Privacy

Thank you for taking the time to read this. When you search for a flight with us, look up your booking or send us a question, you entrust us with your data. We handle it with care, and we want you to be able to see at any time what happens to it.

On this page we explain which personal data we process on airuniqon.com and in our booking engine, why we do so and on what legal basis, who receives the data and what rights you have. We only collect the data we need for each purpose. Cookies for statistics and advertising are only set with your consent.

1. Controller

The controller responsible for processing your data is:

AIR UNIQON GmbH
Dorfstraße 11
16835 Rüthnick
Germany

Managing Director: Fabian Rosenberg
Email: mail@airuniqon.com
Phone: +49 35751 28 94 86

If you have any questions about data protection or would like to exercise one of your rights, simply write to us at this address.

2. General information

Legal bases

We only process personal data where a legal basis permits it. Each section names the one that applies. The main ones are:

your consent (Art. 6(1)(a) GDPR),
the performance of a contract with you, such as your flight booking, or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR),
a legal obligation, for example retention obligations under commercial and tax law (Art. 6(1)(c) GDPR),
our legitimate interest, which we describe in the relevant section (Art. 6(1)(f) GDPR).

We may only store information on your device or read it from there, for example with cookies, with your consent (Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG) or where this is strictly necessary to provide a service you have expressly requested (Section 25(2) no. 2 TDDDG).

Service providers

For some tasks we work with service providers, for example for hosting the website or for our booking system. They process your data only on our instructions and on the basis of a data processing agreement (Art. 28 GDPR). You can find out who they are in the following sections.

Transfers to countries outside the EU

Some service providers are based outside the European Union and the European Economic Area or access data from there. We only allow this where your data is adequately protected: by an adequacy decision of the European Commission (Art. 45 GDPR), such as the one for Canada and for companies in the USA certified under the EU-U.S. Data Privacy Framework, or by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). We will be happy to send you a copy of the standard contractual clauses on request.

Storage period

We only store personal data for as long as we need it for the purpose in question. We then delete it, unless statutory retention periods require us to keep it longer. In that case we block the data for any other use and delete it as soon as the period has expired. The periods for each processing activity are given in the following sections.

3. When you visit our website

Hosting and server log files

Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. mittwald runs its servers in data centres in Germany and processes the data on our behalf.

Each time you open a page, your browser sends information to our server for technical reasons. The server stores the following in log files:

your IP address,
the date and time of the request,
the requested address and host name,
the page you came from (referrer), if your browser sends it,
browser and operating system (user agent),
the status code of the response and the amount of data transferred.

We need this data to deliver the website to you, to ensure its security and stability and to detect errors or attacks. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). mittwald shortens the IP addresses in archived log files so that they can no longer be traced to an individual connection. Access logs are deleted after 60 days, error logs after 7 days. We do not combine this data with other data.

Encrypted connection

Our website can only be reached over an encrypted connection (TLS). You can recognise it by "https://" in your browser's address bar. This means nobody can read what you send to us.

Fonts and images

We serve fonts and images from our own server. Your browser does not connect to Google or any other provider for them.

On your first visit we ask whether you agree to services for statistics and marketing. We store your decision in your browser's local storage under the name "consent": which categories you allowed, when you decided and which version of our request you answered. The entry stays on your device and is not sent to us. It is valid for 90 days; after that we ask you again, and also whenever we would like to use new services.

Without this entry we would have to ask you again on every page. It is therefore strictly necessary (Section 25(2) no. 2 TDDDG). The legal basis for the processing is our legitimate interest in knowing and respecting your decision (Art. 6(1)(f) GDPR).

You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page. If you withdraw consent, we delete the cookies of that category. Withdrawal takes effect for the future: anything done with your consent up to that point remains lawful.

4. Statistics and advertising with Google services

We want to understand how our website is used so that we can improve it, and we want to know whether our advertising reaches people. For this we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Tag Manager

We use Google Tag Manager to integrate and control the other Google services on our website. It is loaded on every page, including before you have made your cookie settings, and ensures that the other services only work as far as your choice allows. Tag Manager itself does not set any cookies. When it loads, Google receives your IP address and information about your browser for technical reasons. According to Google, it only stores these in server log files, which are deleted after 14 days.

