Información legal
Privacy policy
Este documento está redactado en inglés, que es su idioma de referencia.
Información legal
Este documento está redactado en inglés, que es su idioma de referencia.
How BEBEW AGENCY LLC handles the personal data of Mileo clients, travelers and partners: what we collect, why, who receives it, how long we keep it, and the rights you have.
The controller of your personal data is BEBEW AGENCY LLC, which runs the Mileo website and concierge service.
This policy covers the www.flymileo.com website, member accounts, bookings and the concierge service, the affiliate and reseller programs, and the hotels waitlist.
We offer our services to people in the European Union and the United Kingdom. The processing of their personal data is therefore subject to the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and to the UK GDPR (GDPR art. 3(2)). Article numbers in this policy refer to the GDPR; the UK GDPR uses the same numbers.
Wherever you live, we handle your data as this policy describes.
| Purpose | Legal basis |
|---|---|
| Managing your member account | Contract (art. 6(1)(b)) |
| Booking and issuing your tickets, and sending your details to the airlines and to our ticketing providers | Contract (art. 6(1)(b)), including the passenger data that airlines and border authorities require for travel |
| Special assistance and special meals | Your explicit consent (art. 9(2)(a)) |
| Payment and fraud prevention | Contract (art. 6(1)(b)); our legitimate interest in preventing fraud (art. 6(1)(f)); accounting obligations (art. 6(1)(c)) |
| Accounting and invoicing | Legal obligations (art. 6(1)(c)) and our legitimate interest in meeting the accounting and tax rules that apply to us (art. 6(1)(f)) |
| Proving our contracts and the fares we compared | Our legitimate interest in being able to prove what was agreed and how our prices were compared (art. 6(1)(f)) |
| Answering your messages | Contract when your message is about a booking (art. 6(1)(b)); otherwise our legitimate interest in answering you (art. 6(1)(f)) |
| Hotels waitlist | Your consent (art. 6(1)(a)) |
| Offers and news by e-mail | Your consent (art. 6(1)(a)), given with a box that is not pre-checked and withdrawable at any time |
| Crediting your sign-up to the affiliate who invited you | Our legitimate interest when you type an invitation code yourself (art. 6(1)(f)); your consent for the invitation cookie (art. 6(1)(a)) |
| Managing affiliates and resellers | Contract (art. 6(1)(b)); tax obligations (art. 6(1)(c)) |
| Keeping accounts and the site secure (sessions, two-step verification, security logs) | Our legitimate interest in protecting your account and your data (art. 6(1)(f)) |
The information marked as required in our forms is needed to book: without it, we cannot issue your tickets. Everything else is optional.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Our payment providers run automated fraud checks on each payment; if a payment is declined, your concierge can look into it with you.
When you book for other people, you give us their data. You confirm that you are allowed to do so and that you will tell them about this policy. A reseller who books for its clients gives us their data in the same way. Data about a minor is processed only for a booking made by an adult.
We share your data only with those who need it for the purposes above:
Affiliates receive no data about the people they invite, only statistics.
Our web host and technical providers process the data on our behalf, only to provide their service to us. Airlines, airports and payment providers use the data they receive as independent controllers, under their own privacy policies.
We do not sell your personal data.
BEBEW AGENCY LLC and our web host are in the United States: your data is processed in the United States, including when you live in the European Union or the United Kingdom.
When personal data is transferred from the European Economic Area or the United Kingdom to a country that is not recognized as offering an adequate level of protection, the transfer relies, where applicable, on the standard contractual clauses adopted by the European Commission (with the UK addendum for data from the United Kingdom), or on the EU-US Data Privacy Framework and its UK extension where the recipient is certified under it. You can ask us by e-mail for information about these safeguards.
A booking with an airline based outside the European Union or the United Kingdom requires sending it the data needed for the trip: that transfer is necessary for the performance of your contract (GDPR art. 49(1)(b)).
| Data | How long |
|---|---|
| Member account | As long as the account is active; deleted after 2 years without signing in, after a reminder e-mail sent at least 30 days before |
| Bookings | Until the end of the trip and of any possible claims; the record of the contract is then kept for 10 years, without passport numbers |
| Passport numbers and passport photos | Until the trip, then 90 days, unless you save them in your profile; photos added to a quote that was never paid are deleted 24 hours after it lapses |
| Special assistance and special meals | Deleted after the trip |
| Messages | 3 years after the last contact |
| Hotels waitlist | 12 months after you join at the latest |
| Copies of the e-mails we send | Content deleted 3 years after sending |
| Records of acceptance and consent | As long as the contract or the consent they prove |
| Accounting records | 10 years |
| Security logs, and the IP address and browser of signed-in devices | 12 months |
Passport numbers, passport photos and payout details are encrypted. Each team member has individual access, limited to what their role needs, protected by two-step verification and logged. No personal data appears in the addresses of our pages. We never store card data.
You can protect your own account with two-step verification, using an authenticator app.
If you are in the European Union or the United Kingdom, you have the right to:
To use these rights, write to contact@example.com. You can also ask for your account to be deleted from your account page. We answer within one month; for a complex request this can be extended by two more months, and we tell you if it is. We may ask you to confirm your identity.
You can also lodge a complaint with the data protection authority of the EU country where you live (list of EU data protection authorities (nueva pestaña)) or, in the United Kingdom, with the Information Commissioner’s Office (ico.org.uk (nueva pestaña)).
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use sensitive information, such as passport numbers, only to provide the service you asked for.
If you live in a US state with a consumer privacy law, you can ask us to access, delete or correct your personal information by writing to contact@example.com. We will not treat you differently for using these rights. If we decline your request, you can ask us to reconsider it by replying to our answer.
We send you offers by e-mail only if you agreed to receive them. Every such e-mail has an unsubscribe link, and you can change this choice in your profile at any time.
Member accounts are for adults (18 or over). A child can travel on a booking made by an adult, who gives us the child’s details needed for the trip. We do not knowingly collect personal data directly from children.
We may update this policy. The date of the version in force is shown at the top of this page.