PRIVACY POLICY – FLYJUSTICE OÜ

1. Introduction

At Flyjustice, we recognise that protecting personal data is fundamental to maintaining the trust of the passengers we represent. Whether you visit our website, submit a compensation claim, contact our team, or use our services, we are committed to processing your personal data fairly, securely, and transparently.

This Privacy Policy explains what personal data we collect, how we obtain it, why we process it, who we may share it with, how long we retain it, and the rights available to you under applicable data protection laws. We process personal data only where a valid legal basis exists under Article 6 GDPR and, where applicable, Article 9 GDPR for special categories of personal data.

For a comprehensive explanation of our privacy principles, data protection practices, and your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR), please refer to our GDPR & Data Protection Commitment.

2. Scope of This Privacy Policy

This Privacy Policy applies to all personal data processed by Flyjustice in connection with its website, services, and business operations. It covers personal data collected directly from you, received from authorised representatives or fellow passengers, obtained from airlines or other relevant third parties during the handling of your claim, and collected through your interactions with our website and communication channels.

This Privacy Policy applies whenever you:

• Visit or browse the Flyjustice website.
• Submit, manage, or enquire about a compensation claim.
• Contact us by email, telephone, live chat, or other communication channels.
• Subscribe to newsletters or other communications, where applicable.
• Interact with any service, platform, or feature operated by Flyjustice that refers to this Privacy Policy.

Where additional services are subject to separate privacy notices, those notices will apply alongside this Privacy Policy where relevant.

3. Personal Data We Collect

The personal data we collect depends on the services you request and the stage of your compensation claim. In many cases, we only collect the information necessary to assess your eligibility and manage your claim. Where additional documentation is required, we will request it only when it is relevant and necessary for the services we provide.

The categories of personal data we may collect include:

• Identity and contact information.
• Flight, booking, and travel information.
• Information relating to your compensation claim.
• Payment information required to transfer compensation, where applicable.
• Documents and information you voluntarily provide in support of your claim.
• Technical information generated through your use of our website, including cookies and similar technologies.

We collect only the personal data that is relevant, adequate, and limited to what is necessary for the purposes described in this Privacy Policy, in accordance with Article 5(1)(c) GDPR.

4. How We Collect Personal Data

Flyjustice collects personal data from a variety of sources depending on the services you use and the nature of your compensation claim. In most cases, the information is provided directly by you when you submit a claim, contact our team, upload supporting documents, or otherwise interact with our website and services.

Where necessary, we may also receive personal data from authorised representatives, fellow passengers included in the same claim, airlines, airport authorities, legal representatives, business partners, or other lawful third-party sources to assess, process, and manage your compensation claim.

Where personal data is obtained from sources other than you, Flyjustice will provide the information required under Article 14 GDPR, where applicable, and will process such information only where permitted by applicable law and for purposes compatible with this Privacy Policy.

We may collect personal data when you:

• Submit a compensation claim through our website.
• Upload documents or other supporting information.
• Contact us by email, telephone, live chat, or other communication channels.
• Communicate with us during the handling of your claim.
• Visit or interact with our website.
• Authorise another person to act on your behalf.
• Are included as a passenger in a claim submitted by another authorised individual.

5. Why We Process Your Personal Data

Flyjustice processes personal data only where there is a lawful basis under the General Data Protection Regulation (EU) 2016/679 (GDPR). The legal basis depends on the purpose for which your personal data is processed and the services you request from us.

We process personal data only for legitimate, specific, and transparent purposes and do not use it in a manner that is incompatible with this Privacy Policy. Further information about our privacy principles and commitment to protecting personal data is available in our GDPR & Data Protection Commitment.

6. Sharing Your Personal Data

Flyjustice shares personal data only where it is necessary to provide our services, comply with legal obligations, protect our legitimate interests, or where you have authorised us to do so. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Where third parties process personal data on our behalf, Flyjustice ensures that appropriate contractual and organisational safeguards are in place in accordance with Article 28 GDPR.

Depending on your claim and the services provided, your personal data may be shared with:

• Airlines and their authorised representatives for the purpose of processing compensation claims.
• Courts, regulators, supervisory authorities, or other public authorities where disclosure is required by law.
• External legal advisers, auditors, accountants, or other professional advisers where necessary.
• Payment service providers for the secure transfer of compensation payments.
• Cloud hosting providers, communication platforms, IT service providers, and other technology partners supporting our business operations.
• Other third parties where disclosure is necessary to establish, exercise, or defend legal claims, or where otherwise required or permitted by law.

7. International Data Transfers

As an international business, Flyjustice may transfer or allow access to personal data outside the European Economic Area (EEA) where this is necessary to provide our services, process compensation claims, use trusted service providers, or comply with legal obligations.

Where personal data is transferred internationally, Flyjustice implements appropriate safeguards to ensure that your personal data remains protected in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR). Depending on the circumstances, these safeguards may include adequacy decisions adopted by the European Commission, Standard Contractual Clauses (SCCs), or other lawful transfer mechanisms recognised under Articles 45–49 GDPR.

International transfers may occur when we:

• Work with trusted technology or cloud service providers.
• Communicate with airlines or their authorised representatives located outside the EEA.
• Engage professional advisers or service providers operating internationally.
• Comply with legal or regulatory requirements involving international jurisdictions.

8. Data Retention

Flyjustice retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including the provision of our services, compliance with legal and regulatory obligations, resolution of disputes, prevention of fraud, enforcement of our agreements, and the establishment, exercise, or defence of legal claims.

When personal data is no longer required, it is securely deleted, anonymised, or otherwise disposed of using appropriate technical and organisational measures.

