Privacy Notice

AIR INDIA PRIVACY NOTICE

Air India Limited values your privacy and are committed to protecting your Personal Data. This privacy notice (“Privacy Notice") applies to all the Personal Data that we collect and that you provide when you visit our websites, use our mobile applications, or access any services we offer, including our carriage services.

This Privacy Notice is issued on behalf of Air India Limited, hereinafter referred to as “Air India”, “we”, “us”, or “our”. Air India acts as the Controller or Data Fiduciary and is responsible for the processing of the Personal Data in connection with this website and to provide you with our services, as outlined in this Privacy Notice.

If you have any questions or comments, please contact our Data Protection Officer as per the details available in Section XV of this Privacy Notice.

I. Terms used in this Privacy Notice

In this Privacy Notice, the following terms shall have the meanings as ascribed to them below:

Controller / Data Fiduciary means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing Personal Data.
Personal Data means any information about an individual that can be used to identify them – for instance, name, contact information, government-issued identification number, etc.
Process or processing means any operation(s) performed on Personal Data, including collection, recording, structuring, storage, use, sharing, disclosure, dissemination, restriction, erasure or destruction.

II. The Types of Personal Data We Collect and Process

As per Air India’s business practices, we currently collect and process Personal Data, which includes:

General Personal Data: We collect your Personal Data when you book a travel with us or when you create your Registered Customer or Maharaja Club account with us. This information includes your title, full name, phone number, gender, email ID, date of birth, address, and nationality. We also collect information about your emergency contact person, such as their name and phone number.
Travel information: To facilitate your bookings with us, we process your flight details, such as your passenger name record (PNR), ticket number, baggage tags and other details, booking ID, any interactions with our staff during your journey, etc.
Financial information: This information includes payment data, transactional data, masked credit/debit card information, name of cardholder and expiry date of the card, bank account number, GSTIN, etc.
Identification document/information: We may collect advance passenger information such as visa details, OCI Card details, passport details, your Known Traveler Number (KTN), or other identity card details, including your government issued identification document number, the country it was issued in and the expiry date (if applicable).
Health information: To ensure safety of all our passengers and to tailor our services to your needs, we may collect limited health information, including information about your allergies, vaccination certificates, medical conditions, disabilities, and any health related documents that you provide us.
Information related to children: We only process the Personal Data of minors with the prior consent of their parents or legal guardians. For instance, we may process your infant child’s information while providing bassinet services, or process information on student ID cards issued by colleges/universities for fare assessment.
Location and device information: This information includes your device location (where you have permitted access to such location), operating system, IP address, MAC ID, browser information, etc.
Maharaja Club account: To manage your accounts, we may process you Maharaja Club account number, tier level, points and miles data, your preferences, health notes, address information etc.
Details pertaining to the services booked with us: During our interactions and to facilitate the services you have booked with us, we may gain insight into some Personal Data, such as your mode of booking, onward travel details, meal preferences, travel preferences, check in date and time, seat upgrades, excess baggage, Wi-Fi usage, etc.
Queries and feedback: This includes the data you choose to share with us by means of interacting with our social media pages or our chatbot, or by completing a flight satisfaction survey.
Recruitment data: In case you apply to any of our job openings, we shall process your Personal Data to assess if you are suitable for the position. In such scenarios, we shall collect your educational qualifications, professional history, contact details, etc.

Subject to applicable laws, we may monitor or record our phone conversations for training and customer service purposes, to comply with relevant legal obligations, and to make and defend claims. If you visit any of our reservations and ticketing offices or an Air India lounge, you may be monitored by closed-circuit television for security purposes.

We also collect, use, and share aggregated data such as statistical or demographic data for various purposes. Aggregated data may be derived from your Personal Data; however, it is not considered Personal Data under applicable law, as such information does not, whether directly or indirectly, reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website, mobile application, or service feature. However, if we combine or link aggregated data with your Personal Data in a manner that it can directly or indirectly identify you, we treat the resulting combined data as Personal Data and process it in accordance with this Privacy Notice.

In case you share Personal Data with us which relates to another person provisioning a service from us, you are responsible for ensuring the person knows and has consented to us collecting and processing their Personal Data in accordance with the provision of this Privacy Notice.

