Passenger flights in Tallinn International Airport (TLL/EETN), Kärdla Airport (KDL/EEKA), Helsinki-Vantaa Airport (HEL/EFHK), Savonlinna Airport (SVL/EFSA).

1. UAB AK "Transaviabaltika", legal entity code 159973821, address Europos ave. 89 (3rd floor), LT-46333 Kaunas (hereinafter referred to as the "Company"), respecting Your right to privacy and protection of Personal Data, undertakes to process Your Personal Data obtained through Your use of the Company's website transaviabaltika.lt or/and through Your use of the Company's air transportation (flight) services, or through any other legal relationship with the Company, in a proper manner and in accordance with the requirements of legal acts/legal obligations and the principles and rules defined in this Privacy Policy.
2. The Company collects and processes Personal Data acting as a data controller in accordance with the legal acts of the Republic of Lithuania and the European Union. This Privacy Policy informs You about the processing of your Personal Data when You use this website or when You are our customers, other data subjects.
3. The Company may use other persons providing services on behalf of the Company (e.g. tour operators, ticket distributors, etc.) for the provision of air carriage (flights) services and the Company's website may contain links to the websites of such persons. If, by using the Company's website, You access another person's website and/or subscribe to a service offered by that person, the third party will be a separate data controller for the collection and processing of your Personal Data when You visit that person's website or use its services, and will have a separate privacy policy for the processing Personal Data.

4. Personal Data means any information about You or another natural person identified or identifiable, directly or indirectly (collectively, the "Data Subject"), using personally identifiable data such as name, personal identification number, order number, nationality, other.
5. The Company collects and processes Personal Data for the following purposes:
   • For the purpose of contractual relations in connection with the provision of air transport services by the Company - for the purpose of concluding and executing contracts for the provision of an air transport service (performance of a flight) to customers (passengers), for the purpose of accepting and processing orders, and for the purpose of fulfilling the Company's other obligations as a service provider (air carrier) in connection with the provision of air transport services, and for the purpose of identifying the customer (passenger) for that purpose; for the purpose of contracting for the provision of services necessary to provide air transport services, for the purpose of identifying the service provider, partner or other natural person assisting the Company in the provision of air transport services.
   • For the purpose of immigration and/or customs security - to ensure compliance with legal requirements or other lawful instructions to provide passenger information to border control authorities, customs and/or other competent authorities for the purpose of carrying out flight security, immigration, customs and border control procedures.

• For the flight information purposes - to inform customers/passengers of important circumstances relating to flights, their performance, cancellation, changes in flight times and/or other material terms and conditions relating to the provision of the air carriage service (flight) booked.
• For the purpose of security of property and persons, crime prevention - to ensure the protection of the Company's property, the safety and integrity of passengers and their property, as well as the safety of the Company's employees, customers and other persons (including their property), and to comply with the requirements of the civil aviation safety and other legislation.
• For the purpose of administering the customer database - to ensure traceability of the provision of air transport services, to ensure and enforce the rights and legitimate interests of customers, and to carry out surveys, statistical and other analyses.
• For direct marketing purposes - for the purpose of informing about promotions, additional services or goods provided by the Company, as well as for collecting information and opinions about the quality of services provided.
• For the purpose of the selection of candidates for the Company's vacancies offered by the Company - to get to know the person seeking employment with the Company, his/her experience, profession, qualifications, abilities, to assess his/her suitability to perform his/her job functions in the Company.
• For the purpose of administering legal disputes - to ensure the exercise of the Company's, its customers' (passengers') or other natural persons' right to legal redress, to resolve legal disputes (whether pre-litigation or litigation), to process passengers' claims or complaints regarding denied carriage, cancellation or delay of a flight, or other legal claims.
• For payment accounting purposes - to issue accounting documents to customers, to receive accounting documents, to record payments to service providers and other persons, to carry out other payment accounting activities and audits; to detect and/or prevent financial fraud, other financial crime or misconduct.
• For the purpose of improving and administering the websites operated by the Company - to improve and develop the websites operated by the Company and to offer better, more tailored and personalised services to visitors to the websites.
• For the purpose of exercising the Company's rights and obligations under the law - for the purpose of the Company's proper exercise of its rights and obligations provided for in binding legal acts and/or legal instructions (e.g., court judgments, rulings of supervisory authorities, etc.), in the event of the Company's legitimate interest to exercise its rights.

