The term “processing” means:

any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

The term “personal data” means:

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personally identifiable information shall mean the same as personal data

Why do we need your data?

ASAPTICKETS processes your personal data in order to:

We might collect the following data categories:

• Identifiers or Identity Data such as a first/ middle/ last name, alias, postal address, unique personal identifier (cookie), date of birth, online identifier Internet Protocol address, or other similar identifiers.
• Contact Data includes (billing address, delivery address, email address and telephone numbers).
• Commercial Information, including products or services purchased or other purchasing or consuming histories or tendencies, as well as Financial Data (bank account and payment card details) and Transaction Data (details about payments to and from you and other details of products and services you have purchased from us).
• Network Activity Information, including, but not limited to Technical Data (your login data, browser type and version, browsing history, search history, time zone setting and location, browser plug-in types and versions, operating system and Platform, and other technology on the devices you use to access our Platform), and information regarding your interaction with our Platform (Usage Data).
• Geolocation data (country, state or city, time zone)
• Audio (e.g. call records) and Electronic (e.g. email threads) information
• Inferences (conclusions) drawn from any type of personal data collected by us, including, but not limited to Profile Data (your preferences, characteristics, psychological trends, behavior, attitudes, intelligence, feedback and survey responses) and Marketing Data (your preferences in receiving marketing from us and our partners and your communication preferences).

Why do we need your data?

ASAPTICKETS processes your personal data in order to:

Why do we need your data?

ASAPTICKETS processes your personal data in order to:

Aggregated Data could be derived from your personal data, but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Network Activity Information (how you use our website and services) to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with Your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Why do we need your data?

ASAPTICKETS processes your personal data in order to:

How we share your data

Associated companies: We may share your data with the associated companies of ASAPTICKETS, as well as combine it with other information to organize internal workflow, enhance our efficiency, provide and improve our services, Platform’s content and make our advertising more convenient and better matching your expectations.

Corporate affiliates and change of control: We may share your data in case of change of control/owners of ASAPTICKETS.

Service providers: We may share your data with suppliers who perform services on our behalf and have agreed in writing to protect and not further disclose your information.

Payment service providers and travel vendors: If you buy air tickets or apply for a credit through the Platform, we may share your data with the payment service providers and the travel vendors you have booked with.

Business partners: We may share your data with various business partners. Some of these business partners may use your data for fraud prevention. We may also share your information to ask our partner to create a survey, form, application, or questionnaire, for the purpose to know the degree of Your satisfaction with our services. Some of these business partners may use your data for online behavioral advertising purposes, or to offer you services or products that we believe you may be interested in. We may also share your information as otherwise described to you at the time of collection. We may also share anonymous aggregated usage information with partners.

Information shared in public: If you provide us a review of your trip, you authorize us to publish it on all our Platforms under the screen name you provided. You also authorize us to aggregate it with other reviews.

Authorities: We may disclose data if required by LAWS, for example to law enforcement or other authorities.

ASAPTICKETS TYPICAL SECURITY MEASURES

• Authorization and authentication mechanisms;
• Content encryption;
• Pseudonymization;
• Audit trials;
• Access restriction;
• Backup systems;
• Physical security:
  • Security staff;
  • Pass entry system;
  • Alarm system;
  • Video surveillance;
  • Limited access to server rooms;
  • Fire alarm;
  • Protection from power cuts;
• Internal control procedures;
• Timely communication on data protection breaches, maximally mitigating possible adverse effects;
• Firewalls;
• Strong Password Criteria;
• Penetration tests;
• Incorporated internal policies, procedures and documents;
• Staff training;
• Etc.

Information we are providing to you, if we are collecting your data directly from you

• the identity and the contact details of the controller;
• the contact details of the data protection officer;
• the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
• the legitimate interests pursued by the controller or by a third party, where applicable;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, the fact that the controller intends to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available;
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• where the processing is based on consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
• the existence of automated decision-making, including profiling, referred to in GDPR Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Information we are providing to you, if we are collecting your data indirectly

• the identity and the contact details of the controller and, where applicable, of the controller's representative;
• the contact details of the data protection officer, where applicable;
• the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, the fact that the controller intends to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available;
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• the legitimate interests pursued by the controller or by a third party, where applicable;
• the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• where the processing is based on consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
• the existence of automated decision-making, including profiling, referred to in GDPR Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

In case the data is not collected directly from you we shall provide the information:

• within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;
• if the personal data are to be used for communication with you, at the latest at the time of the first communication; or
• if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

In case data is not collected directly from you, the right to be informed shall not apply when:

• obtaining or disclosure of your data is expressly laid down by LAWS, or
• the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• we are prohibited to inform you on it, if and insofar as the data must remain confidential subject to an obligation of professional secrecy regulated by LAWS, including a statutory obligation of secrecy

In such cases we will provide appropriate safeguards.

You are entitled to access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from us rectification or erasure of your data or restriction of processing of your data or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making, including profiling, referred to in GDPR Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
• about appropriate safeguards we are providing regarding your data transfers to a third country or to an international organization taking into account GDPR Article 46.

Cases, when you have the right to obtain from ASAPTICKETS the erasure of your data:

• Your data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• You withdraw consent on which the processing is based and we have no other legal ground for the processing;
• You object to the processing pursuant to GDPR Article 21(1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to GDPR Article 21(2);
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in LAWS to which the we are subject;
• the personal data have been collected in relation to the offer of information society services referred to in GDPR Article 8(1).

The erasure of a personal data is not applicable to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by LAWS to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with GDPR Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defense of legal claims.

You are entitled to obtain from us restriction of processing where one of the following applies:

• You are contesting the accuracy of your data, for a period enabling us to verify the accuracy of your data;
• the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead;
• we no longer your data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
• You have objected to processing pursuant to GDPR Article 21(1) pending the verification whether our legitimate grounds override those of your interests.

GDPR Article 21 (2)-(6)

Where personal data are processed for direct marketing purposes², the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to GDPR Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

²For example, if you have subscribed to receive commercial emails from us, participated in promotional activities or transacted with us (requested a quote, bought tickets and other related services). You can easily unsubscribe from ASAPTICKETS.CO.UK marketing communications at any time by clicking on the “Unsubscribe” link included in the newsletter email/ sms or just change your subscription preferences.

'profiling'

means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

GDPR Article 23

Restrictions

1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

• national security;
• defense;
• public security;
• the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
• other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
• the protection of judicial independence and judicial proceedings;
• the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
• a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
• the protection of the data subject or the rights and freedoms of others;
• the enforcement of civil law claims.

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

• the purposes of the processing or categories of processing;
• the categories of personal data;
• the scope of the restrictions introduced;
• the safeguards to prevent abuse or unlawful access or transfer;
• the specification of the controller or categories of controllers;
• the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
• the risks to the rights and freedoms of data subjects; and
• the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

ASAPTICKETS TYPICAL SECURITY MEASURES

• Authorization and authentication mechanisms;
• Content encryption;
• Pseudonymization;
• Audit trials;
• Access restriction;
• Backup systems;
• Physical security:
  • Security staff;
  • Pass entry system;
  • Alarm system;
  • Video surveillance;
  • Limited access to server rooms;
  • Fire alarm;
  • Protection from power cuts;
• Internal control procedures;
• Timely communication on data protection breaches, maximally mitigating possible adverse effects;
• Firewalls;
• Strong Password Criteria;
• Penetration tests;
• Incorporated internal policies, procedures and documents;
• Staff training;
• Etc.

According information on Cookies: https://cookies.insites.com/, https://en.wikipedia.org/wiki/HTTP_cookie etc.