Privacy Notice according to the EU General Data Protection Regulation for 'Natural Persons' (Flight Booking)
In the following, we inform you about the processing of your personal data in the context of a flight booking.
The privacy policy applies regardless of the domains, platforms, and devices used (e.g. desktop, mobile, etc.).
Personal data within the meaning of the General Data Protection Regulation (hereinafter "GDPR") are all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. Which data are processed in detail and in which way they are used depends primarily on the services you use with us.
1. Controller for data processing
Controller pursuant to Art. 4 para. 7 of the General Data Protection Regulation (GDPR) is:
BERlogic GmbH,
Lankwitzer Str. 39,
12107 Berlin, Germany
For general questions on the subject of data protection, such as information or deletion requests, the following are available to you: E-Mail: datenschutz@berlogic.de or Tel: +49 30 983 20 88 0.
Data Protection Officer
Our company Data Protection Officer is:
Mr. Jürgen Becker
He is responsible for monitoring and compliance with data protection in our company and is available to you for confidential contact on the subject of data protection. You can reach him at: datenschutz@berlogic.de
2. Which sources and data do we use?
Within the booking process, we collect the data of the booking applicants and travelers, which are exclusively required for the mediation of travel products and the provision of our services:
3. Who receives my data?
Data are transferred to third parties only within the framework of the legal provisions according to Art. 6 para. 1 lit. c GDPR or for the initiation and execution as well as the reversal of a contract according to Art. 6 para. 1 lit. b GDPR, as well as on the basis of legitimate interests according to Art. 6 para. 1 lit. f GDPR in an economic and effective operation of our business and if you have consented to the data transmission according to Art. 6 para. 1 lit. a GDPR.
The main categories of our service providers and business partners are as follows:
These service providers have access to personal information that is required for the fulfillment of their tasks. However, they may not use these for other purposes. The personal data are not used for advertising purposes.
The service providers and business partners indicated in point 1 to 5 process your data for the initiation and execution as well as the reversal of a contract according to Art. 6 para. 1 lit. b GDPR. The service providers and business partners indicated in point 6 to 8 process your data on the legal basis of legitimate interests according to Art. 6 para. 1 lit. f GDPR in an economic and effective operation of our business.
Insofar as we use processors pursuant to Art. 28 GDPR to provide our services, we take appropriate legal precautions as well as corresponding technical and organizational measures to ensure the protection of personal data in accordance with the applicable legal provisions.
All our employees and partners are bound to confidentiality. Within the company, those departments that need them to fulfill our contractual and legal obligations have access to your data.
We disclose your data if we are legally obliged to do so according to Art. 6 para. 1 lit. c GDPR (e.g. police, data protection authority. In case of prevailing legal provisions) or if such disclosure is necessary (e.g. lawyers, court).
Depending on your specific booking (e.g. flight route, selected additional services, payment methods), different partners may be involved. This constellation makes it impossible for us to provide a complete and always up-to-date list of all potential recipients of your personal data, but only the categories of the data recipients. These are usually visible during the booking process. Upon your request, we can provide you with precise and up-to-date information on the actual recipients of your personal data in connection with your specific booking. Please also contact us before your booking by e-mail: bookings@berlogic.de or Tel. +49 30 208-981-350, Mon-Fri: 09:00 - 17:00 (CET), except weekends and public holidays.
Please note, if you book a flight, you enter into a contract directly with the respective travel provider. In this case, the travel provider is responsible for the processing of the personal data you provide in the course of the booking. As an independent controller, the travel provider independently decides on the purposes and means of the data processing. This means that the travel provider independently determines how and for what your data are used in connection with the travel booking or the purchase. Please first read the privacy policy and the general terms and conditions of the respective travel provider on the travel provider’s website/platform to find out how the travel provider uses your data before you make a booking or a purchase.
4. Fraud prevention
We use procedures for fraud prevention to protect ourselves against misuse, in particular by fraudulent bookings. The purpose of data processing is to identify and prevent potentially harmful behavior and to avoid financial damage to the company. Fraud prevention protects not only the company, but also the personal and financial data of customers.
For this purpose, we process personal data of the booking applicants and travelers: name, contact data, booking data and payment data. The evaluation is carried out manually by the responsible employees. No automated decision-making takes place.
