Effective date: 24 May 2018
Last updated: 15 March, 2021
China Southern Airlines Company Limited (Hereinafter referred to as “CZ”, “China Southern ”, “We”) respects and takes measures to protect your personal information.
- I. What does CZ do?
- II. How and why does CZ collect your personal information and what kind of information do we collect?
- III. How does CZ entrust processing, share, transfer and disclose your personal information?
- V. On what legal basis does CZ process personal information?
- VI. How does CZ protect your personal information?
- VII. How does CZ store your personal information?
- VIII. Protection of children’s personal information
- IX. CZ’s transfer of your personal information worldwide
- X. Your rights on personal information protection
I. What does CZ do?Company Profile
With headquarters based in Guangzhou, CZ has its company logo seen around the globe with a brilliant red kapok delicately adorning a blue vertical tail fin. As an airline company with the largest number of transport aircraft, the most developed route network and the largest annual passenger volume in the People’s Republic of China, CZ operates several branches including Xinjiang and Northern Branches and several holding airline subsidiaries including Xiamen Air; the China Southern Airlines General Aviation Limited established in Zhuhai; several domestic sales offices in Hangzhou and Qingdao, etc., as well as several international branch offices located in Singapore, New York City, etc.
Working closely with its partners, CZ is currently extending its coverage to even more destinations around the world. During the creation of the Canton Route International Airline Hub, CZ has been developing flight system and improving transit operation, benefiting from 6th Freedom of the air. Based in South East, South and East Asia, centred upon Europe and Oceania with the reach covering North America, Mideast and Africa, CZ has become the largest gateway hub connecting China to Oceania and South East Asia. For more information about CZ, please see the section of our Website at “Company Profile”.
II. How and why does CZ collect your personal information and what kind of information do we collect?
CZ may, according to the business scenarios, collect personal information in the following ways:
1. Information that you provide voluntarily
We may, to provide you with air transit services, request you to supply the following personal information:
- ● Sky Pearl member information: your member account No. and flight information, mileage redemption recipient’s information, trustee’s information, and minor member’s guardian information. Such information will be used to maintain our Sky Pearl members, verify member identity and process your accumulation, reward and redemption of points and other FFP services.
- ● Data and images of identity documents required in business processing: ID card, passport, visa page, papers required by CAAC for taking a flight, validity period, authorities of issuance, age or date of birth, gender, and their corresponding images. Such information and images will be used, as dictated by the law and regulations, to verify your identity when you book an air ticket, reserve a seat, check in, take a flight, handle entry/exit formalities, purchase air insurance, enjoy CZ Account services and any other services (e.g., filing a complaint).
- ● Payment information: your credit card No., billing address, credit card validity, online payment platform (Alipay, WeChat) account information (e.g., Alipay, WeChatPay), CZ Account information, CZ Account balance, orders and operation records, log and risk control information. Such information will be used, when you purchase an air ticket, to maintain your payment information, verify your identity and provide you with CZ Account service and CZ Happy Fly service.
- ● Information to improve travel and other services: emergency contact person, special service requirements and personal likes and dislikes (in-flight meals, location of seats in cabin, in-flight services). Such information will be used to improve the relevance of our products and services so that we can provide you with services that address better your needs and may push to you, subject to your agreement, our promotional and marketing messages.
- ● Personal information contained in contract: contact person’s name, position, address and contact information (one or any of the data). Such information will be used to facilitate the communication between enterprise contact and us and to post contracts and/or relevant documents.
- ● Any other personal information: personal information involved in transactions and online businesses in relation to any other airlines’ points and mileage promotions; personal information obtained from the use of our products and services, e.g., self-service terminal, notification of flight status, Internet boarding, etc.; personal information gathered at questionnaire, solicitation of opinions and/or any other marketing investigations; personal information supplied to CZ for the investigation or solution of any problems, e.g., verification of your identity.
We use this personal information to facilitate your travel, provide you with other goods and services related to your travel, to administer our Sky Pearl Club programme, to carry out marketing activities and to provide you with our information and contact details. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.
2. Information that we collect automatically
When you access our website, App, mini-app, WeChat account, etc., we will, as required by technology and equipment, automatically collect specific information about you from your devices.Such information that we collect automatically may include:
- ● Equipment information: equipment model, operating system version, browser version number, IMEI number, Mac address, IP address, port information, DNS, mobile operator, data network format, ROOT identifier, network access mode, login channel, APP version number, login time, hardware number, and other log information and technical parameter information related to user network, system and equipment.
- ● General position in geography (including location of country or municipality) and other technical data of your device. We may also collect information on how your device interacts with us, including the webpage you have visited and the links you have clicked on.
Please understand that these information is used by such third parties as Gridsum, Taobao, MTA, Jpush and Alipay to analyze and judge the uniqueness of equipment and safety risk control. We will use such information on operation to better understand our visitor community and improve our website quality and its relevance to visitors. If you refuse to agree to our collection of such information, we will be unable to provide you with basic functions and/or services (App, official website, mini-app and WeChat account) that require an online environment.
