Privacy policy

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We are not required to appoint a data protection officer, as the conditions of Section 38 of the German Federal Data Protection Act (BDSG) do not apply to us. For any questions about data protection, please contact us at the address above.

Visiting this website

When you visit this website, our hosting provider processes the data your browser transmits for technical reasons:

• the address requested
• date and time of access
• the amount of data transferred
• the page you came from
• the browser and operating system used
• your IP address

This data is needed to deliver the website at all and to operate it reliably and securely. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in reliable operation. We do not analyse this data on a personal level and do not combine it with other data. We reserve the right to review it retrospectively only if there are specific indications of unlawful use.

All traffic is encrypted with TLS, as shown by “https://” and the padlock symbol in your browser’s address bar.

Hosting and delivery

This website is hosted and delivered through Cloudflare Pages, a service of:

Cloudflare provides web hosting, a reverse proxy and a content delivery network and processes the data solely on our instructions. This is based on a data processing agreement under Art. 28 GDPR.

Using Cloudflare, Inc. may involve a transfer to the USA. This is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in delivering this website securely and quickly. We do not use a customer management system on this website.

Consent, Google Analytics, Meta Pixel and the origin of your visit

On your first visit, a banner asks whether we may measure your use with Google Analytics and use the Meta Pixel to measure and manage our advertising. We store your decision under the key “wintair_consent” in your browser’s local storage. This is technically necessary so that you are not asked again on every visit (Section 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG, and Art. 6(1)(f) GDPR). If you decline, that is the end of it: no cookie, no measurement, no connection to Google or Meta. Regardless of your decision, this website creates two further entries in local storage that have nothing to do with Google or Meta: the origin of your visit (“wintair_utm”, 30 days) and, only after a click on WhatsApp, a short send queue (“wintair_wa_queue”, seven days at most). Both are described below under “Advertising parameters and origin” and in section 6.

Google Tag Manager and Google Analytics 4

If you agree, your browser loads Google Tag Manager and, through it, Google Analytics 4, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself does not process personal data; it only loads the Analytics script. Google Analytics then sets cookies (“_ga”, “_ga_EWTMX81741”, lasting up to two years) with a randomly generated identifier and records pages viewed, time spent, approximate location (from the shortened IP address), device and browser, the page you came from, and events such as a click on the WhatsApp button or starting the video. Google Analytics 4 shortens IP addresses before storing them; we have not activated advertising signals (Google Signals) or personalised ads.

Google processes this data on our behalf under the Google Ads Data Processing Terms (Art. 28 GDPR). This may involve a transfer to Google LLC in the USA, based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR, under which Google is certified. User and event data in Google Analytics is kept for 14 months and then deleted automatically. More information is available in Google’s privacy policy at policies.google.com/privacy.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Meta Pixel

If you agree, your browser also loads the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel script is loaded from connect.facebook.net, sets the cookie “_fbp” (90 days) and, after a click on one of our ads, “_fbc”, and transmits to Meta: the pages viewed, events on this website (click on the WhatsApp button, starting the video, click on a client video), your IP address, browser and device data and, if you are logged in to Facebook or Instagram, the link to your Meta account. We use this data to measure whether our ads lead to enquiries, to build audiences for our advertising and to show you relevant ads on Facebook and Instagram.

We and Meta are joint controllers for collecting and transmitting this data within the meaning of Art. 26 GDPR; the agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing after transmission. This may involve a transfer to Meta Platforms, Inc. in the USA, based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR, under which Meta is certified. More information is available in Meta’s privacy policy at facebook.com/privacy/policy; you can manage your ad preferences at facebook.com/adpreferences.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Withdrawing consent

You can withdraw your consent at any time with effect for the future: click “Cookie settings” in the footer and choose “Only necessary”. You can delete cookies already set by Google and Meta in your browser’s site data settings.

Advertising parameters and origin

If you arrive through an ad, a tagged link or another website, this site reads the advertising parameters in the address bar (utm_source, utm_medium, utm_campaign, utm_term, utm_content and the click IDs gclid, fbclid, ttclid and msclkid) and the address of the page you came from. It stores this information together with the landing page and the time for 30 days in your browser’s local storage under the key “wintair_utm”: once as the first contact, which stays unchanged, and once as the latest contact, which is overwritten on every further visit with such information. This happens regardless of your decision in the banner. If you arrive directly and without such information, nothing is stored.

The sole purpose is to match a later WhatsApp enquiry from you to the channel through which you found us (section 6). Unless you click on WhatsApp, this information does not leave your device; no usage profile is created and nothing is passed to third parties. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in measuring the success of our own advertising. The entry expires on its own after 30 days; you can delete it sooner in your browser’s site data settings.