Google processes this data as our processor. The legal basis is our legitimate interest in managing the integrated services securely and easily (Art. 6(1)(f) GDPR).

Before you decide: measurement without cookies

We use Google's consent mode in its advanced form. As long as you have not given consent, the Google services do not set or read any cookies or other identifiers on your device. Instead, they send individual messages to Google without cookies, for example that a page was viewed. These messages contain technical information such as the time, browser, screen resolution, the previous page, your consent choice and a random number generated anew on each page view. They do not contain an identifier that would allow your page views to be linked to one another; identifiers from clicks on ads are removed. Your IP address is transmitted for technical reasons. Google only uses it to determine your approximate region and then discards it.

Google uses these messages to estimate the gaps in our statistics that arise when visitors do not give consent. The legal basis is our legitimate interest in reliable and at the same time data-minimising audience measurement (Art. 6(1)(f) GDPR). You can object to this at any time (see Section 12).

Google Analytics ("Statistics" category)

If you consent to the "Statistics" category, we use Google Analytics 4. Google Analytics then sets cookies by which it recognises your browser on later visits: "_ga" and "_ga_" followed by an identifier, each with a lifetime of two years. This tells us, for example,

which pages are visited and how visitors find us,
how far pages are read and which links, downloads and videos are used,
which routes and travel dates are searched for, and for how many travellers,
whether someone clicks on one of our email addresses or phone numbers,
which devices, browsers and language settings are used and roughly which region visits come from.

The booking code and last name you enter under "My booking & extras" or at check-in are not passed to Google Analytics. We do not link the data in Google Analytics to your name or any other details you give us. According to Google, Google Analytics does not store the IP addresses of visitors from the EU: they are used on servers in the EU only to determine the approximate location and are then discarded immediately.

Google Analytics automatically deletes data on individual visitors and events after 14 months. Aggregated reports from which no individual visitors can be identified are kept.

Google processes this data as our processor. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Google Ads ("Marketing" category)

If you consent to the "Marketing" category, we use Google Ads. This lets us measure whether our ads lead to flight searches and bookings (conversion tracking), and show you ads from AIR UNIQON on other websites that match your visit to us (remarketing). Cookies are set for this: on our domain, for example, "_gcl_au" with a lifetime of 90 days; on Google's domains, for example, "IDE" (doubleclick.net) with a lifetime of 13 months. Google may link this data with information it already holds about you, for example if you are signed in to your Google account.

For Google Ads, Google and we are each independently responsible. Google also processes the data for its own purposes, for example to personalise advertising; Google's privacy policy applies to this. You can choose which ads Google shows you at myadcenter.google.com (opens in a new tab).

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Transfers to the USA

Google Ireland belongs to Google LLC, based in the USA. Your data may therefore also be transferred to Google LLC servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, Google bases transfers on the European Commission's standard contractual clauses.

You can read more about how Google handles your data in Google's privacy policy (opens in a new tab) and in Google's explanation of how it uses data from its partners' sites (opens in a new tab).

5. Flight search, booking and check-in

Our booking system

You book flights in our booking engine at book.airuniqon.com. There you can also manage your booking, add extras and check in. The booking engine and reservation system are run for us by InteliSys Aviation Systems Inc., 22 King Street, Saint John, New Brunswick E2L 1G3, Canada, as our processor. The systems run on Amazon Web Services in data centres in Frankfurt am Main and in Canada. The European Commission has decided that data is adequately protected in Canada (Art. 45 GDPR).

The flight search on our website

The flight search on our home page and many other pages comes from InteliSys. As soon as the search comes into view, your browser loads the program for it from an InteliSys server, along with our route network from the booking system. When you open the calendar, it requests available flights and fares from InteliSys. In doing so, InteliSys receives your IP address, information about your browser and the address of the page you are searching on, for technical reasons. The flight search does not store anything on your device.

