tick tock

POPI Act – the clock is ticking…

The clock is ticking on the new POPI Act. And although the effective commencement date of this new act remains unclear, it is important for travel agents to be prepared and make POPI a priority in 2017.

Here’s what you need to know:

When is the POPI commencement date?

Nobody knows for sure. The President needs to proclaim the exact date.

According to law firm Michalsons, POPI is expected to commence by 24 May 2017 with a one-year grace period.

“This will mean that by 24 May 2018, you must comply with these privacy and data protection laws, whichever applies to you,” John Giles, a legal advisor at Michalsons, was quoted as saying. “There is no time to lose and much of the hard work needs to be done in 2017, especially the implementation action items.”

What is it exactly?

POPI regulates the manner in which personal information may be processed and provides rights and remedies to protect personal information.

Does it apply to travel agents?

The Act applies to every business that processes (collects, disseminates or merges) personal information (passport numbers, names, phone numbers, race, gender, etc.) and special personal information of the ‘data subject’ (client) ‘entered into a record’ (such as e-mails and hard copies) by or for a responsible person (the travel agent) who determines the purpose and means of such processing (to book flights, hotels, car rental).

How will POPI be policed?

The Act has its very own regulator, which was established in December 2016.

The regulator has extensive powers to investigate and fine responsible parties. Fines can range up to R10m and jail sentences of up to 10 years.  Consumers will be able to complain to the Information Regulator and it will be able to take action on behalf of consumers.

The regulator can demand access to a travel agent’s premises to conduct an investigation. He/she can search the premises, inspect, examine, operate and test equipment used to process information. He/she can also stop a travel agent from processing information, which will effectively mean the travel agent will have to close its doors.

For more information on the POPI regulator, the government has established a new website in February 2017: http://www.justice.gov.za/inforeg/index.html.

What should travel agents start doing and when?

Even though the commencement date has not been set yet, travel agents should start getting retting to comply with POPI.

Here’s what you can already start doing:

  • Raise awareness of POPI within your organization
  • Plan what you will do to protect personal information
  • Start implement the changes you need to make as soon as possible

The Basic Rule

You need the consent of the consumer in order to process their personal information!

Appoint an information Officer

An Information Officer is the CEO or equivalent officer or any person duly authorised by that officer. Every company (responsible party) must appoint an information officer to ensure compliance by the responsible party with provisions of the Act, and the officer must be registered with the Regulator.

Get everything in writing

Always notify clients about what type of information you collect about them and why. This notification can be a simple booking form, which reads: “Please refer to our privacy policy and terms and conditions, which deal with the way your personal information is stored. The purpose of collecting, disseminating and merging is contained therein.”

What if it’s a telephone booking?

Send the client an email, preferably with a delivery receipt recording the transaction and stating in the email: “As per our conversation, you confirm having understood and agreed to our privacy policy and standard terms and conditions; and (ii) that we may proceed with your booking/reservations on your behalf in accordance with our privacy policy and standard terms and conditions. We informed you during the telephone call that we do collect information in line with the POPI Act and by doing so you hereby consent to us utilising same for the purpose as set out in our privacy policy and standard terms and conditions etc.”

What about online bookings

Have a cookie policy in that warn your customers that you are collecting their personal information. Include a disclaimer that outlines that by logging onto the site, the client consents to sharing his information.

What to do with children’s information?

Children’s’ information may not be processed unless it falls into a specific authorisation in POPI. However, you have the right to capture the children’s information if a competent person, such as a parent, gives consent.

Can I share information with third parties?

No! Travel agents are not allowed, under the POPI Act, to reveal any personal and/or special personal information to third parties.

For example, agents cannot divulge information to their client’s wife or boss unless the client has signed an agreement that all information can be passed on.

It is advisable to have agreements in place with corporate clients whereby the company gives you the permission to do all future bookings for the company and their employees. Companies must ensure that they have the requisite permission and/or consent from their employees to hand over information on all bookings made by the company irrespective of who the employee is.

Adjust your terms and conditions

Insert clauses into your current terms and conditions that stipulate that your agency will be collecting personal information as well as special personal information as defined by the POPI Act to secure bookings with third party service providers.

Credit Card information

Internal policies and procedures will need to be implemented, especially with regard to safeguarding any credit card information. Ideally the company should appoint an information officer. This should be the only person to access and process payments on behalf of clients.


