Privacy Policy – Virgin Australia

Virgin Australia Holdings Ltd ACN 100 686 226, its subsidiaries and other related companies, including Virgin Australia Airlines, Virgin Australia Airlines (NZ), Virgin Australia Airlines (SE Asia), Virgin Samoa, Virgin Australia International Airlines and Velocity Rewards (“we”, “us”, and “our”, singularly or collectively as the context requires) recognises the importance of privacy issues. This Privacy Policy briefly tells you how we manage the personal information that we collect, use, hold and disclose and how to contact us if you have any queries. This Privacy Policy does not cover personal information collected or held by us about our employees and is to be read subject to any overriding provisions of law or contract. There are special terms in this privacy policy that will apply to you if you link from one of our websites to a website operated by another person (such as a social media website), using an icon displayed on our websites.

We comply with the applicable privacy laws and we are committed to take all reasonably available measures to protect your privacy.

By visiting our website and/or providing personal information to us and/or by clicking a link to a another person's website, you consent to the terms and conditions in this Privacy Policy unless you tell us to the contrary by following the instructions contained on our website or by contacting our Privacy Officer or our Guest Contact Centre.

General notice for flights to the United States

The Transportation Security Administration (TSA) requires you to provide your full name, date of birth, and gender for the purpose of watch list screening, under the authority of 49 U.S.C. section 114, the Intelligence Reform and Terrorism Prevention Act of 2004 and 49 C.F.R parts 1540 and 1560. You may also provide your Redress Number, if available. Failure to provide your full name, date of birth, and gender may result in denial of transport or denial of authority to enter the boarding area. TSA may share information you provide with law enforcement or intelligence agencies or others under its published system of records notice. For more on TSA privacy policies, or to review the system of records notice and the privacy impact assessment, please see the TSA Web site at www.tsa.gov.

1. Background

Personal information is information or an opinion, in any form and whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

Sensitive information encompasses health information and information about a person's race, ethnic origin, political opinions, membership of political, professional or trade associations, religious or philosophical beliefs, sexual preferences and criminal history. Sensitive information may only be collected if you consent to it or when required by law. We will assume that, unless you tell us otherwise, you have consented to the collection of the information that you have provided to us for use in accordance with this Privacy Policy which may vary from time to time.

In this policy, we refer collectively to personal information and sensitive information as personal information.

We only collect the personal information we reasonably require, in the course of our business of providing services, in accordance with this Privacy Policy by lawful, fair and non intrusive means.

2. Collection of Personal Information by Us

In addition to our need to collect personal information to provide services, we are also required to collect personal information under the laws pertaining to civil aviation and air travel.

The kinds of personal information we collect and store will depend on what products and services you request from us. However, it may include (amongst other things):

• Personal information you give us when you request a product or service from us. This information may include your intended travel dates, place of departure, intended destination and whether you are an adult or a child;
• Personal information you give us when you make a flight booking. This information may include your name, address, telephone numbers, email address, credit card details, passport details and Velocity Rewards membership number;
• Communications between you and us;
• Transactional information about your use of our products and services (for example your feedback on how you enjoyed your flight with us); and
• If you are applying for a position, we will collect information as outlined in the section below titled "Employment Applications".

3. Where Your Personal Information is Stored

Where we store your personal information depends on what products and services you have requested from us. However, some areas may include (amongst other things):

• Our booking system for use of processing transactions, providing confirmation of flights, being aware of any special travel requirements (health or otherwise) and confirming identity;
• Feedback databases for processing customer feedback; and
• Email databases for V-Mail and The Lounge subscriptions.

For further information on how we use your information, check the section entitled Use and disclosure of personal information by us.

For special terms that apply if you link from one of our websites to a website operated by another person, using an icon displayed on our websites, check the section entitled Special terms for links to third party websites.

4. How Your Personal Information is Stored

We take reasonable steps to preserve your personal information from loss, unauthorised access, modification or disclosure in accordance with the Virgin Australia Web Site Terms of Use and this Privacy Policy.

