Web Beacons

We may also include web beacons (also known as Internet tags, pixel tags, tracking beacons and clear GIFs) with the content and ads that we deliver to users, which we will use to collect information regarding users’ interaction with such content and ads. A web beacon is a transparent graphic image placed on a web page or in an email, which indicates that a page or email has been viewed or that an email has been forwarded. In addition, a web beacon allows external parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of the page on which the beacon appears, the time the page containing the beacon was viewed, the type of browser used to view the page, and the information in cookies set by external parties. A web beacon may also tell the browser to get content from another server.

Network Information for App

When a user uses the App, we may automatically collect other network information, including but not limited to network or service availability, networks viewed or searched for, other devices connected to a network, app response times, download errors, length of visits to certain pages, app interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the App.

How We Use the Information Collected

We use information we collect about and from aircraft owners and operators and users for a variety of business purposes, including, for example, to: provide the Services, respond to requests that users make, improve the Services and offer additional services, and to better tailor content, advertisements, offers and the features, performance, and support of the Services; and for purposes disclosed at the time a user or aircraft owner or operator provides Personal Information or otherwise with the user’s consent or the aircraft owner or operator’s consent. We may use transcripts of user e-mail conversations with our customer service agents for support, training, and improvements to our Services. If a user provides feedback to us, we may use and disclose such feedback for any purpose, provided we do not associate such feedback with the user’s Personal Information.

If you submit a request to us concerning your Personal Information, we will use the information we have to help verify your identity before we can complete your request. Similarly, we use such data to fulfill any orders or requests that you make to us in the course of our business with you. In providing our products, we will always use your Personal Information to ensure system security and anti-fraud systems are working and to prevent and contain any such issues.

We may use your Personal Information for marketing and to send you advertising materials, electronic newsletters, or promotional emails about our products and services. Users and aircraft owners or operators can opt-out of receiving further promotional messages from us by following the unsubscribe instructions provided in the promotional email they receive, by selecting to opt-out in our preference center or by contacting us directly at connect@gogoair.com. We may use Personal Information to send Service-related communications, for which aircraft owners or operators, and users may opt-out if they terminate their Account.

To the extent that certain information that we collect in providing the Services constitutes CPNI, Gogo Business Aviation complies with applicable law governing CPNI.

Information We Share

We may share your Personal Data with external parties under the following circumstances:

• External Parties Providing Services On Our Behalf. In order to provide the Services, carry out your requests, make various features, services and materials available to you through the Services and respond to your inquiries, we may share your Personal Data, including Usage Information, with external parties that perform functions on our behalf, such as (a) companies or individuals that: host or operate our Sites; analyze data; provide customer service; or manage payments; (b) advertisers; and (c) sponsors or other external parties that participate in or administer our promotions or provide marketing or promotional assistance. In such cases, such external parties are not entitled to use this data for any other purpose.
• Where required by law. We may share your Personal Data with law enforcement agencies, courts, other government authorities or other external parties where we believe necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any external party.
• In the context of a transaction. We may share your Personal Data with potential transaction partners, service providers, advisors, and other external parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business. Should such a sale or transfer occur, we will use reasonable efforts to obligate the entity to which we transfer your Personal Data to use it in a manner that is consistent with this Privacy Notice.

Except as otherwise stated in this Privacy Policy, we do not disclose Personal Information, CDR, or CPNI with external parties, unless the aircraft owner or operator, authorizes us to do so. We may share Usage Information or Device Identifiers with the owners or operators of the aircrafts on which the Services are available. We may also share non-Personal Information, such as anonymous, statistical or aggregate information (in a form that does not contain data fields that can reasonably be used to identify users) and certain Usage Information, including Flight Information, with external parties. In addition, we may share information as disclosed at or before the time the user provides the information, as set forth in this Privacy Policy and in the following circumstances:

External Parties Providing Services On Our Behalf. In order to provide the Services, carry out requests, to make various features, services and materials available through the Services, and to respond to inquiries, we may share Personal Information or Usage Information, including Device Identifiers and Flight Information, with external parties that perform functions on our behalf (or on behalf of our partners), such as: (a) companies or individuals that: host or operate our Sites or App; analyze data; provide customer service; manage payments; (b) advertisers; and (c) sponsors or other external parties that participate in or administer our promotions or provide marketing or promotional assistance.

