Privacy Statement

Privacy Statement

Last updated: 03.07.2026
Website: https://freedom-travel.at/
Contact: [email protected]

1. About This Privacy Statement

This Privacy Statement explains how personal data is collected and used when you visit our website, search for flights, create an account, book flight tickets, manage passengers, contact customer service, request after-sales services such as refunds or rebookings, or otherwise use Freedom Travel's online travel booking services in Europe.

This Privacy Statement should be read together with our Cookie Statement, which explains how we use cookies, pixels, tags, and similar technologies on the website.

When we refer to "Freedom Travel," "we," "us," or "our," we mean the joint controllers named below, unless the context clearly indicates that only one of them is meant.

If you provide personal data about another passenger, for example when booking a ticket for a family member, colleague, or other traveler, you should make this Privacy Statement available to that passenger wherever possible.

2. Who Is Responsible for Your Personal Data?

For the processing described in this Privacy Statement, the following entities act as joint controllers:

• OTA&A GmbH, [registered office], Austria, [company registration number] ("Freedom Travel"); and
• Aviata LLP, BIN 130740006278, 124 Gagarin Street, Almaty, Kazakhstan.

OTA&A GmbH manages the website https://freedom-travel.at/ and acts as the main point of contact for users in the European Economic Area.

Aviata LLP participates in the operation, development, configuration, security, and maintenance of the online travel booking platform and related systems.

3. Core of the Joint Controllership Arrangement

Freedom Travel and Aviata LLP have entered into a joint controllership arrangement pursuant to Article 26 GDPR.

Under this arrangement:

• Freedom Travel is primarily responsible for publishing this Privacy Statement, acting as the main EEA point of contact, receiving and coordinating requests concerning GDPR rights, and coordinating communication with EU supervisory authorities where required;
• Aviata LLP is primarily responsible for the technical operation, development, maintenance, and security of the platform and related systems;
• both joint controllers are responsible for ensuring that personal data is processed lawfully, fairly, transparently, and securely;
• both joint controllers are responsible for ensuring that appropriate arrangements are in place with service providers and external recipients;
• both joint controllers are responsible for ensuring that international transfers, where required, are covered by appropriate safeguards.

You may exercise your GDPR rights against either of the joint controllers. For your convenience, you may contact us at: [email protected]

4. Personal Data That We Process

We process various types of personal data, depending on how you use our services.

4.1. Website and Technical Data

Website and Technical Data

When you visit the website, we may process the following data:

• IP address;
• device and browser information;
• operating system;
• language settings;
• approximate location derived from technical data;
• pages visited;
• date and time of the visit;
• session identifiers;
• security logs;
• cookie identifiers;
• consent choices and cookie preferences.

4.2. Data on Flight Search Queries

When you search for flights, we process search parameters such as:

• route;
• travel dates;
• number of passengers;
• passenger type, such as adult, child, or infant;
• selected flight options.

In the initial search phase, this information may not directly identify you. However, it may be linked to your account, browser, device, or booking session if you continue with a booking or are logged in.

4.3. Account Data

When you create or use an account, we may process the following data:

• first and last name;
• email address;
• phone number;
• account login credentials;
• authentication data;
• account preferences;
• language settings;
• consent and acceptance data;
• national identification number, where required for the service or specific functionality.

4.4. Passenger and Booking Data

When you book a ticket or add passenger information, we may process the following data:

• passenger's first and last name;
• patronymic, if applicable;
• gender;
• date of birth;
• nationality;
• passenger type, such as adult, child, or infant;
• document type, such as passport, identity card, or national ID document;
• document number;
• document expiry date;
• issuing authority and date of issue;
• visa information, where required for the booking or travel service;
• contact email address and phone number;
• loyalty program data, if provided;
• booking reference;
• ticket number;
• travel itinerary;
• fare information;
• order status;
• information regarding refund, rebooking, or cancellation.

Providing information about passenger identity, travel documents, and contact details is a contractual requirement and, in some cases, is required under airline rules, border control, or aviation security regulations (for example, Advance Passenger Information requirements). If you do not provide this data, we may be unable to complete the booking, issue the ticket, or provide the requested travel service.

4.5. Payment and Transaction Data

When you pay for a booking, we may process the following data:

• payment amount;
• payment status;
• transaction reference;
• limited information about the payment method;
• billing information;
• data for fraud prevention and payment verification.

Full payment card details are normally processed by payment service providers and banks. We do not intend to store full card numbers, unless this is expressly stated during the payment stage and is legally permitted.

4.6. Data on Customer Service and After-Sales Services

When you contact us or request after-sales services, such as refunds, rebookings, name corrections, ticket status checks, cancellations, or adding a child passenger, we may process the following data:

• customer contact details;
• booking reference;
• ticket numbers;
• passenger data relevant to the request;
• correspondence via email, chat, or other communication channels;
• notes and tasks created by customer service staff;
• data regarding the refund or rebooking request;
• new or corrected passenger information;
• documents or other information needed to handle the request.

