Norwegian Air Shuttle ASA
1. Introduction
Norwegian Air Shuttle ASA and Norwegian Reward AS are subject to the EU General Data Protection Regulation (GDPR) as well as national personal data legislation. The protection and confidentiality of your personal data is important to us, and we process your data in a transparent way. Through this Privacy Policy, we will explain which personal data we process, why and how we use your personal data, when and why we share personal data, and the purpose and the legal basis for our processing activities. We will also inform you of your rights under the GDPR.
This Privacy Policy applies to the processing of personal data by Norwegian Air Shuttle ASA (hereafter referred to as “Norwegian”) when you use our websites or mobile applications, book flights or our other services either by yourself or through third parties (for example travel agents or other airlines), book additional services from our selected partners enabled through our website and app, or communicate with us by phone, e-mail, social media or alike. Whether or not you have made a booking, you may choose to register a profile with us.
This Privacy Policy also applies to the processing of personal data by Norwegian Reward AS (hereafter referred to as “Reward”) when you use our loyalty programme to accrue loyalty points and earn benefits by buying services from Norwegian. Benefits and loyalty points can be used to purchase flight tickets or other related products or services from Norwegian. To use the Reward programme, you need to sign up as a member of Reward. More information can be found in the Norwegian Reward Terms and Conditions.
In addition, this Privacy Policy also applies to our sharing of personal data with the Spenn Group AS in the event that you have registered a profile with them. Spenn is our Nordic loyalty currency.
Please note that when you interact or communicate with any other service providers than Norwegian or Reward, this Privacy Policy does not apply. An exception applies if any personal data related to interactions with these providers are shared with us as part of our service, in which case the processing is covered by this Privacy Policy.
2. Data controllers
Norwegian is the controller for the processing of personal data, except for personal data processed in relation to our loyalty programme for which Reward is the controller. As controllers, we are responsible for defining the purposes for processing of your personal data and for compliance with the data protection legislation.
The contact information for Norwegian is:
- Norwegian Air Shuttle ASA, org. no. 965 920 358
- Address: Postboks 115, 1330 Fornebu
The contact information for Norwegian Reward is:
- Norwegian Reward AS, org.no 992197 552
- Address: Postboks 115, 1330 Fornebu
Norwegian and Reward have a joint data protection officer.
Please note that the providers of third-party travel-related services accessible through our website and app are solely responsible and the independent controller for their own processing of personal data.
3. Norwegian's use of personal data
3.1. Booking and management of flights and services
Norwegian processes personal data to manage your booking of flights or other services, and to send you important information about your purchases such as check-in times, gate changes, delays, etc. This processing includes information such as your name, phone number, e-mail address, payment and card details, Reward Number (if you have a registered profile with Reward) and Spenn user information (if you have registered a profile with Spenn). Depending on your specific booking, we may also process additional information such as your passport number or date of birth. In addition, we may process sensitive data such as your health condition if you request special assistance such as dietary or accessibility services.
The information is collected from you or your travel agency when booking the flights or other services. The legal basis for the processing is the performance of a contract. Norwegian must process this information to provide the services as requested by you and to fulfil our obligations under the Terms and Conditions applicable to the purchase.
3.2. Registration of profile and management of account
You are welcome to register a profile with Norwegian on Norwegian.com. This will improve and simplify your booking experience and enable us to provide more relevant communications to you on the webpage and in other channels, as well as enabling you to control how you would like us to communicate with you.
If you register a profile, Norwegian processes personal data to manage your account. This processing includes information about your e-mail, address, gender, and phone number. It also includes other information we may request, but which you may freely choose to give us. The information is collected from you when creating or subsequently amending your profile. The legal basis for the processing is performance of a contract. Norwegian must process this information to provide the profile service as requested by you.
Your profile data will be deleted upon your request. This request for data deletion can be done from your account page, available after you have logged in.
