Privacy Policy

1. General Information and Principles of Data Processing

We are pleased that you are visiting our website. Protecting your privacy and safeguarding your personal data—so‑called personal data—is an important concern for us when you use our website.

According to Art. 4(1) GDPR, personal data includes all information relating to an identified or identifiable natural person. This includes, for example, information such as your first and last name, your address, your telephone number, your email address, and also your IP address.

Data that cannot be linked to your identity—such as data that has been anonymized—does not constitute personal data. Any processing of personal data (e.g., collection, storage, retrieval, querying, use, transmission, deletion, or destruction) as defined in Art. 4(2) GDPR always requires a legal basis or your consent. Personal data must be deleted as soon as the purpose of processing has been fulfilled and no statutory retention obligations apply.

Below you will find information on how we handle your personal data when you visit our website. In order to provide the functions and services of our website, it is necessary for us to collect personal data about you.

We also explain the type and scope of the respective data processing, the purpose, the corresponding legal basis, and the applicable storage period.

This privacy policy applies solely to this website. It does not apply to other websites to which we merely provide a hyperlink. We cannot assume responsibility for the confidential handling of your personal data on these third‑party websites, as we have no influence over whether these companies comply with data protection regulations. For information on how these companies handle your personal data, please refer directly to the respective websites.

2. Controller

The controller responsible for the processing of personal data on this website is Reiner Fritzsche, Theodor‑Loos‑Weg 49, 12353 Berlin

(see imprint)

3. Provision and Use of the Website / Server Log Files

a) Type and Scope of Data Processing

When you use this website without otherwise transmitting data to us (e.g., through registration or by using the contact form), we collect technically necessary data via server log files that are automatically transmitted to our server, including:

  • IP address

  • Date and time of the request

  • Name and URL of the requested file

  • Website from which the access originated (referrer URL)

  • Access status / HTTP status code

  • Browser type

  • Language and version of the browser software

  • Operating system

b) Purpose and Legal Basis

This processing is technically required to display our website to you. We also use the data to ensure the security and stability of our website.

The legal basis for this processing is Art. 6(1)(f) GDPR. Processing the data mentioned above is necessary for providing the website and therefore serves our legitimate interest in operating a secure and functional online presence.

c) Storage Period

The personal data mentioned above is deleted as soon as it is no longer required for displaying the website. Collecting data for the provision of the website and storing it in log files is essential for operating the website. Consequently, users have no possibility to object to this aspect of processing.

Further storage may occur in individual cases if legally required.

 

4. Use of Cookies

a) Type, Scope and Purpose of Data Processing

We use cookies. Cookies are small files that are sent by us to the browser of your device during your visit to our website and stored there.

Some functions of our website cannot be offered without the use of technically necessary cookies. Other cookies, however, enable us to perform various analyses. For example, certain cookies can recognize the browser you use when you return to our website and transmit different types of information to us. We use cookies to make the use of our website easier and to improve it. Cookies allow us to make our online services more user‑friendly and effective, for instance by tracking how you use our website and identifying your preferred settings (e.g., country and language preferences). If third parties process information via cookies, they collect this information directly through your browser. Cookies do not cause any damage to your device. They cannot run programs or contain viruses. Our website uses different types of cookies, which are explained below.

Temporary Cookies / Session Cookies
Our website uses so‑called temporary or session cookies, which are automatically deleted as soon as you close your browser. These cookies allow us to capture your session ID. This makes it possible to assign various requests from your browser to a single session and to recognize your device during future visits.

Permanent Cookies
We also use permanent cookies. These cookies remain stored in your browser for a longer period and can transmit information. The storage duration varies depending on the cookie. You can delete permanent cookies manually via your browser settings at any time.

Third‑Party Cookies
We use analytical cookies to observe anonymized user behavior on our website.
We also use advertising cookies, which allow user behavior to be tracked for advertising and targeted marketing purposes.
Social media cookies enable connections to your social networks and allow you to share content from our website within your networks.

Browser Configuration
Most web browsers are preset to automatically accept cookies. However, you can configure your browser to accept only certain cookies or none at all. Please note that this may limit the functionality of our website.

You can also delete cookies already stored in your browser via your browser settings. Additionally, you can configure your browser to notify you before cookies are stored. Since browsers differ in how they operate, please refer to your browser’s help menu for configuration options.

Disabling the use of cookies may require storing a permanent cookie on your computer. If you later delete this cookie, you may need to deactivate cookies again.

b) Legal Basis

Based on the purposes described above, the legal basis for processing personal data using cookies is Art. 6(1)(f) GDPR. If you have given us your consent to the use of cookies via a notice on our website (“cookie banner”), the additional legal basis is Art. 6(1)(a) GDPR.

c) Storage Duration

As soon as the data transmitted to us via cookies is no longer required for the purposes described above, this information is deleted. Further storage may occur in individual cases if legally required.

d) Use of the Consent Tool “Real Cookie Banner”

To manage the cookies and similar technologies used on our website (such as tracking pixels, web beacons, etc.) and the related consent processes, we use the consent tool “Real Cookie Banner.” Details on how “Real Cookie Banner” works can be found at: https://devowl.io/de/rcb/datenverarbeitung/

The legal bases for the processing of personal data in this context are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in the administration of the cookies and similar technologies we use, as well as the management of the corresponding consents.

