Draft template — have this reviewed by a lawyer qualified in Finnish/EU law (and updated with your real entity details) before publishing. Written for a Finland-registered data controller under the GDPR; if you also actively target customers in India or elsewhere, additional local rules may apply on top of this — confirm scope with your lawyer.

Privacy policy

Effective date: [DATE]. This policy explains how [Truefly Oy], registered in Finland ("Truefly", "we", "us"), collects, uses and protects your personal data when you use this website and app, in accordance with the EU General Data Protection Regulation (GDPR) and Finland's Data Protection Act.

Data controller

[Truefly Oy], [Registered Address, Finland], Business ID [XXXXXXX-X], is the data controller for the personal data described in this policy. Contact our data protection queries at [privacy@yourdomain.com].

Information we collect

Contact details (name, phone, email), travel details (routes, dates, passenger information), payment information (processed by our payment gateway partner — we do not store full card numbers), and device/usage data.

Lawful basis and how we use it

We process your data to perform our contract with you (processing bookings with airlines, hotels, visa facilitators and cab operators; customer support; booking confirmations and service updates), and, where you have given consent, for marketing. You may withdraw marketing consent at any time.

Sharing with third parties

We share the minimum necessary booking details with airlines, hotels, visa processing partners, cab operators, our GDS/consolidator partners and our payment gateway to fulfil your booking. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses). We do not sell your personal data.

Data retention

We retain booking records for as long as required for accounting, tax and dispute-resolution purposes under Finnish and EU law, and delete or anonymise data once no longer needed.

Your rights

Under the GDPR you have the right to access, correct, delete, or port your personal data, to restrict or object to processing, and to lodge a complaint with the Office of the Data Protection Ombudsman (Finland) if you believe your data has been mishandled. Contact us at [privacy@yourdomain.com] to exercise these rights.

Cookies

We use cookies to keep you signed in and to understand site usage. You can manage or disable cookies in your browser settings; see our cookie banner for consent choices.

Contact

Privacy queries: [privacy@yourdomain.com]