For some transactions, such as refunds and rebookings, it may only be necessary to pass on ticket numbers, booking references, and operational information to the booking system. For other transactions, such as adding a child passenger or a name correction, additional data on passenger identity and documents may be required.

4.7. Marketing, Analytics, and Preference Data

Where applicable, and subject to your consent where required, we may process the following data:

• marketing preferences;
• cookie choices;
• campaign identifiers;
• advertising identifiers;
• analytics identifiers;
• interaction with our website, emails, or campaigns;
• preferences used to personalize communications or the website experience.

5. Special Categories of Personal Data

We do not intentionally request special categories of personal data, such as health data, biometric data, religious beliefs, or other sensitive information, unless this is necessary for a specific travel-related request or legally required.

In limited cases, special categories of data may become apparent from information you provide, for example, if you request assistance in connection with a health condition or provide information that reveals sensitive data.

When special categories of data are processed, we rely on an appropriate condition under Article 9 GDPR, such as your explicit consent (Article 9(2)(a) GDPR), necessity for the establishment, exercise, or defense of legal claims (Article 9(2)(f) GDPR), or, in exceptional cases where you are physically or legally incapable of giving consent, the protection of vital interests (Article 9(2)(c) GDPR).

6. Sources of Personal Data

We may receive personal data from:

• you directly, when you use the website, create an account, book tickets, contact customer service, or manage your profile;
• another person booking a trip for you;
• passengers whose data is entered into a booking;
• payment service providers and banks;
• Amadeus, airlines, global distribution systems, and other travel providers;
• customer service channels, including email and chat;
• cookies and similar technologies;
• providers of fraud prevention, cybersecurity, and technical services;
• companies of the Freedom group involved in the operation and support of the platform.

7. Why We Process Personal Data and the Legal Bases

We process personal data only when we have a legal basis to do so under the GDPR. The table below sets out the main purposes for which we process personal data and the primary legal basis for each purpose.

Where we rely on legitimate interests, we do so only for the specific purposes listed below, and only where we have assessed that our interests do not override your interests, rights, and freedoms. We keep documented Legitimate Interests Assessments as evidence of compliance.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where processing is based on legitimate interests, you have the right to object at any time to that processing on grounds relating to your particular situation. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

8. How Booking Data Flows Through the Platform

When you search for flights, the initial search step may relate only to route, dates, and number of passengers.

When you proceed to checkout, passenger data, documents, and contact details enter the booking process. This data is used to create a booking, issue tickets, save the order, create or update your account, and support customer service.

Operationally, data may be processed through systems used for:

• booking orchestration;
• communication between the booking gateway and Amadeus;
• order storage;
• account creation and authentication;
• passenger profiles and the personal account area;
• customer service and CRM;
• after-sales service provision, including refunds and rebookings.

Some systems only pass data through during the request and do not store it. Other systems store information about orders, accounts, passengers, documents, customer service, or consent.

9. Recipients of Personal Data

We may share personal data with the following categories of recipients.

9.1. Travel and Booking Providers

We share booking and passenger data with Amadeus, airlines, global distribution systems, ticket providers, and other travel-related providers, to the extent necessary to search for, book, issue, manage, refund, rebook, or cancel tickets.

During the creation of a booking, Amadeus may receive passenger identity data, document data, visa data where applicable, contact details, and loyalty card information. During after-sales services, Amadeus may receive ticket numbers, booking references, passenger type, and, to the extent necessary for a specific service, additional passenger data.

Amadeus, airlines, and other travel providers may process personal data as independent controllers, processors, or providers with a mixed role, depending on the relevant service, agreement, and legal requirements.

9.2. Payment Service Providers

We share payment and transaction data with payment service providers, acquiring banks, card schemes, fraud prevention providers, and other financial institutions, to the extent necessary to handle payments, refunds, fraud checks, chargebacks, and legal or regulatory obligations.

These providers generally process personal data as independent controllers for regulated purposes relating to payments, fraud prevention, and compliance.

9.3. Hosting and Infrastructure Providers

Our platform is hosted within the European Economic Area, including on the infrastructure of Amazon Web Services in the Netherlands.

Amazon Web Services acts as a service provider for hosting and infrastructure services. Where support, management, sub-processing, or access by the provider involves personal data being accessed from outside the EEA, we apply appropriate GDPR safeguards where required.

9.4. Cookie and Consent Management Providers

We use a consent management platform, including CookieYes, to record and manage cookie choices.

More information about cookies and similar technologies is available in our Cookie Statement.

9.5. Partners for Analytics, Functionality, and Advertising

Subject to your consent where required, we may use partners for analytics, functionality, and advertising. These may be providers affiliated with Cloudflare, Google, Meta, TikTok, Bloomreach, and other technology partners.

Depending on the service, these providers may act as processors, independent controllers, or joint controllers. Where a provider determines its own purposes and means of processing, its own privacy documentation may also apply.

9.6. Professional Advisors, Authorities, and Legal Recipients

We may share personal data with:

• lawyers, auditors, accountants, and consultants;
• courts and dispute resolution bodies;
• tax, regulatory, aviation, law enforcement, or other government authorities;
• insurers;
• other recipients where this is legally required or necessary to protect our rights, users, systems, or services.