The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, if you choose not to provide this data, we will not be able to manage your consents.

5. Collection of Data for the Performance of Pre‑Contractual Measures and Contract Fulfilment

a) Type and Scope of Data Processing

In the pre‑contractual phase and upon conclusion of a contract, we collect personal data about you. This includes, for example, your first and last name, address, email address, telephone number, or bank details.

b) Purpose and Legal Basis of Data Processing

We collect and process this data exclusively for the purpose of performing the contract or fulfilling pre‑contractual obligations.

The legal basis for this is Art. 6(1)(b) GDPR. If you have additionally given your consent, the further legal basis is Art. 6(1)(a) GDPR.

c) Storage Duration

The data is deleted as soon as it is no longer required for the purpose for which it was collected.

Statutory retention obligations may also apply, for example under commercial or tax law pursuant to the German Commercial Code (HGB) or the German Fiscal Code (AO). If such retention obligations exist, we will block or delete your data once these retention periods have expired.

6. Registration Option

a) Type and scope of data processing

On our website, you can register for an account. When you register, we collect and store the data you enter into the input form (e.g., last name, first name, email address). Your data will not be passed on to third parties.

b) Purpose and legal basis of data processing

Your registration is required to use certain content and services on our website or for the performance of a contract or pre-contractual measures. After registering, you are free to modify the personal data provided during registration at any time or have it completely deleted from the controller’s database.

The legal basis for processing is, in the case of consent, Art. 6(1)(a) GDPR. If your registration serves to prepare the conclusion of a contract, Art. 6(1)(b) GDPR is an additional legal basis.

c) Storage period

The data collected during registration will be stored for as long as you are registered on our website and will be deleted thereafter. Statutory retention periods remain unaffected.

7. Data Transfer

We only disclose your personal data to third parties if:

a) you have given your explicit consent pursuant to Art. 6(1)(a) GDPR.

b) the disclosure is legally permissible and necessary under Art. 6(1)(b) GDPR for the performance of a contractual relationship with you or for the implementation of pre-contractual measures.

c) there is a legal obligation to disclose the data pursuant to Art. 6(1)(c) GDPR.

We are legally obliged to transfer data to public authorities, such as tax authorities, social security institutions, health insurance funds, supervisory authorities, and law enforcement agencies.

d) the disclosure is necessary pursuant to Art. 6(1)(f) GDPR to safeguard legitimate business interests, as well as to assert, exercise, or defend legal claims, and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.

e) we use external service providers (so‑called processors) pursuant to Art. 28 GDPR who have been contractually obligated to handle your data with care.

We use such service providers in the following areas:

  • IT

  • Logistics

  • Telecommunications

When transferring data to external entities in third countries, i.e., outside the EU or the EEA, we ensure that these entities treat your personal data with the same level of care as within the EU or the EEA. We only transfer personal data to third countries for which the European Commission has confirmed an adequate level of protection, or when we ensure the careful handling of personal data through contractual agreements or other appropriate safeguards.

8. Contact Options via Email

a) Type and scope of data processing

You can contact us by email. In this case, our data collection is limited to the email address used to contact us and to any personal data you voluntarily provide as part of your inquiry.

b) Purpose and legal basis

The purpose of processing your data is to enable us to respond to your request appropriately. The legal basis for this is Art. 6(1)(f) GDPR. We have a legitimate interest in processing the above-mentioned personal data in order to handle your inquiry properly.

c) Storage period

The duration of storage depends on the context of your inquiry. Your personal data will be deleted regularly once the purpose of the communication has ceased and storage is no longer necessary. This may be the case, for example, once your request has been processed.

9. Newsletter

a) Type and scope of data processing

Our website offers the option to subscribe to a free, regular email newsletter. In order to send you the newsletter on a regular basis, we require your email address.

For sending the newsletter, we use the double opt‑in procedure.

This means that we will only send you an email newsletter once you have explicitly confirmed that you consent to receiving it. We will then send you a confirmation email asking you to verify—by clicking on the corresponding link—that you wish to receive our newsletter in the future.

This ensures that only you, as the owner of the specified email address, can register for the newsletter. Your confirmation must be provided promptly after receiving the confirmation email; otherwise, your newsletter registration will be automatically deleted from our database.

When you subscribe to the newsletter, we collect and store the data you enter into the input form (e.g., last name, first name, email address).

In addition, when registering for the newsletter, we store the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later point. For the confirmation email sent for verification purposes (double opt‑in), we also store the date and time of the click on the confirmation link and the IP address assigned by the ISP.

b) Purpose and legal basis

The data collected during newsletter registration is used exclusively for promotional communication via the newsletter.

