Data protection and cookies
How we process your personal data when you use our website and entrust us with your claim, and which cookies we use.
1Data controller
The data controller is DelayFlight24 s.r.l., with registered office at Via G. Carducci 13, 39100 Bolzano (BZ), Italy, VAT number IT03304190212. For any question about your data you can write to [email protected].
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
2What data we process
- flight details: airline, flight number, date, route, booking, what happened to the flight;
- contact and identification details: first and last name, email, phone, address, identity document;
- the signature of the mandate and travel documents (boarding pass, booking, the airline's messages);
- bank details (IBAN) to pay you the compensation;
- details of travel companions and children added to the claim, which you give us after informing them;
- messages you send us through the contact form, the chat or by email;
- browsing data and cookies, as described below.
3Why we process it and on what basis
- handling your compensation claim and the mandate you signed, including communications with the airline, the law firm and the courts: performance of the contract (Art. 6(1)(b) GDPR);
- answering your questions and sending you updates on your claim, including reminders to complete it: performance of the contract and pre-contractual steps (Art. 6(1)(b));
- meeting tax and accounting obligations: legal obligation (Art. 6(1)(c));
- defending our rights in case of disputes: legitimate interest (Art. 6(1)(f));
- measuring the use of the website and the effectiveness of our advertising through non-technical cookies: consent (Art. 6(1)(a)), which you can withdraw at any time.
Providing the details of the claim is necessary to handle it: without them we cannot claim compensation.
4Who we share data with
We share data only with those who need it to handle the claim:
- the airline concerned;
- the external partner law firm, if the claim moves to legal action, and the courts;
- conciliation bodies and the competent authorities, when we contact them;
- our suppliers, appointed as data processors: Amazon Web Services (servers and document storage), Zendesk (customer support), our email service provider, Userlike (chat), Rollbar and New Relic (technical monitoring of the website), Google and Meta (statistics and advertising, only with your consent), Hotjar (analysis of website use, only with your consent).
We do not sell your data or pass it to third parties for their own marketing.
5Transfers outside the European Union
Some suppliers are based in the United States or transfer data there. In these cases the transfer is based on the EU-US adequacy decision (EU-U.S. Data Privacy Framework) for certified suppliers, or on the standard contractual clauses approved by the European Commission.
6How long we keep it
- claim data: for as long as the claim lasts and then for the period required by accounting and tax obligations and to protect our rights;
- flight checks that were not completed: for as long as needed to complete them, after which we delete them;
- data collected through cookies: for the period set by each supplier.
7Security
We use encrypted connections (HTTPS), keep documents in private storage accessible only to authorised staff and limit access to data to the people working on the claim.
8Your rights
You can ask at any time to access your data, correct it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (Articles 15-22 GDPR). You can withdraw your consent to cookies without any effect on the service.
Write to [email protected]: we reply within one month. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.
9Cookies: what they are and which we use
Cookies are small files that the website saves on your device. We use:
- technical cookies, needed for the website to work (session, form security, language, source of the visit to attribute the claim): these do not require consent;
- statistics cookies: Google Analytics and Hotjar, to understand how the website is used;
- marketing cookies: Google Ads and Meta (Facebook), to measure and show our advertising;
- the cookies of the Userlike chat, so you can talk to us.
These are the cookies on the site, by category:
Technical and functional (always active):
| Name | Provider | Purpose | Duration |
|---|---|---|---|
df_consent | DelayFlight24 | Stores your cookie choice | 6 months |
_delayedflight_session | DelayFlight24 | Session: language, claim form steps, customer area login, form security | Until the browser is closed |
_delayflight_session_id | DelayFlight24 | Technical identifier of the form session | 1 day |
step, step_0, step_1 | DelayFlight24 | Data you enter in the claim form steps | Until the browser is closed |
remember_user_token | DelayFlight24 | Automatic login to the customer area, only if you choose “Remember me” | 2 weeks |
utm_id, aid | DelayFlight24 | Origin of the visit (campaign or affiliate partner) to attribute the claim; not shared with third parties | Until the browser is closed |
uslk_* | Userlike UG (Germany) | Support chat in the claim form | Up to 12 months |
Statistics (only with your consent):
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_* | Google Ireland Ltd (Google Analytics) | Aggregate visit statistics | 2 years |
_hjSessionUser_* | Hotjar Ltd (Malta) | Recognises the same visitor across visits, to understand how the site is used | 1 year |
_hjSession_* | Hotjar Ltd (Malta) | Groups the pages viewed in the same visit | 30 minutes |
Marketing (only with your consent):
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_gcl_au, _gcl_aw | Google Ireland Ltd (Google Ads) | Measures the claims coming from our ads and stores the ad click | 90 days |
IDE, test_cookie (doubleclick.net) | Google Ireland Ltd | Remarketing and personalised ads | Up to 13 months |
_fbp, _fbc | Meta Platforms Ireland Ltd | Measures ads on Facebook and Instagram and remarketing | 90 days |
fr (facebook.com) | Meta Platforms Ireland Ltd | Personalised ads | 90 days |
10How to manage cookies
On your first visit a banner asks for your consent: you can accept all cookies, reject them or use “Preferences” to choose between statistics and marketing. Closing the banner with the × means rejecting: only technical cookies stay active. Until you choose, statistics and marketing cookies stay blocked.
Your choice lasts 6 months. You can change it or withdraw your consent at any time from the “Cookie preferences” link at the bottom of every page, or from here:
Before you choose and after a rejection, Google only receives cookieless signals (Google Consent Mode), which it uses to estimate campaign results in aggregate form; the Meta pixel and Hotjar are not loaded.
You can block or delete cookies at any time in your browser settings; if you also block technical cookies, some parts of the website may not work. For Google Analytics you can also use Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout.
11Changes
We may update this notice; the version in force is always on this page, with the date of the last update.