1. Introduction

This Privacy Policy applies to Bluebox Aviation Systems Ltd’s (Bluebox) collection of Data on behalf of Bluebox or its customers, collected via the Blueview system. “Personal Data” is information relating to an identified or identifiable person. “Device Data” and “Usage Data” are types of data that we automatically collect from the device (phone, tablet, etc.) used to access the Blueview system. Your Personal Data will only be used in accordance with this privacy policy, and in compliance with the European Union General Data Protection Regulation (GDPR) which came into effect 25 May 2018. This Privacy Policy addresses how we collect and process this Data.

Review this privacy notice carefully. Your data will be collected and processed as described in this Privacy Policy.

If you do not agree with any part of this privacy policy or terms of service, do not use the Bluebox Entertainment system.

 2. Changes to privacy policy

We will review this Privacy Policy on a regular basis depending on changes we make to our services and changes in technologies and laws. This Privacy Policy came into effect on 25th May 2018 and was last updated on 24th November 2023.

 3. Categories of personal data processed by Bluebox

Bluebox will collect data required to complete payment for items you order and will pass this data to our payment processing partner to process these transactions.

Bluebox will collect data required to fulfil orders you place using the system and will pass this data to the Airline to process the orders.

Bluebox will collect data for the purposes of providing additional services and membership benefits from the Airline and selected partners.

Bluebox will, with your consent, collect data for the purposes of marketing by the Airline and selected partners.

The Personal Data collected may include:

• Payment details: your name, credit or debit card number, expiry date and CVV number required to complete a payment
• Some services provided via the system will require you to enter some or all of; your name, email, telephone number and address details.

Usage Data collected may include:

• Session App ID
• Device data, including MAC address, type of device and operating system version
• Usage data, including type(s) of content used, duration, and content playback statistics
• Items ordered from the online retail system
• Flight Information

Usage data is not associated with personal information provided for payment, order fulfilment, and additional service provision.

 4. How we collect information

We collect information from you when you:

• Complete a survey: We collect the information you submit in survey responses about your consumer experiences and preferences. The completion of a survey is entirely voluntary and you will be asked for consent if the survey requests any personally identifiable information.
• Enrol for the Airline frequent flyer programme: We collect the personal information you submit the enrolment form, which will include your name, gender, date of birth, address, telephone number, email address. The enrolment is entirely voluntary and by completing the enrolment you will give consent for the use of your personal data to enrol you in the frequent flyer programme and to contact you regarding the frequent flyer programme.
• Make a purchase: If you make a purchase, you may be asked to provide credit or debit card information, and some or all of : name, email address, telephone and home address. To complete a transaction, you may be forwarded to our secure payment processing portal hosted by a third-party payment processor. Please consult the privacy policy on our payment processor’s website regarding the use, storage and protection of your credit or debit card information.
• Make an order using the online system: If you place an order you will be asked to provide your name, seat number and email address. This is to allow the crew to deliver your order to you, and so that you can receive a receipt by email. By placing the order, you will give consent for your data to be used in this way.
• Using the Blueview system: We automatically collect Usage Data when you interact with the Blueview system. This Usage Data includes content playback statistics which we collect in order to improve and enhance the customer experience. During the interaction with the Blueview system we also collect device data such as device type and Operating System version. This device data is used only for analysis purposes and may be shared with the Airline. The device data contains no Personally identifiable Information.

 5. Legal grounds for collecting and processing

Whenever we process your personal information we must have something called a “legal basis”. The legal bases we use are:

• Consent: You have told us you are happy for us to process your personal information for a specific purpose
• Contract: we require your personal data to fulfil our contractual obligations in order to provide you with our services

 6. Your rights and choices concerning Personal Data processing

 6.1 The right to be informed

At the time of collecting personal data we will inform the individual what we plan to do with their data, where that data will be processed and the details of their rights under the GDPR.

 6.2 The right to access

Individuals have the right to request any personal data held by Bluebox either verbally or in writing and if they do so are entitled to obtain the following:

• The personal data in question
• The purpose of the processing
• The categories of data
• The identities of all other parties we have already, or will in future, share that data with
• How long we plan to hold their data, or the criteria by which we determine that period
• The existence of any automated decision making, including profiling, a meaningful explanation of the criteria used to make those decisions and the consequences of those automated decisions on the individual

 6.3 The right to rectification

Individuals have the right to have inaccurate personal data rectified. An individual may also be able to have incomplete personal data completed. We will comply with any request to rectify incorrect information within one month of receipt. However, this can be extended to 2 months where the request is complex.

We will also inform Bluebox’s customer of the corrections required.