6. The Company collects and processes the following Personal Data:
   • For the purpose of the contractual relationship in connection with the provision of the Company's air transport services, the Company shall process the name, surname, date of birth, age, gender, nationality, residential address, flight departure and departure point, flight number, flight reservation data, telephone number, e-mail address, ID number, validity period and country of issue of the ID; health data, if the passenger has special medical requirements, other Personal Data of the passenger obtained from him/herself (or his/her representatives), other data obtained from other persons (e.g. (e.g. tour operators, etc.) or sources (e.g. registers) in the context of the conclusion of contracts, and/or data collected from these persons through the use of websites operated by the Company and other websites.
   • For the purpose of immigration and/or customs control security - the Company processes the name, surname, date of birth, personal identification number, nationality, ID number, expiry date and country of issue of customers/passengers, flight check-in data that it receives from the customers and/or law enforcement or other authorities/entities responsible for flight security/enforcement.
   • For the purpose of providing flight information - the Company shall process the name, email, audio recordings, telephone number, flight check-in, time and location data of the customers which it receives from the customers or their representatives at the time of conclusion of the contract, as well as from other entities responsible for the execution and control of flights.
   • For the purpose of security of property and persons, crime prevention - the Company processes video and/or audio data, name, flight registration, time and location data of persons entering the video surveillance field of its property by obtaining them from the facilities and/or entities responsible for the security of the property and/or flights.
   • For the purpose of administering the customer database, the Company processes name, surname, flight time, price and location data received from customers or their representatives, websites operated by the Company and/or others (e.g., when booking flights online), from third parties (e.g., tour operators, relevant services, etc.).
   • For the purpose of direct marketing - the Company processes the name, surname, email address, mobile phone number of customers or service providers (and their representatives) as they receive them from Data Subjects.
   • For the purpose of selection of candidates for the Company's vacancies offered by the Company, the Company shall process the candidate's name, surname, date of birth, residential address, telephone number, e-mail address, education, qualifications, licenses held, and any other data provided by the candidate himself/herself on his/her own initiative and/or provided by a third party to the extent that such data have been provided.
   • For the purpose of administration of legal disputes - the Company processes the Data Subject's name, surname, date of birth and/or identification number (personal identification number), address, and other data which become known to the Company from documents relating to legal disputes, as well as data provided by the Data Subject to the Company at the time of concluding a contract, by the Data Subject's legal representative, or by the Company's legal representative, or by the legal disputes handling authorities and public registers.

• For the purpose of payment accounting - the Company processes the name, surname, date of birth, personal identification number, address, payment card data, invoice data, documentary data for the receipt of money, current account data, which it receives directly from the Data Subjects and/or third parties (e.g., payment institutions) for the purpose of the fulfillment of its contractual obligations and/or legal obligations.
• For the purpose of improving and administering the websites operated by the Company, the Company processes Personal Data collected when Data Subjects use the websites, such as data on the type of browser, the visitor's IP address, information on browsing history, and others. The Company obtains this Personal Data from Data Subjects when they use websites operated by the Company and/or third parties, including through the use of cookies or similar technologies.
• For the purpose of exercising the Company's rights and obligations under the law - the Company processes the above categories of Personal Data received from Data Subjects (or their representatives) and/or other entities/sources.

7. Personal Data shall be processed to the extent necessary to achieve the specific purpose of the processing of Personal Data.
8. The Company shall implement appropriate technical and organisational measures to ensure the security and confidentiality of the processing of Personal Data at a level appropriate to the risk of a security breach.

9. Only with Your express consent the Company may process and use Your Personal Data (name, surname, email address, mobile phone number) for the purpose of direct marketing in order to provide You with newsletters about the Company's services, discounts, events, other offers. The Company may process the e-mail address of existing customers, their representatives on the basis of legitimate interest, unless these persons do not consent to such processing by concluding a contract or express their opposition by contacting the Company.
10. For the purpose of direct marketing, the Company may use the Personal Data provided by You to provide you with messages via websites and/or applications operated by third parties (e.g. Google, etc.).
11. If the Company asks for Your consent to use your Personal Data for direct marketing purposes, it will do so by a separate request, using a consent form (paper or electronic).
12. You may withdraw Your consent to the processing of Personal Data for direct marketing purposes at any time. You may do so by emailing - info@transaviabaltika.lt.
13. In the event of withdrawal of consent given for the purpose of direct marketing, the Company shall cease the processing of Personal Data immediately, but not later than within 5 (five) working days.

