Privacy Policy

PRIVACY POLICY

At fly2sky, we deeply respect your privacy and appreciate the trust you place in us. That’s why we handle your personal data with the utmost care and responsibility whenever you use our website https://fly2sky.aero/ and our career webpage https://www.careers-page.com/fly2sky (both the website and the career webpage referred to the “Sites”).

Through this Privacy Policy (the “Policy”), we aim to clearly explain what personal data we collect when you access and use the Sites, why we collect it, and what rights you have regarding your information. Our commitment is to keep you fully informed and confident that your data is handled securely and transparently.

By accessing or using thе Sites, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with any part of this Privacy Policy, please refrain from using the Sites or providing any personal data.

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be posted on this page with an updated revision date. Continued use of the Sites after such changes constitutes your acceptance of the updated terms.

Data sharing within the Fly2Sky Group:By visiting the Sites and providing personal data, the visitors of the Sites acknowledge and agree that such data may be shared with and processed by companies within the Fly2Sky group for the purposes of service provision, internal administration, customer support, and fulfillment of contractual obligations.

All companies within the Fly2Sky group are committed to processing personal data in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (GDPR), and shall implement appropriate technical and organizational measures to ensure the security and confidentiality of the data.

1. PERSONAL DATA CONTROLLER

The controller responsible for your personal data, as outlined in this Privacy Policy, is FLY2SKY JSC, UIC 207941061, with its seat and management address at 64 Hristofor Kolumb Str., Building A02, office 021, Iskar District, Sofia 1592, Bulgaria (referred to as the “Company,” “Administrator,” “we,” or “our,” as applicable).

If you have any questions or concerns regarding how we process your personal data, you are welcome to contact us directly by sending an email to dpo@fly2sky.aero or by mail to: 16, Lyuben Karavelov Str., ap. 2, Sofia 1142, Bulgaria.

1. PERSONAL DATA

What is personal data?

Personal data is any information relating to an identified or identifiable natural person. Various pieces of information, put together that can lead to the identification of a specific individual, also constitute personal data.

What personal data do we collect?

1. Data provided through the Request a Quote/ Charter & ACMI Enquiry forms available at fly2sky.aero

We collect the following information that you provide to us upon sending an enquiry through these two forms:

• Full name
• Email address
• Phone number
• Company Name
• Country
• Any other information you may consider relevant to the enquiry

1. Data provided by using our contact form

• Full name
• Email address
• Phone number
• Any other information you may consider relevant to the enquiry
• Data provided by registering for our newsletter
• Email address

1. Data provided through our career webpage

• Full name
• Email address
• Phone number
• Resume / CV
• Any other information you provide to us through the career webpage
• PURPOSES ANDBASISFOR PROCESSING. RETENTION PERIODS

To the extent permitted by law, we use your personal data for the following purposes:

• Answering your requests/enquiries

Grounds: your explicit consent to be contacted (Art. 6, para. 1, item “a” GDPR).

Retention period: When personal data is collected solely for the purpose of establishing contact, it is retained for a period of one year after the communication is concluded, unless a longer retention period is required by applicable law (e.g. you execute an agreement with the Company in which case the grounds for processing a different hence the period).

• For recruitment purposes

Grounds: your explicit consent to apply for an open position at the Company or its affiliated companies (Art. 6, para. 1, item “a” GDPR) and our legitimate interest as a company to try to evaluate and hire/place candidates.

Retention period: up to 6 months after the completion of the specific selection procedure for which the data were initially collected.

• Improving our services

We strive to provide you with the best possible experience when visiting the Sites. To achieve this, we may process certain information related to your user behaviour — including data submitted via our contact forms — and invite you to participate in satisfaction surveys following your registration for our newsletter or following contacting us. These surveys may be conducted directly by us or through trusted partners as part of market research or usability studies. Additionally, we may send you educational emails designed to help you get the most out of Sites.

Educational emails may include helpful instructions, usage tips, or information about advanced features. Their sole purpose is to improve your experience and optimize your use of the Sites — they do not contain any marketing content.

