Privacy Policy

Frederik Aulich
Operating flynto
Düsseldorf
Germany
Email: [email protected]

No Data Protection Officer has been appointed (not required under Art. 37 GDPR).

2.1 Server access logs

Each time you visit our website, our hosting provider automatically processes: your IP address, date and time of the request, requested URL, HTTP status code, and bytes transferred.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the service securely and defending against abuse). Retention: typically 7–30 days, depending on the hosting provider.

Right to object: you may object to processing based on legitimate interest under Art. 21 GDPR.

2.2 Cookies and local storage (§ 25 TDDDG)

flynto uses only technically necessary cookies and local-storage entries that are exempt from the consent requirement under § 25(2) TDDDG:

• Cookie consent (flynto_cookie_consent, cookie): Stores your banner decision. Lifetime: 1 year.
• Language preference (flynto_locale, cookie): Stores the selected language. Lifetime: session to 1 year.
• Session (_flynto_key, cookie): Technically required session cookie. Lifetime: session.
• Flight preferences (flynto:preferences, localStorage): Stores your preferred airlines and aircraft locally on your device. This data never leaves your device unless you create an account.
• Price alerts (flynto:price-alerts, localStorage): Stores locally created price alerts.

No tracking cookies, advertising cookies, or analytics services (e.g. Google Analytics).

2.3 User account and email address

If you create an account, we collect your email address and a password (stored as a bcrypt hash).

Legal basis: Art. 6(1)(b) GDPR (contract performance). Retention: until account deletion, plus any statutory retention periods.

2.4 Price alert email notifications

When you activate a price alert, we send notification emails to your registered address when the price drops below your threshold.

Legal basis: Art. 6(1)(b) GDPR (contract performance — you have explicitly requested this service).

We use the following service providers as data processors (Art. 28 GDPR):

• Hosting provider: [HOSTING PROVIDER NAME], [COUNTRY]. Data processing agreement in place.
• Email delivery: [EMAIL PROVIDER NAME], [COUNTRY]. Data processing agreement in place.

Transfers of personal data to countries outside the European Economic Area (EEA) take place only where an EU Commission adequacy decision exists or appropriate safeguards under Art. 46 GDPR are in place.

We do not carry out automated individual decision-making under Art. 22 GDPR, including profiling with legal or similarly significant effects.

• Access (Art. 15 GDPR): request a copy of all data held about you.
• Rectification (Art. 16 GDPR): correction of inaccurate data.
• Erasure (Art. 17 GDPR): deletion of your data, where no legal retention obligation applies.
• Restriction (Art. 18 GDPR): restriction of processing.
• Data portability (Art. 20 GDPR): receive your data in a machine-readable format (applies to contract-based automated processing).
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3) GDPR): withdraw any consent given, with effect for the future.

To exercise your rights, contact: [email protected]

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the controller (located in North Rhine-Westphalia) is:

You may also contact the supervisory authority in your own EU member state of habitual residence.

We reserve the right to update this privacy policy when legal requirements change or when we adjust our data processing. The current version is always available on this page.