Privacy Policy

I. General Information About This Privacy Policy

II. Definitions

III. Categories of Information We Collect or Process

3.1. Personal Information You Provide to Us

In using our Services or interacting with us, you may provide us with the following categories of Personal Information, including inferences drawn from this Personal Information:

• Contact information and identifiers, including but not limited to your name, address, billing address, shipping address, phone number, and email address;
• Financial information, including but not limited to credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details;
• Credentials/account log-in information, including but not limited to your username, password, security questions, preferences and settings;
• Communications with us, including but not limited to the information you include in communications with us, for example, when sending inquiries;
• Background information;
• Comments, surveys and opinions marketing;
• Your preferences and interests, and other information used to personalize your experience;
• Your measurements for space gear and outfits;
• Event-related information;
• Travel and hosting information;
• Information related to flight operations and training;
• In some cases, biometric information when required for authentication;
• Special Information such as:
  • Government identifiers;
  • Certain demographic data that qualifies as Special Information, such as race, ethnicity, gender, sexual orientation, and disability, to help us understand the diversity of our business operations and our customers as allowed under local law. We also collect this information from you as part of our reporting requirements under various laws. This information, when collected, is generally done so on a voluntary consensual basis, and you are not required to provide this information, unless it is necessary for us to collect such information to comply with our legal obligations;
  • Health and wellness information, such dietary preferences and allergies as part of your journey with us and to participate in our events;
  • In the particular context of your health and medical risk assessments related to flight operations and in case of medical emergencies, please see our Electronic Medical Records Privacy Notice for more details;
• Other persons’ information, such as emergency contact information, the contact information of your guest(s) and certain preferences for how this Personal Information is processed, which you represent and warrant is shared with us after you have obtained the other persons’ consent;
• Additional information as otherwise described to you at the point of collection or pursuant to your consent; and
• Any other information you choose to directly provide to us in connection with our Services.

3.2. Personal Information We May Automatically Collect About You

In using our Services or interacting with us, we may collect or process the following categories of Personal Information about you, including, without limitation:

• Commercial vendor/supplier information, including details about products or services purchased or provided, transaction records and contracts and related data such as purchasing or consumption histories or preferences;
• Identity and contact information, such as first and last name, phone number and email address;
• System and device information;
• Date, time or logs;
• Activity in engaging our Services online, including details about webpages visited and the amount of time spent on each page;
• GPS coordinates for use, including but not limited to tracking flight participants before and after disembarkation, or GPS coordinates if you choose voluntarily to wear a specific tracker device;
• Your weight and balance within the cabin and the cockpit, to calculate and monitor the center of gravity of the spaceship;
• Radiation exposition of the cabin to document the rate of exposition to radiation during a spaceflight;
• Pictures, voice, audio and video recordings of you;
• Social media platform information, in accordance with your privacy settings on the social media platform, and inferences drawn from any of this information reflecting your preferences and characteristics;
• Analytics; and
• Special Information such as security and safety screening and background checks that may reveal criminal or terrorist activities or offenses.

Our automated methods of collecting information are sometimes related to or supported by manual methods. For example, we may use advanced technologies, including artificial intelligence (“AI”), which help enable our information technology systems or those through third parties, to scan, search, classify, score and create analytics, and to perceive, learn, reason and assist in decision-making. To create and maintain these types of processing, we manually review some of the predictions and outcomes produced against the underlying data from which outcomes were made.

3.3. Technologies We Use to Collect Personal Information

We collect certain Personal Information directly and through third parties. We collect this information by using certain technologies, such as cookies, pixels, web beacons, GPS devices, audio and video recording devices and other technologies. Third-party service providers, advertisers and/or partners may also view, edit or set their own cookies, pixels or web beacons. The use of these technologies by such third parties is subject to their own privacy policies and is not covered by this Privacy Policy, except as required by law.