When you click "Search flights", you are taken to the results in our booking engine with the route, travel dates, number of travellers and language. A short code for the page you searched on is added, for example "website-home". It shows us which pages lead to bookings and refers only to the page, not to you.

Where you search for flights, the legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR); otherwise it is our legitimate interest in offering you an up-to-date flight search directly on our website (Art. 6(1)(f) GDPR).

My booking and check-in

When you enter your booking code and last name under "My booking & extras" or at check-in, we open your booking directly in the booking engine. Both details are transmitted in the address (URL) and may therefore appear in your browser history and in the log files of InteliSys's servers. On our website they are neither stored nor passed on to analytics services. The legal basis is the performance of your contract of carriage (Art. 6(1)(b) GDPR).

When you book

In the booking engine we process the data we need for your booking and your flight. Depending on the booking, this includes in particular:

the names of the travellers, and for children and infants also their date of birth,
your contact details, such as email address and phone number,
flight, fare and booking details, seats, baggage and extras,
payment details,
check-in details and boarding passes,
at your request, information about any assistance you need, for example with reduced mobility or for children travelling alone.

We use this data to complete your booking, carry out your flight, send you your booking confirmation, invoice and boarding pass, inform you of changes such as delays or cancellations, and deal with your requests and claims, for example refunds or compensation under the Air Passenger Rights Regulation. The legal basis is the performance of your contract of carriage (Art. 6(1)(b) GDPR). We only process information about your health, such as reduced mobility, with your explicit consent (Art. 9(2)(a) GDPR), which you give by providing us with this information.

If you pay by credit card, a specialised payment service provider handles the payment. Your card details go directly to the provider and are not stored by us. Where necessary for your booking and your flight, we also pass your data on to payment service providers and banks, to the operating air carrier, to airports and ground handling services, and to authorities where we are legally obliged to do so (Art. 6(1)(c) GDPR).

The booking engine sets a cookie for your session ("airuniqon.ibe.sid") so that your details stay together during the booking. It is strictly necessary for this (Section 25(2) no. 2 TDDDG). We do not use any analytics or advertising services in the booking engine. When boarding passes are retrieved, Google reCAPTCHA protects the booking engine from automated requests (see Section 8).

We store your booking data for as long as we need it for your journey and its handling and for as long as claims arising from the carriage can be asserted, usually three years from the end of the year of your journey. We keep invoices and booking records for up to ten years because of obligations under commercial and tax law (Section 257 of the German Commercial Code, HGB; Section 147 of the German Fiscal Code, AO).

6. Plan your trip

On the "Plan your trip" page we show you offers for your destination that match your travel dates. These offers are provided by Ancillarate GmbH, Geidorfplatz 2/Top 7, 8010 Graz, Austria, as our processor.

Once you have entered a trip, your browser loads ancillarate's program and sends ancillarate: departure airport and destination, travel dates, the number of adults and children, the language, the address of the page without your search details and the page you came from, and, for technical reasons, your IP address and information about your browser. So that ancillarate can count which offers are shown and clicked, the program creates a random session identifier. It is held only in your browser's memory and expires after 30 minutes or when you leave the page. ancillarate does not store anything permanently on your device. For this, ancillarate uses servers in Frankfurt am Main operated by providers based in the USA (Vercel Inc. and Fly.io Inc.). Any access from the USA is covered by the safeguards described in Section 2.

If you click on an offer, the provider's website opens in a new window. We do not pass on any data to the provider when you do so. From that point on, the provider is responsible for your data and its privacy policy applies.

If ancillarate cannot show any offers on our page, a link leads to an offers page at airuniqon.ancillarate.com, which ancillarate runs for us. For the duration of your visit it stores a session identifier and your settings in your browser's storage, and it loads fonts from Google's servers and images from other providers, which receive your IP address in the process.

The legal basis is our legitimate interest in showing you offers for your destination that match your trip, which you yourself asked for with your entry (Art. 6(1)(f) GDPR).