If you have agreed to measurement, Google Analytics additionally transmits the parameters as part of the address requested, and the Meta Pixel reads Meta’s click ID (fbclid) to match your visit to the ad you clicked.

Language selection

This website is available in German and in English (wintair.de/en). When you open the home page, our server decides, based on the country your connection comes from and the languages set in your browser, whether you see the German or the English version. It only evaluates information that is transmitted anyway (section 2); nothing is stored in the process. If you choose a language with the “EN” or “DE” switch, we set the cookie “wintair_lang” (lasting one year) so that your choice applies on every further visit. It only contains the value “de” or “en” and is strictly necessary for this function, which you have expressly requested (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR); no consent is required. You can delete it at any time in your browser’s site data settings.

Content from external servers

Without your consent, this website does not load content from third-party servers. All images, graphics and logos are stored on and delivered from our own server. The only exceptions are Google Tag Manager, Google Analytics and the Meta Pixel, which are only loaded after your consent (see section 4), and the Cloudflare Turnstile bot protection, which only the giveaway page loads (see section 7).

We do not load fonts from third-party servers. The main pages use fonts already installed on your device; the giveaway page (wintair.de/en/giveaway) uses three fonts that we deliver from our own server. Google Fonts are not used.

The video area at the top of the page also works without third-party providers: the preview image and video are delivered from our own server. No external video service such as YouTube is embedded.

Contact via WhatsApp, reference code and click log

There is no contact form on this website. The buttons lead to a WhatsApp link with a prepared message; our email address is in the legal notice. WhatsApp is a service of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

No data is transmitted to Meta unless you click the link. If you do, WhatsApp opens with the draft message, which is only sent if you send it yourself. From that moment, WhatsApp’s privacy terms apply, over which we have no control.

Reference code in the draft message

When you click, your browser generates a random code in the form “WA-XXXX-XXXX” and adds it in brackets to the prepared text. The code contains no information about you; it is a random value we use to match your message to the click entry described below. You can delete it before sending. In that case the match is not possible, but your enquiry reaches us all the same.

Click log

At the same time, your browser reports the click to our server. We record: the time, the code, a random event ID, the origin information described in section 4 (first and latest contact, click IDs, referring page, landing page), the page and the button you clicked, your decision in the banner, the country derived from your IP address (we do not store the IP address itself), the device type (mobile or desktop, without the full browser identifier) and your browser language. Our server passes this entry to Make.com, which writes it to a Google spreadsheet. If the entry could not be transmitted straight away, your browser keeps it for up to seven days under “wintair_wa_queue” in local storage and sends it on your next visit; on our server it may be held in a buffer for up to 30 days if Make.com was not reachable.

If you then message us with the code, we match your enquiry to the entry and add its status and your phone number. The purpose is to see which channels enquiries come from and to plan our advertising accordingly. The legal basis for the click log is Art. 6(1)(f) GDPR (measuring the success of our own advertising); from your message onwards, Art. 6(1)(b) GDPR. Our service providers are Make.com (Celonis, s.r.o., Křižíkova 148/34, 186 00 Prague, Czech Republic) and Google Ireland Limited (Google Sheets), both as processors under Art. 28 GDPR. Google may transfer data to the USA, based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR. We delete entries in the spreadsheet automatically twelve months after the click.

If you write to us via WhatsApp or email, we process your message and the contact details transmitted solely to answer your enquiry and arrange a conversation. The legal basis is Art. 6(1)(b) GDPR, as the processing takes place at your request and to prepare a contract.

Giveaway (wintair.de/en/giveaway)

At the Fight Gecko Combat Series 4 event in Dubai on 11 December 2026, we are giving away a First Class flight. Entry is via a form on the English-language page wintair.de/en/giveaway. Required details are your first and last name, your WhatsApp number and your agreement to the giveaway terms; an email address and your consent to receive travel offers are optional.

When you submit the form, we store: the time, your name, WhatsApp number, email address (if given), your two decisions on the terms and on offers, the origin of the visit (for example “fcs4” when the QR code at the table is scanned), the country derived from your IP address, the device type, the browser language and a random event ID. We do not store the IP address itself or the browser identifier. The purpose is to run the giveaway: entry, draw and notifying the winner via WhatsApp. The legal basis is Art. 6(1)(b) GDPR; for travel offers, your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time by writing to [email protected].

Our server passes the entry to Make.com, which writes it to a Google spreadsheet (both processors under Art. 28 GDPR, sections 6 and 9). To prevent duplicate entries, our server remembers your WhatsApp number for 90 days in a buffer at Cloudflare; to limit misuse, it also counts requests per IP address for one hour, holding the address only as a non-reversible hash value created with a secret key. If an entry could not be transmitted straight away, it is held in this buffer for up to 30 days.

