Business Partners Privacy Notice
Last updated - June 2025
Basic information about the processing of Personal Information
Amadeus IT Group, S.A. or, where appropriate, the Amadeus' affiliate with whom you are interacting (together, “Amadeus”) will act as independent data controller(s) in the processing of personal data of customers, vendors and other third parties with whom Amadeus has a commercial relationship and employees, contractors, and other points of contact in those companies or organizations (“Business Partners”) and in the processing of personal data of individuals potentially interested in Amadeus’ products and services (“Prospects”). Purpose of the Personal Data Processed and Legal Grounds for Processing With respect to Business Partners, Amadeus processes your personal data for the purposes of providing or receiving products and services, managing the relationship, and for security and auditing purposes. This is done upon the performance of a contract (or in the adoption of precontractual measures), upon legitimate interest (in properly managing commercial relationships) or in compliance with legal obligations. With respect to Prospects, Amadeus processes your personal data for marketing and sales purposes. This is done upon consent or upon legitimate interest (in promoting products and services). Recipients of the Personal Data Your personal data will be shared with Amadeus’ affiliates, Amadeus’ consultants and services providers and other third parties when needed. Due to the nature of the services Amadeus provides as a global travel technology supplier, the abovementioned recipients may be in any location around the world, even outside of the European Economic Area. In such case, the personal data will continue to receive adequate protection through contractual or other type of arrangements put in place with Amadeus’ affiliates and third-party recipients. Retention Period You have the right to access, rectification, erasure, portability, to object to and/or restrict processing of personal data, and the right to lodge a complaint with a supervisory authority. You may exercise your rights via e-mail: dataprotection@amadeus.com or by sending your request to our registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain).Data Controller Personal Data Amadeus Processes about You Identification data, contact data, career data, marketing and communications data, profile data, profile data, user behavioural data, meeting metadata and relevant system/machine data. International Transfers of Personal Data Amadeus retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal requirements. Your rights
You may contact Amadeus’ DPO by writing to dpo@amadeus.com.Additional information More information about privacy and data protection is available below.
Data controller
This Privacy Notice (“Notice”) provides information about how Amadeus IT Group, S.A. (with registered office at Calle Salvador de Madariaga 1, 28027 – Madrid) and those other Amadeus’ affiliates with whom you are interacting (together, “Amadeus”) collect and process personal data concerning:
- Customers, vendors and other third parties with whom Amadeus has a commercial relationship and employees, contractors, and other points of contact in those companies or organizations (“Business Partners”); and
- Individuals potentially interested in Amadeus’ products and services (“Prospects”).
Purpose of the Personal Data Processed and Legal Grounds for Processing
The personal data you share with Amadeus and that we collect about you will be used, as permitted by local law:
- To provide products and services (including support services) that an Amadeus Business Partner has requested upon the performance of a contract;
- To manage the relationships between Amadeus and Amadeus Business Partners upon the performance of a contract or upon the adoption of precontractual measures;
- To send commercial communications for marketing and sales purposes upon Amadeus’ legitimate interest in promoting products and services, where that is not possible, upon consent;
- To send surveys upon Amadeus’ legitimate interest in gathering feedback from Amadeus Business Partners or, where that is not possible, upon consent;
- For personalizing the content of Amadeus’ communications upon Amadeus’ legitimate interest in ensuring the proper promotion of products and services;
- For fraud prevention purposes and to protect the security of Amadeus and its products and services, as well as the security of the Amadeus Business Partners, upon the performance of a contract or upon Amadeus’ legitimate interest in ensuring network and information security, respectively;
- To perform internal business processes, such as testing or quality assurance, and other uses compatible with providing the services upon the performance of a contract or upon Amadeus’ legitimate interest in ensuring the proper delivery of products and services; and
- To defend against legal claims and/or comply with applicable legislation.
This Notice does not reflect other processing activities performed by Amadeus for other purposes (e.g., processing of personal data collected as a consequence of browsing Amadeus’ websites, processing of personal data for HR or recruitment purposes or processing of personal data of travellers).
Personal Data Amadeus Processes about You
For the purposes described in this Notice we process the following personal data concerning you:
- Personal data directly collected from you
- Identification data: first name, family name(s).
- Contact data: address, email address, telephone number.
- Career data: education and professional experience.
- Marketing and communications data: communication preferences.
- Profile data: interests, preferences, feedback and survey responses.
- Personal data inferred from you: in some cases, the above data may have been provided by the company you work for or may have been inferred from your interaction with Amadeus. Also, Amadeus may collect and process:
- User behavioural data: IP address, login data, browsing actions and patterns.
- Meeting metadata: date, topic of the meeting and, in some cases, agenda, minutes and recording.
- Relevant system/machine data: device and network data, application logs.
Recipients of the Personal Data
We may share personal data with other Amadeus group entities which may be in any location around the world. These Amadeus group entities may process your personal data for the purposes described in this Notice. A link to the complete list of Amadeus group entities and their locations can be found here.
In addition, we may also disclose your personal data to:
- Third party consultants and services providers; and
- If necessary: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal processes; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of other group entities; (f) to protect our rights, privacy, safety, property, and/or that of other group entities, you, or others; and (g) to permit us to pursue available remedies or limit the damages that we may sustain.
Where such disclosures take place, Amadeus requires the appropriate technical and organizational security measures to be in place to protect personal data, and for personal data to be processed lawfully.
Amadeus only allows other group entities and third parties service providers to use personal data for specified purposes and in accordance with Amadeus’ instructions.
International Transfers of Personal Data
When Amadeus shares your personal data, this may involve transferring personal data outside the European Economic Area (“EEA"). When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other type of arrangements in place. For these transfers, at least one of the following appropriate safeguards will be implemented:
- Personal data will be transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
- Standard contractual clauses as approved by the European Commission which, together with supplementary measures, will ensure personal data transferred will retain the same protection it has in EEA; or
- Any other lawful transfer mechanism as foreseen in applicable laws and/or as approved by the European Commission or relevant data protection authority.
Retention Period
Amadeus keeps your personal data for as long as is necessary to fulfil the purposes for which it was collected. Your personal data will be deleted after such period, unless a longer retention period is required or permitted by applicable laws.
Your Rights
You may exercise your rights of access, rectification, erasure, objection, portability and/or restriction of processing in relation to your personal data by sending an email to dataprotection@amadeus.com or by sending your request to our registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain). You may also use that same email address in case you have doubts around how we process your personal data.
If you think your rights have not been properly handled, please contact our DPO: dpo@amadeus.com.
You may also lodge a complaint before competent data protection authorities.
For U.S. residents:
Please refer to ourUnited States Supplemental Privacy Noticefor additional information applicable to individuals residing in the United States.