Agreement To Have Personal Information Shared. While using the Services, users may have the opportunity to opt-in to receive information and/or marketing offers from someone else or to otherwise consent to the sharing of information with an external party while using the Services. If a user agrees to have his or her Personal Information shared, such Personal Information will be disclosed to the external party and will be subject to the privacy policy and business practices of that external party.

Affiliates. To facilitate our marketing and communications efforts, we may share some or all Personal Information with our Affiliates (“Affiliates” are parent companies, subsidiaries, joint ventures, or other companies under a common control), in which case we will require our Affiliates to honor this Privacy Policy.

Business Transfers. If our company or our assets related to this Privacy Policy are acquired by another company, Personal Information, and any other information that we have collected about the aircraft owners or operators or users of the Services, may be disclosed to that company as part of the due diligence process and will be transferred to that company as one of the transferred assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use information provided through the Sites in a manner that is consistent with this Privacy Policy. Also, if any bankruptcy or reorganization proceeding is brought by or against us, all such information may be considered an asset of ours and as such may be sold or transferred to external parties.

Law Enforcement Compliance. We may be required by law, or by law enforcement officers acting under the color of law, to record some or all communications on or through the Services. We may, and you and users hereby authorize us to, disclose Personal Information and other information including user communications through the Services, if required by applicable law or by law enforcement officers acting under the color of applicable law, or if we believe in good faith that such disclosure is necessary to: (a) comply with relevant laws or to respond to subpoenas or warrants served on us; or (b) to protect or defend the rights, property, or safety of Gogo Business Aviation, you, users, or external parties (especially in emergency situations).

Information We Receive from External Parties

Using multiple data sources, we derive your airline, tail number, origin, destination and flight number of the flight when you access the Services. If you choose to opt in, non-Gogo websites will forward your contact data and external party applications/sites (such as Facebook and Twitter) will share your personal data with us. We may also obtain data about you from persons you are connected to on social media sites. For example, if a user is on another website and opts-in to receive information from Gogo Business Aviation, that website will forward to us the user’s email address and other information so that we may contact the user as requested. Users may also choose to participate in an external party application or feature (such as one of our Facebook or Twitter applications or a similar application or feature on an external party web site) through which users allow us to collect and share (or the external party to collect and share) information, including Personal Information. In addition, we may receive information about a user if other users of an external party web site give us access to their profiles and the user is one of their “connections” or information the user is otherwise accessible through his or her connections” web page, profile page, or similar page on a social networking or other external party web site or interactive service.

We may also supplement the information we collect through the Services with other information from external parties in order to enhance our ability to provide service, tailor our content, and to offer opportunities to purchase products or services that we believe may be of interest. We may combine the information we receive from these external parties with information we collect through the Services. In those cases, we will apply this Privacy Policy to any Personal Information received, unless we have disclosed otherwise.

We may match the information we receive about users from external parties with the information we collect ourselves to enhance the experience with the Services and to select which of our advertisements or offers are most likely to appeal to a user and display them while that user is utilizing the Services.

Purposes for the Processing of Personal Data; Legal Basis

We process your Personal Data on the following legal bases, and for the following purposes:

• for entering into and performing the contract between you and Gogo (to provide the Services and process payment information)
• for our legitimate business interests (to provide the Services to you, respond to requests that you make, manage our network and business, provide training and support, improve the Services, and better tailor content, advertisements, offers and the features, performance and support of the Services)
• as regards the use of cookies and other similar technologies, based on your consent and/or opt-out mechanisms
• for purposes disclosed at the time you provide your Personal Data or otherwise with your consent
• to comply with our legal obligations

We do not use your Personal Data for any automated decision making covered by Articles 22(1) and (4) of Regulation (EU) 2016/679.

Gogo may retain your Personal Data both during and after the time you are our customer, but we won’t keep it longer than needed. The amount of time we keep it depends on the type of Personal Data and the purpose for processing. For example, we may need it for regulatory compliance, to maintain our internal financial or transactional records, to communicate with you about our relationship, or in cooperation with law enforcement agency requests.

Gogo may retain your Personal Data both during and after the time you are our customer, but we won’t keep it longer than needed. The amount of time we keep it depends on the type of Personal Data and the purpose for processing. For example, we may need it for regulatory compliance, to maintain our internal financial or transactional records, to communicate with you about our relationship, or in cooperation with law enforcement agency requests.