Destroy information

The Companies Act states that travel agents need to keep documents on file for five years. According to the POPI Act, travel agents can’t keep documents for longer than is necessary to render services.

What to do? Notify the consumer in writing that his/her information will be filed away for five years, after which it will be destroyed. During that period, nobody else will have access to that information.

If the client requests to be removed from the database, comply with this request. Remove his/her file from the computer database and get his/her file offsite with companies such as Metrofile or if you prefer electronic vaults, such as Safe4. 8.


Report any breaches!

Once a breach has occurred the travel agent has an obligation to report the breach to the Regulator as well as the client.

Travel agencies will be held liable for non-compliance with the POPI Act regardless of whether there was an intention to leak information or whether it was negligence.


Growth potential for outbound travel market

Research released at World Travel Market Africa 2017 by Grant Thornton and Reed Exhibitions points to growing opportunities for outbound travel in South Africa, with much of the growth coming from intra-Africa leisure travel.

Traditionally, outbound travel from South Africa has not been well tracked, says Otto de Vries, CEO ASATA. “This research is the first step to enhancing the insights our members have around patterns of leisure travel by South Africans.

“As part of ASATA’s approved strategy for 2017 / 2018, we are commissioning a Travel Market Index Report to provide members with insight in to South African traveller behaviour. We would encourage all companies involved in the business of outbound travel to participate so that proper intelligence can be shared for the benefit of all.”

The research indicates increasing opportunities for outbound travel from South Africans, driven predominantly by the growing wealthy and middle classes.

Gillian Saunders, deputy CEO Grant Thornton, says South Africans in general are not adventurous travellers, tend to travel to the same destinations which are affordable and are not big bookers of independent travel.

“The opportunities lie in showing South African travellers that there are new and different opportunities for travel worldwide other than the destinations they currently travel to. We are however challenged by exchange rates, the current economic climate and visa restrictions that are making it a challenge for South Africans to travel overseas.”

Otto indicates that this is a great opportunity for South Africa’s travel trade to guide South African travellers and grow the market by providing professional service and on-the-ground destination knowledge so that they can Travel with Peace of Mind.

According to Grant Thornton, South Africa’s total outbound travel market was set at 5,5m travellers in 2016 for all forms of travel. However, of that amount, only an estimated 300,000 travellers travel for leisure internationally.

“As a travel industry, we have to work together to grow the market so that more South African travellers have an opportunity to experience their own country as tourists and the many destinations that are welcoming South Africans to their shores,” concludes Otto.

Grant Thornton and Reed Exhibitions’ research indicates those key drivers of outbound travel to be connectivity to markets and products, the cost of travel, a culture of overseas travel and ease of travel and booking.

For more information on outbound statistics click here

Giving immigration advice for New Zealand – what you can legally do

All South African visitors to New Zealand now require a visitor visa. This recent change may increase the number of client requests you receive for New Zealand immigration advice.

A client might come to you for advice on how to get a visitor visa or relocate to New Zealand, how to fill out a visa application, or ask you to represent them to Immigration New Zealand.

What can you do?

Did you know that only licensed or exempt advisers can legally give New Zealand immigration advice? Exempt individuals include current New Zealand lawyers and Immigration New Zealand staff.

As a travel agent based in South Africa you can:

  • Provide information to clients directly from an Immigration New Zealand visa form or the Immigration New Zealand website;
  • Fill in a visitor visa form for a client, under their direction. This means that they tell you what to write on the form, you do not advise them;
  • Submit the application to Immigration New Zealand, as long as you haven’t provided advice;
  • Direct clients to the Immigration New Zealand website so they can complete the visa application themselves;
  • Direct clients to the New Zealand Immigration Advisers Authority (IAA) website where they can find a licensed immigration adviser in their area.

What can’t you do?

Travel agents who are not licensed or exempt cannot:

  • Advise a person on what New Zealand visa they are best to apply for or qualify for;
  • Advise a person how best to answer a question in a New Zealand visa application form;
  • Represent a person to Immigration New Zealand;
  • Use knowledge or experience in New Zealand immigration matters in any other way to advise, direct, assist or represent a person in regard to any immigration matter relating to New Zealand, whether directly or indirectly, and whether or not for gain or reward.

Don’t risk giving unlawful New Zealand immigration advice.

