a EuroBonus member, you can log in as a member on the SAS app, where you can access your EuroBonus account. Read more about how we process your personal data in the SAS application.
Will your personal data be processed outside the EU/EEA?
Personal data shared within the SAS Group or with our Business Partners may be transferred to countries outside the European Union ("EU") or the European Economic Area ("EEA") that do not provide an adequate level of protection for personal data. Such transfers will be made in accordance with applicable data protection laws.
Where personal data is processed outside the EU/EEA, there is either a European Commission decision that the country in question provides an adequate level of protection, including the EU-US Data Privacy Framework, or appropriate safeguards to ensure that your rights are protected, such as the standard contractual clauses.
In order to ensure transparency in the processing of personal data, you have the right to obtain a copy of any standard contractual clauses by contacting us using the contact details below. You can find more information about the countries which are deemed to have an adequate level of protection on the European Commission’s website and you can read more about standard contractual clauses on the Swedish Authority for Privacy Protection’s website.
How do we protect your personal data?
We have taken extensive technical and organizational measures to protect your data from loss, abuse and unauthorized access. Processing and transfer of data between your web browser and our server is properly protected by encryption and we are continuously updating our security measures. When you pay for any of our services using a card, all information is sent via a secure connection to ensure that your personal data cannot be read by third parties. The actors with whom we collaborate in terms of card payments are all certified in accordance with the international security standard PCI-DSS, which means a very high level of security for the processing of your card details.
What are your rights?
You have several rights in relation to your personal data. You can exercise your rights by logging into your EuroBonus account and clicking on "Manage Personal Data" on the SAS website.
Right to withdraw consent
If we process information about you based on your consent, you have the right to withdraw your consent at any time. We will then terminate the processing of the personal data that is based on your consent. You can withdraw your consent for direct marketing and profiling under settings in your EuroBonus account, or by clicking the unsubscribe link in relevant communication. To withdraw you consent for cookies – visit "Manage Personal Data" on the SAS website.
Right to rectification
If you believe that your personal data is inaccurate or incomplete, you can ask for it to be corrected or completed by calling our customer service that will help you correct or complete your data. Visit "Manage Personal Data" on the SAS website for further details.
Right to restriction
In some cases, you have the right to request a restriction of the processing of your personal data, which means that the data is marked so that, in the future, it can only be processed for certain limited purposes. This is possible, for example, if you have objected to the processing, if you have disputed the accuracy of your personal data, or if the processing is unlawful. By requesting a restriction of our processing, you have the right to stop us from processing your personal data for a certain period of time for other purposes than, for example, to defend legal claims.
Right to information and access
You can request information regarding whether we are processing your personal data and ask to receive a copy of your personal data (known as a data subject access request or DSAR) together with certain additional information regarding how we process your personal data. Visit "Manage Personal Data" on the SAS website for further details.
Right to lodge a complaint
It is important for us that you feel confident that EB process your personal data with the utmost respect. If you are uncertain as to how EB is processing your personal data or have any complaints, you are welcome to contact our Data Protection Officer. You also have the possibility of submitting a grievance to the Swedish Data Protection Authority or the data protection authority of your country.
Right to object
You have the right to raise an objection at any point in time to the processing of your personal data that is based on our legitimate interest. If we cannot demonstrate compelling legitimate grounds for the processing of your data that outweighs your interests, rights, and freedoms or that the processing is done for the establishment, exercise or defense of legal claims, then we will no longer process your personal data.
Right to transfer your personal data (data portability)
If we process your personal data to fulfil a contract or on the basis of your consent, you may, in certain cases, be able to obtain the personal data for use elsewhere, e.g. by obtaining a copy of it in a machine-readable format and transmitting it to another data controller.
Right to erasure
In some cases, you may request that your personal data be erased. The right to erasure applies, for example, to personal data that is no longer necessary for the purpose for which it was collected, or to personal data that is processed on the basis of your consent if you choose to withdraw your consent. In certain circumstances, we may not be able to delete your personal data, for example, if your personal data is needed to comply with a legal obligation, if it is still needed for the purpose for which it was collected, or if our interest in continuing to process the data outweighs your interest in having it deleted. Visit "Manage Personal Data" on the SAS website for further details or to exercise your right.
Contact details
SAS has appointed a Data Protection Officer to help SAS and EB ensure that your personal data is processed in the correct manner. You are welcome to contact our Data Protection Officer with questions or requests concerning our processing of your personal information by sending an email to data protection [email protected].
If you have questions regarding the EuroBonus program in general, please contact EuroBonus Customer Service at www.flysas.com.