Grounds: These activities are carried out based on our legitimate interests (Art. 6, para. 1, item “f” GDPR) in improving our services and ensuring a high-quality user experience, while always respecting and protecting your fundamental rights and freedoms.

If we communicate with you by phone, you will always have the option to decline the recording of the call. Should you choose to opt out, we will only process the information manually recorded by our operators during the conversation.

Retention period: 12 months.

• Direct marketing

By choosing to receive marketing communications — where this option is available within the Sites — you provide your explicit consent to receive promotional messages related to fly2sky services.

You may withdraw your consent at any time by:

• clicking the “Unsubscribe” link included in the marketing messages we send you; or
• contacting us directly using the contact details provided in this Privacy Policy.

Grounds: your explicit consent to receive such communication (Art. 6, para. 1, item “a” GDPR)

Retention period: until you withdraw your consent.

• Protecting our legitimate interests

There may be times when we use or share information to protect our rights and business. These may include:

• measures to protect the Sites and the Sites’ visitors against cyber-attacks;
• measures to prevent and detect fraud attempts, including the transmission of information to competent public authorities;
• measures to manage various other risks.

Grounds: The primary legal basis for these types of processing is our legitimate interest in safeguarding our commercial activities. We always ensure that any measures we take maintain a fair balance between our interests and your fundamental rights and freedoms.

In certain cases, our processing may also be based on legal obligations, such as statutory requirements related to the protection of property and assets, as outlined in the applicable legislation.

Retention period: according to the relevant legal provisions.

1. SENSITIVE DATA

The Company does not process any sensitive personal data of visitors of the Sites. We kindly ask that you do not send or disclose any sensitive information — such as data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, criminal records, or trade union membership — via the Sites or through any other means of communication with us.

1. DATA OF MINORS AND JUVENILE PERSONS

Our Sites are not intended for use by individuals under the age of 18. We do not knowingly collect or process personal data of minors. If we become aware that we have inadvertently collected personal information from a minor without verified parental consent, we will take appropriate steps to delete such data as soon as possible.

We kindly ask parents or legal guardians to contact us immediately if they believe their child has provided personal data through the Sites.

1. HOW WE MAYDISCLOSEPERSONAL DATA

Except as expressly described in this Policy, we do not knowingly disclose any personal data collected or stored through the Sites to third parties without the explicit consent of the individual concerned.

Please note

However, to the extent permitted by applicable law and strictly for the purposes for which the data was originally collected, your personal data may be disclosed to:

• Third-party service providers – we may disclose your personal data to trusted external partners that help us operate and improve the Sites. These service providers perform tasks such as hosting, infrastructure support, data analytics, IT services, and communications (e.g. email). These third parties process your data solely on our behalf, under strict contractual obligations and in compliance with applicable data protection laws.

The service providers we may work with include:

• Verpex – hosting and cloud infrastructure provider (server locations in EU);
• Manatal- recruitment software enabling Human Resources departments and Recruitment Agencies to source and hire candidates (server locations in US);
• [Microsoft] – email delivery service (server locations in EU);
• To a third party in the context of corporate transactions – your personal data may be disclosed as part of a business reorganization, merger, acquisition, joint venture, sale, transfer, or other disposition of all or part of our business, assets, or equity interests. This includes disclosures made in connection with bankruptcy, insolvency, or similar proceedings, where permitted by applicable law.
• Where required or appropriate under the law – we may also disclose your personal data when we believe such disclosure is necessary or appropriate to: a) comply with applicable laws or regulations, including those outside your country of residence; b) comply with lawful requests and legal processes (e.g., subpoenas or court orders); c) respond to requests from public and governmental authorities, including those outside your country of residence; d) protect our operations, rights, privacy, safety, or property, and that of our affiliates, users, or others; e) enforce our terms and pursue available legal remedies; or f) limit any potential damages or liability we may face.
• DATA SUBJECTS RIGHTS
  1. Access to your personal data

You have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, please contact us at dpo@fly2sky.aero.