It’s important that you are honest to Immigration New Zealand when you assist clients with visa applications and declare your help. If you or the client is not honest, the visa application may be declined and Immigration New Zealand may refuse to deal with you in the future. 

Becoming licenced

There is more information available on the IAA website about becoming a licensed immigration adviser.  People from all countries, including South Africa, are able to become licensed New Zealand immigration advisers following a course of study that can be completed online.

The IAA Fact Sheet for Travel Agents can be found here. If you need further information or have any questions, please email info@iaa.govt.nz.

risk management

Protecting the mobile workforce – International SOS

As corporate travel continues to increase, there seems to be a discrepancy between the perceived travel risk outlook for travellers and the actual risks expected to increase this year.

Results of a survey conducted by International SOS and IPSOS show that 61% of respondents feel that the travel risk have increased for Sub-Saharan Africa over the past year and 72% indicated that travel risks have increased globally. Also, 57% feel that travel risks will continue to increase over the remainder of the year.

The results of the survey was presented as a recent workshop hosted by International SOS and according to the results respondents perceive the top five travel risks to relate to terrorism, civil unrest, extreme weather events, petty crime and natural disasters.

On the contrary however, International SOS says the reality is actually quite the opposite with the top five travel risk factors for 2017 including stomach and gastrointestinal problems, road accidents, inadequate healthcare, flu and non-infectious diseases.

When it comes to the biggest challenges in protecting travellers,  49% of respondents indicated that educating travellers on travel risks was their biggest challenge,  47% said that communication with their travellers during crises was a top challenge and 42% said tracking employee travel  was a major obstacle.

In light of these challenges companies have indicated that they have either reinforced travel security measures for their travellers, updated their travel risk policy, introduced pre-trip advisory emails, implemented travel safety training or implemented programmes to locate travellers.

According to International SOS, in an effort to protect travellers businesses should consider access to advice that is impartial and that can offer a professional assessment on travel risk to specific locations, risk assessments that a profile and itinerary specific, training of travelling staff, identification of key indicators of deterioration and the ability to rapidly and effectively communicate with travellers.

Another key point touched on by International SOS is the rise of mental health in the workplace. International SOS points out that it is increasingly important for organisations to consider the well-being of their mobile workforce.   

In response to this growing need, International SOS, has partnered with Workplace Options (WPO), to provide a seamless service of rapid response psychological support where it is needed, alongside its health and security advice and on the ground support prior to and during a business trip or expatriation.  The global short term counselling service is also extended to managers, local employees and families and can be provided in over 60 languages.

The counselling method is tailored to a mobile workforce: phone, videocall or face to face with support in over 60 languages. The assessment covers the presenting issue, supporting problems, support systems, coping strategies, background information, and a risk assessment and the outcome is a plan that covers the short-term focus including goals agreed upon with the participant.


Warn your clients about Malaria

The National Institute for Communicable Diseases (NICD) has issued a malaria advisory, warning travellers that South Africa is currently experiencing its annual malaria season and that there has been a recent increase of malaria cases in Mozambique due to the storms following Cyclone Dineo that affected Mozambique and the north-eastern parts of South Africa.

Also the Ministry of Health and Wellness for Botswana has issued a warning that the country is experiencing a high level of malaria, following the recent heavy rains.

With the approach of Easter and the public holidays in April, it is important for travellers visiting any of the malaria areas within or outside of South Africa to take additional precautions and maintain a higher index of suspicion.

The NDC has released the following helpful Q&A:

Where is Malaria Found?
Malaria in South Africa is present along the border with Zimbabwe and Mozambique. It is specifically prevalent in:

  1. Vembe and Mopane district municipalities of Limpopo Province
  2. Ehlanzeni district municipality in Mpumalanga Province
  3. Umknanyakude in Kwazulu-Natal Province
  4. Kruger National Park.

Neighbouring countries such as Mozambique, Zimababwe, Zambia, Malawi, Botswana and Namibia also experience high levels of Malaria.

When Is Malaria Season?
Malaria is distinctly seasonal in South Africa and occurs during the rainy months between September and May.

Who May Be Affected?
People living in an area with malaria are likely to contract the disease if precautions are not taken.