In case of high fraud risk or proven fraud, we take necessary measures. For example, we may cancel bookings, file a criminal complaint and enter the person into the block list. The processing is carried out on the legal basis of Art. 6 para. 1 lit. f GDPR from our legitimate interest in preventing economic damage.
5. Technical analysis
To ensure the security and functionality of our technical systems, we process the following personal data: master and contact data, order history, payment data, access data. For example, if price or booking errors occur in the context of a booking, we need your data in some cases to analyze the error messages, fix the error, as well as to store the correct data in our IT systems or to send cancellation messages. We carry out a proactive risk assessment by systematically analyzing sources of error, their effects and probabilities of occurrence. It serves to improve product quality and process reliability. No automated decision-making takes place. The data processing is carried out according to Art. 6 para. 1 lit. f GDPR due to our legitimate interest in an error-free use of our IT systems and the storage of correct data.
6. Are data transferred to a third country or to an international organization?
Our servers are located in the EU, our contractors and partners, with whom we are jointly responsible for data processing, may also be based outside the EU and EEA. The transfer of personal data takes place in accordance with data protection regulations, in particular the European General Data Protection Regulation (GDPR). Insofar as this is the case and the European Commission has not issued an adequacy decision within the meaning of Art. 45 GDPR for these countries and in the case of the EU-US Data Privacy Framework companies have not certified themselves under it (see adequacy decision at https://ec.europa.eu/commission/presscorner/detail/de/ip_23_3721), we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include, among others, the standard contractual clauses of the European Union or binding corporate rules, which are accompanied by technical and organizational measures, such as effective encryption.
If a third country transfer is planned and no adequacy decision or appropriate safeguards exist, there is a risk that authorities (such as intelligence services) in the respective third country may gain access to the transmitted data, collect and analyze these data. Likewise, the enforceability of your data subject rights may not be guaranteed. If this is not possible, we base the data transfer on exceptions of Art. 49 GDPR, in particular on your explicit consent.
Please note that we have no influence on the independent controllers, such as an airline that is based outside the EU and EEA.
7. Your data protection rights
Every data subject has
the right of access according to Art. 15 GDPR (i.e. you have the right to request information at any time about your personal data stored by us),
the right of rectification according to Art. 16 GDPR (i.e. in case your personal data are incorrect or incomplete, you can request the correction of these data),
the right of deletion according to Art. 17 GDPR and the right of restriction of processing according to Art. 18 GDPR (i.e. you may have the right to request the deletion or restriction of the processing of your personal data if, for example, there is no longer a legitimate business purpose for such processing and statutory retention obligations do not require further storage),
the right to data portability according to Art. 20 GDPR (i.e. you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance),
withdrawal of your consent, i.e. you have the right to withdraw a consent to the processing of your data that you have given us at any time: e.g. by post Lankwitzer Str. 39, 12107 Berlin, Germany, or by e-mail: datenschutz@berlogic.de
Furthermore, there is a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG). The supervisory authority responsible for you can be found at https://www.datenschutz-berlin.de/buergerinnen-und-buerger/beschwerde/einreichen-einer-beschwerde/
In addition, we would like to draw your attention to your right to object according to Art. 21 GDPR:
Information about your right to object according to Article 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6 para. 1 letter e GDPR (data processing in the public interest) and Article 6 para. 1 letter f) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.
The objection can be made without form and no costs other than the transmission costs according to the basic tariffs will arise.
The objection should, if possible, be addressed to: by post Lankwitzer Str. 39, 12107 Berlin, Germany, or by e-mail: datenschutz@berlogic.de
8. To what extent is there an automated decision-making in individual cases including profiling?
We do not use fully automated automated decision-making according to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately, insofar as this is legally required. We do not process your data automatically with the aim of evaluating certain personal aspects (profiling).
9. How long will my data be stored?
The duration of the storage of personal data is based on the respective legal basis, the processing purpose and – if applicable – additionally on the respective statutory retention period (e.g. commercial and tax retention periods).
In the case of the processing of personal data on the basis of an explicit consent according to Art. 6 para. 1 lit. a GDPR, these data are stored until the data subject withdraws his consent.
