Last update: November 12, 2024
Kolet's official legal documents are in French and can be accessed [here]. This translation is provided solely for informational purposes.
Kolet attaches particular importance to the protection of your personal data. Kolet is committed to complying with data protection regulations right from the design stage of its services.
The purpose of this privacy policy is to inform you about the processing of your personal data when you access the https://airfrance.shop.kolet.com/ or
https://klm.shop.kolet.com/ or https://flyingblue.shop.kolet.com/ websites (hereinafter the " Site ") to benefit from the exclusive advantages of the partnership between Air France KLM Group and Kolet, and then use the services on the Kolet application (hereinafter the " Application ").
Data Protection Regulations means the regulations in force applicable to the processing of personal data and in particular: (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 applicable since May 25, 2018 known as the "General Data Protection Regulation" or "GDPR"; (ii) the "Informatique et Libertés" law no. 78-17 of January 6, 1978 as amended; (iii) Any legislation coming into force that may affect the processing covered by this Privacy Policy; and (iv) The best practice guide published by the CNIL or by the EDPS.
Personal data is any information relating to an identified or identifiable natural person, whether that person can be identified directly (e.g. name) or indirectly (e.g. identifier). The identification of a natural person may be based on a single piece of data or on the cross-referencing of a set of data.
The processing of personal data is any operation involving personal data, regardless of the process used (e.g. recording, organizing, storing, modifying, reconciling with other data, transmitting, etc.).
The purpose of a processing operation is the main objective for which personal data is used. Data is collected for a specific and legitimate purpose, and is not further processed in a way incompatible with that initial purpose.
The data controller is the natural or legal person who determines the purposes and means of data processing, i.e. the objective and the way in which it is to be achieved. In practice, this is the legal entity represented by its legal representative.
The processor is the natural or legal person who processes data on behalf of another organization (the data controller) as part of a service.
The Data Protection Officer (or DPO) is responsible for informing, advising and monitoring the compliance of the Data Controller in carrying out the processing operations performed. The DPO is the point of contact for data subjects, the CNIL and other DPOs of Subcontractors and/or Joint Processors.
The recipient is the natural or legal person, public authority, department or other organization that receives personal data.
1. Who is responsible for processing your personal data?
The data controller is Kolet, a société par Actions simplifiée (simplified joint stock company) registered in the Paris Trade and Companies Register under number 981 094 261, with registered offices at 6 rue d'Armaille, 75017 PARIS.
When you order a data plan via Kolet, the local telephone operator is responsible for processing the personal data relating to this data plan.
If you have any questions about using the services, you can contact Kolet directly by sending an e-mail to [email protected].
2. What type of personal data does KOLET process?
Kolet processes your personal data solely for the following purposes:
Data collected on the Air France KLM Group - Kolet website
Purposes of processing | Data categories | Legal basis |
Enable you to benefit from the welcome offer and exclusive advantages of the Air France KLM Group - Kolet partnership | We process the following data: - Travel destination and dates of travel - Chosen plan - Email address - Cell phone number - Flying Blue card number - Cell phone type (to check compatibility)
| Execution of Kolet's general terms and conditions of use and sale |
Contact Kolet or request information in our Chatbot | We process the data necessary to respond to your request, i.e. your contact details and the content of your request. | User consent
Execution of pre-contractual measures taken at the User's request
|
Improve the Site, services and experience of our customers
| We process Site browsing and usage data collected through cookies and tracers (date and time of access and use of the Kolet application, IP address, unique identifier when browsing via a smartphone, location (city), device, browser, operating system, system configuration data). | Kolet's legitimate interest in ensuring the proper operation of the site (for strictly necessary technical cookies)
User consent for other cookies not strictly necessary for navigation.