What Precautions Should Be Taken?
Measures To Avoid Mosquito Bites

  1. Wearing long pants, especially at night when mosquitos are more active
  2. Applying topical mosquito repellents that contain DEET
  3. Sleeping under mosquito repellent bed nets treated with insecticide
  4. Spraying living quarters with insecticide after closing doors and windows

Measures to Prevent Malaria from Developing
Travellers should consult with their doctors for a risk assessment and to obtain the appropriate anti-malarial prophylaxis. Current recommended chemoprophylactic regimens include either mefloquine, doxycycline or atovaquone-proguanil. The consulting doctor will advise on the best option and duration of treatment for everyone.

How Will I Know If I Have Malaria?
All travellers should be maintaining a high level of suspicion for flu-like symptoms during and up to one month after their visit ends. These symptoms include:
·       Fever
·       Chills and/or sweating
·       Headaches
·       Nausea and vomiting
·       Body aches
·       Fatigue

What Should I Do If I Suspect That I Have Malaria?
Malaria is treatable and is best diagnosed as early as possible. Anyone presenting with these symptoms should visit their nearest doctor or health facility immediately for an urgent malaria test. A negative test should be treated with caution and tests should be repeated until positive or until symptoms resolves.


US and UK ban electronics on certain flights – what to tell your clients

Corporate travellers flying to the US and the UK via the Middle East or North Africa will need to check in their electronic devices following a ban issued by the Trump administration and the UK government.

The Trump administration has ordered nine airlines to stop passengers from bringing most types of electronic devices — except smartphones — into the cabin for US-bound flights.

The UK government announced a sweeping cabin ban on laptops and tablets on inbound flights from six countries.

CNN listed the key things travellers need to know.


Which airports are involved?

The US ban cover 10 airports, including major global hubs such as Dubai.

The full list is: Cairo, Egypt; Dubai and Abu Dhabi, United Arab Emirates; Istanbul, Turkey; Doha, Qatar; Amman, Jordan; Kuwait City; Casablanca, Morocco; and Jeddah and Riyadh, Saudi Arabia.

The U.K. list is shorter. It covers all inbound flights from Turkey, Lebanon, Egypt, Tunisia and Saudi Arabia but omits airports such as Dubai, Abu Dhabi and Doha.


Which airlines are affected?

The nine airlines that operate direct flights to the US from affected airports are Egyptair, Emirates Airline, Etihad Airways, Kuwait Airways, Qatar Airways, Royal Air Maroc, Royal Jordanian Airlines, Saudi Arabian Airlines and Turkish Airlines.

Passengers will still be allowed to take electronic devices onto flights departing from the US.

The UK restrictions apply to 14 airlines: British Airways, EasyJet, Jet2.com, Monarch, Thomas Cook, Thomson, Turkish Airlines, Pegasus Airways, Atlas-Global Airlines, Middle East Airlines, Egyptair, Royal Jordanian, Tunis Air and Saudia.


Which devices are banned?

Smartphones will still be allowed. But passengers will have to check in any electronic devices bigger than that. That includes laptops, cameras, gaming devices and tablets such as iPads.

Medical devices required during the flight will still be allowed in the cabin after security screening.


When will it take effect?

The U.S. government officially notified the airlines at 3 a.m. ET Tuesday. They have 96 hours to fully comply.

And if they don’t? “We will work with the FAA to pull their certificate and they will not be allowed to fly to the United States,” one senior US official said.

The UK said it only that its measures would be introduced soon, and would be kept under constant review.


What are the airlines saying?

Turkish Airlines told passengers traveling to the U.S. that anything bigger than a smartphone must be checked in from March 25. Emirates also said it would implement the new measures for all passengers bound for the US from Dubai on Saturday.

Qatar Airways and EgyptAir said they would be applying the new instructions on March 24.

Other airlines, including Royal Jordanian and Saudi Arabian Airlines, have said they will implement the measures.


What’s the reason for the ban?

US officials say the move is a response to fears that terrorist groups may target passenger planes by smuggling explosive devices in consumer goods.

One official said there’s no specific plot authorities are aware of, but the US has been considering such a ban for some time.


Why these airports?

The US is especially concerned about the 10 airports in question, the official said, because of screening issues and the possibility of terrorists infiltrating the ranks of authorised airport personnel.

Officials said that they believe a threat to the U.S. would be negated if a passenger transferred through a secondary city with additional and more trustworthy screening procedures.