• Cookies: To learn more, please see our Cookie Notice, which addresses the use of cookies, how to opt out and information about additional technologies we may use in providing our Services, such as Flash cookies, web beacons, analytics tools and mobile device technologies.
• Log Files: Our servers log information about your IP address, your browser type and the current URL you are visiting. This information is always provided by your browser and automatically logged. These log files are stored in a secure location and used in our internal analysis of traffic patterns.
• Analytics: Services providing analytic tools (“Analytic Services”), such as Google Analytics®, are used with our websites and transmit website traffic data to servers located within the United States. Analytic Services do not collect Personal Information, identify individual users or associate your IP address with any other data. We do not share any Personal Information with our Analytic Services in connection with their performing of any services on our website. We use reports provided by Analytic Services to help us understand website traffic and webpage usage.
• We collect non-Personal Information, such as IP addresses, operating systems, links clicked, pages visited, browser type, time zone setting, browser plug-in types and referring websites of visitors to our website. This information is collected for statistical analysis purposes such as:
  • maintaining the security and operation of the Site;
  • determining web-traffic trends; and
  • determining the effectiveness of our partnerships with other websites.
• Google’s ability to use and share information about your visit to the Site is subject to Google’s privacy policy, which can be accessed and reviewed by clicking here.
• Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. Because there is not a common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the cookie controls and advertising controls described in this Privacy Policy. Please note that if you visit our website with the Global Privacy Control opt-out preference signal enabled, depending on where you are, we will automatically treat this as a request to opt-out for the device and browser that you use to visit the website. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/.

3.4. Personal Information We May Receive from Third Parties

We may collect additional Personal Information about you from our affiliates, partners or vendors, such as travel agencies, data brokers, third-party websites, social media platforms and/or sources providing publicly-available information to help us provide the Services to you, confirm, enhance or supplement our existing information about you (e.g., with your consent or to perform background checks for credit and criminal history), help prevent fraud, maintain security and for marketing, advertising and other business purposes.

IV. How We Use Your Personal Information

• Providing Services and Support:
  • Delivering our Services and related products
  • Fulfilling your requests, including creating and maintaining accounts, processing applications and completing transactions
  • Responding to inquiries and providing requested information via email, text or chat
  • Offering customer support services
• Personalization and Experience:
  • Personalizing or customizing your experience
  • Managing your travel, hosting and hospitality arrangements
  • Managing your participation in interactive features and events
• Marketing and Communications:
  • Sending communications about our Services, company updates and press releases
  • Sending promotional materials, special offers and event invitations (unless you have opted out)
  • Delivering location-based Services and complying with territorial requirements
  • Administering surveys and questionnaires, such as for market research or customer satisfaction purposes
  • Raising awareness and engaging the public in spaceflight initiatives
  • Sending emergency communications
• Safety, Security and Compliance:
  • Performing security screenings and background checks to ensure a safe environment
  • Complying with safety, security and export control obligations and other applicable requirements
  • Using surveillance cameras and recordings for security purposes
  • Detecting and preventing fraud, policy violations and inappropriate behavior
  • Protecting intellectual property and confidential information
• Press, Media and Communications:
  • Using pictures, voice, audio, and video recordings for:
    • Communication between pilots, mission control and spaceflight participants
    • Press and media content(s)
    • Souvenirs and relationship management
    • Incident investigations
    • Security and safety purposes during facility visits, events or spaceflight journey, including use of CCTV footage
• Business Operations
  • Operating, maintaining and improving our Services and our products
  • Performing business analyses
  • Monitoring threats and cyber threats against our business operations and activities
  • Managing relationships and our contractual obligations with our customers, guests, visitors, suppliers, vendors, business partners and investors
  • Building predictive models and using AI systems to enhance our Services and marketing
• Visitor Management
  • Managing access and visits to our facilities, and maintaining records of interactions
  • Coordinating logistics and security for visits and operations on our facilities
  • Maintaining security, safety, operational integrity and compliance, including through identity verifications and authentication
• Legal and Regulatory Compliance
  • Meeting legal and regulatory requirements, responding to lawful requests, exercising our legal rights, defending and advancing our legal interests and defending legal claims, protecting the Services, products and our business operations, including for instance:
    • Preventing, detecting and protecting against fraud, harmful and illegal activity, unauthorized activities and access and other misuses
    • Investigating, preventing or taking action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party or violations of applicable agreements
    • Complying with applicable laws and our legal obligations, our terms and conditions, privacy policies and other company policies
    • Responding to legal processes and related to legal proceedings
• Other Purposes
  • Operating core business functions
  • Strategizing and implementing a reorganization, restructuring, merger, acquisition or transfer of assets
  • Any other purposes disclosed at the time of collection or with your consent.

