Detailed Privacy Notice effective from 21 November 2023

(effective from 21 November 2023)

The purpose of this Full Privacy Notice (“Privacy Notice”) is to provide you detailed information about how Wizz Air group companies process your data, either about how you use our website at www.wizzair.com (“Website”) or mobile application (including using "cookies") or if you make bookings with us (e.g. your booking information and travel patterns). The Privacy Notice helps you to better understand how we use your personal data and explains how we collect and use it for and with whom it is shared.

Data Controller

Wizz Air Hungary Ltd. (seat: Lecher Ödön fasor 6., H-1095, Budapest, Hungary), Wizz Air UK Limited (seat: Main Terminal Building, London Luton Airport, Luton, United Kingdom, LU2 9LY), Wizz Air Abu Dhabi LLC. (seat: Wizz Air Abu Dhabi, PO Box 145076 Abu Dhabi, UAE) and Wizz Air Malta Limited (seat: Skyparks Business Centre, Level 2, Malta International Airport, LQA4000. Luqa, Malta); “Wizz Air”, “we”, “our” or “us”. Each Wizz Air entity is considered as individual data controller, however, in certain cases Wizz Air entities are acting as joint data controllers as detailed in Joint Controllers section of this Privacy Notice. Wizz Air has appointed a group data protection officer in order to ensure compliance with the applicable data protection laws.

What is the Purpose of Processing the Data?

We will use your data for the purposes below:

1) Website and Mobile Application Operation: the processing of your data is necessary for the execution and fulfilment of the related Terms of Use, as a contract and for the regular operation of the Website or the mobile application.

2) Wizz Air Account Management: to create and maintain your Wizz Account, to identify you as a user and give you access to the services and features we offer to our registered users, and to manage your Wizz Credits. The processing of your data is necessary for the fulfilment and execution of the Wizz Account Terms and Conditions.

3) Service delivery, flight booking, payment and communication about your flight: the processing of your data is necessary for the performance of a contract, the management of your booking and payment and the fulfilment and execution of the General Conditions of Carriage of Passengers and Baggage

Relative to the provision of our services to you, we pursue the below sub-purposes:

Carriage of Passengers with special needs (e.g., safety of pregnant passengers)
Validation of the expenses of the inadmissible person (meal voucher, outbound air fare, other costs)
Providing compensation for denied boarding
Prepare a Limited Release declaration form
Prepare form of indemnity for the accompanying passenger of children under 14 years
Prepare passenger waiver form
Prepare immigration violation record
Prepare passenger road transfer form

4) Third parties’ service offerings: We may process your personal data based on your consent to offer third parties’ services and products to you.

These third-party services include:

Hotels
Car Hire
Travel Insurance
Airport Parking
Airport Transfer
Wizz Credit Cards

If you use a Wizz Credit Card, please refer to the applicable Joint Controllers Privacy Notice to understand how we share our responsibilities and roles relative to processing of your data. Otherwise, we have no control over the services and products you may purchase from third parties or how those third parties process your personal data – please refer to the relevant third party privacy notice for further information.

5) Marketing communications and newsletters: the purposes of the processing your personal data relative to marketing communications and newsletters are to carry out customer satisfaction surveys for analytical purposes, for quality improvements, for service developments, to improve the performance of the website, to measure the success of our advertising campaigns or to tailor services to your needs or send you newsletters on the contact channel of your choice.

6) Security and operational safety: We may process your personal data to perform and support administrative tasks, anti-fraud screening, for safety, operational and other reports and security purposes.

7) Secure legal compliance: to comply with the mandatory provisions of the applicable laws such as accounting, billing, audit purposes, consumer protection, immigration or public health related purposes.

For the purpose of legal compliance, we may pursue especially the below sub-purposes:

Processing your data relative to the exercise of the Complainant's data protection rights
Processing your data in legal proceedings related to you
Processing your data relative to the exercise of your consumer rights and relative to securing compliance with the related consumer protection laws
Processing your data relative to securing compliance with accounting laws, securing accounting discipline and retain accounting documents
Processing your data relative to securing compliance with tax laws, especially relative to issuing and retaining invoices

8) Provide Customer Care services: the purpose of processing your personal data is to manage your questions and inquiries to us.

