Privacy Policy & Data Protection Notice

1 Identity of the Data Controller & Data Protection Officer (Art. 13(1)(a)-(b) GDPR)

This Privacy Policy governs the collection, processing, and protection of personal data when you use the online booking platform LetzBookit.com, book flights, hotels, travel packages, or visa services, or interact with our travel agency desk in the Grand Duchy of Luxembourg. The company operating LetzBookit.com and acting as the Data Controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Luxembourg Law of 1 August 2018 is Travel Pro S.A., legally represented by Gianni Pietrangelo:

2 European Data Hosting & Cloud Infrastructure — OVHcloud (Art. 28 GDPR)

In accordance with the principles of data sovereignty, security by design, and Article 28 of the GDPR, the LetzBookit.com web platform, application environment, and associated databases are hosted within the European Union by our appointed infrastructure processor:

OVHcloud acts strictly as a Data Processor under a binding GDPR Data Processing Agreement (Art. 28 GDPR) on documented instructions from Travel Pro S.A. OVHcloud does not access, use, or monetize customer data for its own purposes, and all hosting infrastructure is physically located within European Union member states.

3 Categories of Personal Data Processed (Art. 13(1) & Art. 14(1)(d) GDPR)

Depending on the travel services you request (flight search, ticket issuance, hotel reservation, tailor-made travel package, visa application, or customer assistance), Travel Pro S.A. collects and processes only data that is adequate, relevant, and limited to what is necessary (data minimization under Art. 5(1)(c) GDPR):

• Identification & Contact Data: Civility/title, first name(s), last name(s) (matching official travel documents), postal/billing address, email address, and telephone number.
• Passenger Name Record (PNR) & Itinerary Data: Booking reference (PNR), airline ticket numbers (e-tickets), origin/destination airports (`DEP`/`ARR`), travel dates, cabin class (`Economy`, `Premium Economy`, `Business`, `First`), hotel check-in/check-out dates, room occupancy, frequent-flyer program numbers, and promotional codes.
• Mandatory Regulatory Travel Data (API — Advance Passenger Information): Date of birth, nationality, gender, passport or national ID card number, country of issuance, and document expiration date, where legally required by airlines and destination border authorities (Council Directive 2004/82/EC and Directive (EU) 2016/681).
• Accompanying Travelers' Data: Where you make a reservation on behalf of other adults, youths, children, or infants, you confirm that you are authorized to provide their booking details and have informed them of this Privacy Policy.
• Special Categories of Data (Art. 9 GDPR — Strictly Conditional): Information concerning reduced mobility or wheelchair assistance (IATA SSR codes `WCHR`/`WCHS`/`WCHC`), medical clearance to fly (`MEDA`), or specific dietary preferences (`VGML`, `MOML`, `KSML`) is processed exclusively when voluntarily provided by you to fulfill your specific travel assistance request, based on your explicit consent (Art. 9(2)(a) GDPR).
• Financial, Invoicing & Transaction Data: Payment status, billing invoices, partial masked payment card digits, and encrypted transaction tokens. Online card payments are processed via PCI-DSS Level 1 certified payment gateways; Travel Pro S.A. never stores raw security codes (CVV/CVC).
• Assistance & Communication Data: Inquiries submitted through our online Assistance form (`#assistance`), email exchanges (`info@letzbookit.com` / `assistance@letzbookit.com`), and phone support with our Luxembourg travel desk.
• Technical, Security & Browsing Data: IP address, browser language, timestamp, anti-bot security verification tokens, local storage search parameters, and Cookiebot consent identifier.

4 Purposes, Legal Bases (Art. 6 & 9 GDPR), and Statutory Retention Periods

Travel Pro S.A. processes your personal data only where a specific lawful basis under Article 6 (and, where applicable, Article 9) of the GDPR applies, and retains it strictly for the periods mandated by Luxembourg and European law:

5 Recipients, Processors (OVHcloud, Aaron Group, Amadeus GDS) & Travel Suppliers (Art. 13(1)(e) GDPR)

Travel Pro S.A. never sells, rents, or trades your personal data to third parties. Access to your personal data is strictly limited to authorized IATA-trained staff of Travel Pro S.A. in Luxembourg and the following categories of recipients strictly necessary to deliver your travel services:

• Cloud & Hosting Sub-Processor (EU): OVH SAS (OVHcloud) (2 rue Kellermann, 59100 Roubaix, France), providing sovereign European web and database hosting under an Article 28 GDPR Data Processing Agreement.
• Online Booking Tool (OBT) Technology Provider (Art. 28 GDPR Processor — EU): Aaron Group (Aaron Group s.r.o., European travel technology provider), acting as the appointed technology provider that develops, operates, and maintains the LetzBookit online booking engine (tickets.letzbookit.com) on behalf of Travel Pro S.A. under a binding GDPR Data Processing Agreement.
• Global Distribution System (GDS — EU): Amadeus (Amadeus IT Group, S.A., Salvador de Madariaga 1, 28027 Madrid, Spain — European Union), acting as the official Global Distribution System (GDS) used by Travel Pro S.A. to query real-time flight and hotel availability, manage Passenger Name Records (PNR), and issue IATA electronic tickets in compliance with European data protection standards.
• Airlines, Hotels & Travel Suppliers (Independent Data Controllers): When you book a flight (across 500+ IATA and low-cost airlines), a hotel (across 1,000,000+ properties), or a visa/ESTA service (`visas.letzbookit.com`), the relevant carrier or accommodation provider receives the passenger/guest details strictly required to honor your reservation. Each airline or hotel processes your data in accordance with its own privacy policy and applicable aviation/hospitality laws.
• Consent Management Provider (EU): Cybot A/S (Usercentrics / Cookiebot), Havnegade 39, 1058 Copenhagen, Denmark, managing GDPR/ePrivacy cookie consent logs.
• Payment Service Providers, Insurers & Competent Authorities: Accredited banks, PCI-DSS payment processors, travel insurance providers (when selected), and Luxembourg or international customs/aviation authorities where disclosure is mandated by law.

