PRIVACY STATEMENT

This Privacy Statement applies for the use of our website www.k5-aviation.com (“the Website”).
The protection of your privacy is extremely important to us. We gather and process your personal data in observance of all applicable data protection regulations, in particular the EU’s General Data Protection Regulation (GDPR).

1 Responsible Party

Responsible for the collection, processing and use of your personal data in the sense of Art. 4 No. 7 GDPR are
Erik Scheidt
K5-Aviation GmbH
Katharinazell 5
D-85408 Gammelsdorf
Germany
aviation@k5-group.com

Luca Madone
K5-Aviation GmbH
Baarerstrasse 88
CH-6300 Zug
Switzerland
aviation@k5-group.com

If you wish to object to your data being collected, processed or used by us in accordance with the data protection regulations, either overall or for individual purposes, you can submit your objection to the Responsible Party.
You can save and print out this Privacy Statement at any time.

2 General purposes of processing personal data

We use personal data to operate the Website.

3 Which data we use and why

3.1 Hosting

The hosting services we use serve to make the following services available: infrastructure and platform services, computing capacity, memory and database services, security services and technical maintenance services that we employ to operate the Website.
In doing so, we – or our hosting provider – process master data, contact data, content data, contractual data, usage, meta and communication data of customers, potential customers and visitors to our Website, on the basis of our “justified interest” in providing an efficient and secure Website pursuant to Art. 6 subs. 1 sentence 1 f) GDPR in conjunction with Art. 28 GDPR.

3.2 Access data

We gather information about you when you use this Website. We automatically record information about your user behaviour and your interaction with us, and we register data pertaining to your computer or mobile device. We collect, store and use data on every visit to our Website (server log files). These access data include:
Name and URL of the requested file
Date and time of the request
Data volume transferred
Notification of successful request (HTTP response code)
Browser type and version
Operating system
Referrer URL (the previous website visited)
Websites that the user’s system accesses from our Website
User’s internet service provider
IP address and requesting provider
We use these log data without their being associated with you and without creating any other kind of profile, for anonymous statistical assessments for the purposes of operating, optimising and ensuring the security of our Website, for recording the number of visitors to it (traffic), for measuring the scope and type of usage of our Website and services, and for accounting purposes by measuring the number of clicks we receive from cooperation partners. Using this information, we can make personalised and location-based content available and analyse the data traffic, find and rectify errors and improve our services.
This is also our justified interest pursuant to Art. 6 subs. 1 sentence 1 f) GDPR.
We reserve the right to subsequently examine log data if concrete facts give us justified reason to believe that the Website is being used for illegal purposes. We store IP addresses for a limited period in the log files if this is necessary for security purposes or for the rendering of services. Once the process is stopped, we delete the IP address if it is no longer required for security purposes. We also store IP addresses if we justifiably suspect an illegal act in connection with the use of our Website.

3.3 Cookies

We use session cookies to optimise our Website. A session cookie is a small text file that the applicable server sends when you visit a website and which is then stored temporarily on your hard drive. This file contains what is known as a session ID, with which various requests from your browser can be attributed to the specific visit. With it, your computer can be recognised when you return to our Website. These cookies are deleted from your computer when you close your browser.
To a minimal extent we also use persistent cookies (also small text files that are stored on your device), which remain on your device and enable us to recognise your browser again at your next visit. These cookies are stored on your hard drive and delete themselves autonomously after a prescribed period of time between 1 month and 10 years. They enable us to make our internet offering more user friendly, more effective and safer.
Our justified interest in using the cookies pursuant to Art. 6 subs. 1 sentence 1 f) GDPR lies in making our Website more user friendly, more effective and safer.
The following data and information is stored in the cookies, for instance:
Log-in information
Language settings
Search terms entered
Information about the number of visits to our Website and the use of individual functions it offers.
When the cookie is activated, it is allocated an identification number, and your personal data is not associated with your personal data. Your name, IP address and other similar data that would make it possible to associate the cookie with you are not put into the cookie. Due to the cookie technology, we merely receive pseudonymised information, for example about which pages of our Website were visited, which products were viewed, etc.
You can adjust the settings of your browser to inform you before cookies are installed and to allow you to decide if you wish to reject certain cookies or all cookies. This may, however, restrict the Website’s functionalities.