Profile account holders
Full transparency
We are committed to ensuring your right to privacy and will only process your personal data as set out in this Privacy Policy for Profile Account holders. The Privacy Policy for Profile Account holders is an integral part of the Profile Account Terms and Conditions.
We will below explain how we collect, use, transfer, store or otherwise process any personal data relating to you as a Profile Account holder. Our aim is to be as clear, transparent and candid as possible. Should you still have questions about how we process your personal data, please contact our Data Protection Officer at [email protected].
What is personal data?
Personal data means any information relating to you as a natural person and through which you can be identified, directly or indirectly, such as your name or photo.
We recognize that special categories of data, such as data revealing ethnic origin, religious beliefs or health information, are particularly sensitive. We will only collect and use such sensitive data in accordance with this Privacy Policy for Profile Account holders and where strictly necessary. For instance, it is important for us to know if you are late stage pregnant or require a wheelchair to board a flight.
What does processing mean?
Processing of personal data means any operation or set of operations performed on personal data, whether or not by automated means. All actions carried out on personal data, from collection and storage to alteration, use or disclosure thus constitute ‘processing’.
The legal bases for our processing of personal data
Performing the profile account terms and conditions
Your choice to create a Profile Account necessitates SAS to register and process your personal data and your activities while logged in and using our website. We will thus process your personal data on the legal basis that the processing is necessary in order to fulfill our requirements under the Profile Account Terms and Conditions.
Legitimate interests
We will process personal data based on our legitimate interests to remain competitive within our market segment and therefore to be able to, among other things, analyze the personal data of our Profile Account holders related to booking flights, popular destinations, choice of ancillary products, use of the homepage and application, and following up the outcome of e.g. email communications. We will also process personal data based on our legitimate interests to prevent, investigate or report cases of fraud or safety issues and to cooperate with law enforcement agencies. We have weighed our legitimate interest against the level of privacy intrusion that our processing of your personal data could lead to. We process your personal data on a general and aggregated level, in a transparent manner, for the purpose of improving our products and services offered to you and with a very high level of security and safeguards in place. We thus assess that the level of privacy intrusion is limited and that our interests of carrying out this processing of personal data is justified and legitimate.
Legal obligations
We will process your personal data when we are under a legal obligation to do so, for instance when we are obliged to provide information to government authorities or we are subject to a court order.
What personal data will we process?
SAS registers and processes the following personal data about you and your activities, collectively the “personal data”:
Personal data submitted when you create, maintain or update the Profile Account.
Details collected regarding your travels and use of your Profile Account, such as origin and destination for the trip, carrier, type of tickets, luggage, pre-ordered meals, duration of stay, any complaints made, time of purchase, and amounts paid.
Information on customer care and travel irregularities such as delayed or canceled flights, lost luggage, and complaints, refunds, and compensation paid.
Process, on an aggregated level, all reservations and total revenue in order to optimize e.g. the flight network and pricing.
If you accept our cookies, we will process personal data on your online behavior as registered by cookies and analytics programs on our SAS website or application. For example, what terms you search for, length of the visits, which destinations are of interest to you and which links/headlines you choose to click on. Please see our Cookie Policy for more information on our use of cookies.
Where do we get your personal data from?
The personal data that we process is primarily collected directly from you, e.g. when you enter your contact details to register a Profile Account. In addition, we collect and derive personal data from our flight schedules, airport departments and systems as necessary to fulfill our requirements under the Profile Account Terms and Conditions.
For what purposes do we use the data?
The personal data is registered and processed for the following purposes:
Administer the Profile Account and bookings etc. made through the account.
Manage and carry out your bookings and travels.
Provide you with relevant information, such as booking information with flight dates, pre-ordered meals, seat selection, luggage purchased, in anticipation of an upcoming trip, as a message on the Profile Account or if you have requested to receive information through a different channel of communication, through that channel.
Register and analyze information on customer care and travel irregularities in order to e.g. follow-up on and improve our customer care services on a general and aggregated (i.e. not individual) level.
Carry out statistical analyzes on needs, preferences and purchasing behavior on a general and aggregated (i.e. not individual) level.
Perform basic analyzes on the use, frequency, preferred features and length of visits on our SAS website and application, to maintain, optimize and continuously improve the functionality and features of our digital platforms and the Profile Account. Update your contact information and cancel/block accounts of deceased customers.
How long will we keep your personal data?
We process the personal data regarding you as long as you are registered with an account. Your personal data is retained until the Profile Account is terminated.
Who may access your personal data?
