This notice explains how Aeroplan and its service provider, Persona Identities Inc. (“Persona”), handle your personal information, including your government-issued ID, in connection with Aeroplan’s identity verification and fraud prevention service (“Identity Verification”).
Identity Verification is available to members aged 18 and older.
Find out more about Identity Verification for members aged 17 or younger (“minors”).
1. How Identity Verification works
- You will be guided to use your mobile device to take a photo of your valid government photo ID. Examples: passport, driver’s license, permanent resident card, NEXUS card (“government ID”).
- You will be asked to upload the photo of your government ID.
- Persona will verify the authenticity of your government ID and confirm that the information on it matches your Aeroplan member information.
- If your government ID and other information are satisfactory, your identity is verified. If not, your identity is not considered verified. This decision is based solely on the automated processing of information. To seek a review of this decision, see section 3.
- Your government-issued ID and other personal information used for Identity Verification will be retained for a reasonable period no longer than one year (subject to any legal requirement), to prevent and detect related fraud.
- Where applicable, you can withdraw your consent by contacting our Principal Privacy Officer (see section 6 below). If you withdraw your consent, Aeroplan may still retain and use some of your personal information as permitted or required by law, including to comply with legal obligations, to prevent fraud, and to establish, exercise or defend against legal claims.
- Find out more about Persona’s Privacy Policy.
2. Personal information used for Identity Verification
- Government ID: photos of the ID and the information it contains, excluding data restricted by law where you live
- Aeroplan Member Information: member number, name, address and date of birth
-
Technical and connection information such as: IP address, device OS, device type, browser type, general geolocation data.
This information is used to verify the authenticity of your government ID so as to verify your identity and prevent and detect fraud related to Aeroplan accounts. It will be retained for a reasonable period no longer than one year, or for a longer period if required by law, after which it is destroyed.
3. Requesting Assistance
You will be able to request assistance during the automated process if you are unable to complete Identity Verification or would like a review of a decision that your identity is not considered verified.
4. Protection of personal information collected and used for Identity verification
Aeroplan through Persona uses your government ID exclusively for purposes of Identity Verification.
Persona and its subcontractors process the personal information collected and used for Identity Verification only on Aeroplan’s instructions. They may not disclose it or use it for their own business or commercial purposes. Neither Aeroplan nor Persona may sell, lease, trade, or otherwise profit from your information, although Persona may be paid for its services.
Aeroplan and Persona will not disclose your information unless you consent or if the disclosure is required by law (for example, in response to a valid legal process such as a court order or warrant).
Your personal information will be handled by Persona and its subcontractors in Canada and in the United States of America, possibly outside the province or state where you live. This means your information may be subject to the laws of these jurisdictions, which may permit access by courts, law enforcement or other governmental authorities.
Persona and its subcontractors are contractually bound to meet stringent data protection requirements. All information used for Identity Verification is protected by physical, technological and organizational security measures. For example, your personal information is also encrypted in transit and at rest, and the systems that process it are subject to a vulnerability management program. Access to your information is monitored and limited to authorized personnel who need it to perform their duties in connection with Identity Verification. At the end of the retention period, all personal information is destroyed.
5. More Information
If you have concerns or further questions or wish to withdraw your consent, make a formal access or correction request or terminate your Aeroplan membership, please contact our Principal Privacy Officer using the contact information below.
Email:
AeroplanPrivacy@aircanada.ca
Address:
Aeroplan Principal Privacy Officer
P.O. Box 23000
Station Pointe-Claire-Dorval
Pointe-Claire, QC H9Y 1K2
Please note that we will need to take reasonable steps to validate your identity prior to disclosing any personal information via the above communication channels.