|
Data collected when you use the eSIM service on the Kolet Application
Purposes of processing | Data categories | Legal basis
|
Create and manage your Kolet account
- to create your Kolet account on the Kolet App based on information received via the Air France KLM Group - Kolet website - to send you an e-mail to provide you with your means of authentication on the Kolet App - to enable you to activate your eSIM and order the associated data plans
| We collect your name and contact details (email, telephone) when you create an account.
| Execution of Kolet's general terms and conditions of use and sale |
Continue your orders to provide you with your eSIM and associated plans
- manage invoices and payments - to manage our relationship with you
| We collect your name, billing address and payment card number when you place an order. | Execution of Kolet's general terms and conditions of use and sale |
Customer service management
- to manage requests for contact, information, complaints, or requests for refunds
- to provide you with a support service in the event of technical or logistical problems with the Kolet application, including sharing your cell phone screen (with your consent only where this is necessary to provide you with first-class customer support)
|
We process your contact details and the content of your request
|
Execution of Kolet's general terms and conditions of use and sale |
Direct marketing communications
- to send you communications about Kolet activities and related services that may be of interest to you - to send you our newsletter
| We process your contact information (email address) | Kolet's legitimate interest in developing its commercial activities with existing customers
User consent where required |
Improve the App, its services and the experience of our customers
- evaluate and improve Kolet App and its services - implement and maintain the Application - facilitate your access to and use of the Application - take measures to protect the security of the Application
| We process data on browsing and use of the Kolet Application and Services collected through cookies and tracers (date and time of access and use of the Kolet application, IP address, unique identifier when browsing via a smartphone, location (city), device, browser, operating system, system configuration data).
| Kolet's legitimate interest in ensuring the proper functioning of the Application and services (for strictly necessary technical cookies)
The User's consent for other cookies not strictly necessary for navigation.
|
Evaluate customer satisfaction
Manage pre-litigation or litigation Compliance with legal and regulatory obligations |
|
|
Pre-litigation or litigation management - take action against any identified breach of Kolet or Site terms of use - manage any dispute or litigation
| Customer identification data and, where applicable, the nature of complaints | Kolet's legitimate interest in defending its rights and interests |
Compliance with legal and regulatory obligations - comply with applicable legal and regulatory obligations - manage your requests when you exercise your rights
| The customer's identification data and the content of the request to exercise rights, where applicable | Compliance with Kolet's legal and regulatory obligations |
Where the legal basis is the pursuit of a legitimate interest, the data subject may obtain further information on the balancing of interests on request.
Details of data categories are not exhaustive and are intended to inform the data subject of the types of personal data that may be collected by Kolet.
The provision of certain types of personal data may be necessary or optional, depending on the services you wish to access. The optional or mandatory nature of personal data collection is specified at the time of collection. If you refuse to provide mandatory data, Kolet may not be able to process your request (e.g. eSIM activation request, order request, customer service request).
You may also decide to order an eSIM and associated plans for third parties on the Kolet Application. In this case, you will ensure that you communicate this data to Kolet in accordance with the applicable regulations on the protection of personal data, in particular by informing third parties of the processing of their personal data by Kolet.
3. Who can access your personal data?
Your personal data may be passed on to the following recipients when you access and use Kolet App and its services:
Recipient categories
| Objectives |
Kolet and its duly authorized employees | For the administrative, operational, and commercial management of the Site, Application, and services, as indicated in Section 3 of this privacy policy. |
AIR France KLM Group, as a Kolet partner
| Ensuring the proper execution of the partnership |
Local telephone operators | To provide you with the plans ordered on Kolet App and linked to your eSIM. |
Kolet's service providers (host, payment service provider, IT service provider, etc.) | For operational and technical purposes related to Kolet App and its services |
Where applicable, the relevant courts, supervisory authorities, police or gendarmerie authorities, mediators, auditors, chartered accountants, court-appointed auditors, lawyers, debt collection agencies. | Exclusively in case of an express and justified request on their part or in case of suspected violations of legal or regulatory provisions |
Other third parties | During or following a restructuring, reorganization, acquisition, debt financing, merger, asset sale, or similar operation, including insolvency, bankruptcy, or receivership, when personal data is transferred to one or more third parties |
4. Will your personal data be transferred outside the European Union/European Economic Area?
Wherever possible, your personal data is processed within the European Union (EU) or the European Economic Area (EEA).
