Datenschutzerklärung (auf Englisch)

Data controller

Jaksenvest Global AB (Swedish company registration no. 559413-0543), which operates Airlate, is the controller for the processing of your data. You can reach us at hello@airlate.com. Our postal address and other company details are on the Company details page.

How the form works

Airlate is a simple website with no sign-in, account or customer portal. When you fill in and submit the form, no case is created in any database. Instead your details are compiled into an email that is sent to Airlate’s internal review address, where we read the request manually and come back to you by email. You also receive a confirmation email with your reference number.

What data we process

We apply data minimisation and process only what we need. Through the form we process:

• your email address and, if you give them, your first name, last name and country of residence,
• details of the journey and the disruption: the type of disruption, departure and arrival airports, airline, departure date, details of the delay, cancellation or denied boarding, the reason given by the airline and anything you write as free text about the reason,
• the number of travellers and, if you add them, your fellow passengers’ names and dates of birth (see below),
• any Airlate code and, if you reached the website through a campaign link, the campaign name and source (utm parameters in the address),
• the preliminary outcome of the rules check, the case reference number, the language you used, when you submitted and that you accepted the terms.

If you use the withdrawal function, we process your name, your email address, the reference number if you give it, what you write about the contract, how you want to receive the acknowledgement and when we received your withdrawal. If you email us, we process what you write and send.

When we pursue your claim, we also process the supporting documents we ask you for by email and the payment details (bank account or other payment method) that you provide so that we can pay out the compensation. We may then also receive data about you and the journey from others: from the airline, alternative dispute resolution bodies, courts and authorities, for example booking details, the airline’s response and decisions in your case. Technical data, including your IP address, is also processed when you visit the website; see the section on technical data and logs below.

We do not collect national ID numbers, passport numbers, bank or card details, copies of identity documents, boarding passes as files, or health data through the form. If we need further supporting documents to pursue the claim, we ask for them separately by email. If you upload documents after submitting, they are sent as attachments in an encrypted email to our case handler and are stored in our internal case system, not on the website (see Where data is stored). We process them as part of your case and keep them in the same way as your enquiry (see Retention). The documents are deleted or pseudonymised 12 months after the case is closed, unless we must keep them to establish, exercise or defend legal claims or because of a legal obligation.

Fellow passengers

If you add fellow passengers in the form, we process their names and, if you give them, their dates of birth. We process this data so that we can include them in the compensation claim you ask us to pursue, and this privacy policy applies to them in the same way as to you. They have the same rights. The data comes from you, not from the fellow passengers themselves. The form does not ask for their contact details, so we cannot inform them directly when you submit. Under our General terms (section 12), you may only provide data about other people if you are entitled to do so. Please tell your fellow passengers that you are giving us their details and where they can read this privacy policy.

Purpose and legal basis

We process the data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

• To make the preliminary assessment, to enter into an engagement agreement with you when you submit the form and to perform it: handling the claim, pursuing it against the airline (where necessary through dispute resolution, the courts or enforcement) and paying out the compensation. Legal basis: contract, including steps taken at your request before entering into it (Article 6(1)(b)).
• To include your fellow passengers in the claim. Legal basis: legitimate interests (Article 6(1)(f)): being able to pursue the claim for the whole party, as you have asked us to.
• To see which campaign a request comes from: an Airlate code you enter, or campaign details (utm parameters) in the address you arrived through. Legal basis: legitimate interests (Article 6(1)(f)): knowing which marketing leads to requests.
• To measure the results of our ads, if you have consented in our cookie choice. Legal basis: consent (Article 6(1)(a)). You can withdraw your consent at any time under Cookie settings; this does not affect processing that has already taken place.
• To send the confirmation email with information about the right of withdrawal, to receive a withdrawal through the withdrawal function and send the acknowledgement, to keep accounts and to handle your requests under the GDPR. Legal basis: legal obligation (Article 6(1)(c)), under, among other things, the Swedish Distance Contracts Act and the Swedish Bookkeeping Act.
• To answer questions and complaints you send us. Legal basis: contract (Article 6(1)(b)) where they concern your case, otherwise legitimate interests (Article 6(1)(f)): being able to answer you.
• To keep the website secure and working: limiting the number of requests from the same IP address, keeping technical logs and troubleshooting. Legal basis: legitimate interests (Article 6(1)(f)): protecting the website against misuse and making sure the forms work.
• To establish, exercise or defend legal claims, for example if a claim or the agreement becomes the subject of a dispute. Legal basis: legitimate interests (Article 6(1)(f)).

We do not use consent as the basis for what is necessary to enter into and perform the agreement or to answer you, and we do not use your data to send you marketing. Where we rely on legitimate interests, you have the right to object; see the section on your rights.

What data you must provide

To submit the form, you must give your email address and answer the questions about the journey and the disruption. Without them we cannot assess the claim, enter into the agreement with you or send the confirmation. Name, country of residence, airline, fellow passengers, free text and Airlate code are optional in the form, but some of this data may be needed later for us to pursue the claim. In the withdrawal function, we need your name and email address to register the withdrawal and send the acknowledgement. If you do not provide payment details, we cannot pay out the compensation to you.