Access and Choices

We offer choices regarding the collection, use, and sharing of Personal Information. For example, if an individual receives promotional emails from us, her or she may indicate a preference to stop receiving further promotional communications from us and will have the opportunity to “opt-out” by following the unsubscribe instructions provided in the promotional email received or by contacting us directly at connect@gogoair.com or by accessing our email preference page. Gogo Business Aviation does not charge for this opt-out service, and the opt-out request will be processed within 30 days of the date on which we receive it. Regardless of the indicated email preferences, we may send administrative emails regarding the Services, including, for example, purchase confirmation, account creation confirmation, and notices of updates to our Terms of Use Agreement or Privacy Policy. These options are provided at no charge to you.

To verify, correct or update any of the Personal Information provided to us, edit it in the Account page or by contacting us at bacustomerservice@gogoair.com. Please note that unless stated otherwise, we may send any corrected or updated Personal Information to every organization to which the relevant Personal Information has been disclosed in accordance with this Privacy Policy. In accordance with our routine record keeping, we may delete certain records that contain Personal Information submitted through the Services. Please note that we may be required (by applicable law or otherwise) to keep this information and not delete it (or to keep this information for a certain time, in which case we will comply with the deletion request only after we have fulfilled such requirements). Be aware that it is not always possible to completely remove or delete all information from our databases without some residual data remaining in our archives because of backups and other reasons.

Under current privacy laws, you have the right to:

• Access and be informed – to request, to know what personal information we collect, use, disclose, and sell about you, including the right to know the specific pieces of personal information we have collected about you
• Portability – to request a portable copy of your personal information
• Delete – to request that we delete personal information that we have about you, subject to certain exceptions allowed under applicable law, please visit our preference center
• Not Sell – to opt out of the sale of your personal information to external parties (but note that we DO NOT sell personal information to external parties)
• Not Sell – to opt out of the sale of your personal information to external parties (but note that we DO NOT sell personal information to external parties)

We will not discriminate against you because you exercised any of these rights.

For questions about the collection of Personal Data by Gogo, or to exercise the right to access, correct, update, or delete such data or object, for legitimate purposes, to the processing of Personal Data for which Gogo is the data controller, as provided under applicable law, please click here. You may also exercise these rights by emailing us at privacyofficer@gogoair.com, calling our customer care line +1 303.301.3278, or emailing our customer care team at bacustomerservice@gogoair.com.

We may take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal information and whether you have an account with us.

You may designate an authorized agent to make a request under the CCPA on your behalf. When submitting the request, please ensure the authorized agent identifies himself/herself/itself as an authorized agent.

There may be cases where restrictions on the amount of data that can be disclosed to data subjects under applicable law (for example, if that would necessarily involve disclosing data about another person). Gogo is permitted to withhold some types of Personal Data in certain circumstances, subject to applicable local law requirements. If there is a dispute, please contact the Gogo privacy officer at privacyofficer@gogoair.com. In addition, data subjects have the right to lodge a complaint with a supervisory authority. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based external party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Right to Withdraw Consent

To the extent you have provided consent for certain personal data processing activities, you may withdraw such consent at any time using the options available within this notice.

Online Advertising: How to Opt-out

Gogo Business Aviation licenses technology to serve advertisements on its own Sites and within its content as that content is served across the Internet. In addition, Gogo Business Aviation may use external party analytics vendors to evaluate and provide us with information about the use of the Services and viewing of our content. We do not share Personal Information with these external parties, but ad network providers, the advertisers, the sponsors, and/or analytics service providers may set and access their own Cookies, pixel tags and similar technologies on Devices and they may otherwise collect or have access to information about users, including Usage Information, which they may collect over time and across different websites following a users’ visit to our services. We and our network advertisers may target advertisements for products and services in which users might be interested based on their use of the Services, visits to the Sites and other websites. We may use a variety of companies to serve advertisements.

We do not currently respond to web browser “do not track” signals or other mechanisms that provide a method to opt out of the collection of information across the networks of websites and online services in which we participate. If we do so in the future, we will describe how we do so in this Privacy Policy. Visit the following website, www.allaboutdnt.org, for more information on this developing area.

If a user prefers to not receive targeted advertising, he or she can opt-out of some network advertising programs that use their information. To do so, please visit the Digital Advertising Alliance (DAA) Opt-Out Page: https://www.aboutads.info/choices. Please note that even if a user chooses to remove information (opt-out), the user will still see advertisements while browsing online. Additionally, many network advertising programs allow users to view and manage the interest categories they have compiled from online browsing activities. These interest categories help determine the types of targeted advertisements that will be delivered. The DAA Opt-Out Page provides a tool that identifies its member companies that have Cookies on a browser and provides links to those companies.