3. Information that we obtain from third party sources
From time to time, we will receive personal information about you from third party sources, but only where these parties confirm that they either have your consent or are otherwise legally permitted or required to disclose your personal information to us.
The types of information we collect from third parties include travel professionals and others who assist in booking and arranging travel. We use the information we receive from these third parties to provide services to you, and maintain the accuracy of the records we hold about you.
4. List of permissions to use your device we will request
The permissions and explanations to use your device we will request at startup to provide you with quality service are listed below. When a request pops up, you are recommended to grant the relevant permissions. No permission will be obtained without your prior agreement. You may turn off any permission in your device’s OS Settings.
Permissions Notes Telephone Permission This permission allows reading its hardware data, which serve as a basis to generate a device’s unique identifier, and, by technologies and risk control rules, improve relevance between user and device. It also facilitates the functions of Pay by Friends, Airport Pickup, Call Drop-off Driver, etc. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Storage Permission This permission allows the functions to store and upload pictures, R/W personal settings in cache, create system and log files, cache itinerary/share screenshot/save pictures in album, etc. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Positioning Permission This permission allows personalized recommendation of services, e.g., Site Services, Public Services, Map & Navigation, etc. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Contacts Permission to access Contacts is required to view contacts’ information. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Network Service Network is required to start Southern Airlines's App for the first time. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. SMS Transmission Access to SMS is required to share information by SMS. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Camera & Album This permission facilitates operations to scan codes and read boarding pass/human image/documents. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. MIC Access to MIC is required to pick up your voice message. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Phone Status Access to Phone Status is required to pay by China UnionPay. Bluetooth Access to Bluetooth allows Southern Airlines to connect to devices. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected. Calendar Access to Calendar is required to manage your flight changes and itinerary memo. When you refuse to grand this permission, you will be unable to use the relevant services, and all other functions will not be affected.
In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (including archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.
III. How does CZ entrust processing, share and disclose your personal information?
We may disclose your personal information to the following categories of recipients:
- ● Third-party partners who share your personal information, including but not limited to cooperative online travel ticketing agencies, ticket distributors, agencies, travel agencies, hotels, airlines such as code-sharing, interline and joint venture partners, insurance companies, and financial/payment institutions you choose to use. Specifically, the cooperative online travel ticketing agencies, ticket distributors and agencies arrange discount prices, purchase tickets and provide you with other services such as refunding and changing tickets, points and accumulated mileages on your behalf; the cooperative travel agencies and hotels provide more convenient and efficient quality services in your travel, accommodation and so on, and arrange discount prices and points exchange for your travel on your behalf; the cooperative airlines provide you with more route and price options on code sharing, interline and joint venture, provide you with services such as airport VIP lounges, assistance in carrying or re-booking when your journey is interrupted; the cooperative insurance companies obtain your necessary information to insure you and provide appropriate services; the financial / payment institutions you choose to use will help you pay through our e-wallets. We will share your personal information to the third parties after seeking your consent, or following your request to the extent it is necessary for the performance of our contract with you.
- ● Competent administrative law enforcement authorities, judicial authorities, other regulatory authorities and other such third-parties (including civil aviation authorities, customs, market supervision and administration, public security, national security, courts, procuratorates, network information departments or industry information departments) whom we share or disclose your personal information with in accordance with the provisions of laws and regulations or the mandatory requirements of government authorities: (1) to comply with the requirements of laws and regulations, for example, when it is related to national security, national defense security, public security, public health, major public interests, or to crime investigation, prosecution, trial and execution of sentences; (2) to enforce, establish and safeguard our legitimate rights; (3) to safeguard the vital interests of you or others, such as the safety of life, property, etc.
- ● to an actual or potential counterparty (and its agents and advisers) in connection with any actual or proposed transaction, merger or acquisition of any part of our business, provided that we will inform the counterparty it must use your personal information only for the purposes disclosed in this Privacy Notice;
- ● Any other person with your consent to the disclosure. This will include the situation that you authorize your personal information to others to book, manage your itinerary, etc.
● Our App uses the SDK of the following suppliers. During your use of the App's specific functions, we may share or disclose your personal information to the following SDK suppliers for the following scenarios or service purposes:
Name Business scenarios used Purpose Personal information field Name of third party CCB Dragon Pay
Pay for the order Payment Device information China Construction Bank UnionPay (Cloud Flash Pay)
Payment Payment Device information China UnionPay
Pay for the order Payment Device information
Share links and pictures to moments
WeChat associated login
Payment for tickets
WeChat login, sharing and payment Application information
Risk management Used for system risk management. Helping us to timely identify problems in the process of using App, and quickly locate and solve the problems. Improving the ability of digital operation and maintenance. Device information
Risk management Used for collecting users' behavior data and system stability so that we can analyze the use of system and business functions to improve the system experience Device information
Risk management Used for collecting users' behavior data and system stability so that we can analyze the use of system and business functions to improve the system experience Device information
Beijing Gridsum Technology Co., Ltd.