We record calls made with our Customer Care for the protection and reproducibility of verbal commitments and they may be connected with other reservation data. Complaints submitted electronically, via post or via email, are also archived, and may be connected with other reservation data for possible future complaints handling. If you consent to it, we will use automated means to analyse your communication with us to improve our services

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, we will provide you with a new notice explaining all conditions relating to the new processing prior to the new processing takes place. If required, we will seek your consent before commencing the new data processing activity.

What Personal Data We Process about you?

For the purposes outlined above we process the data categories indicated below:

A. Website and Mobile Application Data: including your browser’s type and version, the operating system you use, the website from which you are visiting us (referrer URL), webpage(s) you are visiting on our Website, date and time of accessing our Website, and internet protocol (IP) address, usage data of our Mobile Application.

B. Analytics data: including logins, pages viewed, and documents downloaded.

C. Wizz Account Data: including your title, your name, your date of birth, your gender, your mobile phone number, your email address, your nationality (citizenship) and your Wizz Credit balance.

D. Passenger Name Record (PNR) Data: including passenger birth date, passenger gender, passenger name, passenger nationality, passenger resident country, passenger travel document expiry, passenger travel document id, passenger travel document issuing country, passenger travel document type, customer name, customer nationality, customer phone number.

E. Service Provision Related Data: including passenger name, nationality, gender, age group, passport or Government issued EU National ID card numbers and expiry date, the special service request code (SSR) for passengers who have requested special assistance or service, provided amenities, phone number, email address, credit or bank card or bank account details, flight details, confirmation number, date of birth, details of travel documents, destination, rush bag tag number, description and value of the baggage, baggage tag number, reservation code, signature, cancelled/delayed flight number, booking reference, new flight number, the services you purchased and Wizz Account number.

F. Injury Report Data: including passenger name, flight number, place of accident, passport number, description of the event, the passenger is injured or not, type of injury, the fact whether the passenger accepted the report or not, signature.

G. Children Under 14 Indemnity Form Data: including name of passenger under 14 years, date of birth, passport/ID number, address, nationality, outbound flight number, outbound flight date, reservation code, inbound flight number, inbound flight date, reservation code. Name of accompanying passenger and accompanying passenger details including date of birth, passport/ID number, address, nationality, outbound flight number, outbound flight date, reservation code, inbound flight number, inbound flight date, reservation code, signature of accompanying passenger.

H. Immigration Violation Record Data: including passenger name, flight number, arrived from, inbound reservation code, outbound reservation code, reason for refusal.

I. Disruptive Passenger Report Data: including passenger name, reservation code, flight number, route, incident details, reasons of refusal, description of complaint.

J. Service Communication Data: including passenger name and passenger contact details (phone number, e-mail address, postal address), flight data, Wizz Account number.

K. Third Party Services Data: including passenger name, nationality, gender, phone number, email address, credit or bank card details, information on special care, flight details, confirmation number, date of birth, details of travel documents, location data (including real-time geographic location of your computer or device through GPS, Bluetooth, and your IP Address , along with crowd-sourced Wi-Fi hotspot and cell tower locations, if you use location-based features and turn on the Location Services settings on your device and computer) and Wizz Account number.

L. Direct Marketing Communication Data: including name and contact details (phone number, e-mail address), historic booking details and if you have any unfinished booking then the selected starting point and destination, one-way or return flight, departure and arrival times, number of passengers, selected fare type, total amount of fare price, whether the user is a newsletter subscriber, booking type (normal, Wizz Discount Club, group), selected services, language of the site/Wizz Air application.

M. Security and Operational Safety Data: including passenger name, address, phone number, IP address, geolocation data, booking and transaction history, credit/debit card details, claim and complaint related data.

N. Compliance Data: including data related to persons requesting special assistance; personal data related to our obligations in case of flight disruption or flight delay, correspondence with the complainant.

O. Tax and Accounting Data: including custom control related data, personal data related to invoicing, personal data related to paying applicable taxes and the related documents to secure compliance with applicable accounting and tax laws.