Links to Other Sites

Our provision of links to other websites or locations is for convenience and does not signify our endorsement of such other websites or location or its contents. We have no control over, do not review and cannot be responsible for these outside websites, their content, or their data collection.

How We Protect Personal Information

The connection through which users access many of the Services is an SSL-encrypted link. However, if a user has VPN, Gogo Business Aviation recommends using that channel for greater security. SSL-encrypted websites or pages, typically indicated by “https” in the address field and a “lock” icon, can also generally be accessed through the Gogo Business Aviation Services. Users should be aware, however, that data packets from un-encrypted Wi-Fi connections can be captured by technically advanced means when they are transmitted between a user’s Device and the Wi-Fi access point. Users should therefore take precautions to lower their security risks. Gogo Business Aviation recommends that users follow good security practices, such as ensuring that file-sharing is not enabled while accessing the Internet from an un-encrypted public network and that laptops have firewall and other protection against malware. Gogo Business Aviation recommends that sensitive or private information should not be accessed via or transmitted over an unencrypted connection. While Gogo Business Aviation takes steps to provide reasonable security for Personal Information, and employs physical, technical, and administrative safeguards to protect such information, we cannot ensure or warrant the security of any information transmitted to us, users utilize the Services and provide us with information at their own risk.

Transfer of Personal Data

Personal Data collected by Gogo may be stored or processed in the United States or in any other country where Gogo or its affiliates, subsidiaries, or external party service providers maintain facilities. EU data subjects who provide Personal Data to Gogo acknowledge the processing and transfer of that data to the United States and around the world. Gogo will execute agreements with external parties for the transfer of personal data outside of the EU. These agreements may use European Commission-approved Standard Contract Clauses and/or employ additional or alternative appropriate safeguards. For more information on the appropriate safeguards in place and to obtain a copy of such safeguards, please contact us at privacyofficer@gogoair.com.

Children

We do not intentionally gather Personal Information about Users who are under the age of 16. If we become aware that we have unknowingly collected Personal Information from a child under the age of 16, we will make reasonable efforts to delete such information from our records.

Compliance with the California Consumer Privacy Act (CCPA)

In addition to the notice provided above, the following notice applies to California residents.

We have collected the following personal information from our users over the past 12 months. What information we collect varies depending on how you interact with us and our services.

• We collect personal identifiers, including your real name, your Gogo username, your IP address, your MAC address, and other unique identifiers from your device. If you call our customer service team, then we will also collect your phone number. For processing your payment, we only collect a credit or debit card token (usually the last 4 digits), your name and billing address, as necessary.
• In your use of the services, we collect commercial information around what you buy from us, to meet our legal, financial, and customer service obligations. As a telecommunication provider, we collect your browsing history (limited only to the hosting sites and not the complete browsing story) for our billing purposes. We collect this information when you use our inflight services. If you interact with the Gogo sites, we collect information about the interaction with the sites as to improve your experience. If you call into our customer service team, we may also collect contact and account information, such as your phone number or email address, to ensure we can communicate with you and complete your given request.
• How do we use the personal information we collect? We use the above-referenced categories of personal information for our business and commercial purposes as further described in Section 2 of this Privacy Policy.
• What categories of sources do we collect your personal information from? We collect the above-referenced categories of personal information directly from you, automatically from your devices, from our service providers who perform business functions on our behalf, your friends who refer you to us, our airline partners, and social media, as further described in Section 1 of this Privacy Policy.
• What categories of other parties do we share your personal information with? We disclose the above-referenced categories of personal information to our affiliates, service providers, business and advertising partners, airline partners, advertising networks, data analytics providers, and social networks, as further described in Section 3 of this Privacy Policy.
• We do not sell the personal information of California residents and we have not engaged in any sales in the last 12 months.

Changes to this Notice

We may modify or update this privacy notice from time to time. If we make any revisions that materially change the ways in which we process your Personal Data, we will notify you of these changes before applying them to that Personal Data.

How to Contact Us

For any questions or concerns regarding this Privacy Policy, please contact us at privacyofficer@gogoair.com.

Modified 2020/01/01