V. Legal Bases for Data Usage

• Consent: Where you have given us consent to process your Personal Information for one or more specific purposes.
• Legitimate Interests: Where processing your Personal Information is reasonably necessary to achieve our legitimate business interests. For example, we may process your Personal Information to investigate, prevent or take action regarding potential violations of our policies, suspected fraud or in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business to another company.
• Performance of a Contract: Where we have entered into a contract with you, or you have requested that we take steps prior to entering into a contract, we process your Personal Information to fulfill the terms of our contract.
• Legal Obligations: Where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order or legal process. For example, we may process your Personal Information in response to a subpoena, or in response to public authorities as necessary to comply with national security or law enforcement requirements.
• Vital Interests: Where processing your Personal Information is necessary to protect your vital interests or the vital interests of another natural person. For example, we may process your Personal Information where we believe it is necessary to respond to natural or human-caused disasters.
• Public Interest: Where processing your Personal Information is necessary for the performance of a task carried out in the public interest.

VI. How We Will Contact You

VII. Data Aggregation and De-Identification

VIII. Disclosure of Your Personal Information

8.1. Third-Party Processors

We may share your Personal Information with third-party data processors that perform certain functions or services on our behalf, including but not limited to data hosting providers, management and storage providers, application and software providers, cybersecurity, safety and security service providers, AI service providers, analyses and analytics service providers, payment service providers, customer and maintenance service providers, communications service providers, travel agencies, hotels, travel or hosting service providers or event providers, third-party screening and background check companies, insurance companies and health care service providers, to provide you with our Services. These third-party processors will process your Personal Information only for purposes specified by us and will be bound by contract to meet our obligations under applicable law.

8.2. Our Third-Party Vendors

Collection and processing of Personal Information may occur by or in collaboration with our third-party vendors.

If you submit a payment for an application through the portal, your credit card (or other payment information) is processed using our third-party payment processing vendor through an encrypted online payment program. For more information regarding the collection of your payment data, please see our payment processing vendor’s privacy policy. Virgin Galactic, at its sole election, may discontinue support for any payment method or it may support additional payment methods (e.g., Apple Pay, Google Wallet or Amazon Payments).

When you agree to participate in a program, your contact information and other pertinent information may be shared and collected using the third-party vendor WhatsApp LLC ("WhatsApp"), through its online processing systems. WhatsApp shares information globally, both internally within the Meta Companies and externally with their partners and service providers. For more information regarding the collection of your data, please see the WhatsApp privacy policy by clicking here.

8.3. Trusted Partners

Virgin Galactic has also built close working relationships known as Trusted Partners who are valued partners with which Virgin Galactic works closely (for example travel agencies, event agencies or sponsors). When you agree to participate in a program, your contact information and other pertinent information will be shared with our Trusted Partners. These Trusted Partners may from time to time wish to send participants, information about their products and services that may be of interest.

8.4. Disclosure of Information for Legal and Administrative Reasons

We may disclose your Personal Information without notice: (i) when required by law or to comply with a court order, subpoena, search warrant or other legal process or investigation; (ii) to cooperate or undertake an internal or external investigation or audit; (iii) to comply with legal, regulatory or administrative requirements of governmental authorities (including, without limitation, requests from the governmental agency authorities to view your Information) or in defending or pursuing a legal claim; (iv) to protect and defend the rights, property or safety of us, our subsidiaries and affiliates and any of their officers, directors, employees, attorneys, agents, contractors, partners, users or customers; (v) to enforce or apply our terms and conditions and agreements; (vi) to verify the identity of the user and customers of our Services, (vii) to share with contractors, consultants or service providers including IT suppliers, insurance companies, cloud hosting providers, database providers, backup and disaster recovery specialists, medical professionals, legal professionals and email and document storage providers and (viii) as part of a sale, acquisition, merger or transfer of some or all of our business or assets.

8.5. Information Shared with Our Affiliates

We may share your information, including analytics, with our subsidiaries and affiliates, or if we go through a corporate sale, merger, reorganization, dissolution or similar event. If you do not want us to share your Information with our subsidiaries and affiliates, please Contact Us.

8.6. Online and Mobile Communications (Chatrooms, Forums, Contests and Message Boards)

If you correspond with us by email, questionnaires, surveys, social media or other digital online platform, we may retain such correspondence and any Personal Information contained in it and use it to respond to your inquiry and to reach out to you. If you use our Virgin Galactic’s portal, you may interact and communicate with other customers and you may elect to share with them your profile, name and approximate location (based on the details we have on file for you but does not disclose your exact address). We will not share this Personal Information with anyone except with the other customers and our service providers to provide the Services.

