Privacy and Personal Data Protection Policy

1. Identity of the Data Controller

2. Personal Data We Collect

• Full name
• Email address
• Phone number
• Content of conversations with the Aira virtual assistant
• Booking data (routes, dates, identity documents for discounts)
• Photos of identity documents (only when special discounts apply)

To manage legal benefits or discounts for senior citizens and persons with disabilities, Aeroregional may collect and process, as applicable, the following personal data: first and last names, ID card, passport or other identity document number, date of birth or age, contact details, booking data, route, flight date, type of benefit requested, proof of benefit validation and, when strictly necessary, an image or digital copy of the document proving age or disability status.

For persons with disabilities, data relating to the disability will be treated as a special category of personal data and limited to what is strictly necessary to validate the corresponding benefit. Aeroregional will not request medical records, diagnoses, tests, prescriptions, fingerprint codes or any medical information not required to apply the discount.

This data may be received through physical channels, counters or authorized service points, and official digital channels enabled by Aeroregional, including WhatsApp.

3. Purposes of Processing

• Customer service and travel support
• Booking management and processing
• Identity verification for discounted fares
• Improvement of our service and virtual assistant
• Communications related to active bookings

Data related to senior citizen or disability benefits will be processed for the following specific purposes:

• Verify the data subject’s identity and eligibility for the requested benefit.
• Apply the corresponding legal discount to the booking or ticket issuance.
• Handle requests made through official physical or digital channels, including WhatsApp.
• Record minimal evidence of the benefit granted for traceability, internal audit, claims handling and inspections by competent authorities, where applicable.
• Respond to requests, inspections or verifications by competent authorities, including the aviation authority, where applicable.
• Comply with applicable legal, regulatory, contractual and record-keeping obligations.

4. Legal Basis for Processing

Aeroregional will process personal data only when there is a legal basis for it, in accordance with the Organic Law on Personal Data Protection and other applicable regulations.

Depending on the nature of the service, the purpose of processing and the category of data involved, Aeroregional may process personal data on the following legal bases:

• Performance of pre-contractual or contractual measures, when processing is necessary to handle the data subject’s requests, bookings, ticket issuance, customer service, provision of air transport services and other matters related to the commercial or contractual relationship.
• Consent of the data subject, when free, specific, informed and unambiguous authorization is required for one or more specific purposes, especially for service through official digital channels such as WhatsApp, or when documentation is requested to verify applicable legal benefits.
• Compliance with legal or regulatory obligations, when processing is necessary to apply, verify, record or support benefits, discounts, inspections, audits or requirements arising from regulations applicable to air transport services.
• Responding to requests from competent authorities, when Aeroregional must retain, communicate or submit strictly necessary information to public entities, oversight bodies or aviation authorities, where applicable.

To manage legal benefits or discounts for senior citizens and persons with disabilities, Aeroregional will process only the data essential to verify the data subject’s identity, validate eligibility for the benefit, manage the booking or ticket issuance, keep minimal evidence of the discount applied and respond to inspections by competent authorities, where applicable.

When processing involves data relating to disability, Aeroregional will handle it as a special category of personal data, applying enhanced measures of confidentiality, security, restricted access, traceability, minimization and limited retention.

5. Data Processing for Senior Citizen and Disability Benefits

Aeroregional may process personal data of senior citizens and persons with disabilities to verify and apply the corresponding legal benefits or discounts. This processing may take place at physical counters, authorized service points or official digital channels, including WhatsApp.

Before receiving documents via WhatsApp, Aeroregional will request specific authorization from the data subject. If the data subject does not wish to proceed via WhatsApp, they may visit a physical counter or authorized service point, where they will also be informed about the processing of their personal data and asked for the corresponding authorization, where applicable.

Declining to continue the process via WhatsApp does not prevent the data subject from requesting the benefit in person. However, access to the benefit will be subject to verification of the applicable requirements.

Aeroregional will request only the information strictly necessary to verify identity and eligibility for the benefit. The data subject should avoid sending documents, images or additional data that have not been requested. In particular, they should not send medical records, diagnoses, tests, prescriptions or unnecessary medical information.

Aeroregional will apply enhanced security measures to this data, including access restricted to authorized staff, confidentiality, traceability of validation, limited retention and secure deletion when the data is no longer needed.

6. Retention Period

Data will be kept for as long as necessary to fulfill the purpose for which it was collected and, thereafter, for the legally required periods (7 years under Ecuadorian tax and civil law for booking and transaction records, or until the data subject requests deletion, where applicable).

7. Recipients and Third Parties

Data may be shared with: airline reservation system providers, cloud infrastructure service providers, and partner flight operators when necessary to complete a booking. Data is not sold to third parties for commercial purposes.

8. International Transfers

Some technology infrastructure providers may process data on servers located outside Ecuador. In all cases, contractual safeguards equivalent to those established by the LOPDP are required.

9. Data Subject Rights (ARCO+ Rights)

As the owner of your personal data, you have the right to:

10. How to Exercise Your Rights

Send your request to info@aeroregional.net stating your full name, the right you wish to exercise and a copy of your identity document. We will respond within a maximum of 15 business days, in accordance with the LOPDP.

11. How to File a Complaint with the Supervisory Authority

If you believe the processing of your data does not comply with current regulations, you may file a complaint with the Superintendency of Personal Data Protection (SPDP): spdp.gob.ec

12. Withdrawal of Consent

You may withdraw your consent at any time by writing to info@aeroregional.net. Withdrawal does not affect the lawfulness of processing carried out before it.

For consent given to manage senior citizen or disability benefits through digital channels such as WhatsApp, the data subject may withdraw consent by writing to info@aeroregional.net or through the same channel used for the request, where technically possible.

Withdrawal of consent will not affect the lawfulness of prior processing, nor prevent Aeroregional from retaining information it must keep to comply with legal, contractual or regulatory obligations, inspections by competent authorities or the defense of claims, where applicable.

13. Last Updated

This policy was last updated in March 2026. Aeroregional reserves the right to modify it to reflect regulatory or service changes, announcing relevant changes on the website.