Automated preliminary assessment

Once you have answered the questions about the journey, our rules engine automatically makes a preliminary assessment of whether you may be entitled to compensation and roughly how much. The assessment is based only on the details of the journey, not on your name or email address. It is indicative and does not stop you from submitting the form, and we read every request manually before we pursue a claim. We therefore make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Where data is stored and who sees it

Email is itself a form of storage: your request lands in Airlate’s email inbox and is read there by us. To pursue the claim, the data may also be processed in our own case notes and our email. The website itself does not store any enquiries or documents. We keep enquiries, uploaded documents and withdrawal notices in our internal case system. Access is limited to our staff with two-factor login, and all access is logged. The case system’s database and document storage are on servers in the EU (Railway, the Netherlands, and Cloudflare R2 with EU jurisdiction).

As a customer you can follow your case in our customer portal. You log in with a one-time link sent to the email address registered on the case; we store only a hashed version of the login link. Documents and messages you submit in the portal are processed on the same legal basis and deleted under the same retention as other case data.

We use the following providers, which process data on our behalf (processors):

• Railway (Railway Corporation, USA) operates the server that runs the website and the forms. Since 3 October 2026 the server has been located in Railway’s EU region (Amsterdam, the Netherlands). Railway’s list of sub-processors is available at trust.railway.com.
• Cloudflare (Cloudflare, Inc., USA) sits between your browser and our server and handles the domain name (DNS), the encrypted connection (TLS) and the delivery of the website. All traffic to the website passes through Cloudflare’s network, including what you write in the forms.
• Resend (Plus Five Five, Inc., USA) sends all email from the website: the messages from the form and the withdrawal function to us, the confirmation email and the acknowledgement to you, and technical alerts to us.
• Proton (Proton AG, Switzerland) provides our email inbox, where requests, withdrawals and your emails to us arrive.

When we pursue your claim, we disclose data to others to the extent necessary:

• to the airline or another party liable to pay,
• to advocates, lawyers, debt-collection agencies, partners or other external representatives we engage for the work,
• to supervisory authorities, alternative dispute resolution bodies, courts and other authorities, when the claim is decided there or has to be enforced,
• to banks and payment intermediaries, when compensation is paid out,
• to another company in the same group or to a buyer, if we transfer all or part of the business.

We do not sell your data. We do not share what you write in the form with anyone for marketing purposes. What the website sends about your visit if you consent is set out in the Cookies section.

Technical data and logs

When you visit the website, technical data is processed:

• Cloudflare receives every page request with your IP address, details of your browser and the address of the page you visit. Your browser may also send technical error reports about the connection to Cloudflare.
• We use Cloudflare's aggregated visitor statistics (number of visits per page, country and device type) to see how the website is used. They are based on the same technical data as above and do not show us any data about individual visitors. Legal basis: legitimate interests (Article 6(1)(f)).
• Railway logs every page request that reaches the server, including the time, the page requested, browser details and IP address. The address of the confirmation page contains your reference number, which may therefore also appear in the log.
• The server counts how often the forms are used from each IP address, to stop automated misuse. For this purpose, the IP address is held only in the server’s working memory and is not written to any file or database.
• If something goes wrong when a form is submitted, the server logs the error, and the log may then contain your email address or your name. At the same time we receive an alert by email. The alert is designed not to contain your data.

Transfers outside the EU/EEA

Railway, Cloudflare and Resend are US companies, and data is therefore transferred to the United States. For Railway this applies even though the server is in the EU: according to Railway’s data processing agreement, which we signed on 16 October 2026, Railway’s processing takes place mainly in the United States. Resend stores the content of emails and delivery logs in the United States. If you have accepted marketing, data may also be transferred to Google LLC in the United States (see Cookies).

The transfers rely on the European Commission’s decision of 10 July 2023 that the EU-U.S. Data Privacy Framework provides an adequate level of protection (Implementing Decision (EU) 2023/1795). Transfers to the United States rely on the framework where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses (2021/914) in the respective data processing agreement. You can check their certification in the official list of certified organisations. Should a certification lapse or the decision cease to apply, the transfer will instead rely on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), which are part of Railway’s (module 2, controller to processor), Cloudflare’s and Resend’s data processing agreements. You can contact Railway at privacy@railway.com.

Proton AG is based in Switzerland. The European Commission has decided that Switzerland provides an adequate level of protection (Decision 2000/518/EC).

If you would like a copy of the safeguards, for example the standard contractual clauses, contact us at hello@airlate.com.