We regularly review developments in security and encryption technologies. Unfortunately, no data transmission over the Internet can be guaranteed as totally secure. Accordingly, although we strive to protect such information, we cannot ensure or warrant the security of any information you transmit to us or from our online products or services and you do so at your own risk. Once we receive your transmission, we take reasonable steps to preserve the security of the information in our own systems.

If a substantial data breach has or may have occurred (i.e. your personal information was shared with unauthorised entities), we will promptly notify you and the Privacy Commissioner about that actual or possible breach.

We only keep your personal information for as long as it is required for the purpose for which it was collected or as otherwise required by law. We take appropriate measures to destroy or permanently de-identify your personal information when we no longer need to retain it. These measures may vary depending on the type of personal information concerned, the way it was collected and how it is stored.

For special terms that apply if you link from one of our websites to a website operated by another person, using an icon displayed on our websites, check the section entitled Special terms for links to third party websites.

5. How Your Personal Information will be Used

We collect your personal information so that we can use it for our functions and activities and to provide services to you, which include, amongst other things:

• Processing your flight booking and any flight booking of a person travelling with you;
• Being aware of any special travel requirements (health or otherwise) you or your travelling companion may have;
• Providing you with confirmation of your flight booking and advising you of any changes to your itinerary;
• Confirming your identity when you check in;
• Processing your purchase of in-flight services such as video, entertainment, food and beverages;
• Processing and considering your employment application (refer to "Employment Application" section below);
• Addressing any feedback or complaints you may have;
• Assisting Customs and Immigration officials;
• Answering any queries you may have;
• Developing and marketing our products and services;
• Conducting research about our products and services;
• Responding to your request to link from our websites to another person's website (such as a social media website); and
• Collecting payment from you for services or goods we supply to you.

If you do not provide us with your personal information, we will be unable to do one or more of the above (including being unable to accept any flight booking).

If you also subscribe to our mailing list, we may email to you updates about our products and services. If you do not wish to remain a subscriber to our mailing list or otherwise receive updates on our products and services, you are able to unsubscribe from our mailing list via our website, or by contacting our Guest Contact Centre.

If you are making a flight booking for yourself and other persons to the same destination, you acknowledge that your personal information will be shared with such other persons.

6. Exchange of Personal Information with Third Parties

Personal information we collect from you may be disclosed:

• To any entity to which we are required or authorised by or under law to disclose such information (for instance, law enforcement agencies and investigative agencies, courts, various other government bodies);
• To our subsidiaries, other related entities, contractors or agents for the purposes set out in the section above entitled "How your personal information will be used", or for other purposes directly related to the purpose for which the personal information is collected;
• To other airlines or travel-related businesses for the purpose of processing your travel arrangements;
• To others in the event of a medical emergency or aircraft incident;
• To others that you have been informed of at the time any personal information is collected from you;
• To your travelling companions where you have booked a flight for yourself and other person(s) to the same destination;
• To our business associates and others for purposes directly related to the purpose for which the personal information is collected;
• To airport management and security personnel;
• To our professional advisors and other contractors (for example IT consultants and mailing houses);
• In accordance with the Special terms for links to third party websites; or
• With your consent (express or implied), to others.

Such disclosure may include the transfer of your personal information between Australia and Canada, Cook Islands, Fiji, Indonesia, New Zealand, Papua New Guinea, Samoa, Solomon Islands, South Africa, Thailand, Tonga, United Kingdom, United States of America and Vanuatu or, if the Special terms for links to third party websites apply, to any country in the world. You consent to your personal information being disclosed to these overseas recipients unless you advise the Privacy Officer or the Guest Contact Centre otherwise. Please note that if you do not authorise us to transfer your personal information, it may limit the services we can provide to you or may prevent us from supplying services to you.