3.4 Data for meeting our contractual obligations

We process data that we require to meet our contractual obligations, such as name, address, e-mail address, flight route, billing and payment data. This information has to be collected in order to conclude the agreement.
The data are deleted after the expiration of the guarantee periods and retention periods required by law.
The legal basis for the processing of these data is Art. 6 subs. 1 sentence 1 b) GDPR, because these data are required for us to be able to meet our contractual obligations to you.

3.5 E-mail contact

If you contact us (e.g. by e-mail), we process your information in order to respond to your inquiry and in case subsequent questions arise.
If the data are processed for precontractual purposes that you request or for the execution of an existing contract if you are already our client the legal basis for this data processing is Art. 6 subs. 1 sentence 1 b) GDPR.
We only process further personal data if you give your consent (Art. 6 subs. 1 sentence 1 a) GDPR) or if we have a justified interest in processing your data (Art. 6 subs. 1 sentence 1 f) GDPR). A justified interest can for example be in responding to your e-mail.

4 Storage duration

Unless otherwise specifically stated, we only store personal data as long as is required to fulfil the purpose pursued.
In some cases, the legislator requires that personal data be retained, for instance under tax or commercial law. In these cases, we only keep the data for these statutory purposes, but we do not process them any further and we delete them at the end of the retention period prescribed by law.

5 Your rights as the party affected by the data processing

According to the applicable laws, you have various rights regarding your personal data. If you wish to assert these rights, please send your inquiry by e-mail or post, clearly identifying who you are, to the address cited in Article 1 above.
The following is a summary of your rights.

5.1 Right to confirmation and information

You have the right to clear and understandable information about the processing of your personal data.
In detail:
You have the right to receive confirmation from us at any time as to whether personal data pertaining to you are being processed. If they are, you have the right to free information about the personal data stored about you, and to demand a copy of those data. You also have the right to the following information:
1. The purpose of the processing;
2. The categories of personal data being processed;
3. The recipients or categories of recipients to whom the personal data have been disclosed or will be disclosed, especially in the case of recipients in other countries or international organisations;
4. If possible, the duration for which it is planned to store the personal data or, if this is not possible, the criteria for determining this period;
5. The right to have your personal data corrected or deleted or to restrict the processing by the Responsible Party, or to object to this processing;
6. The right to complain to a supervisory authority;
7. If the personal data are not collected from you directly, all available information about the origin of the data;
8. Automated decision-making including profiling pursuant to Art. 22 subs. 1 and 4 GDPR and – at least in these cases – relevant information about the involved logic and the significance and desired effects of such processing for you.
If personal data are transmitted to a third-party country or an international organisation, you have the right to be informed about the suitable guarantees pursuant to Art. 46 GDPR related to the transmission.

5.2 Right to correction

You have the right to demand that we correct and where applicable complete the personal data pertaining to you.
In detail:
You have the right to demand that we immediately correct incorrect personal data pertaining to you. Taking the purposes of the processing into account, you have the right to demand the completion of incomplete personal data – also by means of a supplementary declaration.

5.3 Right to deletion (“right to be forgotten”)

In many cases we are obliged to delete personal data pertaining to you.
In detail:
Pursuant to Art. 17 subs. 1 GDPR, you have the right to demand that we immediately delete personal data pertaining to you, and we are obliged to delete personal data without delay if one of the following reasons arises:
1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You revoke your consent to the processing pursuant to Art. 6 subs. 1 sentence 1 a) GDPR or Art. 9 subs. 2 a) GDPR, and there are no other legal grounds for the processing.
3. You object to the processing pursuant to Art. 21 subs. 1 GDPR and there are no compelling reasons worthy of protection with higher priority for the processing, or you object to the processing in accordance with Art. 21 subs. 2 GDPR.
4. The personal data were processed unlawfully.
5. The personal data must be deleted to meet a legal obligation under EU law or the law of the member states to which we are subject.
6. The personal data were collected with regard to services offered by the information company in accordance with Art. 8 subs. 1 GDPR.
If we have made your personal data public and are obliged to delete them pursuant to Art. 17 subs. 1 GDPR, we will take appropriate measures, also of a technical nature, under consideration of the available technology and implementation costs, to inform those responsible for the data processing, that you have demanded the deletion of all links to said personal data or copies thereof.

