GDPR & DATA PROTECTION COMMITMENT – FLYJUSTICE OÜ
Last updated: October 2025
Protecting your personal information is one of Flyjustice OÜ's highest priorities. We are committed to processing personal data lawfully, fairly, transparently, and securely in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679), applicable Estonian legislation, and recognised European data protection principles. (Regulation (EU) 2016/679)
When you use Flyjustice to pursue compensation for flight delays, flight cancellations, denied boarding, missed connections, or other eligible passenger claims under Regulation (EC) No. 261/2004, you trust us with your personal information. We recognise that this trust carries significant responsibility. Every stage of our services — from claim submission and verification to communication with airlines and compensation processing — is designed with privacy, security, and data protection at its core.
This page explains our commitment to protecting your personal information, the principles that guide our data processing activities, and the organisational and technical measures we implement to safeguard your data. For detailed information about the categories of personal data we collect, the lawful basis for processing, retention periods, recipients of personal data, and your individual rights, please refer to our Privacy Policy.
Commitment to Data Protection
At Flyjustice OÜ, data protection is not treated as a standalone legal requirement. It is an integral part of how we design, develop, operate, and continuously improve our services. We believe that protecting personal information is fundamental to maintaining the trust of every passenger who relies on us to pursue their legal rights.
Our objective is to provide a secure, transparent, and accountable platform where passengers can confidently pursue compensation under applicable European passenger rights legislation without compromising the confidentiality, integrity, or security of their personal information.
- Process personal data only where there is a valid legal basis under applicable data protection laws.
- Collect only the personal information necessary to provide our services and fulfil our legal obligations.
- Maintain appropriate technical and organisational safeguards to protect personal information throughout its lifecycle.
- Respect and facilitate the privacy rights of every individual whose personal data we process.
- Continuously review and improve our privacy practices to reflect legal, technological, and operational developments.
Our approach is built upon the principles of accountability, transparency, proportionality, and continuous improvement. Privacy considerations are embedded into our business processes from the earliest stages of service design through to the secure retention, archival, and deletion of personal information when it is no longer required.
Company Information
Flyjustice OÜ is a company incorporated in the Republic of Estonia and operates as a provider of flight compensation claim management services for air passengers travelling under applicable European passenger rights legislation.
For the purposes of the General Data Protection Regulation (GDPR), Flyjustice OÜ is responsible for determining the purposes and means by which personal data is processed in connection with the services described on this website.
| Company Information | Details |
|---|---|
| Legal Entity | Flyjustice OÜ |
| Jurisdiction | Republic of Estonia |
| Registered Country | Republic of Estonia |
| Registry Code | 17489203 |
| Registered Office | Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 10151, Estonia |
| EU Trademark | Flyjustice® (Registered – EUIPO, Application No. 019257188) |
| Website | https://flyjustice.com |
| Privacy Contact | privacy@flyjustice.com |
As the Data Controller, Flyjustice OÜ determines the purposes and means of processing personal data in accordance with applicable European data protection legislation and remains responsible for ensuring that such processing is carried out lawfully, fairly, transparently, and securely.
Our Privacy Principles
Our data protection framework is built upon the core principles established under Article 5 of the General Data Protection Regulation (GDPR). These principles guide every stage of how personal information is collected, processed, stored, shared, retained, and securely deleted. (Regulation (EU) 2016/679)
Lawfulness, Fairness and Transparency
We process personal data only where there is a lawful basis under applicable legislation. Individuals are provided with clear, accessible, and transparent information regarding how their personal information is collected, why it is processed, who may receive it, and how long it will be retained.
Purpose Limitation
Personal information is collected only for specified, explicit, and legitimate purposes directly related to the services provided by Flyjustice. We do not process personal information for purposes that are incompatible with those originally communicated to the individual.
Data Minimisation
We collect only the personal information that is reasonably necessary to verify eligibility, process compensation claims, communicate with relevant parties, comply with legal obligations, and protect our legitimate interests.
We do not request unnecessary personal information or supporting documentation that is unrelated to the services we provide or the claim being processed.
Accuracy
We take reasonable steps to ensure that personal information remains accurate, complete, and up to date throughout the claim process. Where inaccuracies are identified, individuals are encouraged to notify us promptly so that appropriate corrections can be made without unnecessary delay.