7. Contact form

On our "Service" page you can write to us using a contact form. The form and the ticket system come from HappyFox Inc., 530 Technology Drive, Suite 100, Irvine, CA 92618, USA, which processes your data as our processor. The form is loaded from support.airuniqon.com as soon as you get close to it on the page.

In the form we ask for your topic, your name, your email address, a subject and your message. You can optionally add your booking code, your phone number, further recipients of a copy and attachments. We use this data to deal with your request and reply to you. Please only send us what we need for this. We only process information about your health, for example for assistance at the airport, because and insofar as you expressly provide it to us (Art. 9(2)(a) GDPR).

If your request concerns a booking or a contract with us, the legal basis is its performance (Art. 6(1)(b) GDPR); otherwise it is our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

HappyFox sets two cookies that are strictly necessary for the form (Section 25(2) no. 2 TDDDG): "pbrand-csrftoken" protects against forged form requests, and "brand-sessionid" keeps your session. Both expire after 14 days. The form is protected against automated requests by Google reCAPTCHA (see Section 8).

HappyFox stores the data in data centres in the USA. Because HappyFox is currently not certified under the EU-U.S. Data Privacy Framework, we base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

We delete your request once it has been fully dealt with and no statutory retention obligations prevent this. We keep requests about a booking for as long as the booking itself.

8. Protection against misuse with Google reCAPTCHA

Our contact form and the retrieval of boarding passes in the booking engine are protected against spam and automated requests by Google reCAPTCHA. reCAPTCHA checks whether a person or a program is making the entry. To do so, it evaluates, among other things, your IP address, information about your browser, device and screen, the time spent on the page and your interaction with it, and sets a cookie ("_GRECAPTCHA"). reCAPTCHA is part of the services of HappyFox and InteliSys, which integrate it from Google. The data is sent to Google and may also be transferred to servers of Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

The legal basis is our legitimate interest in protecting our services against misuse (Art. 6(1)(f) GDPR). The cookie is strictly necessary for the function you are using (Section 25(2) no. 2 TDDDG).

9. Contact by email or phone

If you email or call us, we process your contact details, your phone number or email address and the content of your message in order to deal with your request. The legal basis and storage period are the same as for the contact form (Section 7).

10. Job applications

If you apply to us by email, we process the data you send us, such as contact details, CV and references, in order to decide on your application. The legal basis is the initiation of an employment relationship (Art. 6(1)(b) GDPR). We only process special categories of data, such as a severe disability, insofar as you provide them to us and they are necessary for the application process (Art. 9(2)(b) GDPR). Your documents are only seen by the people involved in the selection.

If we hire you, your documents go into your personnel file. If we decline, we delete them six months after the rejection. Until then we keep them so that we can defend ourselves against possible claims, for example under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). If you would like us to keep your application longer for future positions, we will ask for your consent first.

We also publish our job ads on Workwise. If you apply there, Workwise's privacy policy applies to its processing.

On our website we link to, among other things, our profiles on Instagram and LinkedIn, to Workwise and to our partners' websites. These are simple links: only when you click on one does your browser connect to the provider in question. Its privacy policy applies there.

12. Your rights

You have the right at any time to

access the data we process about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure of your data (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability, meaning receiving your data in a common, machine-readable format (Art. 20 GDPR).

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). For cookies and similar technologies, the easiest way is via "Cookie settings" at the bottom of every page; for anything else, a short message to us is enough.

To exercise any of your rights, simply write to us at the address in Section 1. To make sure your data does not fall into the wrong hands, we may ask you to confirm that the request comes from you.

Your right to object

If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing, you can object to this at any time without giving reasons (Art. 21(2) GDPR). We will then no longer use your data for this purpose.

Your right to lodge a complaint

If you feel that we are not handling your data properly, please talk to us first. We will clear it up as quickly as possible. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
www.lda.brandenburg.de (opens in a new tab)

13. Further information

You can use our website without giving us any personal details. For a booking we need the data marked as required there. Without it we cannot conclude the contract of carriage.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We update this privacy statement when our website, our services or the law change. The version published here applies.

Last updated: October 2026