Privacy Policy of AviFly Technologies S.L.

At AviFly Technologies S.L. (“AviFly”, “we”) we take the protection of our users’ personal data very seriously.

In this Privacy Policy we explain what data we collect, what we use it for and what your rights are when you use our website, our mobile application (together, the “Platform”) or communicate with us through other channels relating to our services.

This Policy forms part of our Terms and Conditions.

1. Data controller

• Controller: AviFly Technologies S.L.
• Tax ID (NIF/CIF): B22489181
• Registered office: Cl Pont, 33, 08511, L’Esquirol, Barcelona, Spain
• Data protection contact email: soporte@aviflyapp.com

If AviFly formally appoints a separate Data Protection Officer (DPO), their contact details will be updated here.

2. Scope

This Privacy Policy applies to personal data that:

• You provide to us when using our website, our app, forms, chats or support channels.
• We process in the context of providing our flight claim management services, including the assignment of the claim and dealings with airlines, lawyers, court agents and competent authorities.

It does not apply to third-party websites or services that may be linked from our Platform.

3. Personal data we process

Depending on how you interact with us and which service you use, we may process the following categories of data:

3.1. Identification and contact data

• First name and surname
• Identity document (DNI, NIE, passport or other)
• Date of birth
• Postal address
• Email address
• Mobile or landline number
• Preferred language

3.2. Data relating to flights and claims

• Flight data: airline, flight number, date, origin and destination airport, booking reference.
• Information about the disruption: delay, cancellation, overbooking, lost or damaged baggage, denied boarding, and so on.
• Documentation provided: boarding passes, tickets, communications with the airline, expense receipts, and so on.
• Information about the Claim and about the claim assigned to AviFly (amount claimed, case status, settlements, payments, and so on).

3.3. Financial and payment data

• Bank details needed to pay you the compensation (account holder, IBAN, bank).
• Information about payments received from airlines and compensation paid to the User.

We do not store full payment card details unless strictly necessary, and always through secure payment providers.

3.4. Browsing and Platform usage data

We automatically collect certain technical data when you access our Platform, such as:

• IP address
• Device, operating system and browser used
• Language settings
• Pages visited, dates and times of access
• Cookie identifiers or similar technologies (as described in the Cookie Policy)

This data is used mainly to ensure the Platform works properly, improve the service and produce usage statistics.

3.5. Communications and support

• The content of the messages you send us (email, chat, contact forms, and so on).
• Associated metadata (date, time, channel used).

3.6. Special category data (health or other sensitive data)

In some cases you may provide us with information about your health or other particularly sensitive data (for example, if the disruption caused you a medical problem, disability, and so on), where relevant to the Claim.

We do not ask for this data systematically, but if you choose to provide it we will process it solely to handle the claim in which it is needed, on the basis of your explicit consent and/or for the establishment, exercise or defence of legal claims.

3.7. Third-party data (companions, minors, and so on)

If you provide us with other passengers’ data (for example, family members or travel companions):

• You warrant that you have their authorisation to share their data with AviFly.
• You undertake to inform them of this Privacy Policy.

In the case of minors, we will only process their data where the adult contracting the service has the necessary legal standing and representation (parent or legal guardian).

4. Purposes of processing and legal bases

The main purposes for which we process your data and the legal basis that allows us to do so are set out below:

4.1. Providing AviFly’s services (including the assignment of the claim)

4.2. Compliance with legal obligations

4.3. Customer service and support

4.4. Sending informational and marketing communications

You can unsubscribe from marketing communications at any time using the link in each email or by writing to soporte@aviflyapp.com.

4.5. Improving the Platform, analytics and security

As regards cookies and similar technologies, the Cookie Policy applies and, where necessary, your consent.