8.7. Safety and Security

We may share with security or safety professionals, emergency responders, disaster recovery specialists, medical and legal professionals and federal and local authorities, your Personal Information to protect the safety and security of our users, customers, visitors and employees, to provide emergency responses, to prevent fraud, abuse or unauthorized activities or to protect the rights of property of us, third parties, you or others, including enforcing the terms of our agreements.

8.8. Aggregate/De-Identified Information

We may share Aggregate/De-Identified Information with any third parties, including but not limited to advertisers, promotional partners, affiliates, investors and sponsors.

8.9. With Your Consent

We may share information consistent with this Privacy Policy with your consent.

IX. Interest Based Advertising

X. Data Storage, International Operations and Transfers out of Your Home Jurisdiction

XI. Data Retention

XII. Data Protection

XIII. Third-Party Website Links

XIV. Children

XV. Your Rights

• Depending on the state or country where you live, and to the extent we hold Personal Information about you, you may request that we honor any rights provided to you under applicable privacy laws, which may include the right to:
  • Access: Request access to your Personal Information and obtain a copy and certain other information about it.
  • Update or correction: Request that any incomplete or inaccurate or obsolete information we hold about you is corrected.
  • Unsubscribe from marketing communications: When we send marketing communications, you can opt out of them. Please note that even if you unsubscribe to direct marketing messages, we still may need to send you communications relating to your use of our Services, where such communications are service or update messages, or regarding your requested transactions.
  • Complaint: You may have the right to lodge a complaint with your Data Protection Authority.
  • Non-discrimination: Virgin Galactic does not discriminate against those who exercise any of their rights described in our Privacy Policy.
  To exercise your right or to ask us any question about your right, go to the section Contact Us.

XVI. Affiliates

• Virgin Galactic Holdings, Inc.
• Virgin Galactic Limited
• Galactic Enterprises, LLC
• Galactic Co., LLC

XVII. Changes to the Policy

XVIII. Contact Us

Attn: Privacy Team

1700 Flight Way

Tustin, CA 92782

USA

XIX. EU, EEA and UK Privacy Disclosures

19.1. Data Controller

Unless otherwise stated at the time of collection, Virgin Galactic LLC is the data controller for the Personal Information we process for persons in the EU, EEA and UK as it relates to our Services.

19.2. Representatives

The data controller’s representatives in the UK and in the EU are:

19.3. Your Rights

To the extent the European Laws apply to you and our processing activities, and we hold such Personal Information in our capacity as a data controller as defined under those laws, you may request that we honor any rights provided to you under the European Laws, which may include the right to:

• Access: Request access to your Personal Information and obtain a copy and certain other information about it.
• Correction: Request that any incomplete or inaccurate information we hold about you is corrected.
• Erasure: Ask us to delete or remove Personal Information in certain circumstances. There are also certain exceptions where we may refuse a request for erasure (e.g., where the Personal Information is required for compliance with law or in connection with claims).
• Restriction: Ask us to suspend the processing of certain of your Personal Information about you (e.g., if you want us to establish its accuracy or the reason for processing it).
• Transfer: Request the transfer of certain of your Personal Information to another party.
• Objection: In addition, where we are processing your Personal Information based on our legitimate interests (or those of a third party) you may challenge this, e.g., revoking your consent for processing Personal Information. We will consider your request in accordance with applicable data protection and privacy laws. However, we may be entitled to continue processing your Personal Information based on our legitimate interests or where this is relevant to legal claims we may make or are made against us. You also have the right to object where we are processing your Personal Information for direct marketing purposes on the basis of consent.
• Automated decisions: Contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
• Opt out from marketing communications: When we send marketing communications, you can opt out of them. Please note that even if you unsubscribe to direct marketing messages, we still may need to send you communications relating to your use of our Services, where such communications are service or update messages, or regarding your requested transactions.

To exercise any rights provided under European Laws, please Contact Us.

You also have a right to lodge a complaint with a supervisory authority, in particular in the Member State in the EU where you are habitually resident where we are based or where an alleged infringement of European Law has taken place.

You may view a list of supervisory authorities here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

In the UK you can make a complaint to the Information Commissioner's Office (Tel: 0303 123 1113 or at www.ico.org.uk ).

If you have a complaint, we appreciate the opportunity to address your concerns. Please Contact Us.