P. Customer Care Data: including name, address, date of birth, e-mail address, telephone number, Wizz account number, government ID, flight history, content of the request, correspondence with the complainant, content and transcript of phone calls, payment and credit card data.

We would like to draw your attention to the fact that the personal data you provide us with during the creation of your Wizz Account will be used for booking your flight as a passenger with us. This is why you should make sure that you provide us with correct personal data during the registration process that exactly matches your travel document that you use for travelling with us.

Sensitive personal data:

In certain cases, we also need to process special categories of personal data (sensitive personal data), e.g., health related data, for example when you request special assistance from us and/or an airport operator (such as the provision of oxygen), or when you provide us with information about your fitness to fly (for instance if you are pregnant, or allergy information) for safety reasons.

To process your sensitive personal data, we may need to obtain your explicit consent. Where we are required to obtain your explicit consent and you do not provide this, we may not be able to provide you with the requested service(s). If you withdraw your consent or do not provide the consent for the use of your sensitive data, we may not be able to provide all or parts of the services you have requested from us.

Please be aware that if we need to perform a contract between you and us or provide you with our services or personalized offers, we will need your personal data. If you do not provide us with the requested personal data, we will not be able to provide you with all or parts of the services you have requested from us.

The legal basis for processing your personal data

To process your personal data, we may rely on the legal bases below:

Your consent provided to us under the EU Regulation 679/2016 (or, if applicable, EU Regulation 679/2016 as implemented in the UK as UK GDPR) (together referred to as "GDPR") Article 6 (1) (a) (“Consent”) or to enable us to process special categories of personal data in general, we rely on your explicit consent under GDPR Article 9 (2) (a) (“Explicit Consent”).
The processing of your personal data is necessary for the performance of a contract with you under the GDPR Article 6 (1) (b) (“Contractual Basis”).
The processing of your personal data is possible based on our legitimate interest under the GDPR Article 6 (1) (f) (“Legitimate Interest”).
We may process your personal data based on our legal obligations pursuant to Article 6 (1) (c) of the GDPR (“Legal Obligation”).
We may process your personal data if the processing is necessary to protect the vital interests of a natural person where the data subject is physically or legally incapable of giving consent pursuant to Article 9 (2) (c) of the GDPR (“Vital Interest”).
We may process your personal data processing if it is necessary for reasons of substantial public interest, on the basis of Union or Member State law, such as air transport security with suitable and specific measures to safeguard the fundamental rights and the interests of the data subject based pursuant to Article 9 (2) (g) of the GDPR (“Substantial Public Interest”).

We may process your personal data for the purposes and legal bases indicated below:

Purpose of data processing	Categories of personal data processed	Legal Basis	Retention Time
Website and Mobile Application Operation	Website and Mobile Application Data Analytics data	Contractual Basis Legitimate Interest	We store internet search data collected concerning you for four days
Wizz Air Account Management	Wizz Account Data	Contractual Basis	6 years from the fulfilment of the contract concluded with us (i.e., deletion of your Wizz Account).
Service delivery, flight booking, payment and communication about your flight	Wizz Account Data PNR Data Service Provision Related Data Injury Report Data Children Under 14 Indemnity Form Data Service Communication Data	Contractual Basis Legitimate Interest Legal Obligation In case of sensitive data: Explicit Consent Vital Interest	6 years from the fulfilment of the contract concluded with us. We need to keep your personal data relative to your flights (PNR) for 5 years, which data we pseudonymize after 6 months from your flight with us. In the case of consentbased data processing, personal data will be processed until the consent is withdrawn.
Third parties’ services offerings	Third Party Services Data Direct Marketing	Consent	6 years from the fulfilment of the contract concluded with us or until you withdraw your consent, whichever is shorter.
Marketing communications and newsletters	Third Party Services Data Direct Marketing	Consent Legitimate interest	We store internet search data collected concerning you for four days. Otherwise, your personal data will be processed until the consent is withdrawn.
Security and Operational Safety	Security and Operational Safety Data Immigration Violation Record Data Disruptive Passenger Report Data	Legitimate Interest Legal Obligation In case of sensitive data: Substantial Public Interest	6 years from the fulfilment of the contract concluded with us. If an authority, court or disciplinary procedure is initiated, then the personal data will be retained until the termination of the proceedings, including the duration of any possible remedy, which data thereafter, in the case of civil claims, will be deleted after the civil law statute of limitation runs.
Secure legal compliance	Compliance Data Tax and Accounting Data Immigration Violation Record Data Disruptive Passenger Report Data	Legitimate Interest Legal Obligation	Accounting documents are retained for 8 years from the closing of the financial year. Taxation related personal data are retained until the end of the 5th year from issuing the invoice relative to the service. If an authority, court or disciplinary procedure is initiated, then the personal data will be retained until the termination of the proceedings, including the duration of any possible remedy, which data thereafter, in the case of civil claims, will be deleted after the civil law statute of limitation runs.
Provide Customer Care services	Security and Operational Safety Data Compliance Data Tax and Accounting Data Customer Care Data	Legitimate Interest	3 years from the time the complaint is made. In case of consent, until your consent is withdrawn