5. Recipients of the data

We may disclose your personal data to the following types of recipient:

• Airlines and other liable parties (for example, travel intermediaries) against whom the Claim is directed.
• Lawyers, court agents and other legal professionals who work with AviFly on proceedings and litigation.
• Authorities and public bodies (for example, AESA, courts and tribunals, dispute resolution agencies or bodies, tax authorities) where necessary for the Claim or under a legal obligation.
• Financial institutions and payment service providers, to transfer compensation and manage payments.
• Technology providers supplying hosting, cloud storage, communication delivery, internal management tools, analytics, and so on (they act as processors and only access the data on AviFly’s instructions).

In any event:

• We do not sell your personal data.
• We do not allow third parties to use your data for their own purposes other than those described, unless you have a direct contractual relationship with them or you give us your consent.

6. International data transfers

In principle, we aim for our providers and servers to be located within the European Economic Area (EEA).

If, in order to provide our services or because of our relationship with certain providers, an international transfer of data outside the EEA becomes necessary, we will ensure that:

• The country offers an adequate level of protection recognised by the European Commission, or
• Standard contractual clauses approved by the European Commission, or other appropriate safeguards provided for by the GDPR, have been signed with the recipient.

You can request more information about specific international transfers by writing to soporte@aviflyapp.com.

7. Retention periods

We keep your personal data only for as long as necessary for the purposes for which it was collected and, in any event, for the periods required by applicable law. As a guide:

• Data relating to contracted services and claims: for the duration of the contractual relationship and, once it ends, for the limitation periods applicable to legal actions (usually between 5 and 10 years, depending on the type of obligation and applicable law).
• Data used for marketing communications based on your consent: until you withdraw your consent, request erasure of your data or object to the processing. If you unsubscribe, we delete the record after 30 days.
• Conversations with the Aria assistant: the transcript is deleted after 90 days (see §12.A.4).
• Browsing and analytics data: retained in accordance with the Cookie Policy and, in general, for short periods and in aggregated or anonymised form where possible.

When the data is no longer necessary, we will block it (keeping it only for legal liability purposes) or securely delete it.

8. Security measures

AviFly undertakes to protect your personal data by applying appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Use of secure connections (for example, HTTPS).
• Logical access controls to systems and data.
• Backups and recovery plans.
• Limiting access to the data to staff and providers who genuinely need it for their role.
• Confidentiality and data processing agreements with providers who access personal data.

That said, no system is 100% invulnerable; if a security incident affecting your personal data occurs, we will act in accordance with the law, notifying the competent authority and, where appropriate, the affected users.

9. Users’ rights

As the data subject, you can exercise the following rights:

• Right of access: to know whether we process your data and, if so, to obtain a copy.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): to request deletion of your data when it is no longer necessary for the purposes for which it was collected, among other grounds.
• Right to object: to object to processing based on legitimate interests, including receiving marketing communications.
• Right to restriction of processing: to ask us to restrict the processing of your data in certain circumstances.
• Right to portability: to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where the legal basis is consent or a contract and the processing is carried out by automated means.
• Right not to be subject to automated decisions producing legal or similarly significant effects, where applicable.
• Right to withdraw consent at any time, where processing is based on your consent, without affecting the lawfulness of processing before withdrawal.

How to exercise your rights

You can exercise your rights by sending an email to soporte@aviflyapp.com, stating the right you wish to exercise and attaching a copy of a document proving your identity (DNI, NIE, passport or other valid document).

If you consider that we have not handled your request properly, or that the processing of your data infringes the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

10. Minors

Our services are aimed primarily at people over 18.

• If the service is contracted on behalf of a minor, we understand that the person doing so has legal representation of the minor (parent or guardian).
• We will process the minor’s data only to the extent necessary to handle the claim and in accordance with this Policy.

If we find that we have received a minor’s data without proper standing, we will delete it reasonably promptly.

11. Cookies and similar technologies

The Platform uses cookies and similar technologies to:

• Ensure the website and app work properly.
• Remember your preferences (for example, language).
• Analyse use of the Platform.
• Offer additional functionality.

