Last updated: December 8, 2020
As a loyalty rewards and recognition program, Aeroplan uses personal information to maximize value for its members by personalizing opportunities to earn and redeem points. To that end, Aeroplan will:
- Collect and share personal information within the Air Canada group of companies for analytics and marketing. That information includes:
- details about your purchases or redemptions within the group, including those made before you became a member
- details about your browsing on group websites and mobile apps
- insights into your interests, preferences and purchasing patterns
- Share limited information about you with other partners you’re already a customer of
- Collect details on your purchases from our eStore partners
- Collect information about groups of members from trusted third parties
- Share Aeroplan credit card transaction data with Air Canada
- Share within the Air Canada group of companies personal insights based on Aeroplan credit card transaction data
- To what information does this policy apply?
- What personal information do we collect and when?
- Why do we use and share your personal information?
- With whom do we share your personal information?
- What are your choices when it comes to the handling of your personal information?
- Where do we keep your personal information?
- How is your personal information protected? How long is it kept?
- How can you access or correct your personal information?
- How can you ask questions or raise concerns about privacy?
- Members in the European Economic Area, United Kingdom and Switzerland
Our program and your privacy
Aeroplan is a loyalty rewards and recognition program.
We are a subsidiary of Air Canada and are closely integrated with the business of Air Canada and its affiliate Touram Limited Partnership (Air Canada Vacations) (together, the “Air Canada Group”).
Aeroplan allows members to earn points through the purchase of products and services from the Air Canada Group, as well as from Aeroplan’s other partners, and to redeem those points for a variety of rewards.
An essential part of Aeroplan is our data analytics and marketing activities. As described in this policy, we use your personal information to maximize the value of your membership to you. That means we analyze your behaviours related to the program – what products and services you purchase, for example – to better understand your interests and preferences. That way we can tailor the program to you, offering you the most personalized and relevant opportunities to earn points and redeem them for rewards.
Another essential aspect of Aeroplan is our close relationship with other companies in the Air Canada Group. As described below, if you’re a member and interact with any company in the Group, your information is shared within the Group to offer to you the best possible travel-related opportunities and experiences.
To be an Aeroplan Member you must agree to the terms of this policy. Whether you are using our website, our mobile application or contact centers, this policy applies.
If you wish to withdraw your consent to our handling of your personal information (generally or only for certain purposes), then you may make choices discussed at part 5 “What are your choices when it comes to the handling of your personal information?”.
We encourage you to periodically review this policy, as we may update it from time to time (including updating the list of companies in the Air Canada Group). Updates will be posted on our website and we will take reasonable steps to alert members to any significant changes before they take effect.
This policy may be supplemented by other consents you provide, and by any terms and conditions that you agree to as part of your purchase or participation in any other Air Canada Group products, services, promotions, contests or events.
This policy applies to personal information. Personal information is any information about an identifiable individual, such as an individual's home address, telephone number, email address, or activity in the Program.
This policy does not apply to anonymous information – which is any information that does not include an individual’s name, contact information or any other information that could reasonably be expected to identify the individual.
We collect personal information reasonably needed to fulfill our business purposes, like the purposes discussed in part 3 “Why do we use and share your personal information?”.
We collect personal information when you interact with us, for example:
- When you enroll in Aeroplan, we collect information that you provide during the enrollment process.
- When you contact us, we collect information about that interaction, such as when and why you contacted us.
- When you redeem your points for a reward, we collect information about the reward and any additional information necessary to fulfil your redemption request.
- When you browse our website, we collect information including your internet protocol address, device type and browsing activity – for more information please see the aircanada.com Cookies and Tracking Technologies Policy.
If you are an Aeroplan Member, we may collect personal information when you interact with any company in the Air Canada Group:
- When you make purchases or redemptions with a company in the Air Canada Group, that company provides information about the transaction to us – such as transaction date, dates of travel, price, destination, products purchased (ticket type, checked bag, advance seat selection, hotel, cruise), and any other information you provided as part of that transaction.
