Effective January 1, 2026
At Airlines Reporting Corporation, we value your privacy and are committed to protecting and processing your personal data responsibly.
Airlines Reporting Corporation ("ARC," “us,” or “we”) provides a critical service in the air travel industry by providing financial settlement of transactions, including refunds and/or exchanges, between participating airlines and travel agencies (collectively, “Customers” or “Travel Providers”). ARC also sells data products, which are used by ARC’s Customers and third parties, to settle and report transactions, process credit card transactions, audit and reconcile sales data, and understand travel and demand patterns.
This Privacy Policy applies to:
This Privacy Policy does not:
In order to facilitate interactions with ARC and manage the business operations of ARC and its related entities, ARC may collect both Personal Data and non-personally identifiable information from different sources. These sources include:
"Personally Identifiable Information" (also referred to as "Personal Data" or “personal information”) is any information that identifies you personally, either alone or in combination with other information available from ARC. Personally Identifiable Information ("PII") does not include information that does not identify an individual. The types of Personal Data that ARC processes is a subset of the typical information that a customer provides when they travel. This subset of information includes individual passenger name and credit card number and in certain limited circumstances, frequent flyer number, date of birth, and other identifiers associated with airline tickets sold to passengers through U.S.-based travel agencies accredited by ARC. This subset of information also includes non-personal information, including passenger name record (“PNR”) and ticket number. We do not collect or process sensitive personal data.
"Non-personally identifiable information" includes data that does not identify a specific individual. For example, when you use ARC's websites, we may collect non-personally identifiable information such as your browser type, the type of operating system you use, the name of your Internet Service Provider, and pages visited on our site. This information is collected for site administration purposes such as monitoring and evaluating how visitors use the sites, analyzing usage trends and statistics, and enhancing the functionality and usability of the site to better tailor the site, products, and services to visitors' needs. ARC uses Google Analytics and Siteimprove to track such non-personally identifiable information about visitors to the site. Google Analytics’ policies may be viewed here. Siteimprove’s policies may be viewed here. Non-personally identifiable information may be aggregated for reporting about ARC websites' usability and effectiveness. We may also use information collected at this site to personalize the content, improve the content, and/or to provide product or service offers.
Cookies are identifiers that a website can send to your browser to keep on your computer to facilitate your next visit to that website. You can set your browser to notify you when you are sent a cookie, giving you the option to decide whether or not to accept it. A cookie file can contain information such as a user ID that the site uses to track the pages you've visited, but the only PII a cookie can contain is information you supply yourself. A cookie cannot read hard disk or read cookie files placed by others. ARC uses cookies on its websites and may place ads on other websites that may use cookies. We do not link the information we store in cookies to any Personal Data you submit on our site. The information collected by cookies helps us develop customized content for the site and also allows us to statistically monitor how many people are using our site and for what purpose. You can discover how to disable cookies on your browser.
ARC occasionally uses third-party advertising networks on social media platforms — such as LinkedIn, Facebook and Instagram — to collect visitor information on social media platforms to then pass over visitor information to ARC. Visitor information is used for ARC communications including, but not limited to, email, further advertising and direct mail. For more information or to opt out of this type of advertising, please visit the various social media platforms.
ARC does not knowingly collect Personal Data from children under the age of 13 and A RC does not target its websites to children under 13. If you are a parent or guardian of a child who has provided personal information without your knowledge and consent, you may request we remove this child’s information by contacting us at privacy@arccorp.com.
How we use the information we collect depends in part on which services are being used. We use Personal Data to:
We share Personal Data only when necessary to operate our business, deliver the services, or comply with legal obligations. This may include sharing Personal Data with employees, service providers, business partners, affiliates, or legal authorities, where necessary and appropriate.
We process Personal Data only where we have a legal basis for doing so under applicable law or regulations. The legal bases depend on the services and how they are used, and may include:
To protect against unauthorized access, disclosure, alteration or destruction of information, to maintain data accuracy, to safeguard and secure the information in the database, ARC has put in place physical, electronic, and managerial technical security controls that are proportionate to the Personal Data’s level of confidentiality or sensitivity.
We have established an information security program based on industry standard practices including policies and procedures for employees who may have access to your information. We also provide regular information security training for employees.
We will retain your Personal Data in accordance with applicable laws, and for as long as necessary for the underlying purposes for which the information was collected, unless a longer retention period is required or permitted by law. When we delete your Personal Data, we use industry standard methods to ensure that any recovery or retrieval of your information is impossible. We may keep residual copies of your personal data in backup systems to protect our systems from malicious loss. This personal data is inaccessible unless restored, and all unnecessary personal data will be deleted upon restoration.
ARC websites may provide links to third-party websites. If you access such links, you leave ARC's website. ARC does not control such sites or their privacy policies or practices.