Detailed information on the cookies used, their types, purposes, retention periods and configuration options is set out in our Cookie Policy, which you can consult at any time from the Platform.

12. Automated decisions and profiling

AviFly may use automated processes to:

• Carry out a preliminary assessment of whether your flight is eligible for compensation.
• Classify or prioritise claims, and improve internal management and the user experience.

In any event:

• These decisions are not based solely on automated processing producing legal effects concerning you or similarly significantly affecting you, without human intervention.
• If in future we apply automated decisions of that kind, we would inform you clearly and explain your rights (for example, to request human intervention, express your point of view or contest the decision).

12.A. AI virtual assistant (Aria)

The Platform includes a conversational assistant powered by artificial intelligence called Aria, whose purpose is to help you with questions about air passenger rights, Regulation (EC) 261/2004 and AviFly’s services.

12.A.1. Data the assistant processes

• The text of the messages you send to the chat.
• Conversation metadata (date, time, session identifier, language, number of messages).
• Technical browser and device data needed for the widget to work.
• If you choose to provide it, your email address so the conversation can continue through another channel.

We recommend not entering sensitive personal data into the chat (health, third-party data, full financial information). To pursue an actual claim, use the Platform’s secure forms or the official support channels.

12.A.2. Purpose and legal basis

• To give you information and guidance about our services and the applicable rules.
• To improve the quality of the assistant, detect errors and prevent abuse.

Legal basis: AviFly’s legitimate interest in providing customer service and improving the Platform (Art. 6(1)(f) GDPR) and, where applicable, consent when starting the conversation (Art. 6(1)(a) GDPR).

12.A.3. Providers and transfers

Aria runs on third-party language models (for example, OpenAI) acting as processors. Those providers may process messages on servers located inside or outside the European Economic Area.

Where international transfers occur, AviFly requires its providers to offer appropriate safeguards under the GDPR (standard contractual clauses, and supplementary measures where appropriate).

AviFly contracts its AI providers with a contractual obligation not to use the content of conversations to train public models.

12.A.4. Retention

• Before your messages are sent to the model, an automatic filter removes identifiers (DNI, NIE, IBAN, card numbers, emails, phone numbers and booking references).
• If you give us your email so the conversation can continue, we keep a redacted copy of the transcript linked to that contact, limited to the most recent messages.
• That transcript is automatically deleted after 90 days. The contact record is deleted if you unsubscribe, and in any case once it has been inactive for two years.
• The conversation is stored only in the browser tab where you opened it: it expires through inactivity or when the conversation ends, and is deleted when you close the tab. Your email, if you leave it, is not stored in the browser.

12.A.5. Limitations of the assistant

• Aria provides general guidance and does not constitute legal advice.
• Responses are generated automatically and may contain inaccuracies; always verify critical information with our human team before making decisions.
• The assistant does not make automated decisions producing legal effects concerning you within the meaning of Art. 22 GDPR. The eligibility assessment used by the Platform is deterministic and is not performed by the language model.

12.A.6. Your rights regarding the chat

At any time you can:

• End the conversation from the chat menu.
• Download the transcript of your conversation.
• Exercise your rights of access, erasure, objection and the others set out in section 9 by writing to soporte@aviflyapp.com.

13. Links to third-party sites

Our Platform may contain links to third-party websites. Please note that:

• We are not responsible for the privacy practices or the content of those sites.
• We recommend reviewing the privacy policy of each external website you visit.

14. Changes to this Privacy Policy

We may update this Privacy Policy to:

• Adapt it to legislative or case-law changes.
• Reflect changes in our services, internal processes or corporate structure.

We will publish the updated version on the Platform, stating the date of last update. In the event of significant changes, we may inform you through the usual channels (for example, email or notices on the website or app).

We recommend reviewing this Policy periodically to stay informed about how we process your data.

15. Contact

If you have any doubts or comments, or wish to exercise your data protection rights, you can contact us at:

Email: soporte@aviflyapp.com