Retention

We keep data only for as long as necessary for the purposes above, or for as long as required by law:

• We keep your request, uploaded documents and the correspondence about your case in the inbox and in the case system for as long as needed to handle and pursue the claim. Case data and documents are deleted or pseudonymised 12 months after the case is closed, unless we need them to establish, exercise or defend legal claims or must keep them under the Bookkeeping Act. This also applies to an Airlate code and campaign details that came with the request.
• Data that forms part of our accounts, for example invoices and records of payouts, is kept for as long as the Swedish Bookkeeping Act requires: until the end of the seventh year after the end of the calendar year in which the financial year ended.
• Resend and Railway delete the emails, delivery logs and server logs after a limited time, according to each provider’s own routines.
• Cloudflare keeps the data about your visits only for as long as needed to deliver and protect the website, and no longer than our agreement with Cloudflare lasts.
• IP addresses in the server’s working memory disappear when the server restarts, for example when we publish a new version of the website.
• For what is stored in your browser, see the section on cookies below.

Your rights

You have the right to request access to, rectification or erasure of your data, and to request restriction and in some cases have data ported (data portability). As we have no sign-in or self-service, you contact us at hello@airlate.com and we will help you. We may need to keep some data because of an ongoing claim or legal requirements; if so, we explain why.

Right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on legitimate interests. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Cookies

Unless you accept marketing, the website sets no cookies for statistics or marketing. It then stores two things in your browser: your cookie choice, in the cookie airlate_consent for 180 days, and, while you fill in the form, a draft of your answers about the journey and any fellow passengers, so that they are not lost if you reload the page. The draft stays on your device only and does not contain your contact details. It is deleted when you submit the form or choose ‘Start over’, and otherwise remains until you clear your browser’s storage.

When you are logged in to the customer portal (admin.airlate.com), we set a session cookie, __Host-casehub.portal_session. It is strictly necessary for the login, is not used for tracking or marketing, and is removed when you log out or after at most 30 days (7 days idle).

More information about cookies and how to change your choice is on our cookie page.

If you have accepted marketing, the website loads Google’s ad tag. It sets cookies (see the cookie page) and sends Google the page you visit, your IP address, details about your browser and, if you submit the form, the fact that an enquiry was sent. Your answers in the form, your name, your email address and your reference number are never sent. Google is responsible for its further processing, as set out in its own data protection information. The data may be transferred to Google LLC in the US, which is certified under the Data Privacy Framework.

The website has no plugins or share buttons from social media platforms. Google’s ad tag is loaded only if you have accepted marketing (see Cookies); otherwise no details about your visit are sent to Google. The tag is loaded only on the website’s Swedish and English pages.

Airlate on social media

We have official accounts on Instagram, Facebook, TikTok, X, LinkedIn, YouTube and Bluesky. The website only links to them with ordinary links. It does not embed feeds or videos and has no pixels, plug-ins or share buttons from the platforms, so no data about your visit to the website is sent to them. If you follow a link, you leave the website, and the platform then processes data about you under its own terms and privacy policy.

If you follow us, react to or comment on our posts, message us or mention us on a platform, we process what you write and the profile details the platform shows us, for example name, username and profile picture. We do this so that we can reply to you and manage our accounts. Legal basis: legitimate interests (Article 6(1)(f)): being able to reply to people who contact us and to manage our accounts, for example by moderating comments. If the contact concerns your case or a claim you want us to pursue, the legal basis is instead contract, including steps taken at your request before entering into it (Article 6(1)(b)). Do not send booking details, documents or health data via social media. Submit your claim using the form, and email supporting documents to us at hello@airlate.com. Comments and posts in which you mention us remain until you delete them, and we can also delete comments on our posts where the platform allows us to. Messages remain in our inbox on the platform until we delete them, and if we delete them, they are only deleted on our side. The platform also keeps the data under its own privacy policy.

The platforms may produce statistics for us on how our accounts are used, for example the number of views and followers and aggregated data on the country or age group of visitors. We cannot identify you in the aggregated figures. We can, however, see who follows our accounts, where the platform shows this. On LinkedIn, the list of followers is part of the statistics and shows the name and current employer of each follower and when they started following us. We use the statistics to understand how our content reaches people. Legal basis: legitimate interests (Article 6(1)(f)). For Facebook, TikTok and LinkedIn, we and the platform concerned are joint controllers for the statistics (Article 26). How responsibility is allocated is set out in agreements the platforms have published: Page Insights Controller Addendum (Facebook), TikTok Analytics Joint Controller Addendum (TikTok) and Page Insights Joint Controller Addendum (LinkedIn). Under these agreements, it is the platform that answers requests about your rights where they concern the statistics. For Instagram, X, YouTube and Bluesky, the platforms have not published any such agreement. If we receive statistics from any of them, we and that platform may nevertheless be joint controllers for those statistics.

You can contact both us and the platform about the processing on social media. Where we and the platform are joint controllers, you can exercise your rights against each of us, whatever the agreements say (Article 26(3)). If your request concerns the statistics, we forward it to the platform, as only the platform has the underlying data. The privacy policies of the platforms: Instagram, Facebook, TikTok, X, LinkedIn, YouTube and Bluesky.

Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live or work or where you believe the infringement took place. In Sweden, that is the Swedish Authority for Privacy Protection (IMY). We are glad to hear your concern directly, so we can put it right, but you do not have to contact us first.