We will respond to your request free of charge and within one month, in accordance with applicable data protection laws. However, if a request is manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable administrative fee or to refuse the request, as permitted by law.

2. Correction of personal data

If any of the information we hold about you is inaccurate or incomplete, you can ask us to correct or complete it at any time.

3. Your right to erasure or to be forgotten

You can ask us to delete your personal data, but only if:

• It is no longer necessary for the purposes for which it was collected; or
• you have withdrawn your consent (if the data processing is based solely on consent); or
• you exercise a legitimate right to object; or
• it has been unlawfully processed; or
• there is a legal obligation in this regard.

We are not obliged to comply with your request to delete your personal data if the processing is required:

• to comply with a legal obligation; or
• to establish, exercise or defend a legal claim.

There are certain circumstances under applicable law where we may not be obligated to comply with your request to delete personal data. These situations are limited, but they represent the most common reasons why a deletion request might be lawfully denied.

If you wish to request the deletion of your personal data, please contact us at dpo@fly2sky.aero, using the email address associated with you or by otherwise verifying your identity.

Please note that deleting your data is a permanent and irreversible process, including the removal of all associated documents and records. Once deletion is complete, this information cannot be recovered.

4. Restriction of data processing

You have the right to request that we restrict the processing of your personal data, but only in the following circumstances:

• you contest the accuracy of the data, in which case processing will be restricted until we verify its accuracy (see the section on data correction);
• the processing is unlawful, but you prefer restriction over deletion;
• we no longer need the data for the purposes for which it was collected, but you require it for the establishment, exercise, or defence of legal claims;
• you have objected to the processing and we are verifying whether our legitimate grounds override yours.

We may continue to process your personal data during the restriction period only:

• if we have your explicit consent;
• for the establishment, exercise, or defence of legal claims; or
• to protect the rights of the Site owner or another individual or legal entity.
  5. Data portability

You have the right to request that we provide your personal data in a structured, commonly used, and machine-readable format, or that we transmit it directly to another data controller, where technically feasible. This right applies only if:

• the processing is based on your consent or on a contract with you; and
• the processing is carried out by automated means (i.e., not manual processing).
  6. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on our legitimate interests, if you believe that your fundamental rights and freedoms outweigh those interests.

Additionally, you may object at any time to the processing of your personal data for direct marketing purposes. You can do so by following the unsubscribe instructions included in our marketing emails or by contacting us directly at dpo@fly2sky.aero.

7. Making automatic decisions

The controller does not carry out profiling or automated individual decision-making. In the event of a change, you will be expressly notified of this before the change takes effect.

8. Right to file a complaint with the local supervisory authority

If you believe that we are processing your personal data in an unlawful manner, you may contact us at dpo@fly2sky.aero.

You have the right to file a complaint with your local supervisory authority regarding the processing of your personal data.

In Bulgaria, the contact details of the supervisory authority for personal data protection are as follows:

Personal Data Protection Commission

Bulgaria, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Phone: + 359 2 915 35 18

Email: kzld@cpdp.bg

• OTHER INFORMATION

Other information we may collect

“Other information” is any information that does not reveal your specific identity, such as:

• browser and device information, operator, internet connection
• server log information and Sites’ logs
• information collected through cookies, pixel tags and other technologies
• demographic information and other information provided by you
• location information

We may use and disclose Other Information for any purpose, except as required to do otherwise by applicable law. If we are required to treat Other Information as personal data by applicable law, then we may use and disclose Other Information for all purposes for which we use and disclose personal data.

1. DATA SECURITY METHODS

To protect user data from unauthorized or accidental disclosure, we implement reasonable and appropriate technical and organizational measures.

Technical measures: We employ technologies designed to prevent unauthorized third-party access to personal data. As part of our security protocols, we apply encryption to user and end-user data—this includes but is not limited to: all data stored on our servers.

Organizational measures: We have adopted internal policies and procedures that govern how our employees handle personal data. These are part of our internal regulations and are considered confidential for security reasons.

Where servers are hosted in data centres operated by third parties, we ensure that equivalent technical and organizational safeguards are in place and applied by those providers.

