1. Who we are
Data Controller: Leon Morris, sole trader, trading as ClaimFly. Business name registration number: [Business Name Registration number — pending CRO RBN1A]. Principal place of business: Guinness Enterprise Centre, Taylor's Lane, Dublin 8, Ireland.
Contact for data-protection queries: privacy@claim-fly.com
2. What data we collect
When you submit a claim through our website or contact us, we collect:
- Identity data — first name, last name, date of birth (where required for identification with the airline).
- Contact data — email address, phone number, postal address.
- Flight data — flight number, booking reference, route, scheduled and actual times, delay details.
- Identity documents — passport or ID card scan, where the airline or a court requires proof of identity.
- Financial data — bank account details (IBAN/BIC) for compensation payouts.
- Technical data — IP address, browser type, device information, cookies (see our Cookies Policy).
3. Why we collect it
| Purpose | Lawful basis |
|---|---|
| To file and pursue your compensation claim | Performance of a contract |
| To verify your identity with the airline | Performance of a contract |
| To process payments to you | Performance of a contract |
| To comply with Irish accounting / tax law | Legal obligation |
| To improve the service and prevent fraud | Legitimate interest |
| To send marketing or product updates (only if you opted in) | Consent |
4. Who we share it with
We share the minimum data necessary with:
- Airlines and their representatives — to pursue your claim.
- Legal representatives (solicitors) — where the claim escalates to court.
- Payment providers — to transfer your compensation.
- Hosting and infrastructure providers — Cloudflare (EU edge), [TBD — database provider]. All are GDPR-compliant.
- Government authorities — only where legally compelled.
We do not sell your data and we do not share it with advertisers.
5. International transfers
Your data is stored within the European Economic Area. If any sub-processor sits outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure equivalent protection.
6. How long we keep it
Active claim data is kept for the duration of your case. Once your claim is closed, we retain core records for seven years to comply with Irish accounting and tax obligations (Taxes Consolidation Act 1997). After that, the data is securely deleted.
You can request earlier deletion at any time — see Section 8.
7. Security
We use TLS encryption in transit, encryption at rest for sensitive fields, and role-based access control. Access to identity documents and bank details is restricted to staff and processors who need it for the claim. We notify the Data Protection Commission and you within 72 hours of any personal-data breach that risks your rights.
8. Your rights
Under the GDPR you have the right to:
- Access — request a copy of all data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — limit how we process your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — for any processing based on consent.
Email any of these requests to privacy@claim-fly.com. We respond within 30 days.
9. Complaints
If you believe we've mishandled your data, you can lodge a complaint with the Irish Data Protection Commission: dataprotection.ie, +353 57 868 4800, or 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
10. Changes
We may update this policy. The "last updated" date at the top shows when. Material changes are notified by email to active customers.