Privacy Policy

Your privacy is serious business at GlobeAir.

When private personal or business information is given, GlobeAir understands that our responsibility is to ensure all details remain private. We will not compromise your trust.

Here is a detailed description of how we use information provided to us through the use of our site or given to us by clients.In visiting our website acceptance of our policies and practices are automatically assumed.

Requested information

In order to serve you better we may collect information that will make our website more effective.

Understanding how our clientele browse the site by observing information given enhances our ability to better tailor the information.

It also allows us to determine unauthorized or unusual activity and oversee network traffic.

This information is by no means directly or indirectly traceable to any individual.

Information that we may use:

Web browser version;
Time and date of site access;
Address of the internet site host;
Where applicable, host server internet address you are using;
Name of the host and domain from which you access the Internet.

Selling of private data to any third party is strictly against GlobeAir policy unless required by applicable law or valid legal process.

GlobeAir app

This section explains how GlobeAir GmbH processes personal data when you use the GlobeAir app for iPhone.

Controller and contact

GlobeAir GmbH, Flughafenstraße 3, Objekt 10, 4063 Hörsching, Austria. Phone +43 7221 727400. For all data protection questions and requests, write to [email protected].

Your account

You can use the app without an account. To place a bid or book a flight, you sign in with Apple. We then process your name, your email address (with Sign in with Apple this may be an Apple relay address that hides your real address), the account identifier Apple gives us, and a session token. If you enter a mobile number or contact email address when you bid or book, we store it with your account so that the next form is filled in for you. Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the app service).

You can delete your account at any time in the app menu under "Account", "Delete account". This deletes your account data and your sessions. Records of your bids and bookings are kept for the periods stated below, no longer linked to your account. Deleting your account does not delete your contact in our customer database; see "Customer relationship" below.

Bids and bookings

When you bid on or book an empty-leg flight, we process the flight, the amount, the number of passengers, your name, email address and mobile number, and the date and time. We use this to assess your bid, to contact you, and to conclude and perform the charter agreement. Our customer care team is notified of each bid and booking by email and decides on it; we do not make decisions based solely on automated processing. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, and its performance). Without these details we cannot process a bid or booking.

Payment

Payments are made with Apple Pay and processed by Stripe. When you confirm, Stripe places a hold on your card. The amount is only charged if your bid or booking is accepted; otherwise the hold is released. GlobeAir does not receive your card number. Legal basis: Art. 6(1)(b) GDPR. The app contains Stripe's payment software, which itself collects data on how you use the payment screen, for the operation and improvement of the payment function. Stripe processes payment data as our processor, and as an independent controller for its own fraud prevention and legal obligations, under its privacy policy at stripe.com/privacy.

Location

If you allow location access while using the app, the app uses your position on your device to sort flights by distance and to suggest airports near you. To find the nearest airports, the app sends a position rounded to about 1 km to our airport service. This rounded position is not linked to your account and is not used to build a location history; it may appear for a short time in technical server logs.

If you switch on airport arrival alerts in the menu and allow location access "Always", your iPhone watches a radius of about 1.2 km around nearby airports and shows you a welcome notification when you arrive, at most once a week per airport. This detection runs on your device. When you move, the app again sends a rounded position to update the list of nearby airports.

Legal basis: Art. 6(1)(b) GDPR, because you have switched the feature on. You can withdraw location access at any time in the iOS settings.

Push notifications

If you allow notifications, we store your device's push token, an identifier for your app installation, and your saved flights, route alerts and home airports. We use them to tell you when a saved flight changes, when a new flight on a watched route or from a home airport appears, and when your bid is decided. Notifications are delivered through Apple's push service. Legal basis: Art. 6(1)(b) GDPR. You can switch notifications off at any time in the iOS settings.

Customer relationship

If you sign in with an email address that is not an Apple relay address, or enter an email address when you bid or book, we create or update your contact in our customer database (HubSpot). It holds your name, email address and mobile number, that you use the app, when you registered and last signed in, and how many flights and route alerts you have saved. We use it to manage our customer relationship, for example to follow up on your bids and bookings. If we send you information about GlobeAir flights by email, we do so only with your consent or where the law permits it without consent, and every such email lets you unsubscribe.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is maintaining and documenting our relationship with customers and prospective customers. This contact is not deleted when you delete your app account. You can object to this processing or request erasure at any time at [email protected].

Security

Our servers process your IP address and the time of each request to deliver the service and protect it against abuse. With every bid and booking we store the IP address from which it was placed, to prevent fraudulent bids. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security of our service and the prevention of fraud.

Calendar

If you add a flight to your calendar, this happens on your device only. We do not receive your calendar data.

Advertising and analytics

The app shows no advertising and contains no advertising or analytics tools. The only third-party software in the app is Stripe's payment software described above.

Recipients

We share personal data only as far as needed for the purposes above, with:

Cloudflare, Inc. (hosting of the app servers and database), as our processor.
Stripe (payment processing), in the roles described under "Payment".
HubSpot, Inc. (customer database), as our processor.
Amazon Web Services (sending bid and booking notifications to our customer care team, from the EU region Frankfurt), as our processor.
Apple (Sign in with Apple, Apple Pay and delivery of push notifications). Apple's own privacy policy applies to your Apple Account and to Apple Pay.

Some of these providers are based in the USA or may access data from there. Where this applies, the transfer is based on the provider's certification under the EU-US Data Privacy Framework or on standard contractual clauses adopted by the European Commission.

How long we keep data

Account data: until you delete your account. Sessions end when you sign out.
Bookings and the related accounting records: seven years under § 132 BAO and § 212 UGB, and longer while they are relevant to pending proceedings.
Bids that do not lead to a booking: 12 months after the bid was decided or expired.
IP addresses stored with bids and bookings: 12 months.
IP addresses used to limit request rates: one hour.
Technical server logs: up to seven days.
Push token, installation identifier, saved flights, route alerts and home airports: until Apple reports the token as no longer valid (for example after you delete the app), and at the latest 12 months after the app last contacted our servers.
Customer database contact: until you object or request erasure, and at the latest three years after your last sign-in, bid, booking or other contact with us.
Payment data at Stripe: according to Stripe's privacy policy.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. Write to [email protected].

Your right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. Where we use your data for direct marketing, you can object at any time without giving reasons, and we will then stop using it for that purpose. Write to [email protected].

Complaints

You can lodge a complaint with the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, Austria, [email protected].