The retention period for personal data depends on factors including:

• The nature of the information collected.
• The purpose for which the data was collected.
• Applicable legal, regulatory, accounting, or tax obligations.
• Ongoing or anticipated legal proceedings.
• Legitimate business requirements.

9. Data Security

Flyjustice takes the security of personal data seriously and implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

While no method of transmitting or storing information can guarantee absolute security, we continuously review and improve our security practices to help protect the confidentiality, integrity, and availability of the personal data entrusted to us, in accordance with Article 32 GDPR.

Our security measures include:

• Secure access controls and authentication mechanisms.
• Encryption and secure data transmission where appropriate.
• Continuous monitoring and security updates.
• Restricted access to personal data on a need-to-know basis.
• Security assessments and operational safeguards designed to protect our systems and services.

10. Automated Decision-Making and Artificial Intelligence

Flyjustice does not make decisions that produce legal or similarly significant effects solely through automated decision-making.

Where automation or artificial intelligence is used to support administrative, analytical, or operational processes, it is implemented only to assist our team and improve service efficiency. Final decisions affecting your compensation claim are reviewed by appropriate personnel and are not based solely on automated processing.

If our use of automated decision-making or artificial intelligence changes in the future, this Privacy Policy will be updated accordingly, and any additional rights available under Article 22 GDPR will be respected where applicable.

Automation may be used to assist with:

• Claim administration and workflow management.
• Document organisation and processing.
• Fraud prevention and security monitoring.
• Website performance and service improvements.

11. Your Privacy Rights

Flyjustice respects your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR). Depending on the circumstances and the applicable legal basis for processing, you may exercise a number of rights in relation to your personal data. We assess and respond to all requests in accordance with applicable data protection laws and the rights provided under Articles 15–22 GDPR.

Where permitted by law, we may request reasonable information to verify your identity before responding to your request. This helps protect your personal data from unauthorised access, misuse, or disclosure.

For additional information about how Flyjustice protects your personal data and applies GDPR principles throughout our services, please refer to our GDPR & Data Protection Commitment.

Subject to applicable law, you may have the right to:

• Request access to your personal data.
• Request the correction of inaccurate or incomplete personal data.
• Request the deletion of your personal data in certain circumstances.
• Request the restriction of processing.
• Object to the processing of your personal data where applicable.
• Request the transfer of your personal data in a structured, commonly used, and machine-readable format.
• Withdraw your consent at any time where processing is based on consent.
• Lodge a complaint with your competent supervisory authority under Article 77 GDPR if you believe your privacy rights have been infringed.

To exercise any of these rights, please contact us using the details provided in the Contact Us section of this Privacy Policy.

12. Cookies and Similar Technologies

Flyjustice uses cookies and similar technologies to ensure the proper functioning of our website, improve user experience, analyse website performance, and enhance the security of our services. Some cookies are essential for the operation of the website, while others are used only with your consent where required by applicable law.

For detailed information about the cookies we use, the purposes for which they are used, and the choices available to you, please refer to our Cookie Policy.

You can manage or withdraw your cookie preferences at any time through your browser settings or our cookie preference tools, where available.

Cookies may be used to:

• Ensure the website functions correctly.
• Remember your preferences and settings.
• Analyse website traffic and performance.
• Improve website functionality and user experience.
• Enhance website security and prevent misuse.

13. Children's Privacy

Flyjustice's services are intended for individuals who are legally capable of entering into binding agreements or who are represented by a parent, legal guardian, or other authorised representative where required by law.

We do not knowingly collect personal data directly from children without appropriate authorisation. If you believe that personal data relating to a child has been provided to us without the necessary legal authority, please contact us using the details provided in the Contact Us section so that we can investigate the matter and, where appropriate, remove the information.

If you become aware that personal data relating to a child has been submitted without appropriate authorisation, please contact us so that we can:

• Review the circumstances.
• Verify the information provided.
• Remove or correct the personal data where required by applicable law.

14. Changes to This Privacy Policy

Flyjustice may update this Privacy Policy from time to time to reflect changes in our services, business operations, legal obligations, or applicable data protection laws.

Where material changes are made, we will revise the Last Updated date shown at the beginning of this Privacy Policy and, where appropriate, provide additional notice in accordance with applicable legal requirements.

We encourage you to review this Privacy Policy periodically. You may also refer to our GDPR & Data Protection Commitment for additional information about our ongoing commitment to protecting personal data.

This Privacy Policy may be updated to reflect:

• Changes in applicable laws or regulations.
• Improvements to our services or website.
• New technologies or security practices.
• Changes to our business operations or data processing activities.

15. Contact Us

If you have any questions about this Privacy Policy, the processing of your personal data, or if you wish to exercise any of your privacy rights, please contact us using the details below. We will respond to your request without undue delay and in accordance with applicable data protection laws.

For additional information about our privacy practices and data protection framework, please refer to our GDPR & Data Protection Commitment.

You can contact us using the following details:

• Privacy Email: privacy@flyjustice.com
• Website: www.flyjustice.com
• Registered Office: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 10151, Estonia

16. Related Policies and Documents

To help you better understand how Flyjustice operates and protects your personal data, we recommend reading the following documents together with this Privacy Policy.

• GDPR & Data Protection Commitment
• Cookie Policy
• Terms & Conditions
• Imprint

17. Version Information

Flyjustice reviews this Privacy Policy periodically to ensure that it remains accurate, transparent, and compliant with applicable legal and regulatory requirements. Any future revisions will be reflected by updating the Last Updated date at the beginning of this Privacy Policy.

• Document: Privacy Policy
• Version: 2.0
• Effective Date: October 2025
• Last Updated: 31 July 2026
• Document Owner: Flyjustice OÜ

© 2025 Flyjustice OÜ. All Rights Reserved.