Isn’t it dangerous to put electronic devices in checked baggage?

Safety experts and regulators have long warned that batteries shipped in bulk could constitute a fire risk that ultimately could bring down an aircraft. The International Civil Aviation Organization advised global regulators last year to ban carrying bulk shipments of such batteries in the cargo holds of passenger jets.

But electronics spread out across a person’s luggage pose far less of a threat than palettes of lithium batteries, according to a U.S. aviation official.

SARS Audit Findings on the application of zero-rating on international air transport

Following our letter dated 09 November 2016, regarding VAT implications on additional or supplementary commissions from carriers, several of our members have now started to receive audit findings from SARS.

As you will recall from the communique, Shepstone Wylie Attorneys accompanied ASATA to a meeting with SARS to understand the organisation’s concerns and whether there could be an efficient and effective way to resolve the dispute. We also attempted to understand what SARS was focusing on and at the time of our letter to you, suspected that it only related to supplementary commissions, as prior to this meeting, SARS believed that the additional supplementary commissions were for the supply of some other service and that it should be subject to 14%, irrespective that the underlying service was either for the arrangement of local or international travel.

The arrangement of international travel is zero-rated in terms of section 11(2)(d) of the VAT Act and SARS’ view was that it does not automatically follow that the additional or supplementary commissions are also zero-rated in terms of section 11(2)(d).

Based on the SARS findings received to date, their position regarding the application of zero-rating is now clear. SARS believes that the service of arranging international transport is provided to the traveller, not the airline and that all commissions, overrides and rebates received from airlines is not consideration in respect of “arranging international transport” but for a separate supply, being the selling of tickets. As a result of this definition by SARS, they are of the opinion that commissions, overrides and supplier rebates received, do not fall with the ambit of “international transportation” or “arranging” thereof and therefore cannot be zero-rated.

ASATA’s current opinion is that commissions, overrides and supplier rebates in the case of international travel is also zero-rated because there is not another supply and that the arranging of international transport and the selling of tickets is one and the same thing.

What should you do if you receive a similar audit finding from SARS?

You will be required to respond to the findings within 21 days of receipt. We recommend that you apply to SARS for an extension. This should provide you with an additional 21 days to respond.

Engage your legal counsel and/ or auditors and request their assistance in drafting an appropriate response to SARS.

Prior to sending the response to SARS, we would request that your share it with ASATA. This will further guide and inform how the industry will look to respond to the matter, as a collective and whether or not we believe we have grounds to challenge SARS’s interpretation on the Act.

SIA to fold surcharges into Base Airfare – when will SA airlines follow suit?

Singapore Airlines and regional arm SilkAir have announced they will fold fuel and insurance surcharges into base airfares.

With the removal of the fuel and insurance surcharges as a separate component, customers will be presented with a single base airfare when purchasing tickets. The airline explains this move is intended to provide a more simplified fare structure for customers.

The folding in of fuel and insurance surcharges into base airfares will be implemented progressively by region, starting from 28 March 2017. It is expected to be completed by May 2017.

Fuel and insurance surcharges will also no longer apply to KrisFlyer frequent-flyer programme redemption bookings Redemption bookings on flights operated by other airlines may still include surcharges, with effect from 23 March 2017.

ASATA has welcomed Singapore’s announcement, saying that the position of ASATA on the matter has always been that fuel is a cost of doing business, an inherent part of the airline’s operations, and should be included in the airfare, much in the same was as other operational costs such as captain and flight attendant salaries are.

ASATA strongly advocates a move by all airlines operating within South Africa to also include their fuel surcharges, and any other charges that are under the control of the airline, within the base airfare to eliminate confusion among consumers and provide an all-inclusive transparent air ticket price.

Explains Otto De Vries, CEO ASATA: “Fuel is a cost of doing business and should be included in the airfare. The price the passenger sees should be the price he or she pays and any variations in the cost of an airline ticket should be directly related to the cost of doing business, and supply and demand. Not under the auspices of recovering an elevated cost that is no longer elevated.”


ASATA in the news

ASATA is featuring its members in the news on a regular basis. If you would like to be included among the travel consultants that comment or have a story where you’ve saved the day, please contact us on asata@bigambitions.co.za.