5.4 Right to limit the processing of your data

In many cases you have the right to demand from us the restriction of the processing of your personal data.
In detail:
You have the right to demand from us the restriction of the processing under the following conditions:
1. You dispute the correctness of the personal data for a period of time that allows us to check the correctness of the personal data,
2. The processing is unlawful and you decline the deletion of your personal data and instead demand the restriction of the use of the personal data;
3. We no longer require the personal data for the purpose of the processing, but you require the data to assert, exercise or defend against legal claims, or
4. You have submitted an objection to the processing in accordance with Art. 21 subs. 1 GDPR, unless it is ascertained that our company’s justified interests prevail over yours.

5.5 Right to data portability

You have the right to receive the personal data pertaining to you in a machine-readable form, to transmit them or to have them transmitted by us.
In detail:
You have the right to receive the personal data pertaining to you that you have made available to us in a structured, customary and machine-readable format, and you have the right to transmit these data to another responsible party without us hindering you, in as much as
1. The processing is based on a consent pursuant to Art. 6 subs. 1 sentence 1 a) GDPR or Art. 9 subs. 2 a) GDPR or on a contract pursuant to Art. 6 subs. 1 sentence 1 b) GDPR and
2. The processing is done with the aid of automatic procedures.
When exercising your right to data portability pursuant to subsection 1, you have the right to ensure that the personal data are transmitted by us directly to another responsible party if this is technically possible.

5.6 Right to object

You have the right to object to a lawful processing of your personal data by us if this is justified due to your specific situation, and our interests in the processing do not predominate.
In detail:
You have the right to object at any time to the processing of your personal data, which is performed on the basis of Art. 6 subs. 1 sentence 1 e) or f) GDPR, for reasons arising from your specific situation. This also applies to any profiling based on these regulations. We cease to process the personal data unless we can give evidence of compelling reasons for the processing worthy of protection that predominate over your interests, rights and freedoms, or if the processing serves to assert, exercise or defend against legal claims.
If we process personal data to practice direct advertising, you have the right to object to the processing of personal data pertaining to you for the purpose of such advertising at any time. The same applies to profiling, in so far as it stands in conjunction with direct advertising.
You have the right to object, for reasons arising from your specific situation, to the processing of personal data pertaining to you for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 subs. 1 GDPR, unless the processing is required to fulfil a purpose that is in the public interest.

5.7 Automated decisions and profiling

You have the right not to be subjected to a decision based solely on automated processing – including profiling – that has a legal effect for you or significantly compromises you in a similar way.
No automated decision-making takes place on the basis of the collected personal data.

5.8 Right to revoke consent under data protection law

You have the right to revoke your consent to the processing of your personal data at any time.

5.9 Right to complain to a supervisory authority

You have the right to complain to a supervisory authority, in particular in the member state of your place of residence, workplace or the venue of the suspected breach, if you are of the opinion that the processing of the personal data pertaining to you is unlawful.

6 Data security

We take the maximum of effort to ensure the security of your data within the scope of the applicable data protection laws and technical possibilities.
We transmit your personal data in encrypted form. This applies to your orders and also to the customer log-in. We use the encryption system SSL (Secure Socket Layer), but point out that the transmission of data through the internet (e.g. e-mail communication) can exhibit security weaknesses. It is not possible to guarantee invulnerable protection of data against third-party access.
We maintain technical and organisational security measures in accordance with Art. 32 GDPR to protect your data, which we consistently keep up to the state of technology.
Furthermore, we do not guarantee that our offering will be available at any specific times; disturbances, interruptions or downtimes cannot be ruled out. The servers we use are regularly, carefully backed up.

7 Passing data on to third parties, no transmission of data outside the EU

We only use your personal data within our company.
If and in as much as we involve third parties in fulfilling contracts (for example logistics providers), they only receive the personal data to the extent required to render their performance.
If we outsource certain parts of the data processing (“order processing”), we contractually oblige order processors to only use personal data in accordance with the data protection laws and to guarantee protection of the rights of the person involved.
We do not, nor do we plan to, transfer data to persons or entities outside the EU except in the case stated in Article 4 of this Statement.

8 Data Protection Officer

If you have any questions or concerns about data protection, please contact our Data Protection Officer:
data-protection@k5-group.com