Privacy Notice
Last update: July 2026
(Effective 20 July 2026)
As a data controller, the International Air Transport Association (“IATA” or "we"), an association incorporated by a Special Act of the Parliament of Canada with registered headquarters at SS135-800 rue du Square Victoria, Montreal, H3C 0B4, Quebec, Canada, is fully committed to protecting the privacy rights of individuals who provide us with personal data about themselves and to ensuring compliance with applicable data protection and privacy laws notably the Canada Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Quebec Act Respecting the Protection of Personal Information in the private sector, the Swiss Federal Act of Data Protection (“FADP”), the China Personal Information Protection Law (“PIPL”) and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU General Data Protection Regulation” or “EU GDPR”).
Your privacy is important to us and we take the necessary measures to ensure that your personal data, (i.e. any information relating to an identified or identifiable natural person) collected, processed and used in connection with your participation in IATA activities shall be protected from unauthorized access, misuse, loss and destruction.
We have created this Privacy Notice to explain how and why specific categories of personal data are collected as part of the IATAN Agency Accreditation process. In the context of the IATAN Agency Accreditation programme, personal data is typically provided to IATA by the accredited travel agency with whom you are affiliated. This Privacy Notice also provides an overview of the appropriate protection measures taken to safeguard your personal data.
What is the purpose and scope of this Privacy Notice?
This Privacy Notice applies to all personal data collected, processed and used by IATA as part of the IATAN Agency Accreditation program until your personal data is deleted or anonymized by IATA. It does not apply to other appointments or any other activity you might have with IATA or any of its affiliates. In such cases, other privacy notices might apply.
The content of this Privacy Notice may also be subject to any additional conditions or disclaimers or other contractual terms that you have entered into with IATA as an IATAN Accredited Agency as well as any applicable and binding laws and regulations.
What information do we collect from you?
| data | used for accreditation | used for id card | used for IATA vendor operations | used for iata gdp ( global data product) |
|---|---|---|---|---|
| First Name | Y | Y | Y | Y |
| Initial | Y | Y | ||
| Last Name | Y | Y | Y | Y |
| Email Address | Y | Y | Y | |
| Date of Birth | Y | |||
| Phone Number | Y | Y | ||
| Photo | Y | Y | ||
| Gender | Y | |||
| Earnings | Y | Y | ||
| Position at the Agency | Y | Y | Y | |
| Duties at the Agency | Y | Y | ||
| Weekly Hours of Work | Y | Y | ||
| Start Year at the Industry | Y | Y | ||
| Start Year at the Agency | Y | |||
| Last 4-Digit of the Social Security Number | Y |
Why do we use your data?
- Administering IATAN accreditation
- Verifying eligibility and compliance with accreditation requirements
- Issuing and managing IATAN/IATA ID Cards
- Providing industry verification services, including the disclosure of limited identification information through IATA’s CheckACode / Global Data Product (GDP) service for accreditation status verification
- Sending informational, marketing and commercial communications relating to IATAN’s and or IATA’s own products, services, events and industry initiatives, in a professional context. Such communications are subject to applicable communication preferences and opt-out mechanisms made available by IATA/IATA.
You may manage your communication preferences or opt out of marketing communications at any time using the unsubscribe mechanisms included in such communications.
Retention
We store your personal data for as long as we need it to achieve the above purposes. To the extent permissible by applicable laws and regulations, as soon as we no longer need your personal data for such purposes, we will delete the personal data from our systems.
Who do we share your personal data with?
For the purposes set out above, IATA may share your personal data with IATA affiliates, IATA representatives and IATA third-party service providers, within and outside of your country of residence for certification administration and Registry management purposes only. Our affiliates (list available on request), representatives and third parties who have access to the personal data collected, processed and used are obliged to observe data protection regulations.
We may also share your personal data with government agencies and institutions, regulators, etc. in accordance with the applicable laws, regulations, a court order or an official request, or in accordance with and for the purposes of official (regulatory) policies or similar procedures as required or permitted by applicable law.
Personal data may be transferred to IATA affiliates located in countries outside your country of residence, whose laws may offer a lower level of data protection. IATA will then implement appropriate data protection measures so as to ensure an appropriate and adequate level of protection, as set forth in applicable data protection and privacy laws and regulations.
How do we handle electronic messages sent to and from IATA?
All electronic messages sent to and from IATA are protected by appropriate technical and organizational measures within our systems, and may be accessed by individuals not directly involved in the communication, only in specific, justified cases according to the applicable laws and regulations (e.g. a court ruling, suspected criminal behavior, breach of supervisory obligations); they are only accessed by certain individuals in defined functions (e.g. legal, compliance, risk). Each part of the procedure and the search criteria used are logged.
How can you exercise your rights as a user?
Where permitted by law, you have the right to:
- Request information about your personal data that IATA processes, including information such as the source and categories of data, reasons for processing, recipients (or categories of recipients) and the retention period;
- Request to update or correct your personal data held by IATA if such data is inaccurate;
- Request that your personal data be deleted from our systems, once it is no longer required for the above-mentioned purposes.
You may have other data subject rights subject to applicable data protection and privacy laws and regulations.
Please contact us via the IATA Customer Portal at https://portal.iata.org if you have any questions or comments regarding this Privacy Notice or to exercise your aforementioned rights.