Our Legitimate Interest

When we process personal data to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We have conducted the balancing test to conclude our prevailing legitimate interests. We considered the extent to which your interests, rights and freedoms may be impacted by our data processing activities, as well as the organizational structure and operation of the Companies and the privacy guarantees provided by us. On this basis, we have concluded that our relevant data processing activities (as outlined below) do not disproportionately restrict your interests, personal rights and freedoms.

Processing activity	Balancing test
Website and Mobile Application Operation	Wizz Air has a legitimate interest to the processing of your data in the context of operating our website and mobile application to provide you with the content requested from us.
Service delivery, flight booking, payment and communication about your flight	If you are a legal entity contact person, then Wizz Air has a legitimate interest to maintain business communication with such contact person. If a customer contact person has directly contacted Wizz Air with a question or complaint or the legal entity is the contracting party for the flight services, it is reasonable for the relevant contact persons to expect that their data will be processed to facilitate a response or to provide the service
Marketing communications and newsletters	Wizz Air has a legitimate interest to contact you in relation of carrying out customer satisfaction surveys for analytical purposes, for quality improvements, for service developments, to improve the performance of the website, to measure the success of our advertising campaigns or to tailor services to your needs or send you newsletters through the contact channel of your choice.
Security and Operational Safety	Wizz Air has a legitimate interest to prevent and detect fraud of any kind that pose a threat to Wizz Air or to their customers, its employees, business partners and their employees and to respond to legal process or requests for information issued by government authorities or other third parties. Individual persons expect Wizz Air to take compliance with the law and information security seriously and there is a public interest in ensuring that this is the case; harm could arise if Wizz Air were not able to process data in this way and the wider community also benefit from this. For this reason, Wizz Air may disclose unwanted security intrusion, unauthorized access, disclosure and acquisition of information, data and system breaches to authorities and courts and to respond to legal claims and requests from third persons.
Provide Customer Care services	Wizz Air has a legitimate interest in processing data to respond to customer's questions, inquiries, and complaints because it is critical to engage with customers if they have queries to maintain their confidence in Wizz Air. If a customer has directly contacted Wizz Air with a question or complaint, it is reasonable for them to expect that their data will be processed to facilitate a response.
Secure legal compliance	Wizz Air has a legitimate interest in processing data for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

For more detailed information regarding our legitimate interests and the results of the balancing tests, please contact us at data.protection@wizzair.com.

Who may access to your data?

Wizz Air, in the course of its operation, may utilise the services of various data processors and external service providers to handle and process your personal data for specific purposes, on behalf of and in accordance with the instructions of Wizz Air. In addition, under the applicable aviation laws Wizz Air is required to share your personal data with governmental bodies, authorities and other enforcement bodies.

The transfer of your personal data outside of the European Economic Area (and, in respect of personal data originating in the UK, outside of the UK) is necessary to provide you with a service that you have requested, and your personal data may be accessed by Wizz Air Group members and data processors and service providers from countries that do not provide the same level of data protection as provided in the UK/European Economic Area. Wizz Air takes appropriate measures, which in relation to the recipients of your personal data, is necessary to ensure an adequate level of protection as defined by the applicable data protection law, in particular through the application of the Standard Contractual Clauses or by an adequacy decision of the European Commission (or for personal data originating in the UK, an adequacy decision of the UK Secretary of State) which states that the country in which the recipient of the transferred personal data provides an adequate level of data protection.