- When you receive any Air Canada Group emails, we may collect information about how you engage with us, such as whether and when you open our emails – for more details, please see aircanada.com Cookies and Tracking Technologies Policy.
- When you visit or use any Air Canada Group website, mobile application, or any other Air Canada Group online platform, we may collect information such as the webpages you viewed, search queries, frequency of visits, time spent on the site or application, and location information (e.g. to identify where you will depart when you start the booking process) – for more details, please see the terms and conditions of the applicable website or mobile application, and aircanada.com Cookies and Tracking Technologies Policy.
- When you interact with Air Canada Group social media pages and contests, we may collect or receive information about that interaction.
This collection can include information about past interactions – including those that occurred before you became an Aeroplan Member – so we can more quickly understand your preferences and tailor the program to you.
If you are an Aeroplan Member, we may collect personal information when you interact with our program partners – for example:
- If you are an Aeroplan Credit Cardholder, Aeroplan will receive information about you from the financial institution that issued you an Aeroplan credit card – including information about specific transactions made with the card. The transaction information may include: the merchant’s name, location, date and amount of purchase. This information-sharing is described in more detail in the cardholder documents provided with your Aeroplan credit card.
- If you provide a separate consent to link a program partner’s loyalty or marketing program with your Aeroplan account, the program partner may share additional information with us as set out in that consent.
On occasion, we may acquire information about groups of members – not individual members – from trusted third parties in order to help us better understand our members’ interests and preferences. For example, we may receive:
- information on how many of our members are also customers of a prospective program partner
- demographic information (average age, income, family size, etc.) about certain geographic areas
- insights into the frequency or popularity of credit card types (premium, cash-back, no-fee, etc.).
We use and share your personal information to manage Aeroplan – including to:
- Communicate with you, such as to advise you of changes to the program or respond to your questions
- Administer our websites and mobile application, and make them easier for you to use, such as by pre-populating forms with your contact information or other applicable personal information
- Address customer service matters, including reward travel reservations and questions you may have about your account
- Monitor and maintain the quality of our operations, such as monitoring or recording telephone discussions with our representatives for quality assurance purposes.
We also use and share your personal information to maximize the value of your membership to you – including to:
- Better understand your preferences, needs, and interests in order to develop and enhance offers, promotions, benefits, contests, products and services that are relevant to you
- Send you offers about accumulation and redemption opportunities, benefits, products and services related to Aeroplan and our partners that are most likely to be of interest to you. This includes serving you advertisements on other websites (for more information, see aircanada.com Cookies and Tracking Technologies Policy).
We personalize offers for certain segments of our membership based on member behavior, transactions, and other information collected by us, as described above. We consider trends in your accumulation and redemption of points across various sectors to determine which program partners, offers, promotions, benefits, contests, products and services are most relevant to you.
For example, members who frequently accumulate points on car rentals may be selected for special offers or promotions offering discounts or bonus points on car rentals. These offers are communicated in multiple ways (such as by email, mobile app, SMS/text messages and our website).
We also use and share your personal information to improve Aeroplan and address our business or legal needs – including to:
- Measure the success or effectiveness of offers, promotions, benefits contents, products and services associated with Aeroplan
- Generate de-identified information for further analysis, such as to identify trends about our members as a whole, including to support program growth or engagement
- Protect our business or legal interests, such as to investigate, detect or prevent fraud or harm to our systems
- Fulfil other purposes to which you may consent, or as permitted or required by applicable law.
Changing communications preferences
You may modify your communication preferences (to receive or not to receive offers) by logging into your member account, or by contacting us. You may also opt out using the unsubscribe mechanism in any SMS text or email marketing communications.
As permitted by law, some unsubscribe requests may take up to 10 business days to complete (e.g., if a campaign is underway, you may still receive marketing messages shortly after you unsubscribe).
If you withdraw your consent to receive these electronic marketing communications, you will continue to receive administrative information related to your account or changes to our program.
Changing browser or device settings
For more information on how we use these technologies, including how you may block or delete certain of these technologies, see aircanada.com Cookies and Tracking Technologies Policy.
