Privacy Policy
We respect your privacy and protect your personal data in line with GDPR and Cyprus law. This notice explains what we collect, why, how we use it, who we share it with, how long we keep it, and your rights.
Quick navigation
Who we are & contacts
Controller: Charlie Airlines Ltd, operating as Cyprus Airways. A Data Protection Officer (DPO) oversees compliance.
| Email (DPO) | dpo@cyprusairways.com |
| Address | 28 Eleftherias Street, Aradippou, 7101, Cyprus |
| Telephone | +357 24 020 980 |
Policy changes & third-party links
- We review this policy regularly; keep your personal data up to date with us.
- Our website contains third-party links (e.g., Rentalcars.com, Booking.com, ParkCloud, Atlantic). Their policies apply on their sites.
Data we collect
View categories
- Identity: name, date of birth, ID number.
- Contact: email, phone.
- Transaction: payments for tickets and ancillaries.
- Marketing: newsletter/marketing preferences.
- Recruitment: CV details for job applications.
- Special assistance: only what’s necessary for PRM services.
- Cookies: preferences and analytics.
How your data is collected
| Source | Examples |
|---|---|
| Direct interactions | Buying tickets/ancillaries, newsletter signup, marketing opt-in, job applications. |
| Automated tools | Cookies/analytics for preferences and improved experience. |
Purposes & lawful basis
View purposes
- Issuing tickets and ancillaries; processing payments; notifying service updates.
- Sending newsletters and marketing (only if subscribed).
- Compliance with aviation/border control requirements.
- Recruitment processing for vacancies.
Disclosure & international transfers
- We share necessary booking data with partners providing travel services.
- All partners operate under GDPR-level agreements.
- Transfers outside the EEA use SCCs or adequacy mechanisms.
- Payment processing follows PCI DSS requirements.
- Border control data is shared where legally required.
Data security
We apply appropriate measures to prevent unauthorized access, loss, alteration, or disclosure. Access is limited to staff and partners who must use the data to perform services.
Data retention
- We retain data only for necessary operational or legal periods.
- Call Centre recordings: 30 days.
- Legal/regulatory retention periods override other timelines.
Your rights & complaints
View your rights
- Access/Rectification – request your data or corrections.
- Objection – object to processing where allowed.
- Marketing – unsubscribe anytime.
- Contact DPO: dpo@cyprusairways.com
If unresolved, you may complain to the Cyprus Commissioner for Personal Data Protection.
Human Resources (careers)
Recruitment data
- Only used for recruitment and HR assessment.
- General applications retained for limited periods.
- Contact hr@cyprusairways.com for updates.
This summary reflects current practices. If discrepancies exist, the full Privacy Policy prevails.