ABC Bedarfsflug GmbH, Fürstenweg 176, Tyrolean Center, 6020 Innsbruck, Austria, is the controller for this website, enquiries, related correspondence and the preferences described here. We trade as FlyTyrol.
Contact Yann-Guillaume Jaccard at [email protected], email [email protected] or write to ABC at that address. Call +43 512 26 30 40 (24/7) for help. No particular form or subject line is required. Further processing needed for a flight or management service is explained at the relevant stage.
02
Your information and why we use it
Required fields let us understand and respond to your enquiry; without them we may be unable to handle it. Other fields are optional. Submitting a website enquiry is not generally a legal obligation. Enquiries and linked contact records are held in our enquiry system; related correspondence is also held in email.
Information and purpose
Legal basis
Your name, email and management message, or charter route, dates and passenger numbers; optional phone, company, aircraft details, times and notes. Used to respond and prepare a service.
Article 6(1)(b) GDPR for steps you request towards your own contract. For company or representative enquiries, Article 6(1)(f): our legitimate interest in responding and coordinating the proposed service.
Connection data, request logs and abuse-prevention identifiers. Used to operate and protect the website.
Article 6(1)(f): our legitimate interest in a secure, reliable service and preventing misuse.
Relevant service, accounting and claim records.
Article 6(1)(c) for a specific record-keeping duty; Article 6(1)(f) where necessary to establish, exercise or defend an identified legal claim.
03
Optional email updates
The unchecked marketing box records interest in FlyTyrol charter and aircraft-management news and offers from ABC Bedarfsflug GmbH. We retain the choice, exact wording/version, language, source and time. This is a pending request, not an active subscription; a separate email confirmation is required before marketing begins.
We handle the pending preference and limited evidence under Article 6(1)(f), to respect your choice. An activated subscription relies on your consent under Article 6(1)(a) and applicable communications law. Withdraw through the privacy contact; active marketing emails also include an unsubscribe option. Withdrawal does not affect earlier lawful processing.
Marketing is optional and separate from service messages and the privacy acknowledgement. Your choice does not authorise other group companies' marketing or advertising technologies. An unchecked box does not cancel an existing preference.
04
Information from another person
An organiser, employer, assistant or authorised representative may provide your contact and journey details. We use them to handle the proposed service. Article 6(1)(b) applies only to your own contract or steps you requested, including through a representative; being named as a passenger is not enough. Otherwise, where appropriate, Article 6(1)(f) supports our legitimate interest in handling an authorised enquiry.
We provide the relevant source, data categories and privacy information within one month, or earlier at first contact or disclosure, unless a specific GDPR exception applies. You can also ask us about the source.
05
Technical data and location
Our website providers process connection and browser/device information to deliver and protect the service. We use limited technical logs and protected identifiers to prevent misuse. Automated checks may reject invalid or excessive requests; they do not decide whether to enter a flight or management agreement.
The forms use regional hints to suggest a telephone country. Our optional location feature uses IP-based country, region, city and timezone information from Cloudflare, with IPinfo available as an optional fallback. It can run when a form opens; available location information may be stored with a submitted enquiry to coordinate replies. The proposed basis is Article 6(1)(f): our legitimate interest in handling enquiries in their regional context, subject to necessity and balancing checks before activation.
Cloudflare's separate performance measurement is described in the Cookie notice.
06
Who receives information
Recipient
Purpose and limits
Authorised ABC staff
Handle enquiries, communications and services.
Simply Jet IT and authorised support staff
Administer and support ABC's website and systems, with access limited to their work.
Hosting, database, email and security providers; Cloudflare and, where enabled, IPinfo
Deliver and protect the service, store communications and provide the location functionality described above.
Professional advisers and competent authorities
Receive relevant information where required for legal obligations or an identified matter.
If a service requires further recipients, we provide the relevant information at that stage. Group membership does not permit unrestricted marketing or access.
07
International processing
Website hosting and transactional email use AWS's Zurich region in Switzerland, which is covered by an EU adequacy decision. Cloudflare operates a global delivery and security network; processing can occur outside the EEA, including in the United States. Cloudflare describes its transfer safeguards in its Data Processing Addendum: https://www.cloudflare.com/cloudflare-customer-dpa/.
Ask the privacy contact for the recipients, countries and safeguards applicable to your information, including authorised support access and any enabled IPinfo lookup. Hosting location alone does not determine all processing locations.
08
How long information is kept
The following is the proposed retention schedule for review before production. These periods are not a claim that automated deletion is already implemented. Data is deleted or anonymised earlier when it is no longer needed; a review or an unanswered marketing message does not restart a period.
Record
Proposed period or criteria
Prospective enquiries and related contacts/correspondence
Up to three years after the last meaningful interaction with you. Necessary records for a specifically ongoing project or service may continue for that purpose, with an annual review.
Unconfirmed email-update requests
Up to 90 days from the request, then remove the pending preference unless confirmed. A separately justified enquiry record follows its own period.
Active marketing, consent and suppression evidence
Marketing only while permission remains valid. Keep only the evidence needed to demonstrate consent and respect withdrawal or an objection; this does not justify retaining the whole enquiry.
Accounting records and qualifying business correspondence
Generally seven years from the end of the relevant calendar year; longer where proceedings or another duty require it. This is not a period for every lead.
IP-based location snapshots attached to enquiries
Up to 90 days from collection, then remove or anonymise them unless required for a specific documented incident.
Routine application/security logs
Up to 30 days; isolate relevant incident evidence only while needed. Verify each provider's separate log-expiry settings before launch.
Recovery copies
A 30-day database recovery window. Backup files may outlive that window where needed to support recovery; verify their expiry separately. Restrict copies to recovery and reapply deletions after restoration.
Necessary service, operational/airworthiness and identified claim records follow the applicable obligation or purpose. Retention never authorises marketing.
09
Your rights
Subject to the GDPR's conditions, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can object to direct marketing at any time. Consent can be withdrawn without affecting earlier lawful processing.
Contact us using section 1. We respond without undue delay and within one month. Where complexity or the number of requests requires an extension of up to two further months, we explain it within the first month. We may request proportionate information to verify identity; do not send an identity document with your initial request.
You may complain to a competent supervisory authority, including Austria's Data Protection Authority at dsb.gv.at.
10
Please limit sensitive information
Do not send payment-card details, identity documents or detailed medical records through the general enquiry form. Contact the office first for travel assistance and a suitable way to provide any necessary information. General form submission is not consent to process health information.
11
Updates
We update this notice when our processing changes and provide appropriate notice of material changes.
