PRIVACY POLICY
Last updated: 19 August 2026
This Privacy Policy explains how WINAIR d.o.o. (“WINAIR”, “we”, “us” or “our”) processes personal data when you visit winair-aviation.com, contact us, request a flight or submit an open application.
1. Controller and contact details
WINAIR d.o.o. is the controller of the personal data described in this policy.
- Registered address: Svilarska ulica 2, 42000 Varaždin, Croatia
- Email: fly@winair-aviation.com
- Telephone: +385 42 390 700 and +385 91 3520 078
- Website: https://winair-aviation.com
- OIB: 86159887081; VAT ID: HR86159887081
Privacy questions and requests may be sent to the email address above.
2. What data we collect, why we use it and our legal bases
Flight enquiries
When you request a flight, we may collect your name, email address, optional telephone number, trip type, departure and destination, proposed dates and times, passenger count, and any details you choose to add.
We use this information to respond to your enquiry, assess operational feasibility, prepare an offer, arrange requested services and communicate with you. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Where needed, we also rely on our legitimate interests (Article 6(1)(f) GDPR) in managing enquiries, planning safe and efficient operations, preventing misuse and maintaining business records.
General contact
When you use the contact form, email or telephone, we may collect your name, email address, optional telephone number, selected topic, message and related correspondence.
We process this information to answer your question and manage our relationship with you. Depending on the request, the legal basis is taking pre-contractual steps or our legitimate interests in responding to communications, operating our business and keeping an appropriate record of the exchange.
Open applications and recruitment
When you submit an open application, we may collect your name, email address, optional telephone number, area of interest, qualifications or licence summary, introduction, CV in PDF format and later recruitment correspondence.
We use this information to assess your application, communicate with you and consider you for relevant opportunities. The legal basis is taking steps at your request before a possible employment contract and our legitimate interests in organising recruitment and assessing candidates. We do not use application data for unrelated marketing.
Website, security and anti-abuse data
Our website and infrastructure may process technical data such as IP address, browser and device information, requested pages, timestamps, server logs and form anti-abuse signals. Forms use a local honeypot to reduce automated submissions.
We use technical data to deliver and secure the website, diagnose faults, prevent fraud and abuse, and maintain service availability. The legal basis is our legitimate interests in operating a reliable and secure website.
Cookies and similar technologies
At the date of this policy, WINAIR does not use analytics or advertising cookies on this website. The website or its security provider may set strictly necessary cookies, including a Cloudflare security cookie such as cf_clearance, when needed to distinguish legitimate visitors from abusive traffic. These cookies are used for security and cannot be switched off through an analytics or advertising preference. Under the website configuration observed on the date of this policy, cf_clearance expires no later than one year after it is set, unless it is replaced or removed sooner. This setting will be reassessed if the website infrastructure changes.
Google Fonts and external links
The website currently loads fonts from Google Fonts. When this happens, your browser connects to Google servers and transmits technical request data, which can include your IP address and browser information. We use the fonts to provide a consistent presentation of the website and rely on our legitimate interest in delivering the site as designed.
The website also contains ordinary links to third-party websites, including Google Maps. Those services receive data only when you choose to follow the link. Their own privacy notices apply after you leave our website.
3. Sensitive information
Please do not submit passport or identity-document details, payment-card data, medical records, diagnoses, licence scans or other unnecessary sensitive information through free-text fields or a CV.
If practical accessibility assistance is relevant to a proposed flight, provide only the minimum operational information needed and contact us directly. If processing sensitive personal data becomes necessary, we will explain the purpose and applicable legal basis and obtain explicit consent where required before processing it.
4. Data provided by or about another person
We normally collect information directly from the person who contacts us. If someone provides information about another passenger or person in an enquiry, the source is the person or organisation making that enquiry. The information may include contact details, travel or assistance details, and the person’s relationship to the booking. We use it only for the same enquiry, planning and service purposes described above. Where Article 14 GDPR applies and we have the person’s contact details, we will provide the required notice no later than one month after receiving the data, at our first communication with that person, or before the first disclosure, whichever occurs first under applicable law. We ask anyone submitting another individual’s data to ensure that they are permitted to provide it and to make this Privacy Policy available to that individual; this does not replace WINAIR’s own transparency obligations.
5. Required and optional information
Fields marked as required are necessary for us to identify and respond to your request or assess an application. If you do not provide required information, we may be unable to process it. Optional fields are voluntary, although omitting relevant information may limit the detail of our response.
6. Who receives personal data
Personal data is available only to people and organisations that need it for the purposes described above. Recipients may include:
- authorised WINAIR personnel;
- website hosting, IT maintenance, security, content-delivery, email and form-service providers acting for us;
- operational partners and professional advisers where necessary for a requested service or to protect legal interests; and
- public authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.
We do not disclose personal data to third parties for their own unrelated marketing purposes.
7. International data transfers
Cloudflare and Google may process technical data in the United States and other countries outside the European Economic Area. Cloudflare states that transfers from the EEA to the United States rely on the EU-U.S. Data Privacy Framework and that Standard Contractual Clauses apply as a fallback or for other relevant transfers. Google states that it participates in the EU-U.S. Data Privacy Framework and uses its published legal frameworks for international transfers. Current provider information is available in the Cloudflare Privacy Policy and Google data-transfer frameworks. You may contact WINAIR for information about safeguards relevant to a particular processing activity.
8. How long we keep data
- Website form submissions: stored in the website database for 90 days.
- Form IP metadata: retained for 7 days.
- Uploaded CVs: retained with the related website submission and removed when that submission is erased.
- Email copies and follow-up correspondence: deleted when the request has been answered and closed, no active quotation, booking or business relationship remains, no complaint or dispute is unresolved, and the record is no longer needed to establish, exercise or defend a legal claim. If an enquiry becomes a quotation, booking, contract or other legal relationship, relevant records move to the retention rules for that relationship.
- Security and server logs: routine records are deleted or overwritten through the configured log-rotation process once they are no longer needed for an active security incident or fault investigation. Records isolated as evidence of an incident are deleted when the investigation and remediation are complete and they are no longer needed for a related legal claim or mandatory retention requirement.
When a retention period expires, personal data is deleted, anonymised or securely archived where continued retention is required by law.
9. Your rights
Subject to the conditions and limits in applicable law, you may request:
- access to your personal data and a copy of it;
- correction of inaccurate or incomplete data;
- erasure of personal data;
- restriction of processing;
- data portability where processing is based on consent or contract and carried out by automated means;
- objection to processing based on legitimate interests, including an explanation of reasons relating to your situation; and
- withdrawal of consent at any time where consent is the legal basis, without affecting processing that took place before withdrawal.
To exercise a right, contact fly@winair-aviation.com. We may ask for information reasonably needed to verify your identity and request.
You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, HR-10000 Zagreb, Croatia, email azop@azop.hr, telephone +385 1 4609 000.
10. Automated decision-making
WINAIR does not use the website forms for automated decision-making or profiling that produces legal or similarly significant effects. Enquiries and applications are reviewed by people.
11. Security
We apply appropriate organisational and technical measures intended to protect personal data against unauthorised access, alteration, loss or disclosure. No internet service is completely secure, so please use the contact details above if you believe information has been sent to us in error or may be at risk.
12. Changes to this policy
We may update this Privacy Policy when our services, website tools or legal obligations change. The revised version will be published on this page with a new last-updated date. If a change materially affects how we use existing personal data, we will provide any additional notice required by law.
13. Contact
For privacy questions, requests or concerns, contact WINAIR d.o.o. at fly@winair-aviation.com or write to Svilarska ulica 2, 42000 Varaždin, Croatia.