Privacy Policy

Introduction

Your privacy matters to us. This Privacy Policy explains what personal data we collect, why we process it, and how we protect it when you use the FLYSURFER website.

This Privacy Policy applies to all pages and services offered on this website, including the online shop, Partner Map, embedded media, newsletter subscription, contact forms, and service forms.

General Information on Data Processing

We process personal data only when there is a legal basis for doing so. Depending on the situation, this may be your consent, the performance of a contract, a legal obligation, or our legitimate interest in operating a secure and functional website.

Personal data means any information that can directly or indirectly identify you, such as your name, address, email address, IP address, order data, or communication content.

Legal Bases

We rely in particular on the following legal bases under the General Data Protection Regulation:

- Art. 6(1)(a) GDPR when you give us your consent
- Art. 6(1)(b) GDPR when processing is necessary for a contract or pre-contractual steps
- Art. 6(1)(c) GDPR when we are legally required to process data
- Art. 6(1)(f) GDPR when we have a legitimate interest and your interests do not override it

Recipients and Processors

We share personal data only when this is necessary for the relevant purpose. This may include hosting providers, payment providers, shipping and logistics partners, technical service providers, newsletter providers, analytics providers, and authorities where we are legally required to do so.

Where service providers process personal data on our behalf, we enter into appropriate data processing agreements.

Transfers Outside the EU and EEA

Some of the services we use are based outside the European Union or the European Economic Area. This applies in particular to providers based in the United States.

If data is transferred to a third country, we rely on appropriate safeguards. These may include Standard Contractual Clauses approved by the European Commission, an adequacy decision, or certification under the EU-US Data Privacy Framework.

For services that require consent, data is processed only after you have given consent through our consent management system.

Data Retention

We store personal data only for as long as necessary for the relevant purpose. Statutory retention obligations remain unaffected.

Commercial and tax law requirements may require certain data to be stored for up to ten years. Data processed based on your consent will be deleted or restricted if you withdraw your consent and no other legal basis applies.

Data Security

We use technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, and alteration.

This website uses encrypted connections. You can recognize this by the https address and the lock icon in your browser.

Hosting and Server Logs

This website is operated using WordPress and Shopware 6. Hosting is provided by Strato AG, Pascalstraße 10, 10587 Berlin, Germany.

When you visit the website, technical data is processed automatically to ensure secure and reliable website operation. This includes IP address, date and time of access, browser type, operating system, referrer URL, pages accessed, and transferred data volume.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure operation of the website, error analysis, and protection against attacks.

WordPress

We use WordPress to manage and display editorial website content. When you access WordPress-based pages, technical data may be processed so content can be displayed correctly and the website can function securely.

If you do not use interactive functions, WordPress generally processes only technical access data.

Legal basis: Art. 6(1)(f) GDPR.

Shopware 6 and Online Shop

Our online shop is operated with Shopware 6. If you view products, add products to the cart, create a customer account, or place an order, we process the data required for these functions.

Depending on your use, this may include name, address, email address, billing and delivery address, order data, payment status, cart data, customer account data, and communication data.

The processing is used to complete your order, provide your customer account, deliver products, provide customer support, and meet legal obligations.

Legal bases: Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR for secure shop functions.

Customer Account

If you create a customer account, we store the data you provide so you can manage orders, save addresses, and place future orders more easily.

You can request deletion of your customer account at any time unless statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR.

Payments with Stripe

We use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to process payments.

Depending on the payment method chosen, Stripe may process payment data, billing data, fraud prevention data, technical data, and transaction information. We do not store full payment details, such as full credit card numbers, in our systems.

Processing is necessary to handle your payment. Legal basis: Art. 6(1)(b) GDPR. Security and fraud prevention measures may also be based on Art. 6(1)(f) GDPR.

Stripe may process data outside the EU. According to Stripe, safeguards such as the EU-US Data Privacy Framework and other contractual protections are used.

Contact Forms and Service Requests

If you contact us through a contact form, service form, or by email, we process the data you provide to handle your request.

This may include name, email address, phone number, country, product information, serial numbers, photos, message content, and any other information you send us.

Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or possible order. In other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is handling your request and communicating with you.

Newsletter with Mailchimp

If you subscribe to our newsletter, we process your email address and any additional information you voluntarily provide. We use the newsletter to inform you about products, events, service information, and news from the FLYSURFER world.

Newsletter distribution is handled by Mailchimp, a service of Intuit Inc., USA. Mailchimp processes data on our behalf and may process data in the United States.

The subscription is based on your consent. You can withdraw your consent at any time, for example by using the unsubscribe link in every newsletter.

Legal basis: Art. 6(1)(a) GDPR. Evidence of your consent may be stored based on Art. 6(1)(f) GDPR.

Mailchimp states that it uses the EU-US Data Privacy Framework and Standard Contractual Clauses for data transfers to the United States.

Cookies and Similar Technologies

We use cookies and similar technologies to keep the website reliable, enable shop functions, and provide optional features such as analytics, maps, or videos.

Necessary cookies are required for basic functions. These include cart, login, language settings, security, and consent management.

Optional cookies and services for analytics, maps, videos, or marketing are activated only if you consent.

Legal basis for necessary cookies: Art. 6(1)(f) GDPR. Legal basis for optional cookies and similar technologies: Art. 6(1)(a) GDPR.

Consent Management with CCM19

We use CCM19 as our consent management solution, provided by Papoo Software & Media GmbH. CCM19 allows you to choose which optional services you want to allow. You can change your selection or withdraw consent at any time.

CCM19 stores information about your consent, such as timestamp, selection, technical identifier, and the version of the cookie settings. This is necessary to document and apply your decision.

Legal basis: Art. 6(1)(c) GDPR where documentation is required to meet legal accountability obligations, and Art. 6(1)(f) GDPR for secure and privacy-compliant consent management.

Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager helps us manage website tags centrally.

The Tag Manager itself is primarily used for technical administration. It can trigger other services if you have consented to them in our consent management system. The data processed then depends on the service activated.

Google services may transfer data to Google LLC in the United States. Appropriate safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses may apply.

Legal basis: Art. 6(1)(a) GDPR where services are activated through Tag Manager only after your consent.

Google Analytics 4

We use Google Analytics 4, a web analytics service of Google Ireland Limited. Google Analytics helps us understand how visitors use our website. This allows us to improve content, navigation, and functionality.

Google Analytics is activated only if you have consented through our consent management system.

Google Analytics may process data such as page views, session duration, interactions, technical information, approximate location, browser data, and device information. Data is collected using cookies or similar technologies.

We do not intentionally send identifying information such as names, email addresses, or payment data to Google Analytics.

Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time through the cookie settings.

Data may be transferred to Google LLC in the United States. Google states that it uses safeguards such as the EU-US Data Privacy Framework and contractual protections.

Google Maps and Partner Map

We use Google Maps to display our worldwide Partner Map. This helps you find FLYSURFER dealers, schools, test centers, and service partners near you.

Google Maps is loaded only if you consent through our consent management system.

When the map is loaded, your IP address, location data, usage data, and technical information may be transmitted to Google. If you interact with the map, Google may process additional data.

Legal basis: Art. 6(1)(a) GDPR.