Translation. The German version is authoritative.
1. Controller
AviScout GmbH & Co. KG, Heinrich-Kappus-Weg 17, 61440 Oberursel (Taunus), Germany
Telephone +49 6171 8986 483, e-mail mail@aviscout.com, website www.aviscout.com
General partner: AviScout Verwaltungs GmbH, Oberursel (Taunus), Local Court of Bad Homburg v. d. H. HRB 14925.
No data protection officer has been appointed; the conditions of section 38 of the German Federal Data Protection Act are not met.
2. Purposes and legal bases
Initiation, conclusion and performance of the brokerage contract and conclusion of the charter contract in the name and for the account of the Client — Article 6(1)(b) GDPR
Compliance with legal obligations, in particular commercial and tax retention and record-keeping obligations as well as aviation security, sanctions and anti-money-laundering obligations — Article 6(1)(c) GDPR
Assertion and defence of claims and evidence of our position as broker vis-à-vis the tax authorities — Article 6(1)(f) GDPR
Communication via the channels chosen by the Client, including messenger services — Article 6(1)(b) GDPR
3. Categories of personal data
Master data of the Client: name, company, address, VAT identification number, contact persons
Contact data: telephone number, number of an activated messenger channel, e-mail address
Contract and billing data: offers, confirmations, invoices, payment data
Passenger data: surname, first name, date of birth, nationality and the type, number and period of validity of the travel document
Communication content including screenshots of booking confirmations
We do not process special categories of personal data within the meaning of Article 9 GDPR. Where a medical certificate must be produced for a medical transport, it is transmitted exclusively via the channel provided for that purpose and not via messenger services.
4. Source of the data
We generally receive passenger data not from the passengers themselves but from the Client. The Client is obliged to inform the passengers of this; we provide it with an information sheet for that purpose (Annex 3 to our General Terms and Conditions).
5. Recipients
the brokered airline and service providers engaged by it, in particular ground handling
providers of ancillary services, in particular catering and ground transfer
aviation security, border and customs authorities of the departure, destination and overflight states, where required by law
payment service providers and credit institutions
tax advisers, auditors, lawyers and tax authorities
providers of the IT and communication services we use, including the operator of the messenger service chosen by the Client
6. Transfers to third countries
For flights connected with states outside the European Union, passenger data is transferred to the authorities there and to the airline. The basis is Article 49(1)(b) and (e) GDPR and, where applicable, an adequacy decision of the European Commission. Where the Client uses a messenger service whose provider processes data in the United States, this takes place on the basis of the European Commission adequacy decision for the EU-US Data Privacy Framework.
7. Retention period
We store personal data for as long as it is necessary for the purposes stated. Documents subject to commercial or tax retention obligations are retained for the statutory periods; this applies in particular to offers, confirmations, invoices and the evidence of our position as broker. We erase passenger data as soon as it is no longer required for operation and evidentiary purposes and no retention obligation prevents erasure.
8. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on Article 6(1)(f) GDPR (Article 21). You may withdraw any consent given at any time with effect for the future.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.
Automated decision-making including profiling within the meaning of Article 22 GDPR does not take place.
9. Use of our website
9.1 Hosting and server log files
Our website is operated by a processor acting for us for hosting and IT operations. When the site is accessed, information is automatically stored in server log files, in particular IP address, date and time, page accessed, volume of data transferred, referrer and browser and operating system identifier. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation. The retention period is seven days.
9.2 Cookies and consent
We set technically necessary cookies on the basis of section 25(2) TDDDG. All other cookies and comparable technologies are set only with your consent pursuant to section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time via the cookie settings on our website.
9.3 Contacting us
If you contact us via a form, e-mail, telephone or messenger, we process your details in order to handle your enquiry on the basis of Article 6(1)(b) or (f) GDPR.