However, your personal data may be transferred to third countries due to the global nature of the services provided on the Application, in particular when you order a local plan provided by a telephone operator located outside the EU/EEA. In addition, Kolet uses service providers that may also be located outside the EU/EEA.
If the third country does not ensure a level of protection of personal data equivalent to that of the EU/EEA, Kolet ensures that the transfer of personal data is covered by appropriate safeguards (e.g. standard contractual clauses, transfer impact assessments, etc.). A copy of these safeguards can be obtained by sending an e-mail directly to Kolet at [email protected].
Recipient Name
| Third country | Guarantees |
Stripe, Inc. | United States | Stripe Inc.'s adherence to the Data Privacy Framework Program (EU-US) |
Intercom | United States | Intercom Inc.'s adherence to the Data Privacy Framework Program (EU-US) |
Google Cloud Platform | United States | Google LLC's adherence to the Data Privacy Framework Program (EU-US) |
Posthog | United States | Posthog's adherence to the Data Privacy Framework Program (EU-US) |
Slack | United States | Salesforce's (Slack's publisher) adherence to the Data Privacy Framework Program (EU-US) |
Sentry | United States | Sentry.io's adherence to the Data Privacy Framework Program (EU-US) |
5. How does KOLET protect your personal data?
Kolet has put in place appropriate technical and organizational measures to protect your personal data, in particular against potential breaches of personal data that could lead to the accidental or unlawful destruction, loss, modification, unauthorized access or disclosure of your personal data. These measures guarantee a level of security appropriate to the data and take into account the state of the art and the cost of implementation in relation to the risks and the nature of the data to be protected.
To this end, Kolet :
- implements state-of-the-art physical, organizational and technical security measures to protect the personal data held by us and our service providers. However, we cannot and do not guarantee the absolute protection and security of personal data stored by Kolet or by third parties.
- ensures the storage of an encrypted database, inaccessible from the Internet. We use PostgreSQL, Google Cloud Infrastructure, Google Infrastructure Security Design and Google Cloud Platform.
- Protects access to personal data with specific user IDs, passwords and rights.
- Protect our premises with appropriate security measures.
If you discover a vulnerability or wish to report a security incident, please send an e-mail to [email protected].
6. How long will your personal data be kept?
As a general rule, your personal data will only be kept for as long as is necessary to achieve the purposes for which it was collected, or to meet legal or regulatory obligations.
In the absence of applicable exceptions :
- data relating to your Kolet account (including data relating to your orders) will be kept until your Kolet account is deleted at your request or in the event of inactivity of your Kolet account for two (2) years; and
- data relating to your customer support request will be retained until your request has been fully processed.
Beyond these retention periods, Kolet will store your personal data in an archived database for :
- three (3) years for data processed for direct marketing purposes ;
- five (5) years for data processed for evidential purposes; and
- ten (10) years for data processed for accounting purposes.
Concerning cookies and other tracking technologies used on Kolet App:
- Information collected through these cookies and other tracking technologies will be retained for a maximum period of twenty-five (25) years; and
- The lifetime of these cookies and other tracking technologies is a maximum of thirteen (13) months.
Requests for the exercise of rights are kept for the time required to process the request, and are then stored in intermediate archives for the duration of the applicable criminal statute of limitations, i.e. 6 years.
