Privacy Notice

XO Global LLC, a Delaware limited liability company (“XO”) is committed to protecting our visitors’ and members’ privacy. This Privacy Notice (“Notice”) describes the types of information XO may collect and how we may use that information to better serve visitors and members while using our mobile application (the “Application”), our Website (the “Website”) and the services offered by XO (collectively, “Services”).

1. Application of This Notice

1.1 This Notice applies to our collection, use, and processing of your personal information. We collect, use and process your personal information when you use our Services. This includes when you use our Website or Application, book flights with us, or communicate with us in any format, and when you interact with our advertising and applications on social media and other third-party sites and applications.

1.2 This Notice does not apply to information collected by any third party, including through any application or content (including advertising) that may link to or be accessible from or on the Website or Application. These companies will have their own privacy notices and you should check these notices to find out how they will use your data.

1.3 Please read this Notice carefully to understand our policies and practices regarding your information and how we will treat it.

1.4 This Notice may change from time to time (see section “Changes to this Privacy Notice” below). Your continued use of the Services after we make changes to this Notice is deemed to be acceptance of those changes, so please check this Notice periodically for updates.

Notice1.6 If you have questions about this Notice, please contact us as described below (see section 12 “Questions and Contact Details”).

2. Children under the Age of 13

2.1 The Application and the Website are not intended for children under 13 years of age. However, due to the nature of our Services, XO may collect and maintain travel information about children under the age of 13 when necessary to comply with aviation or security regulations, for safety or security reasons or as otherwise necessary for XO to arrange transportation or other Services requested by you, upon receipt of parental or guardian consent to process such information.

2.2 We use the information collected about children known to be under age 13 only to provide Services not for any marketing or promotional purposes.

2.3 We will disclose personal information about children if required by law, e.g., to comply with a court order or subpoena, or to protect the safety and security of members.

2.4 If you are under age 13, do not use or provide any information through the Application or the Website or through any of their features, do not make any purchases through the Application or the Website, do not use any interactive features of the Application or the Website and do not provide any information about yourself to us, including, but not limited to, your name, address, telephone number, email address or any screen name or user name you may use. If we learn that we have collected or received personal information from a child under age 13 without verification of parental or guardian consent, we will delete that information. If a child under age 13 has provided us with personal information without parental or guardian consent, the parent or guardian may contact us as described below (see section 12 “Questions and Contact Details”).

3. Information We Collect

3.1 This section sets out when, how and why we collect your personal information. In some countries, we are required to have a legal justification for processing your information. To find out the legal justification that we rely on when processing your personal information, please see the table below.

3.2 How We Collect Information About You. We collect information about you in a variety of ways depending on how you interact with us and the Services, including: (a) directly from you when you provide it to us, (b) automatically as you navigate through the Application or the Website (information collected automatically may include device type, geolocation, usage details, IP addresses and information collected through cookies and other tracking technologies), and (3) from third parties (for example, public records search services and other business partners).

3.3 Information We Collect About You and Why. We will only collect and process personal information about you if we have a lawful reason to do so. The lawful reason we rely upon to process your personal information will generally be one of the following:

- Where we need to process your personal information to perform the contract we are about to enter into or have already entered into with you;     
- Where We have a legal obligation to process your data, for instance for identity verification and due diligence purposes, business taxation legislation;     
- Where it is necessary for our legitimate interests in operating our business lawfully and effectively, managing our relationship with and providing Services to you, and to ensure the safety of our customers and other third parties; or     
- In certain circumstances, such as where we provide you with marketing information, where we use geolocation tracking, or where we rely on your consent to process your personal information, you have the right to refuse to give your consent or to withdraw your consent at any time. For more information on how you can withdraw your consent please see section 8.1 ("Your Choices").

The following provides examples of the type of information that we collect in a variety of contexts and how we use that information.

3.4 Automatic Data Collection. In addition to the personal information we collect from you, as you navigate through, interact with and use our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns, including:

3.4.1 Device IDs. A device ID (device identification) is a unique device identification associated with a mobile device. It may be possible to limit device ID tracking by adjusting the settings on your mobile device. However, if limit device ID tracking you may be unable to access the Application or certain features in the Application.

3.4.2 Geolocation Tracking. Mobile devices contain a GPS (global positioning system) chip that uses satellite data to calculate your geolocation. It may be possible to disable geolocation tracking by turning off the location feature in the settings on your mobile device. However, if you disable location tracking you may be unable to access the Application or certain features in the Application. Where required by law, we will obtain your consent to use geolocation tracking.

3.4.3 Cookies. When you visit our Website or Application, we collect certain information by automated means using cookies. A cookie is a small file placed on your computer or mobile device. It may be possible to refuse to accept cookies by adjusting the settings on your browser or mobile device. However, if you select this setting you may be unable to access the Application or the Website or certain features in the Application or the Website. Cookies are small text files stored on your device when you visit a website. For more information on the cookies that we use please read our Cookie Notice.

3.4.4 Web Beacons. Pages of the Website, the Application and electronic communications may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit XO, for example, to count users who have visited those pages or opened a message and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity). Some web beacons may be disabled by adjusting the settings in your browser or email settings or by installing browser add-ons. However, if you disable web beacons, you may be unable to access the Application or the Website or certain features in the Application or the Website.

3.4.5 Our website may also feature links to social media websites, When using these links, or our respective pages on these providers' platforms, we encourage you to read and refer to the service provider’s privacy notice.

3.4.6 Server Logs. A server log is a log file or several files that are automatically created and maintained by a server that track activities performed. Server logs cannot be disabled by users. We use the information listed in this section for our legitimate interests, including to troubleshoot application errors and to provide you with the most up to date application and features, to collect information about your activities over time and across third-party websites or other online services (behavioral tracking), to improve the Application and the Website and to deliver better and more personalized Services, and to determine relevant flights, products, services, and promotions that you may be interested in (for example, this data allows us to use your location to send you push notifications about what is going on around you), and for purposes of analytics and flight scheduling, such as to calculate your charter fare. Where required by law, we will obtain your consent for the deployment of cookies and similar technologies on our Services.

3.5 Your User Contributions. You also may provide information to be published or displayed (hereinafter, "posted") on public areas of the Application or the Website, or to be transmitted to other users of the Application or the Website or third parties (collectively, "User Contributions"). Your User Contributions are posted on and transmitted to others at your own risk. We cannot control the actions of other users of the Application or the Website with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

3.6 Information That You Provide About Others. In certain circumstances we may collect other people's information from you, such as where you book flights for other people - we will require you to provide their name, date of birth and passport information. Where you provide other people's personal information, it is your responsibility to ensure that those people are happy for you to share their personal information with us, and to make them aware of how and why we use their personal information by telling them about the information contained within this Notice.

4. How We Use Your Information

4.1 We use the information we collect to provide you with products and Services. In addition to the purposes and uses described above, we use information for one or more of the following reasons:

• To allow you to register an account with Us and navigate the Website and/or mobile application;
• To allow us to manage our relationship with you and to allow us to contact you to keep you informed of your bookings and other requests, such as requests to change your booking details;
• To contact you with reminders regarding your bookings and your flight via in-app messaging, SMS and/or email (e.g., check-in or gate change information), to notify you of any disruption to your flight (e.g., if your flight is delayed or cancelled), or to advise you of the availability of catering or other inflight services requested by you;
• To allow flight operators to calculate luggage allowances for a specific flight and to ensure they are able to balance the aircraft, and to ensure they are aware of any disabilities or dietary requirements;
• To ensure that you are able to successfully board your flight, you have a safe and comfortable flight and to enable you to navigate border control;
• To investigate and respond to and resolve complaints concerning our Services, or to provide you with customer support in order to assist you;
• To allow us to respond to any of the rights you have, or to comply with any of the rights that you have exercised;
• To send relevant marketing information to you where you have consented to receiving it;
• For such other purposes as you may consent (from time to time);
• As otherwise permitted or required by applicable law.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. For example, if you complete an online purchase, we may collect your information to perform our contract with you, but we also collect your information as we have a legitimate interest in maintaining your information after your transaction is complete so that we can quickly and easily respond to any questions about your order. As a result (and as permitted by law), our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.

