Privacy Policy
How FAVORs Air Service collects, uses and protects the personal data of users of the FavorsAir mobile app and the www.favorsair.com website.
1. Who we are and how to reach us
FAVORs Air Service ("we", "the Company") is the data controller for personal data and provides air ticket search, booking and issuance services. We determine the purposes and means of processing the personal data of users of the FavorsAir mobile app and the www.favorsair.com website.
| Data controller | FAVORs Air Service |
| Address | 19 Razzakov St., Rossiya Business Center, office 703, Bishkek, Kyrgyz Republic |
| Phone | +996 552 339 996 |
| Email for data protection matters | sales@favorsair.com |
| Additional office | 22 Aybek St., New World building, Tashkent, Republic of Uzbekistan |
The Company's head of customer support is responsible for personal data protection. Please send any request relating to the processing of personal data, including the exercise of data subject rights, to sales@favorsair.com — we respond within 30 calendar days at the latest.
2. What this Policy applies to
This Policy applies to the FavorsAir mobile app for iOS (io.rk.favors.air) and Android (com.favorseair.favorseair_mobile), as well as to the www.favorsair.com website and the related server-side services.
This Policy does not apply to the websites and services of air carriers, payment organisations and other third parties that you may reach through links in the app. Data processing on those resources is governed by their own policies.
3. What data we process
We collect only the data we need to provide our services. The full list is below.
| Category | Data included | How we obtain it |
|---|---|---|
| Account | Phone number, email address, first name, last name, password (stored as an irreversible hash) | From you at registration |
| Profile | Profile photo, date of birth, citizenship | From you when you fill in your profile |
| Passenger data | First name, last name, middle name, date of birth, gender, citizenship, document type, document number (passport or national ID), its expiry date, relationship, contact phone number and email address | From you when you make a booking or save a passenger in your profile |
| Bookings and trips | Routes, dates, fare, service class, seats, booking status, e-tickets, boarding passes, QR codes, details of refunds and reissues together with the reason | Generated as you use the service |
| Payment | Payment method, transaction identifier, payment status and amount | From our payment partner and from you |
| Support requests | The text of your conversations in the support chat, the history of your requests | From you |
| Loyalty programme | Bonus balance and the history of bonuses earned and spent | Generated as you use the service |
| Technical data | Push notification token, app installation identifier (Firebase Installations ID), device and operating system type and version, app version, selected language and currency, IP address | Automatically |
| Logs | Records of activity in your account and technical error logs | Automatically |
Bank card numbers, CVV codes and other payment credentials are never entered in the app and are neither collected nor stored by us.
4. Data that stays on your device
Some data is stored only locally and is never sent to our servers:
- Access and session refresh tokens — in the secure storage of the operating system (Keychain on iOS, Keystore on Android).
- The hash of the PIN code used to unlock the app. The PIN itself is stored neither on the device nor by us, and cannot be recovered.
- Interface settings: language, currency, appearance, the state of the notification toggles.
- A copy of your profile so the app can work without a network connection.
- Downloaded documents — boarding passes, itinerary receipts and reports — in the app documents folder.
Biometric data (fingerprint, Face ID) is processed solely by your device operating system. The app receives only the result of the check — success or failure — and never gains access to the biometric samples themselves.
All local data is erased when the app is removed from the device.
5. What we do not collect
The app does not request or use:
- location — neither precise nor approximate;
- the camera, photos or media library;
- your contact list, calendar or microphone;
- health and fitness data;
- the device advertising identifier (IDFA, AAID).
We do not track you across other companies' apps and websites, we do not build advertising profiles and we do not take part in advertising networks. The app uses no behavioural analytics services.
6. Purposes of processing and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Registration and sign-in, phone number verification | Account | Performance of our contract with you |
| Flight search, booking and ticket issuance | Passenger data, bookings | Performance of the contract; mandatory carriage requirements |
| Check-in and issuing boarding passes | Passenger data, bookings | Performance of the contract |
| Notifications about booking status, flight changes and departure reminders | Technical data, bookings | Performance of the contract |
| Promotional and marketing messages | Account, technical data | Your consent, which you may withdraw at any time |
| Customer support | Support requests, account, bookings | Performance of the contract; our legitimate interest |
| Accounting and tax records | Payment, bookings | Statutory requirements |
| Security, fraud prevention, incident investigation | Logs, technical data | Our legitimate interest |
7. Data of passengers and other third parties
When making a booking you may enter other people's data — travel companions, family members, colleagues. Such data, including passport details, is required by the air carrier and by border control authorities: carriage is not possible without it.
By entering another person's data you confirm that you are entitled to share it, and you undertake to inform that person in advance of the disclosure and of the terms of this Policy.
If you enter the data of a minor (the "child" and "infant" passenger types), you confirm that you are their parent or legal guardian, or that you are acting with their consent. People under 18 cannot register an account on their own.
Any passenger whose data has been entered into our service may contact us directly at sales@favorsair.com and request access to their data, its correction or its deletion.
9. Cross-border data transfers
We serve international routes, so data may be transferred outside your country of residence — primarily between the Kyrgyz Republic and the Republic of Korea, and also to the countries of transit and arrival along your itinerary.
| Recipient | Country | Data | Retention period |
|---|---|---|---|
| Air carriers and reservation systems | Countries of departure, transit and arrival along the route | Passenger data, booking details | In line with the carrier's rules and statutory requirements |
| Google LLC | The United States and other countries hosting Google infrastructure | Push notification token, installation identifier | Until consent is withdrawn or the app is removed |
By making an international booking you consent to such transfers: carriage is not possible without them. When transferring data we apply contractual and technical safeguards that meet the requirements of applicable law.
10. Retention periods
| Data | Retention period |
|---|---|
| Account and profile | Until the account is deleted |
| Saved passengers | Until you delete them or until the account is deleted |
| Bookings, tickets, payment documents | At least 5 years from the date the trip ended — accounting and tax law requirements |
| Support correspondence | 3 years from the date of the last request |
| Activity and error logs | Up to 12 months |
| Push notification token | Until consent is withdrawn, the app is removed, or the token expires |
Once the period expires, data is deleted or anonymised. Data needed to defend our rights in a dispute is kept until the dispute is resolved.
11. Your rights
In respect of your personal data you have the right to:
- obtain confirmation that we process your data and a copy of it;
- request the correction of inaccurate or incomplete data;
- request the deletion of your data where the grounds for processing no longer apply;
- withdraw consent you previously gave — this does not affect the lawfulness of processing carried out before withdrawal;
- object to processing based on our legitimate interest;
- request the restriction of processing while your request is being reviewed;
- lodge a complaint with the competent data protection authority.
Some of these rights can be exercised directly in the app and in your online account — see the "Your Privacy Choices" page. For anything else, write to sales@favorsair.com. We may ask you to confirm your identity so that we do not disclose your data to someone else.
12. How we protect data
- All data exchanged between the app and the server travels only over HTTPS with TLS encryption. Unsecured connections are blocked at the app level.
- Passwords are stored as an irreversible hash and cannot be recovered even by us.
- Access tokens and the PIN code hash are kept in the secure storage of the operating system — Keychain or Keystore.
- Sign-in can be further protected with a PIN code and biometrics; the app locks automatically when sent to the background.
- Employee access to data is limited by role and granted on a least-privilege basis, and actions in the admin panel are logged.
No system is absolutely secure. If you believe your account has been compromised, change your password immediately and let us know.
13. Agency and administrator accounts
The app is also used by staff of partner agencies and by administrators. When an agency employee makes a booking for their own client, the agency acts as the data controller for that client's personal data, and we process the data on the agency's instructions and under the contract concluded with it.
We forward requests from such clients about their data to the relevant agency. The agency employees' own service data — account, role, activity log — is processed by us in order to provide access to the service and to maintain security.
15. Changes to this Policy
We may update this Policy when the service or legal requirements change. The current version is always available at this address, and the effective date is stated at the top of the document.
We will give advance notice of material changes — in the app or via the contact details you provided. By continuing to use the service after the changes take effect, you accept the new version.
16. Contact us
For any question relating to the processing of personal data, please contact us:
- Email: sales@favorsair.com
- Phone: +996 552 339 996
- Postal address: 19 Razzakov St., Rossiya Business Center, office 703, Bishkek, Kyrgyz Republic
Requests are reviewed within 30 calendar days of receipt at the latest.