If, in relation to data transfers abroad, an adequate level of protection of personal data cannot be ensured, then we shall request your express consent relating to any such data transfers abroad. Please note that such data transfers may be associated with certain risks, particularly that in the country of the data recipient, unauthorised third parties may also have unreasonable access to said data and you may not be able to exercise the rights of the data subject and/or your right to object against acts that may harm your personal data and your right to privacy.

On the website among the origins and destinations, you can find the third countries where your personal data may be transferred, or where it may be accessed from, based on your travel destination and the service providers we use to perform our services. These currently include Albania, Armenia, Azerbaijan, Bosnia and Herzegovina, Egypt, Georgia, Gibraltar, Iraq, Israel, Jordan, Kazakhstan, Kosovo, Kuwait, Kyrgyzstan, Maldives, Montenegro, Morocco, North Macedonia, Oman, Saudi Arabia, Serbia, Switzerland, Ukraine, Turkey, United Arab Emirates, the United Kingdom and Uzbekistan.

We may disclose your personal data to the following categories of third parties (recipients) for the purposes described below:

Wizz Air Group: Your personal data may be shared within the Wizz Air Group as far as such is necessary to provide the services you have purchased from us or to facilitate the purchase of third parties’ services or products on our website, via our mobile application or through our call centre. For more information about Wizz Air Group, please click here.
Wizz Air Service Providers: Wizz Air engages certain third parties to provide assistance during the performance of the services bought from us. Such third parties provide the following services:

ground handling services at airports;
payment processing services;
running loyalty schemes;
marketing agencies;
provision of IT support services;
provision of certain services at the airports, such as sale of tickets, services related to baggage, priority boarding, flight changes;
accounting firms;
provision of customer care services;
third parties, such as law firms or service providers;

Third party Customer Service Providers: When you purchase the service of a third party service provider on our website, in our application or via our call centre (e.g. you order transport service or any related activities) we will transfer your personal data to the respective service provider to facilitate the purchase and to perform the service you ordered from us. The data processing of such third parties may also be governed by their own privacy policies. Please review the privacy policies on the website of such third parties directly for more information about their data processing practices.
Furthermore, we also receive information about you from third parties, for instance when you participate in a loyalty programme.
Government authorities and enforcement bodies: government authorities or enforcement bodies such as the police and regulatory authorities, upon their request and only as required by the applicable law or to protect our rights or the safety of our customers, staff and assets.
We may transfer your personal data to government authorities or enforcement bodies such as the police and regulatory authorities, upon their request and only as required by applicable law; or to protect our rights or the safety of our customers, staff and assets.
Border police and immigration authorities: In certain countries, Wizz Air is required by law to give border control agencies access to booking and travel information. Therefore, any information we hold about you and your travel arrangements may be disclosed to the customs and immigration authorities of your place of departure or your destination or to the local Passenger Information Unit. In addition, applicable laws in certain countries require Wizz Air to collect passport and associated information for all passengers prior to travel to or from those countries. When required by applicable law, Wizz Air will provide this information to the relevant customs and immigration authorities.
Please be informed that under Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (and equivalent legislation in the UK if applicable) Wizz Air is obliged to forward your travel information for the Passenger Information Unit of the Member State where you are travelling to.

Your Rights

You are entitled to exercise your rights indicated below:

(i) Right of access: You have a right to ask whether or not we have personal data about you and, if that is the case, request information on what personal data we have. We will also have to respond to questions about inter alia why we are using your personal data, details about what data we have and to whom we have provided access to the data. However, this is not an absolute right and the interests of other individuals may restrict your access rights.

We may request additional information from you for identification or for further copies requested by you, we may charge a reasonable fee based on administrative costs.

(ii) Right to rectification: We are required to rectify inaccurate personal data, or to complete personal data that is incomplete, on request.

For more information in relation to our rules of name change correction, please click here.