14. The Company shall process and store Personal Data for no longer than is necessary to achieve the purposes for which the Personal Data were collected and processed. The Company shall keep Personal Data within the mandatory time limits set by legal requirements, taking into account the time periods necessary to comply with its legal obligations arising from contracts or legal acts.
15. The maximum retention of Personal Data is for the purposes set out in Articles 5.1 and 5.2 of the Privacy Policy, i.e. up to 10 years, for the purposes set out in Articles 5.6 and 5.10 - for 6 (six) months from the date of receipt of the data, unless the Data Subject's consent to store his/her Personal Data for a longer period is obtained.

16. The Company shall ensure that your Personal Data will not be disclosed to third parties without lawful basis or used for purposes other than those for which it was collected. The Company reserves the right to disclose information about You to third parties if it is required to do so by law.
17. The Company may transfer your Personal Data to third parties (e.g. tour operators, airports, payment institutions, etc.) to assist the Company in the performance of its activities and/or direct marketing. Personal Data will only be transferred to third parties after ascertaining and ensuring that it is only processed in accordance with the instructions given by the Company and the applicable legal requirements for the protection of Personal Data. Third parties may not use this Personal Data for purposes other than the provision of services to the Company.
18. If Personal Data is to be transferred to third countries (outside the European Economic Area), the Company requires partners and service providers to process Personal Data by taking certain security measures and in accordance with the General Data Protection Regulation, and to comply with standard contractual clauses approved by the European Commission to ensure the protection of Personal Data.

19. When processing Personal Data, the Company shall ensure the following rights:
    • to know (be informed) about the processing of Your Personal Data;
    • to have access to your Personal Data processed by the Company;
    • to request the rectification or completion, clarification of incorrect, inaccurate or incomplete Personal Data;
    • to request the erasure of Personal Data when it is no longer necessary for the purposes for which it was collected ("right to be forgotten");
    • require the destruction of Personal Data if it is processed unlawfully or where You withdraw or withhold your consent to the processing of Personal Data, which is necessary;
    • to object to the processing of Personal Data or to withdraw consent previously given;
    • to request the suspension (other than storage) of the processing of Personal Data in the event of disputes or the need to verify the lawfulness of the processing of the data, the accuracy of the data, as well as in cases where the Company no longer needs Your Personal Data, but You do not want the Company to destroy it;
    • require the provision, where technically feasible, of the Personal Data we hold about You and/or its transfer to another Personal Data Controller.

You may submit any claims relating to the exercise of Your rights to the Company by hand or by post to JSC aviation company “Transaviabaltika”, Europos ave. 89 (3rd floor), LT-46333 Kaunas, Lithuania or by email to info@transaviabaltika.lt.

20. At Your request, the Company may ask you to provide documents proving your identity and a power of attorney (if your representative is applying), as well as any other necessary information relevant to the request. The Company will respond to the request within 30 (thirty) calendar days of receipt of the request and all documents necessary to respond to it. If necessary, the Company will suspend the processing of Your Personal Data, except for storage, until Your request is resolved.
21. The Company reserves the right not to comply with Your requests if it needs to ensure the performance of its statutory duties; public order, prevention, detection or prosecution of crime; investigation and detection of breaches of service or professional ethics; protection of the rights and freedoms of You and/or others; or on any other lawful grounds. In all cases, the Company will inform You of the reasons and legal basis for refusing to comply with the request.
22. If you disagree with the Company's actions in processing your Personal Data or with the Company's response to Your request, You may complain about the Company's actions and decisions to the competent state supervisory authority - the State Data Protection Inspectorate of the Republic of Lithuania (https://vdai.lrv.lt/).

23. This Privacy Policy shall be deemed effective from the date of its publication on the website.
24. Any additions and/or changes to the Privacy Policy will be posted on the Company's website, so we recommend that You review it regularly.
25. If necessary, the Company will inform You personally about additions and/or changes to the Privacy Policy.
26. For all requests, complaints and questions related to this Privacy Policy and the processing of Your Personal Data, please contact the Company using the following contact details: