Privacy Policy

This English version is provided for convenience. In case of doubt, the German version prevails.

1 Privacy at a glance

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally, such as your name, email address or IP address.

How do we collect your data?
Some data you give us yourself, for example via the inquiry form, by phone, email, WhatsApp or in person at our office. Other data is collected automatically by our IT systems when you visit the website, mainly technical data (e.g. browser, operating system, time of access). With your consent we also collect statistical data via Google Analytics.

What do we use your data for?
Some data is collected to provide the website without errors. We use your inquiries to offer you suitable flights. Statistical data helps us improve the website. We do not sell data or share it for advertising purposes.

2 Controller

The controller within the meaning of the GDPR (Art. 4(7) GDPR) is:

We are not legally required to appoint a data protection officer, as fewer than 20 people are regularly involved in processing personal data (§ 38 BDSG). For privacy questions, please contact us at the address above.

3 Hosting & server logs

This website is hosted by an external service provider. When you access the website, the server automatically stores information transmitted by your browser in so-called server log files:

• IP address of the requesting device
• date and time of access
• page or file requested
• referrer URL (the previously visited page)
• browser type, version and operating system

This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in providing the website securely, quickly and without technical errors. We have concluded a data processing agreement with our host pursuant to Art. 28 GDPR.

SSL/TLS encryption: For security reasons this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock icon in your browser’s address bar.

Fonts: The fonts used (Plus Jakarta Sans, Inter) are stored locally on our server. No connection to Google Fonts or any other font provider is made when loading the page.

4 Cookies & consent

Cookies are small text files stored on your device. We use technically necessary storage on the basis of § 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); no consent is required for this. We only use all other cookies and similar technologies if you have consented beforehand (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

On your first visit we show you a cookie banner where you can accept all optional services, allow only necessary ones, or choose individually. Rejecting is just as easy as accepting. You can revoke your consent at any time with effect for the future (Art. 7(3) GDPR).

Open cookie settings

Overview of cookies and storage used

5 Google Analytics

If you have given consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies that allow us to analyse how visitors use the website, e.g. which pages are viewed, how long visitors stay, how they found us, as well as approximate location (country, city), device type and browser. This shows us which content is in demand and helps us improve our services.

Legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can revoke it at any time via the cookie settings; analytics cookies already set will then be deleted.

Data may also be transferred to servers of Google LLC in the USA (see section 9). Further information can be found in Google’s privacy policy and at Safeguarding your data in Google Analytics.

6 Google Maps

On our home and contact pages we embed a map from Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded once you agree (via the cookie banner or the “Load map” button). Before that, no data is transferred to Google.

Once the map is loaded, your IP address and information about your use of the map, among other things, are transferred to Google and may be stored in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can revoke at any time.

7 Contacting us & inquiry form

If you contact us via the inquiry form, by email, phone or in person, we process the information you provide (e.g. name, email address, phone number, destination, travel dates, number of travellers) to handle your inquiry and make you an offer. Form data is transmitted to our server in encrypted form and forwarded to us by email.

The legal basis is Art. 6(1)(b) GDPR if your inquiry aims at a contract (e.g. a flight booking), otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). For bookings we pass the necessary data on to airlines and booking systems.

We delete your data once your inquiry has been fully processed, unless statutory retention obligations apply. Booking and invoice records are kept for 6 to 10 years (§ 257 HGB, § 147 AO).

8 WhatsApp & Facebook

Our website links to WhatsApp and our Facebook page. These are plain links, not embedded plugins: simply visiting our website does not transfer any data to Meta. Only when you click a link are you redirected to WhatsApp or Facebook, where the privacy policy of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland applies.

If you message us via WhatsApp, we process your phone number and messages to handle your inquiry (Art. 6(1)(b) or (f) GDPR). If you prefer not to use WhatsApp, you can always reach us by phone or email.

9 Data transfers to the USA

With Google Analytics and Google Maps, data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. For certified companies, the European Commission has found an adequate level of data protection (adequacy decision of 10 July 2023, Art. 45 GDPR). In addition, Google has concluded the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10 Your rights

You have the following rights regarding your personal data:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent at any time for the future (Art. 7(3) GDPR)

An informal message to buyandfly@live.de or a call to +49 40 46 000 933 is sufficient.

11 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Changes to this privacy policy

We update this privacy policy when our website or the legal situation changes. The version published here applies.