The processing of your email address for sending the newsletter is based on Art. 6(1)(a) GDPR and Section 7(2)(3) UWG, on the basis of the voluntary and revocable consent you provide below.

Additionally, processing is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in documenting proof of the required consent.

c) Storage period

Your email address is stored for as long as you remain subscribed to the newsletter. After unsubscribing, your email address will be deleted unless you have expressly consented to further use of your data.

Social Plug-ins

We currently use the following social media plug-ins: Facebook, Twitter, Xing, LinkedIn, Snapchat, TikTok, Pinterest. By using a button, personal data is transmitted to the respective plug-in provider and stored there.

The respective plug-in provider stores the data collected about you as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such analysis is carried out in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on some of our websites. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the respective plug-in provider. Through the plug-ins, we offer you the opportunity to interact with social networks and other users, enabling us to improve our offering and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Art. 6 (1) lit. f GDPR.

The transfer of data takes place regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data collected by us will be directly assigned to your existing account with the plug-in provider. For U.S. providers, data is transferred to the United States.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the privacy policies of these providers listed below. There you will also find further information about your rights in this regard and the settings available to protect your privacy:

 

White‑Label Providers

White‑label services from external providers are integrated into Flightlyst.com. The presentation of the offers takes place on our website; however, the execution of bookings as well as the collection, storage and processing of personal data are carried out on the servers of the respective third‑party providers. For requests for information, objections to data processing or deletion requests, please contact the respective provider directly. You will find their contact details and privacy notices in the list below.

For our “Flight Offers”:

This website integrates a flight search engine provided by Travelpayouts. The display of search results takes place on go.flightlyst.com and through embedded widgets on flightlyst.com. The actual booking process, including the collection and processing of personal data (e.g., name, contact details, travel information, payment details), is carried out on the websites of the respective flight providers to which you are redirected for completing your booking.

Further information on data processing by Travelpayouts can be found here: Privacy Policy of Travelpayouts.

If you wish to request information, object to processing, or request deletion of data stored by a third‑party provider, please contact the respective airline or flight provider directly.

Google Fonts

We use Google Fonts on some of our websites, integrated through our white‑label providers. This allows us to display specific fonts on our website. These fonts are provided by Google via servers located in the United States. When a visitor accesses our website, the visitor’s web browser establishes a direct connection to these servers. In this process, the visitor’s IP address is transmitted to Google and stored there.

Further information about Google: Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA

Further information on Google’s privacy practices:

https://www.google.com/policies/privacy/

11. Data Security and Protective Measures

We are committed to protecting your privacy and treating your personal data with strict confidentiality. To this end, we implement extensive technical and organizational security measures, which are regularly reviewed and adapted to technological developments.

These measures include the use of recognized encryption technologies (such as SSL or TLS). However, data transmitted without encryption — for example, when sent via an unencrypted email — may potentially be read by third parties. This is beyond our control. It is the responsibility of each user to protect the data they provide against misuse, for example by using encryption or other appropriate safeguards.

12. Changes to This Privacy Policy

We reserve the right to update this statement at any time if necessary.

13. Your Rights

Below you will find your rights regarding your personal data. Details can be found in Articles 7, 15–22 and 77 of the GDPR. For this purpose, you may contact the controller (see Section 2).

Right to Withdraw Consent under Art. 7(3) Sentence 1 GDPR You may withdraw your consent to the processing of your personal data at any time with effect for the future. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

a) Right of Access under Art. 15 GDPR You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you have the right to access these personal data as well as additional information, such as the purposes of processing, the categories of personal data processed, the recipients, and the planned storage period or the criteria used to determine that period.

b) Right to Rectification and Completion under Art. 16 GDPR You have the right to request the immediate rectification of inaccurate data. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete data.

c) Right to Erasure (“Right to be Forgotten”) under Art. 17 GDPR You have the right to request the deletion of your data, provided that processing is not required. This applies, for example, if your data are no longer necessary for the original purposes, you have withdrawn your consent, or the data have been processed unlawfully.

d) Right to Restriction of Processing under Art. 18 GDPR You have the right to request the restriction of processing, for example if you believe that the personal data are inaccurate.

e) Right to Data Portability under Art. 20 GDPR You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format.

f) Right to Object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.

In the case of direct marketing, you as the data subject have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling, insofar as it is connected with such direct marketing.

g) Automated Individual Decision-Making, Including Profiling, under Art. 22 GDPR

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you, except in the exceptional cases mentioned in Art. 22 GDPR.

Such decision-making based solely on automated processing — including profiling — does not take place.

h) Right to Lodge a Complaint with a Supervisory Authority under Art. 77 GDPR

You also have the right to lodge a complaint with a data protection supervisory authority at any time, for example if you believe that the processing of your personal data is not in compliance with data protection regulations.