III. How we Collect/Receive Personal Data and the Use of such Personal Data

We use different methods to collect Personal Data about you, including through:

A. Direct Interactions: You may give us your Personal Data by filling out forms or by corresponding with us via phone, email, our website, through live chat, or through other communication channels. This includes Personal Data you provide when you:

Apply for or use our products or services.
Interact with ticketing offices, check-in or boarding counters, or use our in-flight entertainment system.
Create a loyalty account on our website or app.
Use our live chat option “Ask AI.g”.
Subscribe to our services or publications.
Request marketing communications to be sent to you.
Enter a competition, promotion, or survey.
Give us feedback or contact us.
Apply for job openings available at Air India.

B. Indirect Interactions: We may receive your Personal Data from third parties such as:

Travel agents or third-party websites used to make bookings with us.
Airport kiosks.
Payment service providers
Partner airlines and cooperation partners (such as Star Alliance network).
Our Maharaja Club partners, such as when you share your details with our partners to create your Maharaja Club account or when you request to convert your points.
Our affiliates, to provide you with services, or in case of merger or amalgamation.
Referees and recruitment agencies in case you have applied for any job openings with us.
Other passengers or individuals acting on your behalf, such as when they make you their emergency contact, or make a booking for you, manage your travel arrangements, or share your Personal Data with us to facilitate specific requests or benefits, including medical waivers or special service assistance.

When we receive your Personal Data from other airlines in connected with code-share services, each airline involved acts as an independent Controller. Please note that our partner airlines maintain their own privacy notices. If your journey includes travel operated by another airline, we encourage you to review their respective privacy notice.

C. Automated technologies or interactions: As you interact with our website or use our services, we automatically collect technical data about your device, browsing browsing activities, and usage patterns. We collect this Personal Data through cookies, server logs, and similar technologies. Please see our Cookie Policy for further details.

IV. Purpose of Processing and Lawful Basis:

We may only process your Personal Data within the frameworks of data protection laws and regulations, and within the scope of the purposes listed below. Where our ability to provide specific services depends on your consent to process certain information, your refusal or withdrawal of consent may limit or prevent our ability to make those services available to you.

A. Fulfillment of our services:

We may process your Personal Data to provide the services you book with us. A contract exists between you and Air India when you utilise our services by booking a flight or cargo on our website, application or through any third party. In order to fulfill our services, we shall process your Personal Data for the purposes of identity verification, reservations, check-in, cargo management or to issue any refunds.

In this respect, information may also be processed for providing ancillary services including but not limited to additional baggage reservation, seat preference, meal preference, cargo management, lounge access, provision of wheelchair assistance and facilitating duty-free purchases.

When you use our in‑flight entertainment (IFE) system, we may process certain information to provide you with access to movies, music and games. This may include basic technical data such as your device identifiers and system logs. We use this information to operate the IFE system and troubleshoot any technical issues.

If you consent, we may contact you to assist you with your booking. To understand how we process your Personal Data during this interaction, please refer to our Notice for Consent to Communication

We may also process your Personal Data to send communications relevant to the services you have requested from us - such communications may be related to your flight tickets, gate change communication, changes to the flight plan, etc.

The legal basis for the above-mentioned processing is your voluntary disclosure of your Personal Data, or the performance of a contract with you and taking steps at your request prior to entering into a contract. Please note that in some jurisdictions, we may carry out the above-mentioned processing activities only based on your consent.

While travelling with us, you may provide us with additional Personal Data, such as when your meal choice may suggest your health information or other special category of Personal Data. You may also provide us with Personal Data when submitting health‑related information, such as when requesting special assistance (for example, wheelchair or stretcher support), or when seeking a medical waiver of your fare. Such information is processed solely for the purpose of assessing and fulfilling your request. As permitted by applicable data protection laws, we only process this information based on your voluntary disclosure of such information, or based on your consent, and solely to provide you with the services you have requested and assist you during your travel with us.

B. To carry out marketing activities:

We may process your Personal Data to carry out our marketing campaigns by sending you personalised offers and newsletters through various channels such as email, WhatsApp, Short Message Service (SMS), Rich Communication Service (RCS), push notifications or any other communication channel. We shall send such marketing communication only when you have opted in to receive them or we have a valid legal basis to do so. You may opt out or unsubscribe from marketing emails through the unsubscribe link provided in such emails.

We may also process your Personal Data to carry out targeted or personalised advertisement on our websites or mobile applications to show personalised offers and products to you. We may profile you based on the information you provide to us and automated decisions may be made from such profiling activities to send you offers which may be relevant to you.

