Privacy Policy | Findera Services

This policy explains what personal data this website collects, why, how long it is kept, who receives it, and how you can exercise your rights. It describes how the website currently works.

1. Who is responsible

The controller responsible for your personal data is the company identified in our Legal Notice. For any privacy question or request, contact us at contact@finderaservices.com.

2. What we collect and why

Data	Purpose	Legal basis (EU/UK GDPR)
Account: first and last name, email address, optional phone number, password (stored only as a one-way hash), preferred language, email-verification status.	Creating and securing your account, sending booking and account emails.	Performance of a contract (Art. 6(1)(b)).
Booking requests: route, dates, times, number of passengers; for each passenger first and last name and optionally email, phone and an emergency contact.	Preparing your quote, arranging and operating the flight, passenger safety.	Performance of a contract (Art. 6(1)(b)); for emergency contacts, legitimate interest in passenger safety (Art. 6(1)(f)).
Quotes, invoices and payments: prices, references, payment status, payment method type and transaction references.	Billing, accounting and resolving payment questions.	Contract (Art. 6(1)(b)) and legal obligations such as tax and accounting rules (Art. 6(1)(c)).
Contact form: name, email address, subject and message.	Answering your enquiry. Messages are stored so that none are lost if email delivery fails.	Legitimate interest in answering enquiries (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)).
Flight tracking: the booking or ticket reference and surname you enter.	Checking that you hold the booking before showing its flight status. The values you enter are not stored.	Legitimate interest in protecting passengers' data (Art. 6(1)(f)).
Security records: for logged-in users, the IP address and time of each login, of certain account actions and of ticket downloads, and for logins and ticket downloads the browser type and operating system (for example "Firefox on Windows", not the full browser identifier); for everyone, rate-limit and security-event records that contain only a keyed (pseudonymised) hash of the IP address, never the address itself.	Protecting accounts and bookings against misuse, investigating security incidents.	Legitimate interest in security (Art. 6(1)(f)).
Web server logs kept by our hosting environment: IP address, requested URL, date and time, browser identifier.	Operating and securing the website.	Legitimate interest (Art. 6(1)(f)).

We do not use the website to build visitor profiles, we do not look up visitors' locations, and we do not sell personal data.

3. Cookies

The website sets only cookies that are strictly necessary for it to work:

PHPSESSID: keeps you signed in and protects forms against cross-site request forgery. It is deleted when you close your browser; a signed-in session also ends after a period of inactivity and after at most 12 hours.
lang: remembers the language you chose. It is deleted when you close your browser.

We do not use analytics, advertising or social-media cookies, so no cookie consent banner is shown. If that changes, we will ask for your consent first.

4. Who receives your data

Email delivery: our outgoing email provider processes the emails we send you and the enquiries we receive.
Hosting: our hosting provider stores the website and its database on our behalf.
Content delivery: all pages, scripts, styles, fonts and images are loaded from this website’s own server. No content delivery network, font service or analytics provider receives your IP address when you browse the site.
Authorities: where we are legally required to, for example for aviation security or tax purposes.

Some of these providers may process data outside the EEA/UK. Where they do, the transfer is protected by an adequacy decision or the European Commission's standard contractual clauses.

5. How long we keep data

Passport number and nationality, where collected: deleted 30 days after the departure date.
Passenger contact and emergency-contact details: deleted 24 months after the flight or cancellation.
Bookings, quotes, invoices and payment records: 10 years, to meet accounting and tax obligations.
Contact form enquiries: 24 months.
Login history, account-activity and ticket-download records, and the security event log: 12 months. You can see your own recent logins under Settings.
Accounts whose email address was never verified: deleted after 30 days.
Verified accounts: until you ask us to delete them, subject to the periods above for booking and financial records.

6. Your rights

Depending on where you live, you can ask us for access to your data, correction, deletion, restriction of processing and a portable copy, and you can object to processing based on legitimate interests. To make a request, contact us at contact@finderaservices.com. We may need to confirm your identity first. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work.

7. Security

Passwords are stored only as salted hashes, the website is protected against common attacks, and access to booking data is limited to the account holder and authorised staff. No system is perfectly secure. If a personal data breach affects you, we will inform you as required by law.

8. Changes

We will update this policy when our processing changes. The version date is shown at the top of this page.