If there are statutory retention periods for data which are processed in the context of legal or quasi-legal obligations on the basis of Art. 6 para. 1 lit. b GDPR, these data are routinely deleted after expiry of the retention periods, provided that they are no longer required for the fulfillment or initiation of a contract and/or there is no legitimate interest in further storage on our part.
In the case of the processing of personal data on the basis of Art. 6 para. 1 lit. f GDPR, these data are stored until the data subject exercises his right of objection according to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise or defense of legal claims.
Unless otherwise specified in the further information of this declaration about specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.
The privacy policy applies regardless of the domains, platforms, and devices used (e.g. desktop, mobile, etc.).
Personal data within the meaning of the General Data Protection Regulation (hereinafter "GDPR") are all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. Which data are processed in detail and in which way they are used depends primarily on the services you use with us.
1. Controller for data processing
Controller pursuant to Art. 4 para. 7 of the General Data Protection Regulation (GDPR) is:
BERlogic GmbH,
Lankwitzer Str. 39,
12107 Berlin, Germany
For general questions on the subject of data protection, such as information or deletion requests, the following are available to you: E-Mail: datenschutz@berlogic.de or Tel: +49 30 983 20 88 0.
Data Protection Officer
Our company Data Protection Officer is:
Mr. Jürgen Becker
He is responsible for monitoring and compliance with data protection in our company and is available to you for confidential contact on the subject of data protection. You can reach him at: datenschutz@berlogic.de
2. Which sources and data do we use?
Within the booking process, we collect the data of the booking applicants and travelers, which are exclusively required for the mediation of travel products and the provision of our services:
- First and last name, second first name, date of birth, address, nationality, gender, if necessary passport data — for issuing the booking, confirmation documents, invoice.
- E-mail address, telephone number — for sending confirmation documents and invoices, for customer service, e.g. passenger notification.
- Payment data — for the processing of payments as well as provision of receipts – in the case of credit card payment the credit card number, CVC and expiry date of the credit card holder’s payment instrument, 3D Secure data. However, BERlogic in no case receives your complete credit card data. The payment service providers receive the payment data directly.
- Contact and communication – You have the possibility to contact us by post, telephone, fax, e-mail or via the contact form on the website. In the context of contacting us, personal data are collected: first/last name, contact data, content of the communication: the data you send us as a message, date and time of the request.The data indicated under point 1 to 4 we process for the initiation and execution as well as the reversal of a contract according to Art. 6 para. 1 lit. b GDPR.
- Your access data (including date and time of the request, time zone difference to Greenwich Mean Time (GMT), rarely we receive an IP address from a partner (e.g. comparison portal) automatically with the booking). The legal basis for the processing of these data is Art. 6 para. 1 lit. f GDPR for the protection of our overriding legitimate interests in the context of a balancing of interests: (1) ensuring IT security, in particular the security of the website and IT systems, (2) assertion of legal claims and defense in legal disputes, (3) purposes of proof, including clarification of technical error, misuse or fraud cases.
- Health data or other sensitive data — In exceptional situations, such as in a medical emergency, it may be necessary to collect and process special data. In such cases, you can provide us with relevant information. This takes place with your consent according to Art. 6 para. 1 lit. a GDPR. We pass on these data to the respective travel provider, e.g. airline. This is done exclusively for the purpose of appropriate care during your journey.
- Recording of telephone calls — When you call our call center, we record the telephone calls and store them so that we can provide the services you have requested (e.g. purchase and cancellation of the flight ticket, subsequent booking of additional baggage, information, in particular on changes of flight data, etc.) and carry out billing. In addition, we protect the passenger against unauthorized changes in the booking and can prove that the customer has requested and used a certain service. The recording of telephone calls takes place according to Art. 6 para. 1 lit. a GDPR your consent. The consent takes place when you press a key "1" on the keypad of the phone. Further information on data processing can be found in the privacy policy for the recording of telephone calls in the customer center on our website https://www.berlogic.de. If the data are not provided, the conclusion of a contract is not possible.
3. Who receives my data?
Data are transferred to third parties only within the framework of the legal provisions according to Art. 6 para. 1 lit. c GDPR or for the initiation and execution as well as the reversal of a contract according to Art. 6 para. 1 lit. b GDPR, as well as on the basis of legitimate interests according to Art. 6 para. 1 lit. f GDPR in an economic and effective operation of our business and if you have consented to the data transmission according to Art. 6 para. 1 lit. a GDPR.