19.4. Lawful Basis for Processing Your Personal Information

In addition to our disclosures described throughout our Privacy Policy, we handle your Personal Information, which may include your personal data as defined under European Laws, in furtherance of legitimate interests in commercial activities that are not overridden by the interest or fundamental rights and freedoms of the individuals at issue. Depending on what Personal Information we collect from you and how we collect it, we rely on various grounds for processing your Personal Information, including the following reasons:

• To administer our contractual relationship, including setting up and providing any of the Services you may request.
• Because you have provided your consent for us to do so.
• Because it is in our legitimate interest to operate our commercial sub-orbital spaceflight program, make commercial sub-orbital spaceflight available to the public, provide you with Services and other useful content, prevent fraud, address possible criminal threats to public security, process client information and communications, provide technology security, research and analyze customer engagement, improve the program experience, administer and manage our operations, including by engaging with third-party technology and other service providers, and any other legitimate interests or purposes disclosed to you at the time we collect your information.
• To fulfill any legal obligations including but not limited to those arising out of tort or contract or as required by law, regulation, rule or court order, to pursue and defend claims, to respond to regulatory inquiries or investigations, to conduct audits or other professional investigations or any other legal basis or obligation.

If the processing of your Personal Information is based on your consent, the European Laws also allow individuals the right to access, revoke or modify your consent at any time. To review or modify your consents, please Contact Us.

19.5. Consent to Transfer

Our primary operations are based in the United States, with additional activities in the United Kingdom.

We may use service providers based in the United States or outside the EU/EEA/UK to operate our business and our relationship with you. Please be aware that information, including your Personal Information, that we collect will be transferred to, stored and processed in the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside. We only collect and transfer to the United States information, including Personal Information: (i) with your consent; (ii) to perform a contract with you; and/or (iii) to fulfill a compelling legitimate interest of ours in a manner that does not outweigh your rights and freedoms. We endeavor to apply suitable safeguards to protect the privacy and security of your Personal Information and to use it only consistent with your relationship with us and the practices described in this Privacy Policy. We also enter into data processing agreements and model clauses with vendors whenever feasible and appropriate.

19.6. Children’s Information

In general, the Services are not intended for use by children under the age of sixteen (16), and the terms for certain Services may specify further age-related restrictions. In limited cases, certain Services may be offered for use by children under the age of sixteen (16), in which case additional age specified restrictions may apply.

If you are in the EU, EEA or UK and are over sixteen (16) years of age, you must have your parent or legal guardian’s permission to use the Services. Please have your parent or legal guardian read this agreement with you. If you are a parent or legal guardian of a user/customer located in the EU, EEA or UK and under the age of sixteen (16), by authorizing your child to use the Services, you are subject to the terms of this Privacy Policy and responsible for your child’s activity on the Services. You can Contact Us to help you manage your child’s experience.

For children located in jurisdictions within the EU, we comply with the age limits applicable in each EU Member State. In these instances, the references above to the age of sixteen (16) will be deemed to be references to the age limits applicable in each Member State. Where our Terms or our Privacy Policy refers to consent, this will require the consent of a parent or legal guardian in relation to any person under the age limits applicable in each Member State.

We may link to third-party websites that may collect data from children. These third-party websites have their own privacy policies and terms and conditions. See Third-Party Website Links for more information.

For certain activities in which children are allowed to participate, any request for Personal Information (such as registration data) is intended for and directed to the parent or legal guardian.

CHILDREN: If you are under sixteen (16) years of age, please do not use or access our Services at any time or in any manner. Upon learning of the existence of information concerning persons under sixteen (16) years of age (or a higher age threshold where applicable) that has been collected by us without verified parental consent, we will take appropriate steps to delete it.

PARENTS/LEGAL GUARDIANS: In the event that we begin collecting any Personal Information or data from children under the age of sixteen (16), we will notify parent(s) or legal guardian(s) first, and will seek parental or legal guardian consent to collect, use and/or disclose certain Personal Information from children under the age of sixteen (16) where applicable under law. Parent(s) or legal guardian(s) may review and have deleted their child’s Personal Information and may refuse to permit further collection or use of their child’s information by Contacting Us. Parent(s) or legal guardian(s) may consent to our collection and use of their child’s Personal Information without consenting to the disclosure of that information to others.

We encourage parents and guardians to monitor their children’s online behavior, put parental control tools in place and teach children not to provide their Personal Information through the Services without parental consent. Contact Us if you believe that we have mistakenly or unintentionally collected information from a child under the age of sixteen (16).

XX. References

• VG2600-EAPP-001 Employees and Applicants Privacy Policy
• VG2000-CNP-001 Cookie Notice
• Electronic Medical Records Privacy Notice