The following story appeared in BizCommunity this week and tells consumers exactly how South African travel consultants have given the Internet a run for its money. Check it out here

South African travel agents giving the Internet a run for its money

Technology, digitisation and automation – travel agents have faced numerous disruptions over the past few years. Newspapers have even predicted the end of the travel agent altogether, saying the travel consultant will soon become extinct. However, instead of succumbing to outside pressures, the South African travel industry has become stronger, and ASATA travel agents have even given the internet a run for its money.

The Internet can take orders but can it offer proactive consulting?

Sure Travel has focussed on proactive consulting and offering concierge-style services to its clients instead of limiting itself to order taking. Sure Travel’s Robyn Daneel Spicer explains that Sure Travel consultants are anticipating what the client wants in order to be able to offer their clients the best value-for-money offering.

Says Spicer: “An online travel agency can quote you on flights to small towns in remote parts of the world even if these flights will take over 24hours of travel. A Sure travel agent will investigate cutting travel time and find the best routing in terms of airfares, trains, and transfers. The client thinks they know what they want, but it is up to us as advisors to guide them in the right direction.”

The Internet has created tech-savvy travellers, but also customer-centric agents

The ease of booking travel online hasn’t only attracted tech-savvy travellers but also agents who are customer-centric, according to Club Travel.

Club Travel’s Luana Visagie explains many potential clients are confused by mixed reviews found online and are overwhelmed when it comes to penalties for changes and cancellations. “This is where a clued-up consultant is able to put the client at ease by asking questions, profiling the client and limiting options to those which really appeal to the client’s needs and budget,” she says.

Visagie says the disruptions the industry has faced, have pushed travel consultants to remain on top of their game. “The industry competition is tough and will only get tougher, so agents need to know how to ‘wow’ their clients to the point that they are referring their friends and family to their agent.”

The Internet can’t offer corporate travellers an end-to-end solution, but travel agents can

Marco Ciocchetti, CEO XL Travel, explains that the role of travel management companies or TMCs has become and will continue to evolve in finding end-to-end solutions for their clients from the booking process to the expense management of the company.

A corporate travel agent will offer clients a comprehensive optimisation of the company’s travel spend, as well as data consolidation and reporting. The ASATA travel agent will ensure travellers toe the line and are compliant with the company’s travel policy. They will also make sure the traveller is safe and put together a professional duty of care programme.

Can’t beat the technology wave? Join it

Club Travel’s Visagie explains there is no doubt the increase and growth of online travel platforms like booking.com, Airbnb and others have resulted in many more ‘DIY travellers’ and this has disrupted the industry. But, she says that instead of resisting this change, Club Travel offers clients the opportunity to make their bookings on any of Club Travel’s online booking platforms. The difference is that they have access to a support team if need be.


PCI DSS compliance – Don’t fear it, but don’t ignore it!

We don’t need to tell you that the risk of fraud associated with payment card transactions and potential data breaches has been rife over the past few years.

To ensure safer transactions, IATA is expecting Accredited Travel Agents operating within the BSP to be compliant with the Payment Card Industry (PCI) and the Data Security Standard (DSS).

Effective 1 June 2017, PCI DSS compliance will even be a mandatory condition to obtain and retain accreditation as an IATA Accredited Agent under the Passenger Sales Agency Rules in Resolution 818g. 

Important to note that this requirement has not emerged out of the blue. For many years, ASATA has been including a notification on this in its membership renewal documentation

In the interim, ASATA is working with the WTAAA and IATA to ascertain exactly what IATA’s requirements are with regards to PCI DSS and will make every effort to assist our members in their efforts to be compliant. 


Credit card companies have compiled the PCI Data Security Standard to enhance payment card security. All entities that store, process and transmit payment card data are required to adhere to PCI security standards, which are the technical and operational conditions to preserve payment card security.


We understand that the PCI DSS compliance process may in some cases be complex. Depending on the nature and the size of your business, the process can vary. 

Our advice would be as an initial step: 

Approach your financial institution if you are a merchant and process transactions through your local Point of Sale (POS).

If you are not a merchant and only process credit card transactions through the GDS (the airline’s merchant), we suggest that you contact every credit card brand that you are working with individually, in order to find out the compliance process applicable to your agency.

For more information to help you understand the importance of PCI DSS compliance for your business and guide you through the first steps that you will need to take, please visit the dedicated PCI DSS website: www.iata.org/pci-dss