The main categories of our service providers and business partners are as follows:
- Computer reservation system: airline booking system, global distribution system (interfaces for connection to the airlines), booking system of BERlogic GmbH, booking system of the partner – for the execution of the booking.
- Service providers, e.g. your direct contractual partner, such as the airline or flight providers selected by you – for the execution of the service.
- Comparison portal, where you searched or booked the flight tickets – to clarify your matters, e.g. in case of complaint/problem solving.
- Customer center – for customer service, e.g. to be able to offer you further services by e-mail and telephone at your request, such as cancellation of the ticket, changes of flight times or the subsequent booking of additional baggage.
- Payment gateway, online payment service providers and acquiring bank: for processing payments (credit card).
- IT service providers: technical support of our IT systems and IT infrastructure, IT security, maintenance and support, such as helpdesk services.
- Cloud and hosting service providers: for the operation of virtual server, network and data storage infrastructures.
- Debt collection service providers: In case of payment default, including an unjustified chargeback, we reserve the right to have the claim enforced by a collection service provider and to transmit your data to them for this purpose.
These service providers have access to personal information that is required for the fulfillment of their tasks. However, they may not use these for other purposes. The personal data are not used for advertising purposes.
The service providers and business partners indicated in point 1 to 5 process your data for the initiation and execution as well as the reversal of a contract according to Art. 6 para. 1 lit. b GDPR. The service providers and business partners indicated in point 6 to 8 process your data on the legal basis of legitimate interests according to Art. 6 para. 1 lit. f GDPR in an economic and effective operation of our business.
Insofar as we use processors pursuant to Art. 28 GDPR to provide our services, we take appropriate legal precautions as well as corresponding technical and organizational measures to ensure the protection of personal data in accordance with the applicable legal provisions.
All our employees and partners are bound to confidentiality. Within the company, those departments that need them to fulfill our contractual and legal obligations have access to your data.
We disclose your data if we are legally obliged to do so according to Art. 6 para. 1 lit. c GDPR (e.g. police, data protection authority. In case of prevailing legal provisions) or if such disclosure is necessary (e.g. lawyers, court).
Depending on your specific booking (e.g. flight route, selected additional services, payment methods), different partners may be involved. This constellation makes it impossible for us to provide a complete and always up-to-date list of all potential recipients of your personal data, but only the categories of the data recipients. These are usually visible during the booking process. Upon your request, we can provide you with precise and up-to-date information on the actual recipients of your personal data in connection with your specific booking. Please also contact us before your booking by e-mail: bookings@berlogic.de or Tel. +49 30 208-981-350, Mon-Fri: 09:00 - 17:00 (CET), except weekends and public holidays.
Please note, if you book a flight, you enter into a contract directly with the respective travel provider. In this case, the travel provider is responsible for the processing of the personal data you provide in the course of the booking. As an independent controller, the travel provider independently decides on the purposes and means of the data processing. This means that the travel provider independently determines how and for what your data are used in connection with the travel booking or the purchase. Please first read the privacy policy and the general terms and conditions of the respective travel provider on the travel provider’s website/platform to find out how the travel provider uses your data before you make a booking or a purchase.
4. Fraud prevention
We use procedures for fraud prevention to protect ourselves against misuse, in particular by fraudulent bookings. The purpose of data processing is to identify and prevent potentially harmful behavior and to avoid financial damage to the company. Fraud prevention protects not only the company, but also the personal and financial data of customers.
For this purpose, we process personal data of the booking applicants and travelers: name, contact data, booking data and payment data. The evaluation is carried out manually by the responsible employees. No automated decision-making takes place.
In case of high fraud risk or proven fraud, we take necessary measures. For example, we may cancel bookings, file a criminal complaint and enter the person into the block list. The processing is carried out on the legal basis of Art. 6 para. 1 lit. f GDPR from our legitimate interest in preventing economic damage.
