PRIVACY STATEMENT

Flightscanner.nl

Version August 2026 — English translation; in the event of any discrepancy, the Dutch version prevails.

1. Who are we?

This privacy statement applies to the processing of personal data via the website Flightscanner.nl. The controller within the meaning of the General Data Protection Regulation (GDPR) is Flightscanner.nl (a trade name of Megatour B.V.):

• Registered address: Ruysdaelbaan 43, 5613 DX Eindhoven, the Netherlands
• Dutch Chamber of Commerce (KvK) number: 61001333
• E-mail address for privacy matters: klantenservice@flightscanner.nl

We attach great importance to the protection of your personal data and process it exclusively in accordance with the GDPR, the Dutch GDPR Implementation Act and the Dutch Telecommunications Act.

2. What personal data do we process?

Depending on your use of our website and services, we process the following categories of personal data:

• Identity data: name, initials, gender designation (as required by carriers) and date of birth of the traveller(s)
• Contact data: e-mail address, telephone number, address details
• Travel document data: passport or identity card details and nationality, only if and to the extent required by the carrier or the authorities of the country of destination (e.g. API data); driving licence details for car rental
• Booking data: destinations, travel dates, flight details, hotel and car rental details, booking references, baggage and seat preferences
• Payment data: payment method, invoice details and transaction data; your payment is handled by our payment service provider Stripe – full payment card details are processed by Stripe and are not stored by us
• Technical data: IP address, device and browser data, click and browsing behaviour on our website, collected via cookies and similar technologies, including Google Analytics (see section 8)
• Communication data: correspondence with our customer service, telephone notes and, where announced in advance, recorded calls

3. Purposes and legal bases

We process your personal data exclusively for the following purposes and on the following legal bases (Article 6 GDPR):

Where we rely on a legitimate interest, we always balance our interest against your privacy interest. In those cases you have the right to object (see section 10).

4. Special categories of personal data

As a rule, we do not process special categories of personal data. However, in the context of your trip you may provide us with information from which health information can indirectly be derived, for example a request for wheelchair assistance, medical support or a specific meal. We process such data solely to pass on your request to the relevant service provider, on the basis of your explicit consent (Article 9(2)(a) GDPR). You may withdraw this consent at any time; this may, however, mean that the request cannot be fulfilled.

5. With whom do we share your data?

We never sell your personal data to third parties. We share your data only where necessary for the purposes described above, with:

• Your travel service providers: the airlines, hotels and car rental companies with whom you book, as well as the reservation and distribution systems (GDS) they use, to the extent necessary for the performance of your booking
• Payment service provider: Stripe, for the settlement of your payment and the prevention of fraud; for more information, see Stripe’s privacy policy (stripe.com/privacy)
• IT and analytics providers: Google (Google Analytics) for website statistics, as well as hosting, e-mail and customer service providers that process data on our behalf; we conclude data processing agreements with processors in accordance with Article 28 GDPR
• Authorities: government bodies, border and immigration authorities and supervisory authorities, only to the extent we are legally obliged to do so (for example the mandatory transfer of passenger data)
• Advisers: legal advisers, accountants and insurers, to the extent necessary for our business operations or legal position

6. Transfers outside the EEA

Where you book a trip to a destination outside the European Economic Area (EEA), or where a service provider is established outside the EEA, the transfer of your data to that country is necessary for the performance of your booking (Article 49(1)(b) GDPR). In addition, service providers such as Stripe and Google may process data in the United States; both are certified under the EU-U.S. Data Privacy Framework or apply the standard contractual clauses (SCCs) adopted by the European Commission, supplemented with additional measures where necessary. A copy of the applicable safeguards can be requested via klantenservice@flightscanner.nl.

7. How long do we keep your data?

We do not keep your personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law. Among other things, we apply the following principles:

•  booking and invoice data: 7 years after the end of the financial year, pursuant to the Dutch tax retention obligation (Article 52 of the Dutch State Taxes Act)
• customer service correspondence: up to 2 years after resolution, unless longer retention is necessary in connection with an ongoing dispute
• marketing data: until you unsubscribe or withdraw your consent
• data relating to special assistance requests: only for the duration of the handling of the relevant trip
• technical log files: in principle a maximum of 12 months; Google Analytics data in accordance with the configured retention period of a maximum of 14 months

After expiry of the retention period, data is deleted or irreversibly anonymised.

8. Cookies and Google Analytics

Flightscanner.nl uses functional cookies that are necessary for the operation of the website, analytical cookies and – only with your prior consent – marketing and tracking cookies. On your first visit you can set your preferences via the cookie banner; you can change or withdraw these at any time via the cookie settings on the website.

We use Google Analytics for website statistics. We have configured Google Analytics in a privacy-friendly manner in line with the guidance of the Dutch Data Protection Authority: we have concluded a data processing agreement with Google, the last octet of your IP address is masked, data is not shared with Google for its own purposes, and no other Google services are used in combination with the Analytics cookies. For a complete overview of the cookies used, their purpose and retention period, please refer to our separate cookie policy on Flightscanner.nl.

9. Security

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access and other unlawful use (Article 32 GDPR). These include encrypted connections (TLS/SSL), role-based access restrictions, logging, and contractual arrangements with our processors. Payments are processed via Stripe, which is certified to the highest standard in the payment industry (PCI DSS Level 1). Should a data breach nevertheless occur that poses a risk to your rights and freedoms, we will report it to the Dutch Data Protection Authority in accordance with the law and, where required, to you.

10. Your rights

• Under the GDPR you have the following rights:
• Right of access: you may request which personal data we process about you
• Right to rectification: you may have incorrect or incomplete data corrected or supplemented
• Right to erasure: you may request the deletion of your data, unless we must retain it on the basis of a legal obligation or another compelling interest
• Right to restriction: you may request that processing be temporarily restricted
• Right to data portability: you may receive the data you have provided to us in a common, machine-readable format or have it transferred
• Right to object: you may object to processing based on a legitimate interest; you may object to direct marketing at any time and free of charge, after which we will cease that processing
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of the processing prior to withdrawal

You can send your request to klantenservice@flightscanner.nl. To prevent misuse, we may ask you to prove your identity in an appropriate manner. We will respond within one month; for complex requests this period may be extended by two months, in which case we will inform you in good time. In principle, exercising your rights is free of charge.

11. Complaints

If you have a complaint about the way we handle your personal data, we ask that you first contact us via klantenservice@flightscanner.nl so that we can look for a solution together. In addition, you always have the right to lodge a complaint with the supervisory authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, the Netherlands, www.autoriteitpersoonsgegevens.nl.

12. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, with the exception of automated fraud checks on payments (including via Stripe Radar). If a transaction is refused on that basis, you can contact us for a human review.

13. Changes to this privacy statement

We may amend this privacy statement from time to time, for example in the event of changes to our services or to laws and regulations. The current version is always available on Flightscanner.nl, including the version date. In the event of significant changes, we will actively inform you, for example by e-mail or via a notification on the website.

14. Contact

For questions about this privacy statement or about the processing of your personal data, please contact Flightscanner.nl, Ruysdaelbaan 43, 5613 DX Eindhoven, the Netherlands, or by e-mail via klantenservice@flightscanner.nl.