3.3. Customer support and user inquiries
Norwegian processes personal data to provide customer support and handle questions and complaints from customers and users. This processing includes information such as name, e-mail, address, phone number, transactional data, payment and card details, Reward Number, and other information that may be required or that you choose to give us to handle the inquiry.
The information is collected from you when you contact us or file a complaint (for example through the LiveChat or questionnaire on our website, by phone, e-mail or letters), from our systems, or from our selected partners. The legal basis for the processing is performance of a contract, as Norwegian must process the information to provide the services as requested by you and to fulfil our obligations under the Terms and Conditions applicable to the purchase.
3.4. Quality assurance of customer support and user inquiries
Norwegian processes personal data to ensure and improve the quality of our customer support and handling of user inquiries. This processing includes information such as your name, contact details, account details, Reward Number, and content of your communications and interactions with us. The information may also include recording of your phone calls to our customer service, which may be stored for three months. You always have the possibility to opt out if you do not wish for such recordings to be made.
The information is collected from you when you contact us with a user inquiry. The legal basis for the processing is our legitimate interest in ensuring and improving the quality of our customer support and handling of user inquiries. For recordings of phone calls, the legal basis is legitimate interests with an opt-out possibility. The legitimate interests are quality assurance.
3.5. Statistics, maintenance, market research, and improvement of services
Norwegian processes personal data to gather statistics about your use of our services and to be able to maintain and improve these services. This processing includes information about visitors’ and customers’ use of our website and mobile applications, including IP address, which pages that are visited, time and date for page visits, and how long users stay on each page. It may also include information such as your name, contact details, account details, Reward Number, interactions with us, purchases, and transactions. Some of this data will be statistical and not connected to identified persons.
The information is collected through cookies and other tracking technologies, and from our systems. To improve our communications with you, we also carry out market research, using personal data connected to various data sets. Personal data in analytical data sets will always be deleted after the analysis. The legal basis for this processing is our legitimate interest in maintaining and improving our services, secure uptime and to uncover downtime and irregularities as well as market research.
3.6. Personalisation of services and marketing
3.6.1. E-mail marketing
Norwegian processes personal data to send you offers, notice of various activities, reminders about your uncompleted bookings, and other marketing via e-mail. This processing includes information about your e-mail address, purchases, and activity on our website and app. The information is collected directly from you upon booking and from our systems. The legal basis is our legitimate interest in sending marketing to our existing customers. For non-existing customers, the legal basis is consent.
3.6.2. Personalisation of services
If you have registered a profile with Norwegian, we process personal data to personalise your profile, to make our service and communications more individualised and user friendly, to understand which information you would like to receive and how you would like us to communicate with you (through which channels, at what frequency, etc.), and to simplify your booking process. For example, we may pre-fill your information from previous bookings into your current booking form. This processing includes information on your use of our services, our digital channels (website, e-mail, app), as well as booking and campaign participation history. The information is collected from your use of the services, the information you have previously given to us, and from cookies. The legal basis for the processing is our legitimate interest in providing you the best possible service and to save you time and effort. For cookies, the legal basis is consent collected through Norwegian’s cookie consent platform.
You can opt out of personalisation through your account page and by changing the setting to off. This will stop the personalisation of your profile and delete the data that is only needed for this processing.
3.6.3. Personalised marketing
Norwegian processes and analyses personal data to send you personalised marketing with more relevant offers and information through our web services, app and promotional e-mails. This processing includes information such as purchase history, profile data, and your interactions with content in our digital channels. The information is collected from our systems and your use of our services. The legal basis for the processing is consent.
Based on your consent we will also present you with information and promotions from us through third party media platforms such as social media and publishing platforms including online newspapers. Your e-mail address or phone number will be matched with third party platforms to achieve this. We are joint controllers with the platforms for such matching.
You have the right to withdraw your consent at any time. Withdrawal of a consent does not affect the lawfulness of the processing that has taken place based on consent prior to the withdrawal.