 6.4 The right to erasure/be forgotten

Individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in the following circumstances:

• The data subject withdraws their consent or objects to the processing and there is no overriding legitimate interest to continue processing
• The personal data is no longer necessary in relation to the purpose for which it was collected/processed
• The personal data was unlawfully processed or must be erased in order to comply with a legal obligation
• The personal data is processed in relation to the offer of information society services to a child.

 6.5 The right to restrict processing

Individuals have the right to request the restriction or suppression of their personal data. Bluebox may still store personal data but will not make use of it. Data processing restriction requests will be responded to within one month.

Individuals may request to restrict the processing when processing it is unlawful, when they have contested its accuracy, when they have objected to the processing and we are considering whether we have legitimate ground which overrides this or when we no longer need the data, but the data subject requires it to establish, exercise or defend a legal claim.

 6.6 The right to data portability

Bluebox will provide an individual with their personal data in a manner that allows them to easily take that data elsewhere. That data will be in a machine-readable format, ie. spreadsheet or export file (.CSV, .TXT, etc). Data portability requests will be processed within one month. This can be extended to 2 months where the request is complex.

The right to data portability only applies to personal data you have provided to Bluebox, where the processing is based on consent or the performance of a contract and where processing is carried on by automated means.

 6.7 The right to object

Individuals have the absolute right to object to the processing of their personal data if it is for direct marketing purposes (including profiling). Bluebox will inform data subjects of their right to object and where the data subject objects to direct marketing we will cease immediately. There are no exemptions or grounds to refuse.

When a data subject objects to processing their personal data in other ways than direct marketing then Bluebox will comply with this request unless we have overriding compelling legitimate grounds to continue processing or that the processing is for the establishment, exercise or defence of legal claims.

 6.8 Rights in relation to automated decision making and profiling

If Bluebox makes decisions about individuals based on automated profiling, we will provide a mechanism whereby the individual can obtain human intervention. This means processes that use profiling must also allow for a manual override.

The above right does not apply if the automated decision:

• is necessary for entering into or performance of a contract between Bluebox and the individual;
• is authorised by law (e.g. for the purposes of fraud or tax evasion prevention);
• is based on explicit consent; or
• does not have a legal or similarly significant effect on the data subject.

 7. Cookies Policy

 7.1 What are Cookies

Cookies are small data files that websites send to or access on your computer, laptop or mobile device. They contain information about your device such as user settings, device information and usage history.

7.2 How we use Cookies

We use Cookies for the following purposes:

• Store play events on your device to allow a more seamless playback experience.
• Record device visit and session cookies to streamline the user experience
• To record previously watched content events
• To record survey entry events

 7.3 Controlling or restricting Cookies

You can control Cookies through your internet browser settings, either by blocking all or some Cookies. There may also be settings which alert you whenever a cookie is placed on your device. You may also be able to reject mobile device identifiers via settings on your mobile device. Although you are not required to accept Bluebox Entertainment Cookies blocking them may detrimentally affect the user experience

 8. Retention and disposal of Personal Data

Bluebox will securely store your Personal Data for the purposes of payment reconciliation, dispute resolution, and refund processing, for a period of twelve months.

 9. Security

Data security is of upmost importance to Bluebox. We have a rigid set of information security managements systems policies and procedures which are continuously reviewed and improved. These policies and procedures help us to safeguard against theft and other threats to the confidentiality and integrity of your data.

If you have reason to believe that the Blueview system’s security has been compromised, please contact privacy@blueboxaviation.com

 10. Children’s Privacy

Our service is not intended for unsupervised use by children under sixteen and we do not intentionally collect personally identifiable information from children under the age of sixteen. If you are under the age of sixteen, you must ask your parent or guardian for permission to use the Blueview system. If we learn that we have collected personal information of a child under sixteen, we will take the appropriate steps to delete such information from our files as soon as possible. If you learn that a child has provided us with personal information in violation of this Privacy Policy, you can alert us at privacy@blueboxaviation.com

 11. Cross-border transfers of personal data

Bluebox Aviation Systems Ltd is based and primarily operates out of the United Kingdom and as such we must comply with the EU’s GDPR legislation. Please note that we may transfer your data to a Bluebox customer who may be based in a country which does not have such a comprehensive set of data protection laws. We will pass your personal information to our third party payment processors in connection with goods and services that you have bought through us. When we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law.

12. Contact Us

If you have any questions about privacy when using the Blueview system, please contact us by one of the following means:

By email: privacy@blueboxaviation.com

By post:
Attn: Data Protection Team
Bluebox Aviation Systems Ltd
Estantia House
Pitreavie Drive
Dunfermline
UK
KY11 8US