Your rights | Scope of your rights |
Right of access
(Article 15 of the GDPR) | You have the right to request confirmation of whether or not Kolet processes your personal data, a copy of this personal data, and information about how Kolet uses your personal data in a clear, transparent, and understandable manner (as provided in this privacy policy). |
Right to rectification
(Article 16 of the GDPR) | You have the right to request the rectification of your personal data to update or correct your personal data if it is outdated, inaccurate, or incomplete. |
Right to erasure (right to be forgotten)
(Article 17 of the GDPR) | You have the right to request the deletion of your personal data (or right to be forgotten) when one of the following conditions applies: you object to the processing of your personal data, and there are no compelling legitimate grounds for the processing to continue; you object to marketing activities; you withdraw your consent on which the processing is based; your personal data is no longer necessary for the purposes for which it was collected; or the use of your data does not comply with applicable legal or regulatory provisions. |
Right to restrict processing
(Article 18 of the GDPR) | You have the right to request the restriction of processing for a limited period, particularly to conduct certain verifications, when one of the following conditions applies: you dispute the accuracy of your personal data; the processing is unlawful, but you prefer to restrict its use instead of deletion; Kolet no longer needs your personal data for processing, but you need it for legal claims; or you have objected to the processing, pending verification of whether Kolet's legitimate grounds override your interests, rights, and freedoms. |
Right to data portability
(Article 20 of the GDPR) | You have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format and may also request its transfer to another data controller where technically feasible. This right applies only if all conditions are met, including that the request concerns only your personal data, it does not infringe others' rights, processing is automated, and it is based on consent or contract performance. |
Right to object
(Article 21 of the GDPR) | You have the right to object at any time to the processing of your personal data if it is based on legitimate interests. Kolet will stop processing your data unless it demonstrates compelling legitimate grounds overriding your rights or for legal claims. |
Right to withdraw consent
(Article 13-2 of the GDPR) | You have the right to withdraw your consent where it has been obtained, without affecting the lawfulness of data processing carried out before withdrawal. |
Right to determine the fate of data after death
(For French residents - Article 85 of the Data Protection Act) | You have the option to define instructions regarding the retention, deletion, and communication of your personal data after your death and to designate a third party to receive it. In the absence of instructions, your data will be destroyed unless required for legal obligations or evidentiary purposes. |
7. What rights do you have regarding your personal data?
If you are based in the EU/EEA, you have the following rights to your personal data:
Depending on your country of residence, you may have additional local rights regarding the processing of your personal data. For example, if you are established in France, you may define general or specific instructions concerning your personal data in the event of your death (for example, their deletion or transmission to any person of your choice). You may revoke your instructions at any time.
In certain circumstances, Kolet may ask you for specific information in order to confirm your identity and ensure the exercise of your rights. This is another appropriate security measure to ensure that personal data is not disclosed to anyone who is not entitled to receive it.
If you have any questions or if you wish to exercise your rights, you can contact Kolet directly by sending an e-mail to [email protected] or by post to : DPO Kolet -6 rue d'Armaille, 75017 PARIS
If necessary, you may also file a complaint with your national data protection authority. This right may be exercised at any time and free of charge, excluding any postal charges or expenses related to legal representation or assistance if you choose to use the assistance of a third party for the procedure.
8. Modifications to this policy
When browsing the Site or Application, the user may click on the icons dedicated to the following social networks: Instagram, Linkedin, Facebook, Tiktok. By clicking on them, users will be redirected to third-party websites (or applications).
Social networks enhance the user-friendliness of the Site and Application and help to promote it through sharing. When the User uses buttons to share publications on social networks, Kolet may have access to personal information that the User has indicated as public.
In order to limit access by third parties to personal information on social networks, users are advised to configure their profiles and publications via the dedicated spaces in order to limit the audience. On each social network, users will be subject to the privacy settings they have defined, as well as to the privacy policy of each social network.
9. Changes to this policy
This policy is clearly dated and may be modified and updated by Kolet at any time, particularly in the event of changes related to the services available on Kolet App or to applicable law. We therefore recommend that you consult this policy each time you access Kolet App. Any updated policy will be communicated to you by any appropriate means.