3.7. Compliance with legal obligations
Norwegian processes personal data when we are required to do so by law, for example to document compliance with tax and accounting obligations or as part of processes with courts, regulators, or other public authorities. This processing may include information such as your name, contact details and purchases. In addition, we are obliged under EU law to collect and share passenger data with authorities. The legal basis for the processing is the legal obligation to which we are subject to and/or for exercise of legal claims.
3.8. Access to and use of WiFi on board our flights
Norwegian may offer access to WiFi on board our flights. We may also offer you entertainment through our in-flight WiFi service. We will process information necessary to deliver these services, such as name, e-mail address, and device ID. If you choose to purchase entertainment through our WiFi service, we will process payment card data and transactions. The legal basis for the processing is performance of a contract, as Norwegian must process the information to provide the services as requested by you.
4. Reward’s use of personal data
4.1. Registration and management of account
Reward processes personal data to allow you to register an account and to operate the loyalty programme memberships. The processing includes information such as your name, date of birth, gender, e-mail address, phone number, address, Reward Number, preferred language and currency, and data on your earning and spending of loyalty points and benefits. The information is collected from you when you register and use your account. The legal basis for the processing is performance of a contract. Norwegian must process this information to provide the loyalty programme as requested by you and to fulfil our obligations under the applicable Terms and Conditions.
4.2. Registration and management of Family Account
Norwegian Reward allows members to create or join a Family Account, which enables members to earn and use loyalty points collectively. If you create a Family Account, Reward will process personal data to manage and provide the Family Account functionality such as names, e-mail addresses, Reward Numbers, relationship to the other members in the Family Account, birth date, gender, purchases, and earning and spending of and benefits, for all members of the Family Account. Personal data for all the members of a Family Account will be shared with the person that manages the Family Account. The information is collected from you and the members of the Family Account. The legal basis for the processing is performance of a contract, as Norwegian must process the information in order to provide the Family Account service as requested by you.
4.3. Earning and spending of loyalty points and benefits
Reward processes personal data to allow you to earn and spend loyalty points and benefits. This processing includes information such as name, account details, transactional data, and information about your flights such as destination, price, and dates. Reward will share information with Norwegian when you use your loyalty points and benefits on purchases with Norwegian. The information is collected from you when you use our loyalty programme services. The information about your flights is collected from Norwegian, and Reward will share information with Norwegian when you use your loyalty points and benefits on purchases with Norwegian. The legal basis for the processing is performance of a contract. Your data must be processed to provide the loyalty programme and services as requested by you and for us to deliver in accordance with applicable Terms and Conditions for Reward and for Reward offers.
4.4. Customer service
Reward processes personal data to be able to provide customer support and respond to user queries. The processing includes information such as name, e-mail, Reward Number and other account information, audit logs for your account, and other information that you provide when communicating with our customer support staff. The information may also include recording of your phone calls to our customer service, which may be stored for three months. You always have the possibility to opt out if you do not wish for such recordings to be made.
The legal basis for this processing is performance of a contract. Reward must process this information to provide the loyalty programme as requested by you, support you with customer enquiries and to fulfil our obligations under the applicable Terms and Conditions. For recordings of phone calls, the legal basis is legitimate interests with an opt-out possibility. The legitimate interests are quality assurance.
4.5. Marketing
4.5.1. E-mail marketing
Reward will send you offers and promotional content per e-mail. We will process your e-mail address and the legal basis is consent under the EPrivacy regulation and Norwegian marketing act.
Reward might occasionally send you e-mails with updates and information in regards to your membership. The legal basis is legitimate interest in customer care and customer experience.
4.5.2. Personalisation of services including e-mails
Reward processes personal information to personalise your profile, to make our service and communications more individualised and user friendly, to understand which information you would like to receive, how you would like us to communicate with you (through which channels, at what frequency, etc.) and to simplify your processes for earning and spending loyalty points and benefits. This processing involves information on your use of our services and digital channels (website, e-mail, app), as well as booking and campaign participation history. The information is collected from your use of the services, the information you have previously given to us, and cookies. The legal basis for the processing is our legitimate interest in providing you the best possible service and to save you time and effort. For cookies, the legal basis is consent collected through Reward’s cookie consent platform.
