Privacy Policy

1. Data controller

The controller is MB „Airdue“, company code 308105173, registered office Vytauto g. 23C, LT-59124 Prienai. Email info@airdue.net, phone +370 667 60004. A Data Protection Officer has not been appointed, as our activities do not meet the criteria in Art. 37 GDPR.

2. Data we collect

• Contact data: name, surname, email address, phone number.
• Flight data: airline, flight number, date, route, booking reference, description of the disruption.
• Uploaded documents: booking confirmation, boarding pass, airline correspondence and other evidence you choose to provide.
• Answers given in the preliminary eligibility questionnaire.
• Technical data: IP address, browser type, visit time, service logs.
• Payment details (bank account) only if a contract is concluded and compensation is recovered.

3. Purposes and legal bases

• Preliminary assessment and replying to your enquiry — steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Pursuing the claim against the air carrier — performance of a contract (Art. 6(1)(b)).
• Establishing, exercising or defending legal claims — legitimate interest and legal obligation (Art. 6(1)(f) and (c)).
• Accounting and tax duties — legal obligation (Art. 6(1)(c)).
• Website security and statistics — legitimate interest (Art. 6(1)(f)).
• Marketing messages, where requested — consent (Art. 6(1)(a)), withdrawable at any time.

4. Recipients

• Air carriers and their representatives, to the extent needed to submit the claim.
• Cooperating lawyers where a case goes to court.
• National enforcement bodies (in Lithuania, the Transport Safety Administration), courts, bailiffs.
• IT and infrastructure providers (hosting, database and file storage, email delivery) acting as processors under Art. 28 GDPR agreements.
• Accounting service providers.

Data is processed within the European Economic Area. Any transfer outside the EEA relies on an adequacy decision or Standard Contractual Clauses (Art. 45–46 GDPR). We never sell personal data.

5. Retention

• Enquiries that do not become a contract — up to 12 months from the last contact.
• Case and contract files — 10 years after the case is closed.
• Accounting records — the period required by law (generally 10 years).
• Technical logs — up to 12 months.

6. Your rights

• Access your data and receive a copy (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure (Art. 17).
• Restriction of processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time, without affecting prior processing.

To exercise your rights, write to info@airdue.net; we reply within 30 calendar days. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, ada@ada.lt) or go to court.

7. Security

We use encrypted connections (HTTPS), restricted access, private file storage with temporary signed links, role-based permissions and staff confidentiality undertakings. Personal data breaches are notified to the supervisory authority within 72 hours and, where the risk is high, to you.

8. Automated decision-making

The on-site questionnaire provides an indicative, informational result only. It is not an automated decision producing legal effects within the meaning of Art. 22 GDPR — a human always decides whether to take on a case.

9. Changes

We may update this policy. The current version is always published on this page with its update date.