To provide our services, and for the purpose of preventing illegitimate use of Our services, we may carry out profiling of our customers and their activities using automated processes. If this occurs, We will always ensure that final decisions based on these profiles and information are taken by natural persons.

5. How We Share Your Information

5.1 Sharing with Third Parties. We may share your information with the following third parties: (a) our subsidiaries and affiliates to enable us to operate and manage our business and whom may provide certain services to us or you from time to time; (b) to providers of professional services who provide certain services to us, such as consultancy, banking, legal, insurance and accounting services; (c) to service providers who we use to support our business and allow us to provide the Services to you, including third parties who: operate aircrafts on our behalf to enable us to provide the flights we offer you, who provide food and beverage services and other services you ask us to provide through our concierge team, perform certain searches for us (including searches of public records), including to enable us to verify your identity and to perform fraud protection and credit risk searches, process payments on our behalf, provide our IT infrastructure, provide IT services to us such as data storage services, data analytics and hosting services, provide service and maintenance services to us to ensure that our Website and Application work properly; (d) to event partners who organize or provide services at an event on our behalf; and (e) to social media, advertising and other companies who we use to provide you with information about our Services and to measure the performance of our advertising campaigns.

5.2 When you book a flight with us, in certain airports, you the customer will have the opportunity to choose and book your own meal directly via our service provider. When your flight is confirmed, You will receive an email with a link which will redirect you to our service provider’s homepage, where you will be able to order your preferred meal. A credit will be granted to you by XO; should your order exceed such credit awarded to you, you will be prompted to process the payment for the exceeded amount.

5.3 Other Sharing Scenarios. There are several other scenarios where we may disclose your information, including: (a) to a buyer or other successor to our business; (b) for other purposes we disclose to you when you provide the information; (c) to comply with any court order, law or legal process, including to respond to any government or regulatory subpoena or other request; (d) to enforce or apply our Membership Agreement, Terms of Use, Copyright Notice, Charter Terms, Public Charter Operator-Participant Agreements or other agreements; (e) we believe disclosure is necessary or appropriate to protect the rights, property or safety of XO Global, our customers or others.

5.4 We may ask if you would like us to share your information with unaffiliated third parties who are not described elsewhere in this Notice. In this event, We will always specify the purpose for sharing Your personal data. If You wish to receive more information, please refer to section 12 “Questions and Contact Details”.

6. Transfer of Your Information to Other Countries

6.1 In certain circumstances, we may transfer your personal information outside the country or territory where the information is collected for the purposes described in this Notice. As a result, your information may be processed in a foreign country where privacy laws may be less stringent than the laws in your country. With respect to transfers originating from the European Economic Area (“EEA”) or the United Kingdom (“UK”) to a country outside of the EEA, such as the United States, we will only do so if an adequate level of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

6.1.1 The country to which your personal information will be transferred has been deemed by the European Commission or the UK Information Commissioner’s Office to provide an adequate level of protection for personal information; or

6.1.2 Where we have put in place specific contracts with the party to whom we will transfer your personal information that include the EU Standard Contractual Clauses issued by the EU Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, supported by additional measures as may be required.

6.2 If you have any questions relating to transfers of your personal information, or you would like to obtain information on the specific safeguards in place in relation to transfer to a particular third party or third country, please contact as described below (see section 12 “Questions and Contact Details”).

7. Our Retention of Your Data

7.1 We will only retain your information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of providing Services to you, and for satisfying any legal, regulatory, tax, accounting or reporting requirements.

7.2 We will retain the information that we collect about you while you are utilizing Our services and accessing the Application and, unless we are required to keep your information for longer to comply with any legal, regulatory, tax, accounting or reporting requirements, We will delete it in accordance with applicable law and regulations. If You wish to receive more information on how long We keep Your data, please contact Us at privacy@vistaglobal.com.

7.3 In certain circumstances you have the right to ask us to delete your data sooner (see "Your Choices and Rights" below). Following receipt of such a request, we will delete all the information that we are not required to retain.

7.4 If you have any questions or queries about the retention period for certain information, you can simply contact us as described below (see section 12 “Questions and Contact Details”).

8. Your Choices and Rights

8.1 Your Choices. Where we rely on your consent to enable us to process your information, you can withdraw it at any time by doing the following:

8.1.1 To change your marketing preferences or to stop receiving marketing communications, or for any other situation where we have obtained your consent to process your information, contact us as described below (see section 12 “Questions and Contact Details”). You can also follow any unsubscribe instructions in the marketing communications you receive from us.

8.1.2 To disable location tracking and push notifications, you can change the settings on your device. To stop push notifications, you will need to use your browser settings.

8.1.3 You can also choose not to provide us with any information; however, it may be needed to utilize the Services, and, where you do not provide us with the information we have requested, we may not be able to perform the terms of a contract we have with your or to provide you with the Services. We also may need your information to comply with applicable law.

8.2 Your Rights. Some jurisdictions, such as the EU and the UK, give you rights with respect to your personal information, including:

8.2.1 Object to Processing. The right to object to our processing of your data where we are relying on a legitimate interest to process your information and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your rights and freedoms. This includes where we make automated decisions about you without any human intervention in the process, or where we process your information for direct marketing purposes;

8.2.2 Deletion (the ‘right to be forgotten) The right to request that your information be erased where there is no good reason for us continuing to process it;

8.2.3 Restrict Processing. The right to restrict us from processing your information further in certain circumstances, such as where you want us to establish the data's accuracy or the reason for us processing it;

8.2.4 Access. The right to obtain information regarding the processing of your personal information and the right to receive a copy of the information we hold about you;

8.2.5 Portability. The right to obtain from us some of your information in a structured, commonly used and machine-readable format and have the right to transmit that data to another data controller;

8.2.6 Rectification. The right to correct, amend, or update information that is inaccurate or incomplete (where you have an account with us, you can also do this by logging in and updating your information);

8.2.7 Revoke Consent. Where we rely on your consent to process your personal information, you have the right to refuse to give your consent or to withdraw your consent at any time.

8.2.8 Rights in relation to automated decision-making, including profiling.

Where automated decision-making is performed, You have the right not to be subject to a decision based solely on automated processing, including profiling, which could affect You. If such decision is necessary for the performance of a contract or based on consent, You as a data subject have the right to obtain human intervention, to express Your point of view and to contest the decision.

8.2.7 Opt-Out of Targeted Advertising. The right to opt-out of online tracking based targeted advertising (e.g., cookies); You can do so via our Cookies Dashboard. Please note that if you change browsers or computers, or if you clear your browser’s cache, you may need to click the link again to apply your preference. You may also opt-out of other forms of targeted advertising by submitting a request as described below;

8.2.8 Opt-Out of Sale. The right to request that your personal information is not sold.

8.2.9 If you are in the EEA or the UK, You also have the right to lodge a complaint with a supervisory authority if you are not happy with how we handle your information; although we encourage you to try to resolve any complaints directly with us before doing so by contacting us at privacy@vistaglobal.com. A list of Supervisory Authorities within the EEA can be found here. If you are in the United Kingdom, your Supervisory Authority is the Information Commissioner’s Office, https://ico.org.uk/.

9. Exercising Your Rights (Including Accessing, Correcting and Deleting Your Information)

9.1 To exercise any of your rights described above, please follow the instructions below.

9.1.1 For California Residents - If you wish to exercise any of these rights – please follow here. California residents can also request to exercise any of the above by calling Toll Free on +1 (888) 914-9661 Enter PIN: 179339. You may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf. If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of a completed Authorized Agent Designation Form indicating that you are able to act on another person’s behalf.

9.1.2 For EU or UK Residents - If you wish to exercise any of these rights – please follow here.

9.2 Please note that as required by law, we will require you to prove your identity. We may verify your identity by phone call or email. Depending on your request, we will ask for information such as your name, the last item you purchased from us, or the date of your last purchase from us. We may also ask you to provide a signed declaration confirming your identity.

9.3 Please note that, while we will carefully assess every request we receive, we may not always be able to comply with your request. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. For example, we may not accommodate a request to change or delete information if we believe it would violate any law or legal requirement or where we require the information to exercise or defend legal claims. We also may not accommodate a request to change information if we believe the change would cause the information to be incorrect. We will not discriminate against individuals who exercise their privacy rights under applicable law. If you ask us to delete your User Contributions from the Application or the Website, copies of your User Contributions may remain viewable in cached and archived pages or might have been copied or stored by other users of the Application or the Website.

