Privacy Policy

1. Introduction

PremFly is committed to protecting your personal data. We collect and process only the data strictly necessary to provide our service, and we do so lawfully, transparently, and fairly. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the PremFly website (www.premfly.com) and subscription services.

By using the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with it, you should not use the Service.

"Personal data" means any information that can be used to identify you, directly or indirectly.

2. Who Is the Data Controller?

PremFly is managed and administered by:

Pilot Projects MB
Company registration no.: 307481660
Giedraičių g. 39-R53, Vilnius 09302, Lithuania, European Union
Email: hi@premfly.com

We are the data controller responsible for the processing of your personal data in connection with PremFly.

3. Data Processing Principles

When processing your personal data, we:

• Comply with the EU General Data Protection Regulation (GDPR) and applicable Lithuanian data protection law
• Process your data lawfully, fairly, and transparently
• Collect data only for specified, explicit, and legitimate purposes
• Retain data only for as long as necessary for those purposes
• Take appropriate technical and organisational measures to keep your data secure
• Do not sell, rent, or share your personal data with third parties except as described in this policy

4. How PremFly Works

PremFly is an email-based premium flight deal subscription service. Members receive curated business and first class flight deal newsletters matched to their selected airports and preferences. The member dashboard is a self-service panel for managing account settings, preferences, and billing — it is not a booking platform.

Displayed prices are informational only. To confirm the final price of any offer, members must visit the relevant third-party provider by clicking the link in the email.

Members may cancel their subscription at any time. Upon cancellation, data is retained in accordance with Section 9 of this policy.

5. Affiliate Disclosure

PremFly participates in affiliate marketing programmes. When members book hotels or travel services through partner links featured in our emails or dashboard, we may earn a commission on completed transactions. This does not affect the price paid by the member.

We are committed to transparency regarding our affiliate relationships. For further enquiries, contact hi@premfly.com.

6. What Personal Data We Collect and Why

6.1 Account and membership data

When you create a PremFly account or subscribe to any of our products, we collect:

• Name and email address
• Home airport(s) and travel preferences
• Subscription type and billing information (payment processing is handled by our payment processor Stripe Technology Company Limited; we do not store card details)

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Retention: for the duration of your membership and up to 3 years after termination, or as required by applicable law.

6.2 Customer support and communications

When you contact us by email or submit a complaint, inquiry, or cancellation request, we collect:

• Email address
• Date, content, and context of the communication

Legal basis: our legitimate interest in managing customer enquiries and improving service quality (Article 6(1)(f) GDPR); or your consent where applicable (Article 6(1)(a) GDPR).

Retention: up to 1 year from the date of your enquiry, unless a longer period is required for legal or dispute purposes.

6.3 Analytics data

We use Google Analytics to collect aggregated, anonymised data about how users interact with our website, including page views, session duration, and device type. This data does not identify you personally and is used to improve the Service.

Google Analytics may set cookies on your browser. For more information, see Google's privacy policy at https://policies.google.com/privacy.

Legal basis: our legitimate interest in improving the Service (Article 6(1)(f) GDPR).

6.4 Data we do not collect

We do not collect or process special category personal data, including data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Please do not submit this type of information to us.

7. Cookies

We use cookies and similar tracking technologies on our website for the following purposes:

• Analytics: Google Analytics uses cookies to collect aggregated data about website usage. See Section 6.3 above.
• Functionality: cookies may be used to remember your preferences and maintain your session.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

8. Who We Share Your Data With

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers: third parties we use to operate the Service, including email delivery platforms, website hosting providers, payment processors, and analytics tools. These providers are contractually required to process your data only in accordance with our instructions and applicable data protection law.
• Affiliate and deal partners: we may share limited data with partner providers to facilitate deal redemptions or track affiliate transactions.
• Legal requirements: we may disclose your data if required to do so by law, court order, or a competent public authority.

Where data is transferred to third parties outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as required under GDPR.

9. How Long We Keep Your Data

We retain your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. Specific retention periods are set out in Section 6. After the applicable retention period, your data is securely deleted or anonymised.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include access controls, encryption, and regular security testing.

However, no method of transmission over the internet is completely secure. You provide your information to us at your own risk. In the event of a data breach that poses a risk to your rights or freedoms, we will notify you as soon as practicable after becoming aware of it.

11. Your Rights as a Data Subject

Under the GDPR, you have the following rights in relation to your personal data:

• Right to be informed: to know how and why your data is processed
• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your data where it is no longer necessary for the purposes for which it was collected
• Right to restrict processing: to request that we pause processing your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format where applicable
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hi@premfly.com. We may ask you to verify your identity before processing your request. We will respond within 30 calendar days. This period may be extended by up to two further months where requests are complex or numerous; we will inform you of any extension within the initial 30-day period.

12. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority in the EU member state where you reside or work. A full list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us first at hi@premfly.com so we can try to resolve any issue promptly.

13. Minors

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at hi@premfly.com and we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted at www.premfly.com/privacy-policy with an updated revision date. Where changes are material, we will notify you by email.

15. Contact Us

For any questions about this Privacy Policy or the way we handle your personal data:

Pilot Projects MB
Company registration no.: 307481660
Giedraičių g. 39-R53, Vilnius 09302, Lithuania, European Union
Email: hi@premfly.com