This Privacy Statement was last updated on 6 May 2026
About this Privacy Statement
This privacy statement explains how Airways collects, stores and uses your personal information. In this
Privacy Statement, “Airways”, “we”, “us”, and “our” refers to the relevant Airways entity, as
applicable.
Openness and transparency are important to us. The Privacy Act 2020 (“the Act”) requires us, like any
other New Zealand agency, to tell you certain things about the personal information we need in order to
carry out our functions.
As we take our obligations under the Act seriously, we would like to explain what personal information
we collect and how we use or share it. We will also explain about the way we store and protect personal
information, your rights to access and correct it, and how each of our Airways entity websites (each a
Website) process personal information.
As at the date of this Privacy Statement, the Airways entities (Airways entities) include Airways
Corporation of New Zealand (Airways Corporation), Airways International Limited (AIL), AIL trading as
Aeropath, and Airshare Limited (AirShare).
Changes to this Privacy Statement
We may amend the terms of this Privacy Statement from time to time by uploading a revised policy onto
the applicable Website. Any changes will apply from the date that we upload the revised policy. It is
your responsibility to review any updated Privacy Statement.
If we update this Privacy Statement, your continued engagement with us (including procuring our
products) or continued access to or use of our services (including our Websites or apps) (together, the
Services) constitutes acceptance of those changes. If you do not agree with the updated Privacy
Statement, you must cease procuring our products and using our Services.
Summary of this Privacy Statement
A high-level summary of key points in this Privacy Statement is:
We collect personal information where it is reasonably necessary in order to carry out our
functions, which may include security validation that we use to protect you and Airways from
malicious actors or malware.
We may collect personal information about you either directly from you or from other people or
agencies, and we may generate personal information about you when we carry out our functions.
We store all our data (including your personal information) in secured facilities that are
protected with all reasonable technical and process controls appropriate to the data being
stored (see more information on this below).
You can ask us for a copy of your personal information at any time. We will be as open as we can
with you and ensure that we meet our obligations.
We will only use and share personal information where necessary to carry out the functions for
which we collected it, or if required to do so by law.
If you cannot find the information you need, or you have concerns about the way we are managing
your personal information, then please contact us at any time using the contact methods set out
at section 11 (Your privacy rights and how to contact us).
How we collect personal information
Direct collection from you
Most of the personal information we collect is provided directly by you, or your authorised
representative, when you engage with us. You do not have to provide your personal information to us.
However, we may not be able to provide you with our products or Services if you do not provide us with
the information we need.
Personal information we may collect from you directly may include:
your name;
your location;
your contact details, including your address, email address or phone number;
information about your authorised representative (if you have one);
any documents or other information you provide to us or agree for us to gather in order to receive our Services;
correspondence from you sent to us;
billing or purchase information;
the information set out at clause 7.1 if your employer or organisation has engaged us to provide
training Services to you; or
data that we use to assess the security of the transaction with you such as the operating system
you use, type of browser and similar information that allows us to protect you and Airways.
In the course of providing you with Services, we may generate personal information about you. The
personal information we may generate about you may include:
correspondence (such as letters and emails), including between our staff or with the staff of
other agencies;
file notes, memoranda, meeting minutes or other records of actions taken; and
legal views or opinions.
Collection from third parties
We may also collect your personal information from third parties where you have authorised this or the
information is publicly available. Where we collect personal information from a third party, then (to
the
extent required by the Information Privacy Principle 3A of the Privacy Act) we will take reasonable
steps to
ensure that you are aware of the collection, and if not already covered by this Privacy Statement:
the purpose for which it is being collected, the intended recipients, and our contact details;
the legal basis upon which we are authorised or required to undertake the collection; and
your rights to access and correct the personal information.
Information collected from use of our Websites
When you use our Websites, you may provide various personal details such as your name and email address.
This information, and any other information provided by you or collected / generated by us may be used
by us so that we can communicate with you and provide Services to you. In addition to the details you
provide, the server will record the specific transactions you perform when visiting our Websites. This
information will primarily be used for statistical purposes but also for security purposes.
Web server logs are also kept for the purposes of generating Website usage statistics and performing
security auditing. The logs record information every time you request a page from the server. This
information will not be used to identify you except in the event of irregularities in the use of the
Website. The information logged may include:
the time of each page request;
the pages you requested;
what web browser you are using;
your client IP address;
what site you came to the relevant Website from; and
other security specific data we need to ensure the ongoing security of the transactions with you
and others who use our Website.
Cookies are small pieces of information that a website can store on your computer through your web
browser. Each Website uses cookies only for maintaining your user session – the cookies will not be
stored to your hard disk. You may disable cookies by changing the settings on your browser, although
this may mean that you cannot use a Website or some or all of its features.
How we use personal information
We may use personal information in order to:
provide our products or Services;
answer queries or respond to communications from you, including a complaint;
verify your identity;
contact you about our products or Services;
improve the Services that we provide to you;
undertake credit checks of you (if necessary);
bill you and to collect money that you owe us;
conduct research and statistical analysis (on an anonymised basis);
market our products or Services to you, including contacting you electronically (e.g. by text or
email for this purpose). You can opt out of further marketing communications by using the
unsubscribe function located in the footer of our email or by emailing us to advise that you
wish to be removed from these marketing communications;
if you use Aeropath’s Services, contact you from time-to-time with important safety information,
in accordance with section 6(b)(iii) of the Unsolicited Electronic Messages Act 2007. For
example, we may contact you to notify you of any delay in the distribution of an amendment to
the Aeronautical Information Publication (AIP). You cannot opt out of safety-related
communications;
protect and/or enforce our legal rights and interests, including defending any claim; and
for any other purpose authorised by you or the Act.