If you are a Registered Customer or a Maharaja Club Member, you may update your marketing preferences through your account settings at any time. Additionally, you may also reach out to us at the details mentioned in Section XV to opt-out of such communications.

Please note that opting out of receiving the marketing emails shall not stop our transactional communications sent for services availed with us.

The legal basis for this processing is your consent, or legitimate interest in promoting our products and services, as permitted under applicable laws.

C. To detect and prevent fraud:

We may process Personal Data for the purpose of detecting, monitoring and preventing fraudulent activities, such as for identity verification, validating transactions while receiving payments, and during insurance claims.

The legal basis for the above-mentioned processing is our legitimate interest in ensuring security of our customers and preventing fraud.

D. To improve our products and services:

We may analyse your Personal Data to better understand your needs and preferences, and to develop and improve our products and services. We may also send survey links, make calls and send you invites for usability testing and interviews to receive feedback from you on the services you have availed from us.

As permitted under applicable data protection laws, we may rely on your voluntary disclosure of Personal Data, your consent, or our legitimate interest to improve our services as the legal basis to process the above-mentioned information you provide.

E. To manage Registered Customer profiles:

We process your Personal Data to create and manage your Registered Customer profile. If you are above 18 years of age, you may create your Registered Customer account by providing your email address or mobile number, or by signing up through your Google or Apple profiles. Please note that when you sign-up or sign-in using your Google or Apple accounts, you may be required to share certain Personal Data with Google or Apple. We recommend you to please refer to their privacy notices to understand how they collect and process your Personal Data.

Once your account has been created, you can provide us with additional information such as your title, name, date of birth, gender and nationality. You can also upload or provide us with details of your travel documents, such as your passport, OCI Card, Known Travel Number for TSA PreCheck, Redress Control Number, visa details and other similar information. We use the information you provide us with to make your booking process easier and assist you in tracking your travel bookings.

If you wish to delete your Registered Customer account, kindly refer to Section VIII of this Privacy Notice.

The legal basis for the above-mentioned processing is your voluntary disclosure of your Personal Data or your consent, as may be permitted under applicable data protection laws.

F. To manage your Maharaja Club account:

We process your Personal Data to administer and maintain your Maharaja Club account under our frequent flyer programme. Such processing is carried out in accordance with the Maharaja Club terms and conditions. We shall also process your data to determine offers and provide personalised services based on your tier and the preferences you provide us, such as your topic of interest. If you have shared your address information with us, we may use it to send you gifts or hampers.

At times, the Personal Data may be processed to manage your Maharaja Club points upon conducting transactions with our Maharaja Club partners and affiliates.

As permitted by applicable data protection laws, the legal basis for above-mentioned processing may be your voluntary disclosure of Personal Data to us, or the performance of our contract with you. Please note that in some jurisdictions, we may carry out the above-mentioned processing activities only based on your consent.

G. To manage your requests and complaints:

We may process your Personal Data under circumstances where you have initiated contact with us for queries, requests, or to address any grievances or feedback you may have pertaining to the services you have opted for. Our live chat functionality, AI.g, may be used for basic queries (e.g., FAQs or flight status). Please avoid sharing any sensitive or unnecessary Personal Data through the chat. When you call our customer service centre, we may record the calls to assess and make any necessary improvements within our services.

As permitted by applicable data protection laws, the legal basis for the above-mentioned processing may be the performance of our contract with you, your voluntary disclosure of information or your consent. Please note that in some jurisdictions, we may also carry out some of the above-mentioned processing activities for our legitimate interest to improve our services.

H. To manage disputes and comply with our legal obligations:

We may process your Personal Data to manage disputes, address complaints, and defend our legal claims. This may include processing your data when necessary to establish, exercise, or defend a claim. Additionally, we use your Personal Data, including any financial information that you provide us to issue compensations as per our legal obligations.

We may also process your Personal Data to comply with statutory requirements such as tax, accounting, record keeping, and other legal obligations. Where required under the laws of the countries to which we operate, we may need to collect and process certain health‑related Personal Data, such as medical certificates or vaccination records, to comply with entry, transit, or public‑health requirements.

In certain circumstances, we may be required to disclose your Personal Data to government authorities, law enforcement agencies, or regulatory bodies in connection with investigations, legal disputes, or when necessary to prevent, detect, or prosecute crimes such as identity fraud, terrorism, or threats to national security.