The form is protected against automated entries by Cloudflare Turnstile. Your browser loads a script from challenges.cloudflare.com; Cloudflare checks technical characteristics of your browser to determine whether the entry comes from a human and only passes the result to us. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a fair giveaway without automated mass entries.

We delete entry data no later than 90 days after the draw. We keep the winner’s data for as long as necessary to provide the prize and meet legal record-keeping obligations. Under the giveaway terms, the winner records a short testimonial video, which we may publish with their first name on our websites and on our social media channels (for example Instagram, Facebook, LinkedIn, TikTok and YouTube) and use in our own marketing. For this we process the winner’s image, voice and first name on the basis of Art. 6(1)(b) GDPR (the giveaway terms). Once published, the video and the details in it are publicly visible; the platforms’ own privacy terms also apply there. We keep the video published for as long as we use it in our marketing. If you agreed to receive travel offers, we keep your name and WhatsApp number until you withdraw your consent.

Links to other providers

In the menu and in the hotel access section, we link to our hotel portal at wintair.cube-travel.de, where you can book hotels at our partner rates yourself. The portal is operated technically by a service provider and is a separate offering with its own privacy policy. If you create a customer account there or book a stay, your data is processed under the terms that apply there.

We also link to the membership overview of our partner at cube-travel.de, to René Winter’s Flightradar24 profile and, in the client stories section, to two videos on YouTube, a service of Google Ireland Limited. The preview images are copies stored on our own server; YouTube only opens in a new window when you click.

These are simple links, not embedded content or provider buttons. No data is transmitted to these providers unless you click one of the links. Only then do their privacy terms apply, over which we have no control.

Recipients of your data

We do not pass your data on to third parties, except to the processors named in this policy and where we are legally required to do so.

Our processors are Cloudflare, Inc. (hosting, section 3) and, for the click log in section 6, Make.com (Celonis, s.r.o., Prague) and Google Ireland Limited (Google Sheets). Google Ireland Limited and Meta Platforms Ireland Limited only receive further data if you have agreed to measurement in the banner (section 4).

For the giveaway (section 7), Make.com and Google Ireland Limited (Google Sheets) also act as processors; the Turnstile bot protection is provided by Cloudflare, Inc. under the data processing arrangement described in section 3.

If your enquiry leads to a booking, we pass the data required for that booking to the service providers involved, for example airlines, hotels or booking systems. This happens only within the specific assignment and on the basis of Art. 6(1)(b) GDPR. Depending on the destination, this may involve a transfer to a country outside the EU where this is necessary to perform the contract (Art. 49(1)(b) GDPR).

How long we keep data

How long we keep data depends on the purpose and on statutory retention periods:

• Our provider deletes server log files after a short time as part of normal operation.
• The origin information in your browser’s local storage (“wintair_utm”) expires after 30 days and the send queue (“wintair_wa_queue”) after seven days at most; you can delete both at any time in your browser’s site data settings.
• We delete click log entries in the Google spreadsheet automatically twelve months after the click; the buffer on our server expires after 30 days.
• The language cookie “wintair_lang” expires after one year. For the giveaway, the buffer that prevents duplicate entries expires after 90 days, the counter per IP hash after one hour and an entry that could not be transmitted after 30 days; we delete entry data in the Google spreadsheet no later than 90 days after the draw.
• We delete enquiries that do not lead to a booking once it is clear they will not be pursued and keeping them is no longer necessary.
• If an enquiry leads to a contract, statutory retention periods apply. Under German commercial and tax law, these are up to ten years depending on the document (Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code).
• We delete data processed on the basis of a legitimate interest as soon as you object, unless compelling legitimate grounds prevent this.

Your rights

You have the following rights with regard to us:

• Access to the data stored about you, Art. 15 GDPR
• Rectification of inaccurate data, Art. 16 GDPR
• Erasure, Art. 17 GDPR
• Restriction of processing, Art. 18 GDPR
• Data portability, Art. 20 GDPR
• Objection to processing, Art. 21 GDPR
• Withdrawal of consent given, with effect for the future, Art. 7(3) GDPR
• Complaint to a supervisory authority, Art. 77 GDPR

A simple message to [email protected] is enough. We may ask for proof of identity so that we do not disclose data to unauthorised persons.

Right to object

Where we process your data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

Where we process your data for direct marketing, you may object at any time without giving reasons. We will then no longer use your data for marketing.

After an objection, we stop the processing concerned. We may continue processing only if we can demonstrate compelling legitimate grounds that override your interests, or if the processing serves to establish, exercise or defend legal claims.

Complaints to a supervisory authority

You may lodge a complaint with a data protection supervisory authority at any time, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Whether and how we work with you is decided in a personal conversation.

Changes to this policy

We update this policy when the technology of this website or the legal situation changes. The version published here, with the date shown above, applies.