We may also obtain personal and other information from some or all of the third parties listed above to enable us to provide our services or products to you. When we obtain personal and other information from third parties whom we are referred to by you, we will assume and you will ensure that you have made that third party aware of the referral of the persons and purposes involved in the collection, use and disclosure of the relevant personal or other information.

7. Use and Disclosure of Personal Information by Us

If we use or disclose your personal information for a purpose (the "secondary purpose") other the main reason for which it was originally collected (the "primary purpose"), to the extent required by law, we will ensure that:

• The secondary purpose is related to the primary purpose of collection (and directly related in the case of sensitive information), and you would reasonably expect that we would use or disclose your information in that way; or
• You have consented to the use or disclosure of your personal information for the secondary purpose; or
• The use or disclosure is required or authorised by or under law; or
• The use or disclosure is otherwise permitted by law (for example, as a necessary part of an investigation of suspected unlawful activity).

8. Employment Applications

Generally, the type of personal information we collect about you is the information included in your application, for example, your name, mailing address, telephone number, email address, career history, education details or other information relating to your career.

In considering your application, we may also obtain personal information about you from third parties, for example, from your previous employers or nominated referees. We may also collect sensitive information about you such as information about your health (including any disability) or any criminal record that you may have.

We collect personal information for any one or more of the following purposes:

• Assess you for a position or positions with us or our related entities;
• Assess whether you are suitable to progress to each stage of the recruitment process for a vacant position; or
• Store your information for future job opportunities.

If you do not provide us with the information we seek, we will be unable to do one or more of the above.

We may disclose your personal information to:

• Organisations that conduct competency or psychometric tests;
• Referees or previous employers;
• Recruitment agencies or related entities acting on our behalf;
• Our related entities;
• Law enforcement agencies to verify whether you have a criminal record; or
• Educational or vocational organisations to the extent necessary to verify your qualifications.

If we engage third party contractors to perform services for us which involves handling personal information we will take reasonable steps to prohibit the contractor from using personal information except for the purposes for which it was supplied.

9. Collection of Information Other than Personal Information

If you visit our website, some of the information we and/or our contractors collect about your visit to our website is not personal information because it does not reveal your identity. Information of this nature can include:

Site Visit Information

When you visit our website, we and/or our contractors collect general information about your visit which may include your server address, the date and time of your visit, the pages you accessed, the information you downloaded and the type of Internet browser you used.

We and/or our contractors may use this information in anonymous, aggregated form, for statistical purposes only, to assist us in improving the quality and usability of our website.

Cookies

A cookie is a small string of information that a website transfers to your browser for identification purposes. The cookies we and/or our contractors use may identify individual users.

Cookies can either be "persistent" or "session" based. Persistent cookies are stored on your computer, contain an expiration date, and are mainly for the user's convenience. Session cookies are short-lived and are held on your browser's memory only for the duration of your session, they are used only during a browsing session, and expire when you quit your browser.

We and/or our contractors may use both session and persistent cookies. This information may be used to personalise your current visit to our and our contractors' websites. Upon closing your browser, the session cookie is destroyed.

Most Internet browsers can be set to accept or reject cookies. If you do not want to accept cookies, you can adjust your Internet browser to reject cookies or to notify you when they are being used. However, rejecting cookies may limit the functionality of our website.

10. Collection of Personal Information from Children

Virgin Australia hosts general audience sites and does not knowingly collect personally identifiable information from children under the age of 13 without verifiable parental consent. If you are under the age of 13, please do not provide us with personally identifiable information of any kind whatsoever. If your child provides us with personally identifiable information, you may contact our Privacy Officer to delete this information from our records.

11. Access and Correction of Your Personal Information

You can ask to obtain access to your personal information that we and/or our contractors hold, although under some circumstances permitted by law, we may not provide such information to you. Also, we may not be able to require our contractors to provide personal information to you. We may not be able to require the operators of websites operated by other people (such as social media website operators) to provide personal information to you

We may ask you to put your request in writing and pay a reasonable fee levied by us for providing you with the information you have requested. We may also ask you to provide us with some proof of identification before releasing or correcting your personal information.

It is important to us that the personal information we hold about you is accurate, complete and up-to-date. If you are aware that this is not case and would like to correct your personal information, or simply desire access to your personal information, please contact our Privacy Officer.

We will deal with your request within a reasonable time and, if we decide not to correct or provide you with access to your personal information, we will give you our reasons for our decision.

12. Site Security Policy

Our website uses up-to-date technology to maximise the security of your personal information. Technology such as Secure Site Certificates and Secure Socket Layers ensure your information is as secure as possible. Particularly, we use a Thawte Secure Site Certificate to protect your personal information. Details and validity of this certificate can be viewed by clicking the thawte verification link in our Website Security FAQ.

More information on Website Security can be found in our FAQ section and includes the topics below

• What is SSL?
• What Are Cookies Used For?
• How Do I Maximise My Security Settings And Still Be Able To Book Flights?
• What Is Virgin Australia's Security Certification?

Using supported browsers and plugins also plays a part in your Website Security. For information on supported Browsers and Plugins check the minimum requirements in our FAQ.

For special terms that apply if you link from one of our websites to a website operated by another person, using an icon displayed on our websites, check the section entitled Special terms for links to third party websites.

13. Method of Sale

There are three ways to book a flight with Virgin Australia and those are:

• Through our website (www.virginaustralia.com) or related entity websites or through other legitimate travel websites;
• Through your local travel agent; or
• By calling our friendly Guest Contact Centre on one of the following numbers:

Please note that Virgin Australia does NOT cold call Guests or engage in unsolicited telemarketing campaigns, so do not under any circumstances accept a verbal offer over the phone or provide credit card details to anyone calling you directly and claiming to be from Virgin Australia.

14. Complaints

If you have a complaint about the way we have dealt with your personal information, please contact our Privacy Officer.

We will make all attempts to respond to your complaints or requests within a reasonable time after the complaint or request was made.

For special terms that apply if you link from one of our websites to a website operated by another person, using an icon displayed on our websites, check the section entitled Special terms for links to third party websites.

15. Updates to Privacy Policy

We may amend this Privacy Policy at any time and from time to time. If we do so, we will post the amended Privacy Policy on our website (mentioned above) so that you will always be aware of how we manage your personal information. The Privacy Policy is also available upon request to our Guest Contact Centre.

16. Further Information

Please contact our Privacy Officer if you have any queries about the personal information that we hold about you or the way we handle that personal information.

17. Privacy Officer Contact Details

The Privacy Officer - Legal
Virgin Australia Holdings Ltd
PO Box 1034
SPRING HILL QLD 4004
AUSTRALIA
Ph: +61 7 3295 3000
Fax: +61 7 3839 4024
Email: feedback@virginaustralia.com

18. Special Terms For Links To Third Party Websites

These special terms apply to you if you link from one of our websites to a website operated by somebody else, such as a social media website (referred to as a third party website). By clicking on a link to any third party website, you consent to these special terms.

In order for us to process your request to link to a third party website, we must share your personal information with our software provider and the operator of that website. You consent to us sharing your personal information with those people.

We do not have any control over how third party website operators may deal with your personal information once we provide it to them. In particular, we do not have any control over:

• Where they store your personal information;
• How they store your personal information;
• How they use your personal information;
• Whether and how they exchange your personal information with other people;
• Which other countries (if any) they transfer your personal information to;
• How you can access or correct your personal information held by the third party website operators;
• The security policies and procedures (if any) implemented on the third party websites;
• Whether those third party website operators have privacy policies and whether they comply with those policies (if any); or
• Whether or not those third party website operators comply with privacy laws.

We do not make any representations or warranties of any kind about any of these matters. We are not responsible in any way for any loss or damage which third party website operators may cause to you, in relation to your personal information. We are unable to address any complaint which you may have about the way that third party website operators deal with your personal information. You must contact the third party website operator directly if you have concerns or require any information about any of those matters.