Member's second password authentification
Facial recognition Device information
City location, dynamic flight path Location, navigation Device information
Knowledge search, flight search Voice recognition Device information
Adding bank card for wallet
Opening wallet account
Scanning for identification of documents and bank cards Device information
Weibo sharing Weibo sharing Device information
QQ login QQ login Device information
Electronic Luggage Tag
Electronic luggage tag Electronic luggage tag None BAGTAG
Message push Push Device information
usabilla Suggestion feedback Collecting users' feedback None usabilla
Daxing Face Scan
Daxing Airport One ID Facial recognition Device information
User's Login ID, Name, Mobile Number, ID Number
Risk management Used for encrypting data to ensure the security of user data, system data and communication. None Beijing Zhi You Wang An Technology Co. Ltd.
APP building packages Used for fast packaging integration of APP to improve R & D efficiency. None Ali Cloud
CZ APP Used for offline packages to improve users' experience of browsing H5 web pages in the APP Device information
Risk management Used for encrypting data to ensure the security of user data, system data and communication. Device information Ali Cloud
Risk management Used for system risk management. Monitoring and blocking crawlers to ensure system safety and stability and to prevent the crawlers crawling data and damaging the system. Device information Ali Cloud
Apple Pay payment payment Device information Apple
In addition to maintaining the necessary basic functions of CZ APP operation, you will have the right to choose whether to use the above functions voluntarily when using CZ APP. We will continue to use your authorization during your use of CZ APP, and will stop using after you stop using the APP.
V. On what legal basis does CZ process personal information?
Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.
However, we will normally collect personal information from you only (1) where we need the personal information to perform a contract with you; (2) where the processing is in our legitimate interests and not overridden by your rights; (3) where we have your consent to do so. (4) In some cases, we may also have a legal obligation to collect personal information from you (5) We may need your personal information to protect your vital interests or those of another person under certain circumstances.
If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our company and communicating with you as necessary to provide our services to you and for our legitimate commercial interest, including responding to your queries, improving our products and services, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests, and if appropriate, we will make clear to you at the relevant time what those legitimate interests are.
VI. How does CZ protect your personal information?
We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include Secure Socket Layer (SSL) encrypting technology to secure the transmission of your data from your web browser to our internet system.
VII. How does CZ store your personal information?
In order to provide you with the air transport and related services you need (booking, refunding, changing tickets), membership services, CZ's various products, fulfill the agreements with you, comply with applicable legal, tax, financial and accounting requirements and CZ's legitimate business needs, we will encrypt or desensitize the personal information collected from you.
If we do not store your personal information for the above reasons, we will delete or anonymize it. If it can not be deleted immediately or anonymized for objective reasons, we will safely store your personal information and avoid further processing before it can be deleted or anonymized.
VIII. Protection of children’s personal information
CZ attaches great importance to the protection of minors' personal information. If you are a minor under the age of 14 or recognized as a child under the laws of other countries, you should obtain the written consent of your parents or legal guardians before using our products and / or services. CZ protects the personal information of children and minors of other ages in accordance with the relevant laws and regulations of the country.
For the collection of personal information of minors with the consent of their parents or legal guardians, we will only use or disclose this information with the permission of the law, the explicit consent of their parents or guardians or the necessary protection of the minors.
IX. CZ’s transfer of your personal information in the world
Your personal information may be transferred to countries other than the country in which you are resident for processing. These countries may apply different laws related to the protection of personal information (please note that the degree of protection of your personal information may vary under the laws of different countries).
Specifically, our Website servers are located in the People's Republic of China, and our group locations and third party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.
However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group locations, which require all group locations to protect personal information they process in accordance with applicable data protection law.
X. Your rights on personal information protection
You have the following rights to protect personal information:
- ● You can choose to cancel your Southern Airlines's Sky Pearl member account by opening the APP, clicking in turn "I-set-account center-cancel CZ member" on the front page and following the guidelines to complete the cancellation of membership, or call the customer service hotline 95539 to cancel your CZ membership. After you cancel the account, we will stop providing you with the corresponding products and services, and delete or anonymize your personal information. Please note that after cancellation, the unused points and mileage in your personal account will be cleared to zero.
- ● Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
- ● You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your personal information protection regulator. Contact details for data protection authorities in the European Economic Area, Switzerland are available here.
We will respond to the requests for the protection of personal information of the individuals concerned in accordance with the applicable personal information protection laws. For the exercise of above access, correction, deletion, cancellation and other functions on the App, we will complete the above requests within 15 working days in accordance with the relevant regulations.
If you have any questions or concerns about our use of your personal information, please contact us:
Contact information of Southern Airlines personal information protection officer :
Company's registration address: Room 301, 3rd Floor, Phase I Building, Guanhao Science Park, No.12 Yuyan Road, Huangpu District, Guangzhou, Guangdong Province
Other contact address: customer service counter of Southern Airlines, Baiyun Airport, Guangzhou, Guangdong Province
If you have questions other than privacy and personal information protection, please contact the following email address: email@example.com