I wonder why a HK incorporated company based their Privacy Policy on EU GDPR principals? Gives non-EU users the same rights as EU users (right to be forgotten, correction, etc).

Enforcement would have to come from an EU user though; and with the EUR20m fine I imagine a single breach puts AirHelp under.

Aggregated data could be traded under this agreement (they can use legitimate interest as their legal basis for processing under GDPR so long as there is some form of anonymising aggregation). For example stats shared with airports about the types of people visiting them at different times of year, etc and what other products they buy. E.g. Hey JFK, 10% of your fliers shopped at X in the 30 days before they visited, but 12% did after, proving that X's ad campaign must have worked. From that perspective it's a pretty massive panel.