We may keep a record of all the products and Services you have purchased from us for quality control,
training and record keeping.
How we disclose personal information
We may disclose your personal information to:
one or more other Airways entities where this is necessary to provide you with products or
Services. For example, one Airways entity may perform accounts and billing functions on behalf
of another Airways entity;
a third party provider or data processor, including our payment services provider and any person
that hosts or maintains any underlying IT system or data centre that we use to provide the
Websites or other Services and products;
a credit reference agency for the purpose of credit checking you;
third party providers or data processors to assist us to deliver products and Services (for
example, we pass your contact details on to our fulfilment agent in order to pack and deliver
the products you have purchased from our online store);
other third parties to generate anonymised statistical information;
any person or entity authorised by, or who can lawfully require disclosure under the Act or any
other applicable law (e.g. a regulatory authority);
authorised contractors and third parties (such as data analysis or information security
providers) engaged to support our operations, including maintaining cyber security standards (as
described at clause 8.6); and
any other person authorised by you.
If you use the AirShare Services in the AirShare mobile app, data is used solely within the app and is
not shared or disclosed to any third parties except to the extent necessary to provide the AirShare
Services.
Additional policy terms for training Services
If your employer or organisation has engaged us to provide training Services to you, we will need to collect
some personal information from you in addition to the above. This includes your:
name;
contact information;
aviation experience, qualifications and certifications; and
performance during the course of our training.
We collect this information in order to provide you and your employer or organisation the training Services,
and to confirm whether or not you have successfully completed the training. Providing this information is
optional. However, if you choose not to provide this information, you will not be able to participate in our
training Services.
If you ask us to, we will also confirm whether or not you successfully completed the training to other
organisations (for example, future employers).
Storage, retention and security
We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk.
Each Airways entity maintains robust internal processes to ensure that any personal information it receives from another Airways entity is protected to at least the same standard that the receiving entity applies to its own information.
Your user details and password are stored in a secure database. Passwords are hashed before being stored. When your user details or password are transmitted between our servers and your browser, that information is protected using Secure Sockets Layer (SSL).
We use cloud-based services to store and process your personal information. We primarily rely on Microsoft Azure data centres, which are predominantly located in Australia. However, some services may store data in other jurisdictions, or within Airways’ own data centres. We assess the security and appropriateness of all offshore data facilities against applicable Department of Internal Affairs guidance.
Where personal information is stored or processed offshore, we will only transfer your personal information outside New Zealand in accordance with the requirements of the Act, including if we have your permission, or if we have reasonable grounds to believe that:
the recipient is subject to New Zealand privacy laws;
the recipient is subject to privacy laws in their country that offer similar protections to those under New Zealand privacy laws; or
the recipient agrees contractually to protect the information in a way that provides similar protections to those under New Zealand privacy laws.
To help ensure compliance with the law and maintain cyber security standards, we and our authorised contractors may monitor the use of and interaction with our information systems (including email traffic and web browsing). This monitoring may include activity logging and analysis, and occasional formal audit. Information gathered through such monitoring (regardless of whether it relates to or is connected with your involvement in any malicious or illegal activity) may be:
used to prevent and resolve unauthorised access to or attacks on our information systems; and
provided to others (such as data analysis companies, information security providers, the police and/or other government agencies) to comply with New Zealand or overseas laws, improve cyber security, and/or assist us to decide what is needed in order to comply with such laws or improve cyber security.
Privacy Policies of third parties
We may engage specialist third party providers or data processors to assist us to deliver products and Services, including security assessments. For example:
AirShare uses Google Maps to deliver its services. Please review Google’s Privacy Statement (available at https://policies.google.com/privacy, as amended from time to time) on how Google handles your personal information.
Your credit card information is sent directly to our payment processor to process your payments, and is protected in accordance with their security methods. If you subscribe to MarketPlace, please review the Privacy Statement of Payment Express (https://xdlworldwide.com/privacy-policy/) on how Payment Express handles your personal information.
We have used reasonable care in selecting our third party providers and data processors. However (to the extent permissible by law) we disclaim any responsibility for their actions.
In addition, our Services and Websites may contain links to third party services that are not under our control, and which may not follow the same privacy practices as us. We do not endorse or make any representations about the third party services (including but not limited to their accuracy or completeness) and will not be responsible for their content, privacy practices or terms of use. Your disclosure of personal information to third party services is at your own risk, and we recommend that you check any relevant privacy policies before providing your personal information to any third party.
Access to and correction of personal information
Subject to certain grounds for refusal under the Act, you have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected (by way of correction, deletion, or addition) if you think it is wrong.
If you’d like to ask for a copy of your information, or to have it corrected, please contact us using the details below.
In respect of a request for correction, if we agree with the correction and we are reasonably able to change the personal information, we will make the correction. If we do not make the correction, we will take reasonable steps to attach a statement of correction in relation to the relevant personal information.
If you request deletion of your personal information, we will consider the request in accordance with the Act. Where the information is no longer required for a lawful purpose, we will take reasonable steps to delete or de-identify the information as soon as practicable. However, we may retain personal information where required or permitted by law, or where the information is still required for a purpose set out in this Privacy Statement.
We may charge you our reasonable costs of providing to you copies of your personal information or correcting that information, in accordance with the Act.
Your privacy rights and how to contact us
Should you have an enquiry relating to this Privacy Statement, an access or correction request, or any privacy-related concern, please contact us at Privacy.Officer@airways.co.nz.
When contacting us, please explain and, where required, provide evidence of who you are, and include details of your request.
Privacy Commissioner
If you are not satisfied with our response to any privacy-related concern you may have, you can contact the Office of the Privacy Commissioner online at www.privacy.org.nz, or:
Office of the Privacy Commissioner
PO Box 10-094
Wellington 6143