4.5.3. Personalised marketing
Reward processes and analyses personal data to send you personalised marketing with more relevant offers and information through our web-services, app and promotional e-mails. This processing includes information such as your purchase history, profile data and your interactions with contents in our digital channels. The information is collected from our systems and your use of our services.
Based on your consent we will also present you with information and promotions from us through third party media platforms such as social media and publishing platforms including online newspapers. Your e-mail address or phone number will be matched with third party platforms to achieve this. We are joint controllers with the platforms for such matching.
The legal basis for the processing is consent. You have the right to withdraw your consent at any time. Withdrawal of a consent does not affect the lawfulness of the processing that has taken place based on consent prior to the withdrawal.
5. Transfer of personal data to third parties
5.1. Data processors
We share personal data with our third-party service providers, who perform operations or work on our behalf and process personal data described in this Privacy Policy on our instructions as data processors. For clarity, use of data processors is not transfer of personal data under the GDPR. The data processor’s processing is legally limited to our instructions and is done under our responsibility.
5.2. Data sharing between Norwegian and Reward and the loyalty currency provider Spenn Group
For Norwegian’s customers that have profiles with Reward and/or the Spenn Group (“Spenn”), transactional data will be shared both ways to the extent necessary for calculations and issue of loyalty points, as well as to the extent necessary for you to spend your loyalty points.
Personal data shared both ways will typically include your identity and contact information, your purchases with Norwegian, Reward and/or Spenn, Reward Number, Spenn user ID, Norwegian user ID, as well as your account balance for benefits. This is necessary to enable your earning and spending of loyalty points.
Spenn may provide you the option to link your Spenn account to the account you hold with us. If you choose to do this, the data shared both ways will be your profile data registered with us and with Spenn, as well as data related to your use of your profile.
The legal basis for sharing is the performance of a contract with you, which are the applicable terms and conditions and your active wish to have a joint profile or joint login solution. The purpose is to deliver services you have requested.
Based on your consent, Norwegian and Reward will share your profile data, information about your purchase history, and your interactions with contents in their digital channels to provide you with more relevant offers and information.
Based on your consent, Norwegian and Reward will share your booking data and purchase history with Spenn to allow for personalised services and offers from Spenn.
The purpose of the transfer of personal data is marketing. You have the right to withdraw your consent at any time. Withdrawal of a consent does not affect the lawfulness of the processing that has taken place based on consent prior to the withdrawal.
5.3. You bookings with selected partners
We offer you the possibility to book services with selected partners through our digital channels, such as hotel services, airport transport, and rental cars. Even though the booking process originates in our digital channels, your bookings with selected partners will constitute an agreement directly between them and you. These partners will be the sole data controllers for your personal data, and the processing will be subject to their privacy policies and terms and conditions.
We will share your name, contact details, Reward Number and travel information with these partners when you initiate a booking process with them through our digital channels. This to create a more user-friendly booking flow. The legal basis for the transfer is performance of a contract.
5.4. Transfer of personal data to authorities and under legal obligation
We will, subject to local legal obligation, share personal data with public authorities when required through local law and regulations including enforceable governmental requests or due to procedural rules for complaints or cases before a court of law.
According to EU and Norwegian laws and regulations, we are obliged to collect and share passenger data as contained in travel documents with relevant competent national authorities (border authorities and passenger information units).
6. Use of cookies and similar technologies on our Websites, technical data used for communication with websites and app, and our organic use of Social media
To secure that communication with our website and app work, our systems will collect data such as IP addresses and device information. The data collected is similar for use of both our website and our app. If the settings on your mobile devices permit our app to collect location information, we will also collect that information automatically.
When you visit our website or use our app, we collect certain information by automated means using cookies and similar technologies. Some of this data can be connected to you and is personal data. Cookies are small text files stored on your device that our services can write to and read from.