(iii) Right to erasure (right to be forgotten): We are in some circumstances required to erase personal data on request by the data subject.

(iv) Right to restriction of processing: We are in some circumstances required to restrict our use of personal data on request by the person concerned. In such cases, we may only use the data for certain limited purposes set out by the law.

(v) Right to data portability: You may have the right to receive your personal data to which we have access, in a structured, commonly used and machine-readable format and such persons may then have a right to transmit those data to another entity without hindrance from us.

(vi) Right to object:

You have the right to object to the processing of your personal data for any reason relating to your situation, and in this case, we may not be able to process your personal information. If you have the right to object and the exercise of this right is justified, your personal data in concern will not be further processed for the purposes of the objection. The exercise of this right does not entail any costs.

When the processing of your personal data is based on your consent, you can withdraw your consent at any time without giving any reason to us, free of charge. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you withdraw your consent or do not provide the consent for the use of your sensitive data, we may not be able to provide all or parts of the services you have requested from us. Please note that in these circumstances you will not be able to cancel or obtain a refund of any fees you have paid.

If you would like to exercise your data protection related rights, you can submit your request HERE after logging in into your Wizz account under the data protection tab.

If you do not have a Wizz account, you can contact us by submitting your request via our email address for DSARs below.

If you consider that your privacy and data protection rights have been infringed, you may contact the competent data protection authority.

In case of Wizz Air Hungary the Hungarian National Data Protection and Freedom of Information Agency (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH; seat: H-1055 Budapest, Falk Miksa u. 9-11.; website: www.naih.hu; phone: +36-1-391-1400; email address: ugyfelszolgalat@naih.hu; fax: +36 1 391 1410) is the lead supervisory authority under the GDPR.

You can also contact the competent data protection regulatory authority located in the European Union’s relevant Member State where your habitual residence, place of work or place of the alleged infringement is.

The Information Commissioner's Office (ICO) is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data in connection with UK GDPR. The ICO can be contacted by phone: 0303 123 1113; or post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Joint Controllers

In relation to the marketing related activities Wizz Air Hungary Ltd., Wizz Air UK Ltd., Wizz Air Abu Dhabi LLC. and Wizz Air Malta Limited (together as “Wizz Air Companies”) are considered as joint data controllers, also in relation to the loyalty scheme and the provision of services related to Wizz Credits.

The Wizz Air Companies have signed a joint controller arrangement, which sets out their roles and responsibilities. Wizz Air Hungary Ltd (and the Wizz Air Group DPO), is responsible for taking care of your privacy related questions, queries or complaints. You can also contact the Wizz Air Group DPO directly, if you wish. Irrespective of the terms of the arrangement, data subjects may exercise their rights in respect of and against each of the joint data controllers. Wizz Air Hungary Ltd is also responsible for providing you with information in relation to this processing (as set out in this Privacy Notice) and notifying the relevant supervisory authority in the event of a data breach. If you need more details regarding the joint controller arrangement, please contact us at data.protection@wizzair.com.

Data Protection Officer

If you have any further questions about the Privacy Notice or how we handle your personal data please contact us by sending your query to us through our webform by clicking HERE or by writing to our Data Protection Officer at Wizz Air Hungary Ltd., Lecher Ödön fasor 6., H-1095, Budapest, Hungary (or data.protection@wizzair.com).

EU/UK Representative

Considering its data processing activities Wizz Air UK Limited and Wizz Air Abu Dhabi LLC is subject to the GDPR and accordingly appointed Wizz Air Hungary Ltd. (seat: Lecher Ödön fasor 6., H-1095, Budapest, Hungary) as its EU representative.

Considering their data processing activities Wizz Air Hungary Ltd. and Wizz Air Malta Limited are subjects to the UK GDPR and accordingly appointed Wizz Air UK Limited (seat: Main Terminal Building, London Luton Airport, Luton, United Kingdom, LU2 9LY) as their UK representative.

Our Website may contain links to third party websites. These linked websites are not under our control and are regulated by their own privacy policies. We are not responsible for the privacy practices of any such linked websites. Our Website use cookies and similar technologies. For more information read our Cookie Policy.

This Privacy Policy is effective from 21 November 2023