9.4 Please note that if you exercise certain rights, it may have an effect on our ability to provide you with the Services you have requested. For example, we cannot delete your personal information except by also deleting your user account (which may result in cancellation of your membership); and we are not able to provide you with a flight booking where you do not provide us with your name, date of birth and passport information.

10. Security and Confidentiality

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We also urge you to be careful about giving out or posting your information in public areas like message boards as the information you share in public areas may be viewed by other users. Unfortunately, the transmission of information via the internet is not completely secure. Although we use reasonable efforts to protect your personal information, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

11. Changes to This Privacy Notice

We may update this Notice to reflect changes to our information practices. Such changes will be effective upon posting on the Application and the Website, unless we make significant changes to the Notice where we will notify you before they become effective. We encourage you to periodically review this page for the latest information on our information practices.

12. Questions and Contact Details

If you have any questions about this Notice, or our approach to privacy, please contact us at the appropriate address below:

For US Residents

By mail at XO Global LLC, 1901 W. Cypress Creek Road, Suite 600, Fort Lauderdale, FL 33309 or via email at privacy@vistaglobal.com.

For EU/UK Residents

By mail at XO Global LLC., 500 E Broward Blvd., 19th Floor, Fort Lauderdale, FL 33394 or via email at privacy@vistaglobal.com. You can also contact XO Global LLC’s representative within the EU for the purposes of Article 27 GDPR, via email at privacy@vistaglobal.com.

13. Additional Information For California Residents

13.1 California law requires us to disclose the following additional information related to our privacy practices. If you are a California resident, the following privacy disclosures apply to you in addition to the rest of the Privacy Notice.

13.2 California Shine the Light. If you are a California resident, you have the right to request certain information regarding our disclosure of your Information to third parties for direct marketing purposes pursuant to Section 1798.83 of California Civil Code. If you would like more information concerning the categories of personal information (if any) we share with third parties or affiliates for those parties to use for direct marketing, please submit a written request to us using the information in the “General information” section above. If you or your authorized agent wish to opt-out of the sale of your personal information, or of targeted advertising, please raise a request using this form.

13.3 “Do Not Track” Disclosure. We do not currently recognize the “Do Not Track” signal.

13.4 California Notice of Financial Incentive. We may offer programs that provides certain perks, such as discounts and exclusive offers (the “Loyalty Programs”). When you sign up for a Loyalty Program, we will ask you to provide your name, email address, and in some cases your telephone number. Under California law, our Loyalty Programs might be interpreted as “financial incentive” programs as they involve the collection of personal information. We do not assign a monetary value to the information we collect. Based on our reasonable estimate, the value of your personal information to us is related to the value of the free or discounted products or services that you obtain. This value is based on the expense related to offering those free or discounted products or services. You may withdraw from participating in the Loyalty Programs at any time by contacting us at the address described in the program terms and conditions. If you wish to receive more information, please contact Us using the details in section 12 “Questions and Contact Details.

13.5 California Information Disclosure. The table below describes the categories of personal information collected, disclosed for a business purpose, “sold” and/or “shared” in the past 12 months (as those terms are defined by California law). We do not knowingly sell the information of minors less than 16 years of age without affirmative authorization. Please note, in addition to the recipients identified below, we may disclose any of the categories of personal information we collect with government entities, as may be needed to comply with law or prevent illegal activity. For details regarding how we use personal information, please see the “Information We Collect” section of this Notice. For information regarding how long we retain personal information, please refer to the “Our Retention of Your Data” section of this Notice.

13.6 California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): driver’s license, passport information, state identification card, social security number, precise geolocation, account log-in, debit card or credit card number in combination with any required security to access code, password, and health information. This information is collected in order to process transactions, comply with laws, manage our business, or provide you with services.  Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121. We do not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising.

13.7 Non-Discrimination. If you choose to exercise any of your rights under the CCPA/CPRA, we will not deny the services you requested or provide a different quality of service.

Last updated and effective: January 2024, version no. 2.2. Previous versions of this Privacy Notice can be provided upon request.