Personal data is shared between affiliates within the SAS group to operate our international flights, to manage the Profile Account, for statistical analyzes, among other things.
Personal data that is shared within the SAS group will sometimes be transferred to countries that do not belong to the European Union (“EU”) or the European Economic Area (“EEA”) and which do not ensure an adequate level of protection for personal data. Such transfers will be carried out in compliance with applicable data protection laws.
When transferring personal data to a non-EU/EEA country without an adequate level of protection for personal data we will apply appropriate safeguards normally by entering into standard contractual clauses adopted by the European Commission. The standard contractual clauses can be found via the following link
Where there is no adequacy decision by the European Commission and also no established appropriate safeguards in the form of standard contractual clauses as outlined above, we will transfer your personal data to affiliates within the SAS group and to our business partners on the legal basis of the Profile Account Terms and Conditions, including the present Privacy Policy for Profile Account holders. More specifically, we will transfer your personal data on the basis that the transfer is necessary for us to perform the Profile Account Terms and Conditions.
Who can I talk to about my personal data and my rights?
Scandinavian Airlines System Denmark- Norway-Sweden, a consortium established under the laws of Denmark, Norway and Sweden, and having its principle office at Frösundaviks allé 1, SE-195 87 Stockholm, Sweden, is the controller which will determine the purposes and means of the processing of your personal data.
SAS is the legal entity responsible for personal data in accordance with applicable legislation on data protection, including the General Data Protection Regulation (EU Regulation no. 2016/679).
SAS has designated a Data Protection Officer who supports SAS in ensuring that the members’ personal data is processed correctly. You may contact the Data Protection Officer with questions or requests relating to the processing of your personal data, at the following address: [email protected].
If you have questions about your Profile Account, please refer to our contact details at flysas.com.
What are my rights?
We want to be as transparent and clear as we can on how we process your personal data, and have therefore taken particular care in illustrating your rights under this Privacy Policy for Profile Account holders. On your profile account, you can now not only view and update your contact details, but also find information on your rights and on our processing of personal data laid out interactively. By navigating and operating the profile account, you can also easily enforce your rights. For instance, you have the right to access the personal data that we process on you. You can easily obtain an excerpt of the personal data on you that we process and find more information by signing in to your profile account.
In the same way, you can find further information on and enforce also the following rights:
Correct, update or delete information that is incorrect or incomplete on your profile account.
Object to or restrict our processing of your personal data.
To be forgotten. The right to be forgotten means that you may request that we delete all the personal data we have collected on you.
Receive a copy of the personal data related to you and information regarding our processing of your personal data in a commonly used data format and to transmit – or have transmitted, where technically feasible – the data to another controller.
Request that personal data not be used for direct marketing purposes.
Lodge a complaint to the data protection authority within your jurisdiction, which in Sweden is the Data Protection Board (Sw. Datainspektionen).
You can also find more information about all the different safeguards and technical measures we have put in place to protect your data and your right to privacy and freedom and to ensure that we are fully compliant with applicable data protection legislation. If you require assistance or have any questions regarding your rights, please contact our Data Protection Officer at [email protected]. Please note that restricting the processing of your personal data or enforcing your right to be forgotten will mean that we will no longer be able to provide you with our services relating to the Profile Account. The processing of personal data as set out in this Privacy Policy for Profile Account holders is necessary in order for us to perform the Profile Account Terms and Conditions. You are at any time welcome to become a EuroBonus member by clicking on the following link: https://www.sas.se/en/eurobonus//. In our EuroBonus program, we offer a range of easy, joyful and personalized services and offers to make life easier for our members.
When may SAS ask me for my consent?
In certain situations, we will need your consent in order to process your personal data.
For instance, some of the features and services associated with the EuroBonus membership may be offered also to our Profile Account holders based on your consent. As these services involve processing of personal data beyond what is stated in this Privacy Policy for Profile Account holders, we will only perform such additional features and corresponding processing of personal data subject to your informed and specific consent.
Hence, we may ask you for your consent e.g. to process personal data to better understand your needs and preferences, i.e. for profiling purposes, to use information stored in cookies, or to pre-complete booking forms with your contact details, accompanying persons, passport and payment data etc. to facilitate a faster and simpler use of our services.
We may also ask for your consent to use post, mobile phone, SMS, MMS, email, social media and other digital channels to send promotional communications to you concerning our, or our business partners’, products and services.
Provided that you give your consent to the use of cookies on our website or application, we may also ask for your consent to process your personal data in order to analyze your online behavior in order to identify e.g. destinations that you may be interested in. Read more about our use of cookies in our cookie policy.