Privacy policy

This is an English translation of our German privacy policy. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on this website and in the booking portal booking.franconia-air-service.de is:

Franconia Air Service GmbH
Managing Director: Thomas Müller
Nägeleinsgasse 18
91413 Neustadt an der Aisch
Germany
Phone: +49 9161 6204564
Email: info@franconia-air-service.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data protection officer

We are not legally required to appoint a data protection officer. If you have any questions about data protection, please use the contact details above.

2. Your rights

You have the following rights with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object: Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, an informal message to the contact details above is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

3. Hosting and server log files of the website

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

When you visit the website, information transmitted by your browser is automatically stored in server log files: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not combined with other data sources.

The processing serves to provide the website securely and reliably. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The log files are deleted as soon as they are no longer required for this purpose, unless they are needed to investigate a security incident.

4. SSL/TLS encryption

This website and the booking portal use SSL/TLS encryption. You can recognize an encrypted connection by “https://” in the address bar and the padlock symbol in your browser. When encryption is active, the data you send to us cannot be read by third parties.

5. Cookies and consent management

We use cookies and similar technologies. We use technically necessary cookies on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR. This includes a cookie that stores the language you have selected (German or English). We use all other cookies and services (e.g. for web analytics) only with your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

To manage your consent, we use the consent tool CCM19 provided by Papoo Software & Media GmbH, Bonn, Germany, on this website. Your choices, the time of consent and technical information about your device are stored so that we can demonstrate your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). You can change or withdraw your choices at any time using the cookie icon on the website.

6. Contacting us

If you contact us by email, phone or via the contact form, we process the information you provide (e.g. name, email address, phone number, content of your request) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or booking, and otherwise our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR).

We delete the data once your request has been fully processed and there are no statutory retention obligations.

Spam protection

To protect the contact form against automated requests, we use an invisible check field and a simple technical check in your browser. No cookies are set and no data is transferred to third parties. The legal basis is our legitimate interest in a working contact form that is protected against misuse (Art. 6(1)(f) GDPR).

7. Online booking

You can book flights via our booking portal booking.franconia-air-service.de. For this purpose, we process the data required to book and operate the flight, in particular the name and contact details of the person making the booking, the names of the passengers, travel dates, baggage information, payment details and, where required for the journey, identity document data.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Where we are legally required to pass on passenger data to airports, border or security authorities, we do so on the basis of Art. 6(1)(c) GDPR.

Hosting of the booking portal

We use the following service providers as processors under Art. 28 GDPR to operate the booking portal:

• Vercel Inc., USA – hosting of the booking portal and its interfaces, server region Frankfurt am Main, Germany
• MongoDB, Inc. (MongoDB Atlas) – database, region Frankfurt am Main, Germany
• Amazon Web Services – storage of images and documents and sending of emails in the AWS European Sovereign Cloud, region eusc-de-east-1 in Germany

The data is stored in data centers in Germany. Where providers based in the USA may access data in individual cases, this is done on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the EU-US Data Privacy Framework.

Payments and invoices

Credit card payments are processed by Computop Wirtschaftsinformatik GmbH, Bamberg, Germany. We transmit the data required for the payment to Computop (e.g. name, amount, booking number); your card details are processed exclusively by Computop.

If you pay by SEPA direct debit, we record your IBAN and the name of the account holder in the booking portal and collect the amount ourselves; no payment service provider is involved.

We create invoices for bookings using Lexware Office provided by Haufe-Lexware GmbH & Co. KG, Freiburg, Germany, and send them by email. Haufe-Lexware processes the invoice data on our behalf in accordance with Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retaining invoice data.

Storage period

We store booking data for as long as it is required to process the contract and, beyond that, for the statutory retention periods under German commercial and tax law (up to ten years).

Usage analysis, error logs and bot protection in the booking portal

• Mixpanel: If you have given your consent, we analyze the use of the booking portal with Mixpanel provided by Mixpanel, Inc., USA (e.g. pages viewed, features used, device type). The data is processed in a data center in the EU. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time.
• Sentry: To detect and fix technical errors, we use Sentry provided by Functional Software, Inc., USA. When an error occurs, technical information is transmitted, e.g. the error message, browser, operating system and time. The legal basis is our legitimate interest in error-free operation (Art. 6(1)(f) GDPR).
• Vercel BotID: To protect the AI booking assistant against automated access, we use Vercel BotID provided by Vercel Inc., USA. Technical characteristics of your browser are checked in the process. The legal basis is our legitimate interest in protecting the service against misuse (Art. 6(1)(f) GDPR).

Transfers to the USA are subject to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the EU-US Data Privacy Framework.

8. AI booking assistant

We offer an AI-powered booking assistant in the booking portal. The chat states that the answers are generated by an AI. When you use the assistant, we process what you enter in the chat (e.g. departure and destination, travel date, number of passengers) in order to understand your request and to find and display suitable flight offers.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Where we analyze chat histories to investigate errors and improve the service, we rely on our legitimate interest under Art. 6(1)(f) GDPR.

AI provider: To process your input, we use OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as a processor. This is based on a data processing agreement under Art. 28 GDPR. Processing also takes place in the USA; the transfer is based on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), which form part of the data processing agreement.

Data minimization: Email addresses and phone numbers are automatically removed from your input before it is sent to OpenAI. OpenAI receives neither your IP address nor your session ID, only a pseudonym for the session. OpenAI does not use the data to train AI models; storage of responses at OpenAI is disabled. To detect misuse, OpenAI retains requests for up to 30 days.

Storage period: We store chat histories for 30 days after the last message and then delete them automatically. We store counters used to limit usage for no more than 90 days. Only the booking portal server accesses the chat histories; there is no view of the chats in the administration area. If you make a booking, the retention periods set out in section 7 apply to the booking data.

The assistant’s offers are generated automatically and are non-binding. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place; price and availability are confirmed during the subsequent booking process. Please do not enter sensitive data in the chat, such as health, identity document or payment data.

9. Web analytics with Google Analytics 4

If you have given your consent, we use Google Analytics 4 on this website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is integrated via the WordPress plugin MonsterInsights.

Google Analytics uses cookies and records your usage behavior in the form of events, e.g. page views, clicks on external links, scroll depth and file downloads, as well as your approximate location (region), the date and time of your visit, technical information about your browser and device, and the referrer URL. IP addresses are truncated by Google within the EU or EEA. We do not use the “User-ID” and “Google signals” features; there is no cross-device analysis and no use for personalized advertising.

The data is used to analyze the use of our website and the success of our marketing activities. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition.

Data linked to cookies is automatically deleted after 14 months. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings. More information: Google privacy policy.

10. Links to social networks

Our website links to our profiles on Facebook, Instagram and LinkedIn. These are simple links, not embedded plugins. Data is only transferred when you click a link and visit the respective network. The privacy policy of the respective provider applies there.

11. Fonts

The fonts used on this website are loaded locally from our own server. No connection is made to servers operated by Google or other providers.

12. Objection to promotional emails

We hereby object to the use of the contact details published in our legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

13. Changes to this privacy policy

We will update this privacy policy if our data processing or the legal situation changes. The version published on this page applies.