Privacy and Personal Data Protection Policy

1. Identity of the Data Controller

This Privacy and Personal Data Protection Policy applies to the processing of personal data carried out by Aeroregional through its services, physical and digital channels, website, customer service channels, reservation systems, the Aira virtual assistant and the Regional Plus Program, whenever SERVICIO AEREO REGIONAL REGAIR CIA. LTDA. acts as data controller.

Data Protection Officer

2. Personal Data We Collect

Depending on the service requested and the corresponding purpose, Aeroregional may collect and process the following categories of personal data:

• Full name.
• Email address.
• Phone number.
• Identification data, including ID card, passport or other identity document number where applicable.
• Booking data, including routes, dates and other information needed to manage the air transport service.
• Content of conversations held through the Aira virtual assistant and official customer service channels.
• Photos or copies of identity documents only when necessary for the purpose disclosed to the data subject.
• Data needed to manage benefits for senior citizens and persons with disabilities.
• Data associated with the Regional Plus Program, including full name, email address, identity document type and number, passport number when voluntarily provided by the data subject, and the data needed to create and authenticate the account.
• Data arising from participation in Regional Plus, such as information on earning, crediting, using and managing miles and benefits, where applicable.
• Browsing data obtained through cookies and similar technologies on the website, as described in the cookies section of this policy.

To manage legal benefits or discounts for senior citizens and persons with disabilities, Aeroregional may collect and process, as applicable, the following personal data: first and last names, ID card, passport or other identity document number, date of birth or age, contact details, booking data, route, flight date, type of benefit requested, proof of benefit validation and, when strictly necessary, an image or digital copy of the document proving age or disability status.

For persons with disabilities, data relating to the disability will be treated as a special category of personal data and limited to what is strictly necessary to validate the corresponding benefit. Aeroregional will not request medical records, diagnoses, tests, prescriptions, fingerprint codes or any medical information not required to apply the discount.

This data may be received through physical channels, counters or authorized service points, and official digital channels enabled by Aeroregional, including WhatsApp.

3. Purposes of Processing

Aeroregional will process personal data, as applicable, for the following purposes:

• Customer service and travel support.
• Booking management and processing.
• Identity verification for discounted fares.
• Improvement of our service and the Aira virtual assistant.
• Operational, informational or service communications related to bookings, flights and contracted services.

Regional Plus Program

Personal data collected within the Regional Plus Program will be processed for the following specific purposes:

• Create, register and manage the data subject’s Regional Plus Program account.
• Identify the account holder and correctly link their identification data to their participation in the program.
• Associate the data subject’s flights with their Regional Plus account, where applicable.
• Record, credit, accumulate, manage, check, redeem and administer Regional Plus Program miles and benefits.
• Handle requests, inquiries, updates, complaints and other matters related to the Regional Plus account.
• Use the ID card, passport or other identity document number, as applicable, to identify the data subject and correctly associate their flights, miles, benefits and transactions within the program.
• Use the passport number, when the data subject chooses to provide it optionally, to make it easier to identify them and associate their miles when they travel with that document.
• Manage the data subject’s participation in Regional Plus Program promotions, campaigns, benefits and activities, where applicable.
• Send promotions, offers, news, benefits and commercial communications related to Aeroregional and the Regional Plus Program, when the data subject has given consent for this purpose, in cases where that legal basis applies.
• Manage withdrawal of consent or the data subject’s request to stop receiving commercial communications.

Senior citizen and disability benefits

Data related to senior citizen or disability benefits will be processed for the following specific purposes:

• Verify the data subject’s identity and eligibility for the requested benefit.
• Apply the corresponding legal discount to the booking or ticket issuance.
• Handle requests made through official physical or digital channels, including WhatsApp.
• Record minimal evidence of the benefit granted for traceability, internal audit, claims handling and inspections by competent authorities, where applicable.
• Respond to requests, inspections or verifications by competent authorities, including the aviation authority, where applicable.
• Comply with applicable legal, regulatory, contractual and record-keeping obligations.