10. International Transfers

Our website is hosted within the European Economic Area, including on the infrastructure of Amazon Web Services in the Netherlands.

Some personal data may be accessed from, or transferred to, countries outside the European Economic Area where this is necessary for the operation, support, security, and maintenance of the platform, or for travel bookings, ticketing, aviation operations, payment processing, customer service, analytics, advertising, or legal compliance.

Where personal data is transferred outside the European Economic Area and no adequacy decision applies, we use appropriate GDPR safeguards, such as the European Commission's Standard Contractual Clauses, transfer impact assessments, and additional technical and organizational measures where required. In particular, because our joint controller Aviata LLP is established in Kazakhstan, personal data processed on the platform may be accessed from, and transferred to, Kazakhstan, a country not covered by an adequacy decision of the European Commission. These transfers take place on the basis of the Standard Contractual Clauses concluded between the joint controllers, supported by a transfer impact assessment and additional technical and organizational measures.

You may contact us at [email protected] for more information about the safeguards used for international transfers. Upon request, we will provide you with a copy of the relevant safeguards or information about where they have been made available.

11. How Long We Retain Personal Data

We retain personal data only for as long as necessary for the purposes described in this Privacy Statement, unless a longer period is required or permitted by law.

Our retention approach is based on the following criteria:

When data is no longer needed, we delete it, anonymize it, or restrict access to it.

12. Marketing Communications

We may send you marketing communications where we have your consent or where this is otherwise permitted by applicable law.

You may withdraw your consent or unsubscribe at any time by using the unsubscribe link in the message or by contacting us at: [email protected]. Withdrawal of marketing consent does not affect service communications, such as booking confirmations, ticket updates, payment information, refund information, or security notifications.

13. Profiling and Automated Decision-Making

We may use limited profiling for analytics, advertising, personalization, fraud prevention, security, service improvement, and campaign measurement.

We do not currently make decisions based solely on automated processing (except with payment and fraud prevention providers, where transactions may be automatically declined without human review) that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Where profiling for advertising or analytics relies on cookies or similar technologies, we ask for consent where required.

14. Beveiligingsmaatregelen

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

These measures may be implemented directly by the joint controllers or through our technology, hosting, security, and infrastructure service providers.

Our measures include, where applicable:

• DLP controls in key departments;
• firewalls for inbound and outbound traffic, segmentation, and perimeter protection;
• application-level protection from Cloudflare, including DDoS protection, malicious traffic filtering, and web application firewall functionality;
• secure software development lifecycle controls;
• SAST, SCA, secrets detection, and container security scanning;
• regular penetration testing and scanning of critical resources;
• antivirus protection and workstation monitoring;
• TLS 1.2 / TLS 1.3 encryption in transit;
• Vault-based secrets management;
• access rights reviews and access revocation in critical systems;
• backup restoration testing;
• confidentiality obligations for personnel;
• role-based access controls;
• logging and monitoring;
• incident response procedures.

No system is completely secure. If we become aware of a personal data breach, we assess it and notify the competent supervisory authority and the affected individuals where this is legally required.

15. Your Rights Under the GDPR

Subject to the conditions and limitations set out in the GDPR, you have the following rights:

• Right of access: to obtain confirmation as to whether we process your personal data, and to receive a copy of that data.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure: to request that we delete your personal data where the conditions of the GDPR are met.
• Right to restriction: to request that we restrict processing in certain circumstances.
• Right to data portability: to receive certain personal data in a structured, commonly used, and machine-readable format, and to have it transmitted, where applicable, to another controller.
• Right to object: to object to processing based on legitimate interests, including profiling based on legitimate interests.
• Right to object to direct marketing: to object at any time to processing for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
• Right not to be subject to certain automated decisions: where Article 22 GDPR applies.

To exercise your rights, you may contact us at: [email protected]

We may need to verify your identity before responding. We will respond without undue delay and in any event within one month of receipt of your request. Where your request is complex or we have received a large number of requests, we may extend this period by up to two further months; in that case, we will inform you of the extension and the reasons for it within one month of receipt of your request.

16. Complaints

We recommend that you first contact us at: [email protected]

You also have the right to lodge a complaint with a supervisory authority.

For Austria, the supervisory authority is:

Austrian Data Protection Authority

Österreichische Datenschutzbehörde

Barichgasse 40-42

1030 Vienna

Austria

Email: [email protected]

Phone: +43 1 52 152-0

You may also contact the supervisory authority in the EU member state where you reside, work, or where you believe an infringement has taken place.

17. Links to Third-Party Websites and Services

Our website may contain links to third-party websites, airline services, payment services, or other external platforms. This Privacy Statement does not apply to third-party websites or services that are not managed by us. Their own privacy statements and terms and conditions apply.

18. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes to our services, systems, legal requirements, providers, data flows, or business activities. Where changes are significant, we will take appropriate steps to inform you, for example by publishing a notice on the website or, where required, by requesting renewed consent.

If you have any questions about this Privacy Statement or about how we process personal data, you may contact:

[email protected]