6 International Transfers of Personal Data Outside the EEA (Chapter V GDPR)

All primary hosting, booking engine technology, GDS processing, and administration of LetzBookit.com take place within the European Economic Area (EEA) — specifically in the Grand Duchy of Luxembourg (Travel Pro S.A. headquarters) and within the European Union through OVHcloud (hosting infrastructure), Aaron Group (OBT technology provider), and Amadeus (GDS).

However, due to the global nature of international aviation and hotel bookings, if you book a flight or accommodation in a destination located outside the EEA (for example in the United States, United Arab Emirates, United Kingdom, Canada, Brazil, China, India, Argentina, South Africa, or Japan), your booking and PNR/API data must be transmitted to the operating airline, destination hotel, or border authority in that third country. Such transfers are carried out in strict compliance with Chapter V of the GDPR (Articles 44–49) on the basis of:

• European Commission Adequacy Decisions (Art. 45 GDPR): Transfers to countries or frameworks recognized by the European Commission as providing an adequate level of data protection (including the UK, Switzerland, Canada, Japan, Argentina, and certified organizations under the EU-U.S. Data Privacy Framework);
• Appropriate Safeguards & Standard Contractual Clauses (Art. 46(2)(c) GDPR): Standard Data Protection Clauses adopted by the European Commission and IATA contractual frameworks; or
• Necessity for the Performance of Your Travel Contract (Art. 49(1)(b) & (c) GDPR): Where the transfer to a non-EEA airline or hotel is objectively necessary to execute the international travel booking requested by you.

7 Technical & Organizational Security Measures & Data Breach Notification (Art. 32–34 GDPR)

Travel Pro S.A. and its hosting provider OVHcloud implement state-of-the-art technical and organizational measures pursuant to Article 32 GDPR to guarantee a level of security appropriate to the risk:

• Encryption in Transit & Infrastructure Hardening: Full HTTPS/TLS encryption across all LetzBookit.com pages and booking forms, HSTS, Content Security Policy headers, anti-DDoS protection, and isolated EU server environments at OVHcloud.
• Access Control & Confidentiality: Strict role-based access control (RBAC) ensuring only authorized Travel Pro S.A. travel agents can access booking files, bound by contractual confidentiality obligations.
• Personal Data Breach Procedure (Art. 33 & 34 GDPR): In the event of a personal data breach likely to result in a risk to your rights and freedoms, Travel Pro S.A. will notify the Commission Nationale pour la Protection des Données (CNPD) without undue delay and, where feasible, within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
• No Automated Decision-Making (Art. 22 GDPR): Travel Pro S.A. does not subject users to any automated decision-making, including profiling, that produces legal effects or similarly significantly affects them.

8 Cookies, Local Storage & ePrivacy Compliance (Luxembourg Law of 30 May 2005)

In compliance with the amended Luxembourg Law of 30 May 2005 on the protection of privacy in the electronic communications sector and CNPD guidelines on cookies and other trackers, LetzBookit.com uses Cookiebot by Usercentrics (`cbid: 4d52cdd8-27eb-4b26-b54e-3604a1393adf`) to obtain and record your prior informed consent before placing any non-essential cookies:

• Strictly Necessary Cookies & Local Storage (Always Active): Essential for technical navigation, security, storing your cookie consent state (`CookieConsent`), and temporarily keeping your selected departure/arrival airports and travel dates in your browser's `localStorage` so you do not have to re-type them during your session.
• Preferences / Functional Cookies (Subject to Consent): Allow the website to remember enhanced interface settings and regional preferences.
• Statistics & Marketing Cookies / Third-Party Embeds (Subject to Explicit Consent): Used only if you explicitly accept them in the Cookiebot banner. You may review, change, or withdraw your cookie consent at any time using the button below:

9 Your Rights under GDPR (Articles 15–22) & Supervisory Authority in Luxembourg (CNPD)

Under Regulation (EU) 2016/679 (GDPR) and the Luxembourg Law of 1 August 2018, you may exercise the following fundamental rights at any time, free of charge:

• Right of Access (Art. 15 GDPR): Obtain confirmation as to whether personal data concerning you is being processed and receive a copy of such data together with statutory processing information.
• Right to Rectification (Art. 16 GDPR): Request the immediate correction of inaccurate personal data or the completion of incomplete data.
• Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): Request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent, subject to mandatory statutory retention obligations (such as the 10-year accounting retention under Luxembourg law).
• Right to Restriction of Processing (Art. 18 GDPR): Request the temporary restriction of processing while accuracy or legitimate grounds are verified.
• Right to Data Portability (Art. 20 GDPR): Receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or request its transmission to another controller.
• Right to Object (Art. 21 GDPR): Object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR), and object unconditionally to any processing for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.