Storage Limitation
Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with applicable legal obligations, resolve disputes, and establish, exercise, or defend legal claims.
Once applicable retention periods expire, personal information is securely deleted, anonymised, or otherwise disposed of using appropriate technical and organisational measures.
Integrity and Confidentiality
We implement appropriate technical and organisational safeguards designed to protect personal information against unauthorised access, accidental loss, destruction, alteration, misuse, or unlawful disclosure.
Our security controls are regularly reviewed and updated to align with recognised industry practices, evolving technological standards, and applicable regulatory requirements.
Accountability
Flyjustice OÜ is responsible for demonstrating compliance with applicable data protection legislation. We maintain internal governance measures, documented policies, contractual safeguards, and operational procedures designed to support responsible handling of personal information and continuous compliance with applicable legal obligations.
Privacy by Design & Data Protection by Default
Privacy considerations are integrated into the design, development, implementation, and ongoing operation of our services from the outset rather than being introduced as an afterthought. This approach helps ensure that privacy and security remain fundamental components of every product, process, and operational decision.
Whenever new technologies, business processes, or service improvements are introduced, data protection considerations are evaluated alongside operational, legal, and security requirements to minimise potential privacy risks.
Our Privacy by Design approach includes:
- Limiting access to personal information based on authorised responsibilities and legitimate business need.
- Collecting only the minimum personal information necessary to provide our services.
- Implementing secure authentication, identity verification, and access management controls.
- Using encrypted communications and secure data transmission protocols.
- Evaluating third-party service providers before they are authorised to process personal information on our behalf.
- Regularly assessing risks associated with personal data processing activities.
- Applying secure retention, archival, and deletion procedures throughout the information lifecycle.
Where appropriate, we also assess potential privacy risks before implementing significant changes to our systems, technologies, or operational processes to help ensure that data protection remains an integral part of our governance framework and service delivery model.
Lawful Basis for Processing Personal Data
Flyjustice OÜ processes personal data only where there is a valid legal basis under the General Data Protection Regulation (Regulation (EU) 2016/679). Every processing activity is reviewed to ensure it is supported by an appropriate legal basis before personal information is collected, used, or shared. Our objective is to process personal data responsibly, transparently, and only to the extent necessary for providing our services and complying with applicable legal obligations.
Depending on the nature of your interaction with Flyjustice, one or more of the following lawful bases may apply.
Performance of a Contract
Legal Basis: Article 6(1)(b) GDPR
Most of the personal data processed by Flyjustice is necessary for the performance of a contract or to take steps at your request before entering into a contract. Without certain personal information, we may be unable to assess your eligibility, communicate with airlines, submit compensation claims, or provide the services you have requested.
Examples include:
- Registering and managing your Flyjustice claim.
- Verifying flight and passenger information.
- Preparing and submitting compensation claims.
- Communicating with airlines, airports, regulators, and authorised representatives.
- Providing claim updates and customer support.
- Processing compensation payments where applicable.
Compliance with Legal Obligations
Legal Basis: Article 6(1)(c) GDPR
Certain processing activities are necessary for Flyjustice to comply with legal obligations arising under applicable European Union and Estonian legislation. These obligations may include accounting, taxation, anti-fraud measures, regulatory compliance, responding to lawful requests from competent authorities, and maintaining records required by law.
Examples include:
- Maintaining accounting and financial records.
- Complying with tax and corporate reporting obligations.
- Responding to lawful requests from courts or regulatory authorities.
- Preventing fraud and protecting the integrity of our services.
- Retaining information where required by applicable legislation.
Legitimate Interests
Legal Basis: Article 6(1)(f) GDPR
Where appropriate, Flyjustice may process personal data to pursue its legitimate business interests, provided those interests are not overridden by the rights and freedoms of the individuals concerned. Before relying on this legal basis, we carefully assess the necessity of the processing and its potential impact on your privacy.
Legitimate interests may include:
- Protecting our website, systems, and infrastructure from security threats.
- Preventing fraudulent or abusive claims.
- Improving our services and user experience.
- Maintaining internal administration and operational efficiency.
- Establishing, exercising, or defending legal claims.