Changing program partner consents
If you have separately agreed to certain additional Aeroplan-related activities, you can terminate those activities and the associated collection and disclosure of your personal information. For example:
- If you are an Aeroplan Credit Cardholder and you object to the sharing of your personal information by or with your financial institution, please contact your financial institution to discuss your options.
- If you have previously given your consent to link your Aeroplan account with a program partner’s own loyalty or marketing program – and you no longer wish to consent to the information-sharing contemplated by that consent – you have the option of contacting Aeroplan or that program partner to withdraw that consent.
Other data handling choices
If you wish to withdraw from other collections, uses or disclosures of your personal information by Aeroplan, please contact us (see part 9 “How can you ask questions or raise concerns about privacy?”). Please note that we may be unable to accommodate a withdrawal from particular collections, uses and disclosures that are central to our program. In that case, your only option may be to terminate your membership in Aeroplan.
We generally store, access and use personal information at our offices in Toronto and Montreal, and at our data centres in Canada and the United States.
Some of our service providers access, use or store your personal information outside of your province or territory, or outside of Canada. The laws of those other places will then apply to that information, including laws that may permit or require disclosing that information to government, courts and law enforcement.
If you would like more information about our policies and practices regarding processing of personal information outside of Canada, please contact our Privacy Office directly, either by email or the postal address (see part 9 “How can you ask questions or raise concerns about privacy?”).
Each company in the Air Canada Group maintains appropriate organizational, technical, and physical safeguards to protect your personal information. These safeguards are intended to prevent the loss, theft or unauthorized access, use, disclosure, modification or destruction of your personal information. For example:
- your personal information is subject to restricted access
- electronic data is protected by technological means, such as firewalls, access controls, encryption and pseudonymization (de-identification of information with pseudonyms)
- we use multi-factor authentication for Aeroplan members using our Single Sign-On to access Aeroplan and Air Canada applications with the same username and password
- our personnel are trained on the importance of safeguarding personal information from loss, theft or unauthorized access, use or disclosure
As many of our interactions with you are online or via email, we rely on you to take reasonable steps to safeguard your personal information. For example:
- we expect you to use unique passwords for your accounts with us, and to safeguard those passwords so that they are not used without your permission
- you should not provide us with an email account with us that you share with another person – if you do, then any email messages (including password resets) sent to that email account would be accessible to that other person.
Like most companies, we cannot guarantee that our security safeguards are always effective or that online communications are always secure. A breach of security safeguards can result in the risk of identity theft, for example. In these cases, we act promptly to mitigate the risks and to inform you where there is a real risk of significant harm, or as otherwise required by law.
We keep your personal information for as long as it is needed to fulfill the purposes for which it was collected, or a longer period if permitted or required by law. When no longer needed, personal information is destroyed, anonymized or disposed of using secure methods.
Please note that if your personal information is collected by a third party, such as a program partner, it will be kept in accordance with the privacy policies and records retention requirements of that third party.
You have the right to access and correct your personal information.
By logging into your member account, or by contacting Aeroplan Contact Centre (see part 9 “How can you ask questions or raise concerns about privacy?”), you can view and edit your profile information, review your recent transaction history, and modify your communication preferences.
For any personal information that you cannot directly access or correct via these methods, you can make a formal access or correction request by contacting our Privacy Office (see part 9 “How can you ask questions or raise concerns about privacy?”). In that case, we will respond to your access or correction request within a reasonable timeframe (but no later than 30 days from your request) pursuant to applicable laws.
If your personal information in our records is inaccurate or incomplete, we will amend the personal information as required. Where appropriate, we will transmit the amended information to third parties having access to your personal information.
It is your responsibility to provide and maintain accurate and complete information.
If this policy does not answer all of your questions, please contact one of our agents at the Aeroplan Contact Centre at:
1 800 361 5373
for Canada, United States and the Caribbean
(see our website for other available telephone numbers)
The Aeroplan Privacy Office is responsible for overseeing what we do with your information and for monitoring compliance with this policy and data protection laws. If you have concerns or further questions about how we handle your personal information, or wish to make a formal access or correction request, please contact us by writing to the Privacy Office using the contact information below.