The legal basis for this processing is our compliance with legal obligations.

I. Flight planning and management:

We may process your Personal Data to plan and manage our fleet efficiently, which includes scheduling, route optimisation and crew allocation. This helps us to ensure better operations along with minimal disruption to passengers while using our services.

We may also process Personal Data to audit, monitor and improve our internal processes for smooth functioning of our website, mobile application, and internal procedure.

The legal basis for the above-mentioned processing is our legitimate interest in improving our services.

J. Processing job applications:

We shall process your Personal Data to evaluate and manage the job applications submitted by you, whether through our website, or through third-party agents or recruitment agencies.

The legal basis for the above-mentioned processing is your voluntary disclosure of your Personal Data or your consent, as permitted by applicable data protection laws.

V. Personal Data of Minor

Due to the nature of our services as an airline, we may collect travel information, which may include Personal Data of persons below the age of majority (“Minor”) when it is required to comply with the law, or as otherwise required to provide transportation needs and services.

For instance, Air India may offer special discounts to minors for which we need to assess fare eligibility, including verification at check-in, and sharing of data to another airline if a transfer is involved. Additionally, we may process minor data for transport of unaccompanied minor or when providing you bassinet services for your infant child travelling with you. Maharaja Club members can also enroll a minor in our frequent flyer programme through their account.

A minor may use our services only with the involvement of a parent or authorised guardian. If Personal Data related to minors has been collected without the consent of their parents or legal guardians, the parents or authorised guardians have the right to object to processing and/or request deletion of such Personal Data (Please refer to Section VIII for more details on how to exercise these rights).

VI. Who We Share Your Personal Data With

We may share this information with:

Other companies in the Air India Group, such as Air India Express.
Our travel-related business partners and affiliates, such as airlines and code-share partners, global distribution systems, airport operators, and payment processing and financial services partners.
Our service providers, such as our ground handling service providers, caterers, marketing service providers, campaign managers, IT and system administration services providers, data analytics service providers, and disaster and crisis management firms.
Our Maharaja Club partners and Star Alliance network.
Passengers travelling under the same booking as you, where you have made a travel booking.
Our legal and other professional advisors, including lawyers, bankers, auditors, and insurers.
Third parties in connection with financing, securitisation, insuring, restructuring, assignment, sale, transfer, or other disposal of all or part of our business or assets, or in relation to defence of claims. This includes situations where we choose to sell, transfer, or merge parts of our business or assets, or where we seek to acquire or merge with other businesses.
Official authorities, including law enforcement, governmental and regulatory authorities, and other organization: (a) if we believe disclosure is required by any applicable law; (b) to protect and defend our rights, or the rights or safety of third parties; (c) to detect, prevent or otherwise address any security risks, public health issues, or fraudulent activities; (d) if we have a good faith belief that it is reasonably required to comply with any applicable legal obligation, process or request; or (e) where it is in your interest.
Customs, border control, security, anti-terrorism and immigration authorities, as per applicable laws, e.g., under Passenger Name Record (PNR) Information Regulations, 2022 under the Indian Customs Act, 1962, or under the EU Directive 2016/681. For example, we may be required to share your data, which includes your Advance Passenger Information (API) and/or Passenger Name Record (PNR), with relevant authorities in the countries included in your travel itinerary under applicable laws.
In accordance with Article L 232-7 of French Internal Security Code, please be informed that air carriers have to transmit reservation/checking and boarding data collected from their passengers (PNR/API) to the French national public services and competent authorities for the purposes and under conditions as defined in the Decree N° 2014-1095 dated 26/09/2014 and the modifying Decree N° 2018-714 dated 03/08/2018.
Third-party service providers for recruitment purposes, including but not limited to recruitment agencies, background verification agencies, and IT system providers that support our hiring and onboarding process.

VII. How we Retain and Erase your Personal Data

We retain your Personal Data for periods that vary depending on the type of data and the nature of our relationship with you. Once the purpose for which the Personal Data was collected no longer applies, we will delete, destroy, or anonymise it, unless applicable laws require a longer retention period or such data is needed for the establishment, exercise, or defence of legal claims. When erasing Personal Data, we will take commercially reasonable and technically possible measures as prescribed under applicable laws to make the Personal Data irrecoverable or irreproducible in accordance with the applicable laws.

VIII. Your Data Protection Rights

You have certain rights in relation to your Personal Data and how we process it, depending upon the jurisdiction you are in.