- Monitoring service performance and platform reliability.
Consent
Legal Basis: Article 6(1)(a) GDPR
Where required by law, Flyjustice will request your consent before processing personal data for specific purposes. Consent is obtained only where it is freely given, specific, informed, and unambiguous. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
Consent may apply to:
- Optional marketing communications.
- Newsletter subscriptions.
- Non-essential cookies or similar technologies.
- Future services that require consent under applicable law.
Establishment, Exercise, or Defence of Legal Claims
Legal Basis: Article 6(1)(f) GDPR, together with applicable provisions of the GDPR and relevant civil procedure laws where necessary.
As a company assisting passengers with compensation claims, Flyjustice may process and retain relevant personal information where necessary to establish, exercise, or defend legal claims. This processing helps protect the interests of both our customers and our organisation throughout administrative, regulatory, or judicial proceedings.
Special Categories of Personal Data
Legal Reference: Article 9 GDPR
Flyjustice does not intentionally request or process special categories of personal data unless such processing is strictly necessary, legally permitted, or required for the provision of our services. Where exceptional circumstances require the processing of sensitive personal information, appropriate safeguards will be implemented in accordance with applicable law.
Our Commitment to Lawful Processing
Every processing activity undertaken by Flyjustice is assessed against the principles of necessity, proportionality, transparency, and accountability. We regularly review our processing activities to ensure they remain appropriate, supported by a valid legal basis, and aligned with the requirements of the General Data Protection Regulation, applicable Estonian legislation, and recognised European data protection standards.
See also: Privacy Policy | Terms & Conditions | Cookie Policy | EU261 Passenger Rights Guide
Categories of Personal Data We Process
Flyjustice OÜ processes only the personal data that is necessary to provide our flight compensation claim management services, comply with applicable legal obligations, protect our legitimate interests, and fulfil our contractual responsibilities. The categories of personal data we process depend on the nature of your interaction with our website, the services you request, and the information required to assess and pursue your compensation claim.
We are committed to the principle of data minimisation under Article 5(1)(c) of the General Data Protection Regulation (GDPR). This means we collect only the personal information that is relevant, adequate, and necessary for the specific purpose for which it is processed.
| Category of Personal Data | Examples | Primary Purpose |
|---|---|---|
| Identity Information | Full name, date of birth, nationality, identification details (where required) | Identity verification and claim validation |
| Contact Information | Email address, telephone number, postal address, country of residence | Customer communication and claim updates |
| Flight & Booking Information | Flight number, airline, booking reference (PNR), travel dates, departure and arrival airports | Eligibility assessment and compensation claim processing |
| Passenger Documentation | Boarding pass, booking confirmation, e-ticket, travel itinerary, baggage records (where applicable) | Verification of travel and supporting evidence |
| Claim Documentation | Airline correspondence, delay notifications, cancellation notices, supporting evidence, legal documents, signed authorisations | Preparing, managing, and pursuing compensation claims |
| Payment Information | Bank account details, IBAN, payment confirmation (where applicable) | Processing approved compensation payments |
| Communication Records | Emails, contact form submissions, customer support conversations, correspondence with airlines | Customer support, claim management, and service improvement |
| Technical Information | IP address, browser type, operating system, device identifiers, log files | Website security, fraud prevention, and system administration |
| Website Usage Information | Cookies, analytics data, website interaction data (subject to applicable consent requirements) | Website functionality, analytics, and user experience improvements |
The categories listed above represent the types of personal data that may be processed throughout the lifecycle of your relationship with Flyjustice. Not every customer will provide every category of information, and the specific data processed will depend on the services requested and the circumstances of each individual claim.
Why We Process Your Personal Data
Passengers often ask why certain documents or personal information are required during the claim process. At Flyjustice, every request for personal information serves a specific and legitimate purpose. We do not collect documentation unless it is reasonably necessary to verify your eligibility, pursue your compensation claim, comply with legal obligations, or protect the rights of all parties involved.