The cookies will collect information about how visitors use our websites. This helps us improve the functionality of our website and gives us useful information about how we can provide a better customer experience. We also use cookies for authentication purposes so that you do not have to provide your credentials every time you visit our website.
We also employ commonly used cookies for personalisation of our digital services, analytics, and for marketing purposes. We also use pixel technology. We use these cookies to serve you more relevant information and personal offers through advertising, measure the effectiveness of our advertising campaigns, and limit how often we display each advertisement.
Note that you can manage how your mobile device share location information with us, as well as how your browser handles cookies and related technologies, by adjusting the privacy and security settings in your device, browser, and/or app.
The legal basis for processing of the information collected through cookies is consent. Consent for different categories of cookies is collected through our cookie consent management platform accessible through our websites. In our platform you will find comprehensive information concerning the different cookies we employ, including third party cookies set through our digital services. The legal basis for processing of location data collected through our app is consent, which is provided in your local app settings.
We have organic presence on major social media. If you interact with our organic profile and organic content, the social media provider will log your interactions with our content in accordance with the terms and conditions for the social medium in question. We are joint controllers with the social medium for interaction data collected by them. Our legal basis is legitimate interest in being present in social media. Your requests for access, rectification, and deletion of this personal data, should be directed to the social medium in question.
7. Transfer of personal data to third countries
Norwegian and Reward are Norwegian companies and generally we process the personal data within the EEA/EU.
As a result of legal obligations, we will transfer passenger data to third countries you have booked flights to through us. The legal basis for the transfer is performance of a contract (the flight booking) under the GDPR article 49(1)(b).
In addition, some of our data processors will process personal data in the US. The legal basis for the transfer is the EU – US Data Privacy Framework.
For our very limited transfers to other third countries, transfers will only take place if appropriate safeguards are provided, for example through Binding Corporate Rules or EU Standard Contractual Clauses or if the receiving party is subject to an adequacy decision from the EU Commission.
8. Your rights
You have the right to request access to, rectification or erasure of, or restriction of processing concerning your personal data. You also have the right to object to the processing as well as the right to data portability. Where the processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing that has taken place before the withdrawal.
If you have a registered profile with us, you can always update, correct, or delete information you have provided to us. Other inquiries regarding processing of personal data and access request can be directed to our website.
9. Data retention
Your personal data will be retained for as long as necessary to fulfil the purpose of the processing. Generally, we retain personal data for a period of four years, except for the situations specified below.
Some of the transactional data will be stored for 5 years in accordance with the Norwegian bookkeeping obligations.
If you have registered a profile, you can delete this at any time through our webpage. If you delete your account, your personal data will be deleted accordingly, except transactions, including any corresponding data, linked to your loyalty points balance. Such data will be retained for 5 years, counting from the date the transactions were processed by our system due to our bookkeeping obligations.
The information you have provided for the purposes of booking and booking management will be stored for up to 10 years. This due to our legal responsibilities for consumer protection, your rights under EU and national consumer protection law, and our establishment or defense of other legal claims.
Recorded calls to customer service will be stored for three months.
10. Changes and amendments to this policy
We will update or change this Privacy Policy from time to time due to changes in our practices, legal practices or legislation. An updated version will always be available through our websites.
11. Data Protection Officer. Complaints
Norwegian and Reward have appointed a Data Protection Officer (“DPO”) in accordance with the GDPR. The DPO is our contact point with the regulators and advice our group and employees on data protection. The DPO may also help you assert your rights under the GDPR. Address inquiries to:
Data Protection Officer, Norwegian Air Shuttle ASA
Postboks 115
1330 Fornebu.
You can contact us if you believe we process your personal data in breach of this Privacy Policy or outside what EU and national legislation allows for.
If you are a European citizen, you also have the right to file a complaint with your local data protection regulator. As Norwegian companies, we are subject to the Norwegian regulator Datatilsynet, https://www.datatilsynet.no/.