Pursuant to the EU-U.S. Data Privacy Framework (“DPF”), ARC provides notice to individuals of the following regarding any of their personal data which may be transferred from the European Union to ARC, located in the United States:
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Airlines Reporting Corporation commits to resolve DPF Principles-related inquiries or complaints about our collection and use of your personal data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Airlines Reporting Corporation as follows:
Please submit A Subject Access Request (“SAR) by email to privacy@arccorp.com or by . You may also submit by contacting the following toll-free number: 1-855-816-8003. Each SAR must include the following information pertaining to the inquiry/complaint:
Name (including middle initial)
Preferred contact information, such as telephone number, email address, and/or postal address;
Last four digits of the credit card you used to purchase air travel;
A description of your request
Any other information you deem relevant to ARC’s ability to respond appropriately.
We will attempt to verify your identity using any of your personal data that is already in our possession. We may need to request additional personal data in order to verify your identity. We will not use additional personal data you provide for verification for any other purposes, and we will promptly delete any such information once the verification process is complete. By providing any such verification information, you explicitly consent to, authorize and request ARC’s collection and use of such information solely for the purpose of verifying your identity in order to respond to your SAR submission. Any SAR submitted without the above information may result in a delay of ARC’s response. We will investigate and attempt to resolve complaints within 45 days.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ARC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to the International Centre for Dispute Resolution of the American Arbitration Association (ICDR-AAA), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://go.adr.org/dpf_irm.html for more information or to file a complaint. The services of the ICDR-AAA are provided at no cost to you.
a. The right to be informed
b. The right of access
c. The right to rectification
d. The right to erasure/deletion
e. The right to data portability
f. The right to restrict or object to processing
The privacy practices described in this Privacy Policy comply with the Global Cross Border Privacy Rules System. The Global CBPR system provides a framework for organizations to ensure protection of personal data transferred among participating economies. More information about the Global CBPR framework can be found here.
The Personal Data we process may be accessed from, processed or transferred to countries other than the country in which you reside. Those countries may have data protection laws that are different from the laws of your country. Such cross-border transfer of your Personal Data is necessary for us to provide the services required by your transaction with our Customers, and for the other purposes outlined in this Privacy Policy.
The servers for our platform are located in the United States, where it is processed. The transferees of your personal data may also be located in countries other than the country in which you reside.
We have taken appropriate steps and put safeguards in place to help ensure that any access, processing and/or transfer of your personal data remains protected in accordance with this Privacy Policy and in compliance with applicable data protection law, including the EU-US DPF. Such measures provide your personal data with a standard of protection that is at least comparable to that under the equivalent local law in your country, no matter where your data is accessed from, processed and/or transferred to. We will comply with obligations regarding personal data cross-border transfer in accordance with applicable data protection laws, regulations, and conditions set by the competent authorities. This may include fulfilling obligations such as security assessments and/or certifications and signing agreements with overseas recipients in accordance with the standard contract established by the competent authorities.
Pursuant to GDPR (and other similar applicable privacy laws), ARC has appointed a data protection officer (“DPO”). If you would like to submit a SAR per above or have any questions or concerns related to this privacy policy or other aspects of data protection pertaining to ARC, you may reach out to the DPO as follows:
Airlines Reporting Corporation
3000 Wilson Blvd., Suite 300, Arlington, VA 22201
Attention: Data Protection Officer
Email: privacy@arccorp.com
Phone (to submit a SAR): 1-855-816-8003 (toll free)
If you believe that we have not been, or will not be, able to assist with your complaint or concern, and you are located in the European Economic Area (EEA) or the United Kingdom (UK), you have the right to lodge a complaint with the competent supervisory authority. If you work or reside in a country that is a member of the European Union or that is in the EEA, you may find the contact details for your appropriate data protection authority on the following website: https://edpb.europa.eu/about-edpb/about-edpb/members_en.
You have certain rights and choices with respect to your personal data, as described below:
Certain states provide their state residents with rights to:
The exact scope of these rights may vary by state or other jurisdiction. To exercise any of these rights by submitting a Subject Access Request (“SAR”), please fill out this form: https://my.datasubject.com/Uw03R7mCGS/60313. We will attempt to verify your identity using any of your personal information that is already in our possession. However, we may need to request additional personal information to verify your identity. We will not use additional information you provide for verification for any other purposes, and we will promptly delete any such information once the verification process is complete. You consent to, acknowledge and agree that by providing any such verification information, you explicitly consent to ARC’s collection and use of such information solely for the purpose of verifying your identity to respond to your SAR submission.
We respond to all verified requests we receive from individuals wanting to exercise their personal data protection rights in accordance with applicable data protection laws. Should you have the right under applicable law to appeal a decision we have made to not take action on your request, another email address to which you can submit your appeal will be included in our response to you.
In fiscal years 2023 and 2024, ARC received no requests to delete personal information, no requests to know or access what personal information we were collecting, no requests to what information we sold or shared and to whom, and no requests to opt out of the sale or sharing of personal information.
ARC reserves the right to change this policy at any time. Visitors to the site are responsible for consulting this page for any changes. The effective date will be noted to indicate the last time modifications were made. You may review the policy at any time by clicking on “Privacy” at the bottom of all ARC website pages.