You have the following rights irrespective of the jurisdiction you belong to:

Right to access: The right to request copies of the Personal Data we hold about you at any time. This includes access to information about the processing, such as purpose, categories of data, your data subject rights and appropriate safeguards in case of third-country transfers.
Right to rectification: The right to have your Personal Data rectified or updated if it is inaccurate or incomplete. Depending upon the nature of the request, you may be able to update certain sets of Personal Data on your own. For instance, if you are a Registered Customer or a Maharaja Club member, you can self-modify your some of your information through the profile section of your account.
Right to erase: The right to request that we delete or remove your Personal Data from our systems.
Right to withdraw consent: The right to withdraw previously given consent to process your Personal Data.
Right to complain to supervisory authorities: If you wish to make a complaint or are unhappy with the way we process your Personal Data, you have the right to complain to the appropriate supervisory authority in your jurisdiction. However, we would suggest utilising our grievance redressal mechanism or writing to the Data Protection Officer before reaching out to the supervisory authorities.

If you belong to India, you have additional rights as below:

Right to nominate another person: You have the right to nominate any individual to act on your behalf in case of your death or incapacity to exercise applicable rights.

Depending on the jurisdiction you belong to, you may have certain additional data subject rights available to you such as:

Right to restrict our use of your Personal Data: The right to limit the way in which we can use or process your Personal Data.
Right to data portability: The right to request that we move, copy, or transfer your Personal Data to another data Controller in a machine-readable format.
Right to object: The right to object to our use or processing of your Personal Data including where we use it for our legitimate interests.

Please contact us at data.privacy@airindia.com if you wish to make a request for exercising the above rights or if you have a grievance related to the processing of your Personal Data.

If you wish to delete your Maharaja Club account or your Registered Customer account, kindly reach out to us through your registered email address. To help us confirm your identity and to ensure that the Personal Data is only disclosed to authorised individuals, we may request your full name, Maharaja Club ID, email ID, phone number or any other required information. If you are raising a data subject request on behalf of another individual, you must provide a valid proof of your identity, details of relationship with the concerned individual, and proof of your authority to act on their behalf.

Please note that in certain circumstances where we are legally permitted, we may be unable to honour your data subject requests, such as for establishment, exercise or defense of our legal claims, where complying with your request may infringe on another individual’s rights, or where we are required to retain the data for legal or regulatory compliance purposes.

IX. Links

For your information and convenience, our website or mobile application may contain links to other websites or platforms that are managed by third parties. Please be aware that we are not responsible for the privacy practices of such third parties, and we encourage you to read the privacy statements of all websites or applications that collect your Personal Data.

X. Cross Border Transfer of your Personal Data

We are an organisation based out of India, so your Personal Data shall be transferred outside the country where you are located. Your Personal Data may also be transferred to our offices, authorised agents, and our partners to facilitate your travel with us. For example, we transfer your Personal Data with our business partner wherein you have booked a codeshare flight for your travel. We may also share your Personal Data with our processors and service providers.

We ensure that all cross-border data transfer complies with applicable data protection laws, and is safeguarded by appropriate contractual and technical measures, including the use of binding contractual obligations. For instance, if you are based in the EU, we rely on standard data protection clauses that are approved by the European Commission for the transfer of Personal Data outside the European Economic Area.

XI. Security

We strive to do our best to protect your Personal Data and undertake all appropriate technical and organisational measures to ensure the same. We constantly review our security practices to mitigate any risk arising out of unauthorised access, accidental data loss, or damage to your Personal Data.

Our security practices are in alignment with the industry-best practices, including storing your account details and Personal Data on secure servers and conducting regular security and privacy trainings for our employees to make them understand their responsibilities in looking after your information.

XII. Notification of Breach

If you suspect any misuse or loss or unauthorised access to your Personal Data, please let us know immediately by contacting us via the contact details given in this Privacy Notice as provided in Section XV.

XIII. Changes to this Privacy Notice

We may amend the Privacy Notice and update the effective date when this Privacy Notice is updated. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

XIV. Cookie Usage

We also use cookies to improve your experience of using our website. You may refer to our Cookie Policy to understand how we collect and process your data through cookies and other similar technologies.

XV. Privacy Contact Information

If you have any questions regarding our Privacy Notice or if you want to exercise any of your rights, you can do so by contacting our Data Protection Officer at data.privacy@airindia.com.

February 2026