1. Who We Are (Data Controller)

Skytours GmbH acts as the data controller for personal data processed via all by us powerded and controlled websites.

2. What Personal Data We Collect

3. Why We Process Your Data (Legal Basis)

We process your data only where legally permitted, including:

Contract performance (Art. 6(1)(b) GDPR):
To process bookings, issue confirmations, and coordinate travel services.

Legal obligations (Art. 6(1)(c) GDPR):
Accounting, tax, aviation security, and regulatory compliance.

Legitimate interests (Art. 6(1)(f) GDPR):
Customer service, fraud prevention, platform security, and service improvement.

Consent (Art. 6(1)(a) GDPR):
Marketing communications, cookies, and optional services (can be withdrawn at any time).

4. How We Use Your Data

We use your personal data to:

• process and manage bookings,
• issue airline tickets and travel documents,
• communicate with airlines and local travel providers (DMCs),
• provide customer support,
• manage payments and refunds,
• improve our platforms and services,
• comply with legal requirements.

5. Sharing Your Data (Very Important)

To deliver your trip, we may share only necessary data with:

• Airlines (for ticketing and flight operations)
• Local Destination Management Companies (DMCs) and service providers (hotels, transfer companies, tour operators)
• Payment service providers
• IT and hosting providers acting as data processors
• Authorities, where legally required

All partners receive only the data required to perform their services and are contractually obliged to protect it.

6. International Data Transfers

Some service providers (e.g. airlines or local DMCs outside the EU) may be located in third countries.

Where this occurs, we ensure appropriate safeguards, such as:

• EU Standard Contractual Clauses (SCCs),
• adequacy decisions, or
• other lawful transfer mechanisms under GDPR.

7. Data Retention

We retain personal data:

• as long as necessary to fulfill contractual obligations,
• as required by tax, accounting, or aviation regulations,
• or until consent is withdrawn (where applicable).

After expiry, data is securely deleted or anonymized.

8. Your Rights Under GDPR

You have the right to:

• access your personal data,
• correct inaccurate data,
• request deletion ("right to be forgotten"),
• restrict processing,
• object to processing,
• data portability,
• withdraw consent at any time,
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at [privacy@skytours…].

9. Marketing Communications

You will receive marketing emails only if you have opted in. You can unsubscribe at any time via the link in our emails or by contacting us.

Transactional and booking-related communications are not optional.

10. Security Measures

We apply appropriate technical and organizational security measures to protect your data against unauthorized access, loss, or misuse.

However, no internet transmission is 100% secure, and absolute security cannot be guaranteed.

11. Children's Privacy

Our services are intended for users 18 years or older. We do not knowingly collect data from minors without parental consent.

12. Third-Party Websites

Our websites may link to third-party sites. We are not responsible for their content or privacy practices. Please review their privacy notices separately.

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. The current version is always available on our website, with the effective date shown above.

14. Contact

If you have questions about this Privacy Notice or data protection, please contact: