Privacy Policy | Vimania SE

Data Controller

Controller	[To be configured]
Trading Name	Vimania
Address	España
Contact Email	[Pending]

Data We Process

We operate on a "Privacy First" basis. We do not store sensitive personal data (names, passports, credit cards).

Technical Data (Automatic)

IP address (masked/hashed) - approximate location
Browser type and device - to optimise experience
Pages visited and time spent

Legal Basis: Legitimate Interest (Art. 6.1.f GDPR)

Analytics & Marketing

Google Analytics 4: Anonymous website analytics
Affiliate cookies: Conversion tracking to validate commissions

Legal Basis: Your explicit Consent via Cookie Banner (Art. 6.1.a GDPR)

                 Privacy First: We also use our own analytics system (IA-Tech Analytics) 
                that doesn't require cookies and anonymises your IP.
            

Data We Don't Collect

We don't collect names, emails or contact details (unless you contact us)
We don't store payment data (bookings are made on third-party sites)
We don't create personalised profiles with unique identifiers
We have no access to passport or travel document data

Purpose of Processing

Purpose	Legal Basis	Retention
Show relevant flight deals	Legitimate interest	Active session
Website analytics	Legitimate interest / Consent	12 months
Improve user experience	Legitimate interest	12 months
Marketing (optional)	Explicit consent	Until revoked

Data Sharing & International Transfers

We use third-party tools that may process data outside the EEA (European Economic Area):

Service	Purpose	Location	Safeguards
Google Analytics 4 (Google Ireland Ltd)	Traffic analysis	USA	EU-US Data Privacy Framework
Kiwi.com / TravelPayouts	Affiliate programme	EU (Czech Republic)	Direct GDPR
IA-Tech Analytics (own)	Privacy-first analytics	Spain (Germany server)	Direct GDPR

                 Note on Kiwi.com: We do not share your personal data with them 
                directly. We only redirect you via a tracked link containing technical identifiers 
                (not personal data).
            

We never sell your data to third parties.

Your Rights (GDPR/UK GDPR)

You have the right to:

Access: Know what data we have about you
Rectification: Correct inaccurate data
Erasure: Request deletion of your data
Object: Object to data processing
Portability: Receive your data electronically
Restriction: Limit processing in certain cases

                 To exercise your rights:

                Email [contact email] 
                with your request.
            

You may also lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk

Security

HTTPS encryption across the entire site
Servers located in the European Union
Access restricted to authorised personnel
IP hashing for anonymisation
Regular security updates