Website

• Measure website usage and the performance of our advertising campaigns, only when the data subject has accepted this in the cookie notice.
• Respond to requests for commercial information, such as advertising in VOAR Magazine.

4. Legal Basis for Processing

Aeroregional will process personal data only when there is a legal basis for it, in accordance with the Organic Law on Personal Data Protection and other applicable regulations.

Depending on the nature of the service, the purpose of processing and the category of data involved, Aeroregional may process personal data on the following legal bases:

• Performance of pre-contractual or contractual measures, when processing is necessary to handle the data subject’s requests, bookings (including those requested via WhatsApp), ticket issuance, customer service, provision of air transport services and other matters related to the commercial or contractual relationship.
• Consent of the data subject, when free, specific, informed and unambiguous authorization is required for one or more specific purposes, such as receiving documents to verify legal benefits through official digital channels like WhatsApp, sending commercial communications or using cookies that are not strictly necessary.
• Compliance with legal or regulatory obligations, when processing is necessary to apply, verify, record or support benefits, discounts, inspections, audits or requirements arising from regulations applicable to air transport services.
• Responding to requests from competent authorities, when Aeroregional must retain, communicate or submit strictly necessary information to public entities, oversight bodies or aviation authorities, where applicable.
• Regional Plus Program: Processing of the personal data needed to apply for enrollment, create and manage the Regional Plus account, identify the member and manage the earning, crediting, use and administration of miles and benefits will be based on pre-contractual measures requested by the data subject and/or performance of the contractual relationship arising from their participation in the Regional Plus Program, according to the specific purpose of processing.
• Regional Plus Program commercial communications: Processing of the data subject’s contact details to send promotions, offers, news, benefits and commercial communications related to Aeroregional and the Regional Plus Program will be based on the data subject’s consent, where that is the applicable legal basis. Such consent will be requested separately, freely, specifically, in an informed and unambiguous manner and may be withdrawn at any time; refusing or withdrawing it will not prevent the creation or management of the Regional Plus account.

To manage legal benefits or discounts for senior citizens and persons with disabilities, Aeroregional will process only the data essential to verify the data subject’s identity, validate eligibility for the benefit, manage the booking or ticket issuance, keep minimal evidence of the discount applied and respond to inspections by competent authorities, where applicable.

When processing involves disability-related data, Aeroregional will handle it as a special category of personal data, applying enhanced measures of confidentiality, security, restricted access, traceability, minimization and limited retention.

5. Processing of Personal Data in the Regional Plus Program

Regional Plus is Aeroregional’s loyalty program. SERVICIO AEREO REGIONAL REGAIR CIA. LTDA. acts as the controller of the personal data processed to manage the program.

To create a Regional Plus account, Aeroregional may collect the data requested in the registration form, including full name, email address, identity document type and number and, when the data subject chooses to provide it, passport number, as well as the data needed to create and authenticate the account.

This data will be processed to:

• register and manage the Regional Plus account;
• correctly identify the account holder;
• link the data subject’s identity to their participation in the program;
• record, credit, manage and enable the use of miles and benefits;
• handle requests and actions related to the account;
• prevent miles from being credited to the wrong person; and
• comply with the legal or contractual obligations applicable to the program.

Mandatory data will be only what is strictly necessary to create and manage the account and provide the Regional Plus Program services. When a data field is optional, the form must expressly identify it as such.

Failure to provide mandatory data may prevent the creation or proper management of the Regional Plus account. Failure to provide data identified as optional will not prevent the account from being created, unless that data later becomes necessary for an operation specifically requested by the data subject.

The data subject is responsible for providing accurate and up-to-date information. Incorrect or inaccurate information could prevent proper identification of the data subject, association of flights, crediting of miles or management of benefits.

6. Processing of Data for Senior Citizen and Disability Benefits

Aeroregional may process personal data of senior citizens and persons with disabilities to verify and apply the corresponding legal benefits or discounts. This processing may take place at physical counters, authorized service points or official digital channels, including WhatsApp.

Before receiving documents via WhatsApp, Aeroregional will request specific authorization from the data subject. If the data subject does not wish to proceed via WhatsApp, they may visit a physical counter or authorized service point, where they will also be informed about the processing of their personal data and asked for the corresponding authorization, where applicable.

Declining to continue the process via WhatsApp does not prevent the data subject from requesting the benefit in person. However, access to the benefit will be subject to verification of the applicable requirements.

Aeroregional will request only the information strictly necessary to verify identity and eligibility for the benefit. The data subject should avoid sending documents, images or additional data that have not been requested. In particular, they should not send medical records, diagnoses, tests, prescriptions or unnecessary medical information.

Aeroregional will apply enhanced security measures to this data, including access restricted to authorized staff, confidentiality, traceability of validation, limited retention and secure deletion when the data is no longer needed.

7. Retention Period

Data will be kept for as long as necessary to fulfill the purpose for which it was collected and, thereafter, for the legally required periods (7 years under Ecuadorian tax and civil law for booking and transaction records, or until the data subject requests deletion, where applicable).

8. Recipients and Third Parties

Personal data may be processed by providers that render services to Aeroregional as data processors, only when necessary for the corresponding purpose and in accordance with Aeroregional’s instructions.

These may include reservation system providers, technology infrastructure and storage services, platforms needed to operate digital services and, where applicable, technology providers involved in operating Regional Plus.

Aeroregional will not sell data subjects’ personal data to third parties for commercial purposes.

When data is communicated to a third party acting as an independent recipient, Aeroregional will inform the data subject in accordance with applicable regulations.

9. International Transfers

Some technology infrastructure, messaging (such as WhatsApp) and web measurement (such as Google and Microsoft) providers may process data on servers located outside Ecuador. In all cases, contractual safeguards equivalent to those established by the LOPDP are required.

10. Cookies and Similar Technologies on the Website

When you visit aeroregional.net we show you a cookie notice where you can accept, reject or choose by category which technologies are enabled. Those that are not strictly necessary are only loaded if you accept them:

You can change your choice at any time from the Cookie settings link in the footer. This policy page is always shown without analytics, advertising or chat cookies.

11. Data Subject Rights (ARCO+ Rights)

As the owner of your personal data, under the LOPDP you have the right to:

12. How to Exercise Your Rights

Send your request to info@aeroregional.net or to our Data Protection Officer (delegadodeprotecciondedatos@aeroregional.net) stating your full name, the right you wish to exercise and a copy of your identity document. We will respond within a maximum of 15 business days, in accordance with the LOPDP.

13. How to File a Complaint with the Supervisory Authority

If you believe the processing of your data does not comply with current regulations, you may file a complaint with the Superintendency of Personal Data Protection (SPDP): spdp.gob.ec

14. Withdrawal of Consent

You may withdraw your consent at any time by writing to info@aeroregional.net. Withdrawal does not affect the lawfulness of processing carried out before it. Consent for cookies can be withdrawn directly from the Cookie settings link in the footer.

For consent given to manage senior citizen or disability benefits through digital channels such as WhatsApp, the data subject may withdraw consent by writing to info@aeroregional.net or through the same channel used for the request, where technically possible.

Withdrawal of consent will not affect the lawfulness of prior processing, nor prevent Aeroregional from retaining information it must keep to comply with legal, contractual or regulatory obligations, inspections by competent authorities or the defense of claims, where applicable.

Withdrawal of consent applies only to processing whose legal basis is consent.

When processing is necessary to perform the contractual relationship of the Regional Plus Program or to comply with a legal obligation, withdrawing consent given for an additional purpose will not automatically end processing that has another valid legal basis.

15. Last Updated

This policy was last updated in October 2026. Aeroregional reserves the right to modify it to reflect regulatory or service changes, announcing relevant changes on the website.