Privacy Policy
Effective date: 20 February 2026
Fly Rights
Rruga Mine Peza, Tirana 1001, Albania
Email: legal@flyrights.eu
This Privacy Policy explains how Fly Rights ("we", "us", "our") collects, uses, stores and shares personal data when you visit or use flyrights.eu, submit a claim, request assistance with passenger compensation under EU Regulation 261/2004 and UK261, or otherwise contact us. It also explains your rights and how to exercise them.
1. Controller
The data controller for personal data collected via this website and in relation to claims is Fly Rights, address above. For questions about this policy or to exercise your rights, contact: legal@flyrights.eu.
2. Personal data we collect
We collect or receive the following categories of personal data:
- Identity & Contact: name, date of birth, nationality, postal address, phone, email, ID/passport numbers (only when required).
- Booking & Travel: flight numbers, booking reference (PNR), ticket numbers, airline, airports, scheduled/actual times, boarding passes, e‑tickets.
- Claim records & communications: emails, messages, claim forms, correspondence with airlines/ADRs/courts, notes of calls, scanned documents you provide.
- Payment details: bank account (IBAN/SWIFT), payment confirmations required to transfer compensation.
- Technical & Usage: IP address, device/browser info, cookies and analytics data.
- Other evidence: receipts, medical certificates, photos, videos, or other documents you provide to support a claim.
We only collect special category data (e.g. health information) where you voluntarily provide it and we have a lawful basis to process it (e.g. explicit consent to support a claim).
3. How we collect personal data
- Directly from you (forms, emails, uploads, phone).
- From third parties you authorise (airlines, travel agents, ADRs, banks).
- Automatically through our website (cookies, analytics).
- From public or third‑party sources when necessary and lawful.
4. Purposes of processing and legal bases
We process personal data for the following purposes:
- To provide claims services (preparing, submitting and pursuing compensation claims) — legal basis: performance of a contract / legitimate interest.
- To communicate with airlines, ADRs, courts and third parties — necessary for claims handling.
- To transfer recovered funds — performance of contract.
- Identity verification & fraud prevention — legitimate interest and legal compliance.
- To comply with legal and regulatory obligations (accounting, record retention).
- Marketing communications (newsletters, offers) — only with your explicit consent; you may opt out at any time.
- Website operation, improvement and analytics — legitimate interest.
Where we rely on legitimate interests, we balance those interests against your rights. Where processing requires consent (e.g. marketing, certain cookies), we obtain consent and allow withdrawal.
5. Recipients and processors
We share personal data with: airlines and their agents; payment providers and banks; ADR bodies, courts and regulatory authorities; service providers (claims platforms, storage, translators, identity verification, legal partners); and law enforcement or regulators when required by law. All processors act under contract and are required to implement appropriate safeguards.
6. International transfers
Your data may be transferred outside the EEA or the UK. Where transfers occur we will rely on an appropriate safeguard (e.g. adequacy decision, standard contractual clauses, or other lawful transfer mechanism). Contact legal@flyrights.eu for details of specific transfers and safeguards.
7. Data retention
We retain personal data only as long as necessary: claim files typically up to 7 years for legal, dispute and accounting reasons; marketing data until consent is withdrawn; website analytics generally up to 26 months, unless anonymised earlier. If you request deletion, we will erase data unless we must retain it to comply with legal obligations or to defend/establish legal claims.
8. Your rights
Depending on your jurisdiction, you may have the right to: access your personal data; request correction of inaccurate data; request deletion (in limited circumstances); request restriction of processing; object to processing (where based on legitimate interests); data portability; withdraw consent where processing is based on consent; lodge a complaint with a data protection supervisory authority. To exercise rights, contact: legal@flyrights.eu. We may need to verify your identity before responding.
9. Security
We use appropriate technical and organisational measures to protect personal data (encryption, access controls, secure storage, staff training). No transmission over the internet or storage method is completely secure. Notify legal@flyrights.eu if you suspect a breach.
10. Automated decision-making
We do not use fully automated decision‑making that produces legal effects. We may use automated tools to prioritise claims or for eligibility checks, but final decisions are reviewed by a human.
11. Children
Our services are aimed at adults. We do not knowingly collect data from children under 16. If you believe we hold information about a child, contact legal@flyrights.eu and we will remove it.
12. Changes to this policy
We may update this Privacy Policy. Material changes will be published with an updated effective date. Non‑material edits may be made without prior notice.
13. Contact
Data protection enquiries and rights requests: legal@flyrights.eu