Aeroplan Privacy Office
P.O. Box 23000
Pointe-Claire, QC H9Y 1K2
Please note that we will take reasonable steps as necessary to validate your identity prior to disclosing any personal information via the above communications channels.
- How does this policy apply to you?
Because of differences in applicable law, this policy applies to members in the EEA, UK and Switzerland with certain exceptions. Specifically, the sections of this policy that describe the data practices below do not apply to you unless you separately consent to them:
- The collection or sharing of your personal data from or with other companies in the Air Canada Group, for analytics and marketing purposes
- The detailed analysis of your behaviour in the program to understand your interests and preferences, except more limited analysis that is in our legitimate interests, as explained below under part 10(ii) “What are the legal bases for processing my personal data?”
- The collection of details about the specific items you purchase from our eStore partners
- The collection of information about groups of members from trusted third parties
- What are the legal bases for processing your personal data?
Aeroplan may legally process your personal data for the purposes described in this policy because:
- It is necessary to perform our contract with you – for example, we will process:
- your name and contact information to set up your account and to communicate with you about the program
- information on your purchases or redemptions with partners to credit or debit your points balance
- information needed to resolve any customer services issues
- It is necessary for our legitimate interests – for example:
- we de-identify information about your purchases and redemptions in the program for statistical or analytical purposes, for example, to understand the interests or preferences of segments of our members (not individual members) or to develop analytic models – this helps us with program strategy and development, member engagement, and service improvement
- we use your general characteristics (such as your country of residence, age, gender and Aeroplan Elite Status) to send you more relevant offers
- we use relevant personal data to ensure security and prevent fraud and to comply with laws outside of the EEA, UK and Switzerland
- It is necessary to comply with laws in the EEA and/or UK and/or Switzerland — for example, to make disclosures to law enforcement
- It is necessary for any other applicable legal basis
Where no other legal basis applies, we will obtain your consent to process your personal data (for example, for the data practices described above at part 10(i) “How does this policy apply to me?”. That consent may be withdrawn at any time by contacting our Privacy Office (see part 9 “How can you ask questions or raise concerns about privacy?”).
- It is necessary to perform our contract with you – for example, we will process:
- What are your rights?
In addition to the access and correction rights described in part 8 “How can you access or correct your personal information?”, you may be entitled to exercise the right to:
- object to the processing of your personal data (for instance, where we base the processing on our legitimate interests, see part 10(ii) “What are the legal bases for processing my personal data?”), and we will stop processing your data. Except for processing related to direct marketing, we may resume processing if we can show legitimate grounds that override your rights.
- request the restriction of processing of your personal data (for instance, if the data is not accurate and needs to be updated). This can also be done for data where the purposes of processing no longer apply, but you still need the data and do not want us to erase it.
- request erasure of your personal data (for instance, if it’s no longer necessary for the purposes for which it was collected, if you have withdrawn consent or there is no other legal basis for processing, or if you have objected to the processing and our legitimate interests do not override your rights). Certain data may not be erased if we have a requirement to retain it for legal purposes.
- request portability of your own personal data (the transfer of information you have provided to us, to another controller, in a structured, commonly used and machine-readable format), if such a request is technically possible to complete.
To exercise these rights, please contact the Privacy Office at the addresses provided in part 9 “How can you ask questions or raise concerns about privacy?”. We will respond to your request within 30 days, subject to any legal exceptions, and otherwise in accordance with the law.
You also have the right to file a complaint with the data protection authority in your country.
- How is your data safeguarded?
In addition to the safeguards described in part 7 “How is your personal information protected? How long is it kept?” and in part 4 “With whom do we share your personal information” in the section “Transfers to our Service Providers”, we use standard contractual clauses approved by the European Commission for transfers of personal data to countries not considered by the Commission to provide adequate protection for data, unless there is another legal basis for such transfers.