Our objective is to collect only the information required to provide our services efficiently while maintaining the highest standards of privacy, transparency, and security.
| Information Requested | Why We Need It |
|---|---|
| Full Name | To identify the passenger and match airline records accurately. |
| Email Address | To provide claim updates, request additional information, and communicate throughout the claim process. |
| Telephone Number | To contact you if urgent clarification is required regarding your claim. |
| Flight Number | To verify flight details and determine eligibility under applicable passenger rights legislation. |
| Booking Reference (PNR) | To identify the booking with the airline and validate travel information. |
| Boarding Pass | To confirm that you travelled on the affected flight where required. |
| Booking Confirmation / E-ticket | To verify travel arrangements and passenger eligibility. |
| Airline Correspondence | To review previous communications and avoid duplication during the claim process. |
| Power of Attorney or Authorisation (where applicable) | To allow Flyjustice to represent you before airlines or other relevant organisations where required. |
| Bank Account Details | To transfer compensation once your claim has been successfully resolved. |
| Supporting Documents | To strengthen your claim and provide evidence where additional verification is required. |
We never request personal information that is unrelated to your claim or unnecessary for providing our services. Where optional information is requested, this will be clearly indicated, and you may choose whether or not to provide it.
Information We Do Not Intentionally Collect
Flyjustice does not intentionally collect personal information that is unrelated to providing our services. We generally do not request sensitive personal information, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health information, or information concerning a person's sex life or sexual orientation, unless such processing becomes strictly necessary, legally permitted, and appropriately safeguarded in accordance with Article 9 GDPR.
Accuracy of Information
Providing accurate and complete information helps us assess your eligibility more efficiently and reduces unnecessary delays during the claim process. If your personal information changes while your claim is being processed, we encourage you to notify us promptly so that our records remain accurate and up to date.
Our Commitment to Data Minimisation
Flyjustice reviews its data collection practices regularly to ensure that only the minimum amount of personal information necessary for each processing activity is collected. We continuously evaluate our forms, systems, and operational processes to reduce unnecessary data collection while maintaining the quality and effectiveness of our services.
See also: Privacy Policy | Terms & Conditions | Cookie Policy | Passenger Rights Guide | Flight Delay Compensation | Flight Cancellation Compensation
Your Rights Under the General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) provides individuals with a number of rights regarding their personal data. Flyjustice OÜ is committed to respecting these rights and providing individuals with reasonable assistance when they wish to exercise them. Subject to applicable legal requirements and certain exceptions, you may exercise the following rights in relation to your personal information processed by Flyjustice.
Right of Access
Legal Reference: Article 15 GDPR
You have the right to request confirmation of whether Flyjustice processes your personal data and, where applicable, obtain access to that information together with details regarding how it is processed.
Right to Rectification
Legal Reference: Article 16 GDPR
If you believe that your personal information is inaccurate or incomplete, you may request that it be corrected or updated without undue delay.
Right to Erasure ("Right to be Forgotten")
Legal Reference: Article 17 GDPR
Under certain circumstances, you may request the deletion of your personal data where there is no longer a lawful basis for its continued processing. This right is subject to legal obligations that may require Flyjustice to retain certain records.
Right to Restrict Processing
Legal Reference: Article 18 GDPR
You may request that the processing of your personal data be temporarily restricted in specific circumstances, such as while the accuracy of your information or the legal basis for processing is being verified.
Right to Data Portability
Legal Reference: Article 20 GDPR
Where applicable, you may request a copy of certain personal data in a structured, commonly used, and machine-readable format or request that it be transmitted directly to another controller where technically feasible.
Right to Object
Legal Reference: Article 21 GDPR
You may object to the processing of your personal data where processing is based on Flyjustice's legitimate interests or for direct marketing purposes, subject to applicable legal exceptions.
Right to Withdraw Consent
Legal Reference: Article 7 GDPR
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to Lodge a Complaint
Legal Reference: Article 77 GDPR
If you believe that your personal data has been processed in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. We nevertheless encourage you to contact Flyjustice first so that we have the opportunity to address your concerns promptly and fairly.
Exercising Your Rights
To exercise any of the rights described above, please contact us using the contact details provided in the Privacy Contact section of this page. We may request reasonable information to verify your identity before responding to your request in order to protect your personal information from unauthorised access or disclosure.
Flyjustice will respond to requests relating to personal data within the timeframes required by applicable data protection legislation. Where permitted by law, we will inform you if additional time is required due to the complexity or volume of your request.
See also: Privacy Policy | Contact Us
International Data Transfers
As part of providing our services, Flyjustice may transfer personal data to airlines, service providers, business partners, or competent authorities located within or outside the European Economic Area (EEA). Where such transfers occur, we take appropriate measures to ensure that your personal information continues to receive an adequate level of protection in accordance with applicable data protection laws.
Where required, international data transfers are protected through appropriate safeguards, including:
- European Commission Adequacy Decisions, where applicable.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Other lawful transfer mechanisms permitted under the GDPR.
We carefully assess third-party providers involved in international data transfers and implement contractual and organisational safeguards designed to protect personal information throughout the transfer process.
Data Retention & Secure Deletion
Flyjustice retains personal data only for as long as necessary to provide our services, comply with legal obligations, resolve disputes, enforce our agreements, and establish, exercise, or defend legal claims.
Once personal information is no longer required, it is securely deleted, anonymised, or otherwise disposed of using appropriate technical and organisational measures to reduce the risk of unauthorised access or recovery.
Detailed retention periods for specific categories of personal data are described in our Privacy Policy.
Data Security
Protecting personal information is a fundamental part of our operations. Flyjustice implements appropriate technical and organisational security measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction.
Our security measures may include:
- Secure encrypted connections (HTTPS/TLS).
- Access controls based on authorised business responsibilities.
- Authentication and account security measures.
- Secure hosting infrastructure and regular system maintenance.
- Monitoring and logging of security-related events.
- Controlled access to personal information.
- Regular review of our security practices.
Although no method of electronic transmission or storage can guarantee absolute security, we continually review and improve our safeguards to help maintain the confidentiality, integrity, and availability of personal information.
Third-Party Service Providers
Flyjustice works with carefully selected third-party service providers that support the delivery of our services, including website hosting, cloud infrastructure, communication services, payment processing, and other operational functions.
Where third parties process personal data on our behalf, they do so under appropriate contractual arrangements and are required to protect personal information in accordance with applicable data protection laws.
Automated Decision-Making & Artificial Intelligence
Flyjustice does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals without appropriate human involvement.
Where artificial intelligence or automated technologies are used to improve operational efficiency, customer support, or claim management, they are implemented with appropriate human oversight and do not replace human decision-making where legal rights may be affected.
Regulatory Oversight
If you believe that your personal data has been processed in a manner that does not comply with applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.
As Flyjustice OÜ is established in Estonia, the primary supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon – AKI). Information about your rights and the complaints process is available through the relevant supervisory authority.
We nevertheless encourage you to contact us first, as we are committed to resolving privacy-related concerns promptly, fairly, and transparently.
Accessibility
Flyjustice is committed to making its website and services accessible to as many people as reasonably possible. We continually review and improve the accessibility of our digital services to enhance usability for all visitors.
If you experience accessibility barriers or require information in an alternative format, please contact us and we will make reasonable efforts to assist you.
Related Legal Documents
Additional information about how Flyjustice processes and protects personal data can be found in the following documents:
Privacy Contact
If you have any questions about this GDPR & Data Protection Commitment, your personal information, or wish to exercise your rights under applicable data protection legislation, please contact us. We aim to respond to privacy-related enquiries as promptly as reasonably possible and within applicable legal timeframes.
| Contact | Details |
|---|---|
| Privacy Email | privacy@flyjustice.com |
| Company | Flyjustice OÜ |
| Website | https://flyjustice.com |
Version History
| Version | Effective Date | Description |
|---|---|---|
| 1.0 | October 2025 | Initial publication of the Flyjustice GDPR & Compliance Statement. |
| 2.0 | Current publication date | Expanded and redesigned as the GDPR & Data Protection Commitment, aligned with the current Flyjustice legal framework and applicable data protection requirements. |
Legal Disclaimer
This GDPR & Data Protection Commitment provides a general overview of Flyjustice's approach to data protection and privacy. It is intended to support transparency and should be read together with our Privacy Policy, Terms & Conditions, and other applicable legal documents. Where there is any inconsistency between this page and applicable law, the relevant legal requirements shall prevail.
© 2025 Flyjustice OÜ. All Rights Reserved.