5. Technical analysis
To ensure the security and functionality of our technical systems, we process the following personal data: master and contact data, order history, payment data, access data. For example, if price or booking errors occur in the context of a booking, we need your data in some cases to analyze the error messages, fix the error, as well as to store the correct data in our IT systems or to send cancellation messages. We carry out a proactive risk assessment by systematically analyzing sources of error, their effects and probabilities of occurrence. It serves to improve product quality and process reliability. No automated decision-making takes place. The data processing is carried out according to Art. 6 para. 1 lit. f GDPR due to our legitimate interest in an error-free use of our IT systems and the storage of correct data.
6. Are data transferred to a third country or to an international organization?
Our servers are located in the EU, our contractors and partners, with whom we are jointly responsible for data processing, may also be based outside the EU and EEA. The transfer of personal data takes place in accordance with data protection regulations, in particular the European General Data Protection Regulation (GDPR). Insofar as this is the case and the European Commission has not issued an adequacy decision within the meaning of Art. 45 GDPR for these countries and in the case of the EU-US Data Privacy Framework companies have not certified themselves under it (see adequacy decision at https://ec.europa.eu/commission/presscorner/detail/de/ip_23_3721), we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include, among others, the standard contractual clauses of the European Union or binding corporate rules, which are accompanied by technical and organizational measures, such as effective encryption.
If a third country transfer is planned and no adequacy decision or appropriate safeguards exist, there is a risk that authorities (such as intelligence services) in the respective third country may gain access to the transmitted data, collect and analyze these data. Likewise, the enforceability of your data subject rights may not be guaranteed. If this is not possible, we base the data transfer on exceptions of Art. 49 GDPR, in particular on your explicit consent.
Please note that we have no influence on the independent controllers, such as an airline that is based outside the EU and EEA.
7. Your data protection rights
Every data subject has
the right of access according to Art. 15 GDPR (i.e. you have the right to request information at any time about your personal data stored by us),
the right of rectification according to Art. 16 GDPR (i.e. in case your personal data are incorrect or incomplete, you can request the correction of these data),
the right of deletion according to Art. 17 GDPR and the right of restriction of processing according to Art. 18 GDPR (i.e. you may have the right to request the deletion or restriction of the processing of your personal data if, for example, there is no longer a legitimate business purpose for such processing and statutory retention obligations do not require further storage),
the right to data portability according to Art. 20 GDPR (i.e. you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance),
withdrawal of your consent, i.e. you have the right to withdraw a consent to the processing of your data that you have given us at any time: e.g. by post Lankwitzer Str. 39, 12107 Berlin, Germany, or by e-mail: datenschutz@berlogic.de
Furthermore, there is a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG). The supervisory authority responsible for you can be found at https://www.datenschutz-berlin.de/buergerinnen-und-buerger/beschwerde/einreichen-einer-beschwerde/
In addition, we would like to draw your attention to your right to object according to Art. 21 GDPR:
Information about your right to object according to Article 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6 para. 1 letter e GDPR (data processing in the public interest) and Article 6 para. 1 letter f) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.
The objection can be made without form and no costs other than the transmission costs according to the basic tariffs will arise.
The objection should, if possible, be addressed to: by post Lankwitzer Str. 39, 12107 Berlin, Germany, or by e-mail: datenschutz@berlogic.de
8. To what extent is there an automated decision-making in individual cases including profiling?
We do not use fully automated automated decision-making according to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately, insofar as this is legally required. We do not process your data automatically with the aim of evaluating certain personal aspects (profiling).
9. How long will my data be stored?
The duration of the storage of personal data is based on the respective legal basis, the processing purpose and – if applicable – additionally on the respective statutory retention period (e.g. commercial and tax retention periods).
In the case of the processing of personal data on the basis of an explicit consent according to Art. 6 para. 1 lit. a GDPR, these data are stored until the data subject withdraws his consent.
If there are statutory retention periods for data which are processed in the context of legal or quasi-legal obligations on the basis of Art. 6 para. 1 lit. b GDPR, these data are routinely deleted after expiry of the retention periods, provided that they are no longer required for the fulfillment or initiation of a contract and/or there is no legitimate interest in further storage on our part.
In the case of the processing of personal data on the basis of Art. 6 para. 1 lit. f GDPR, these data are stored until the data subject exercises his right of objection according to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise or defense of legal claims.
Unless otherwise specified in the further information of this declaration about specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.