Data Storage Location: All personal data is stored on servers located within the European Union.

1. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL ORGANIZATION

All personal data is stored generally on servers located within the European Union. Only information provided through our career page might be transferred to, respectively stored on Manatal’s servers located within the US. Such transfers are conducted in full compliance with Article 46 of the GDPR, based on:

• the use of Standard Contractual Clauses (SCCs) adopted by the European Commission, and/or
• certification under the EU–US Data Privacy Framework, where applicable.

These safeguards are in place to ensure that your data receives an adequate level of protection, even when processed outside the European Economic Area (EEA).

1. THIRD PARTY SITES

The Sites may contain links to websites, mobile applications, and other online services operated by third parties. Please note that this Privacy Policy does not apply to the privacy, data handling, or other practices of such third parties. We are not responsible for the content, security, or privacy practices of any third party, including those whose services are linked to or accessible from within the Sites. The inclusion of a link in the Sites should not be interpreted as an endorsement of the linked website or service by us.

We are also not responsible for the data collection, use, or disclosure practices (including data security measures) of other organizations or platforms—such as Facebook, Apple, Google, Microsoft, or any other application developers, service providers, social media platforms, operating system providers, wireless service providers, or device manufacturers. This includes any personal data you choose to share with such organizations through or in connection with our presence on social media or third-party platforms.

• COOKIEPOLICY

1. What are cookies?

Cookies are small text files that are stored on your computer or mobile device. They are widely used to make websites work or work better and more efficiently. They can do this because websites can read and write these files, allowing them to recognize you and remember important information that will make your use of the website more convenient (for example, by remembering your preference settings).

The Sites automatically identifies the user's IP address. An IP address is a number that is automatically assigned to the user's computer after connecting to the Internet. All such information is recorded in an activity file by the server, which allows subsequent data processing.

2. Whatare scripts?

A script is a piece of programming code that is used to make our Sites function properly and interactively. This code runs on our server or on your device.

3. Whatis a "web beacon"?

A web beacon (or "pixel tag") is a small, invisible piece of text or image on a website that is used to monitor website traffic. To do this, various data about you is stored using web beacons.

4. What cookies do we use?

• “Functional”. The technical storage or access is required to enable specific features that enhance the user experience, such as remembering user preferences or choices. These cookies support the proper functioning of non-essential services explicitly requested by the user, but are not strictly necessary for the operation of the website or for the basic transmission of communications over an electronic communications network.
• “Marketing”. These cookies are used by advertising companies to serve ads that are relevant to your interests. You can always opt-out of using these cookies using the “View Preferences” button on our Sites.

5. Social mediabuttons

On our Sites, we have included buttons for Facebook, X, Line, Whatsapp, Linkedin and Instagram to promote webpages (e.g. “like”, “pin”), subscribe or share on social networks. These buttons work using pieces of code coming from the respective media itself. This code places cookies. These social media buttons also can store and process certain information, so a personalized advertisement can be shown to you.

Please read the privacy statement of these social networks (which can change regularly) to read what they do with your (personal) data which they process using these cookies. The data that is retrieved is anonymised as much as possible.

6. CookieSettings

You can use your internet browser to automatically or manually delete cookies. You can also specify that certain cookies may not be placed. Another option is to change the settings of your internet browser so that you receive a message each time a cookie is placed. For more information about these options, please refer to the instructions in the Help section of your browser.

You can always change the cookie preferences using the “Change Preferences” button on our Sites.

Please note that our Sites may not work properly if all cookies are disabled. If you do delete the cookies in your browser, they will be placed again after your consent when you visit our Sites again.

 

• CHANGES TO THE PRIVACY POLICY

We may update or modify this Privacy Policy at any time. The most current version will always be available within the Sites.

If we make any material changes to the way we process your personal data, we will notify you by displaying a prominent notice within the Sites before the changes take effect. We confirm that such changes will not apply retroactively.

We encourage you to review this Privacy Policy periodically while visiting the Sites, so that you remain informed about how your data is being protected.

Last updated on: 17 June 2025