Privacy Notice for EU Users (GDPR)
This notice explains how CashMyFlight processes personal data of users in the European Union, and supplements the Hebrew-language privacy policy.
Controller
CashMyFlight is the controller of the personal data described here. Contact: privacy@cashmyflight.com.
Purposes and legal bases
- Performing the eligibility check and handling your claim — performance of a contract, Art. 6(1)(b) GDPR.
- Service security and integrity — our legitimate interests, Art. 6(1)(f) GDPR.
- Marketing — only with your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time.
Data we process
Flight details, contact details, passenger details, documents you upload, and signature-evidence data (IP address, timestamps).
Recipients
- The airline and its agents — as part of the claim itself.
- The legal advisors handling the case.
- Infrastructure providers (hosting; case documents are stored within the EU).
- Authorities — where required by law.
- Marketing partners — only as described under "Sharing for marketing purposes" below, and only with your consent.
Personal data is never sold.
Sharing for marketing purposes
Only with your explicit, separate and documented consent (Art. 6(1)(a) GDPR — a dedicated checkbox that is never pre-ticked), we may share your contact details and interest data (such as name, email, phone and area of interest — e.g. travel) with business partners in the following categories only: travel, insurance and consumer services, so that they can offer you their products and services.
- We never share for marketing purposes: case documents, information about your legal matter, ID numbers, or bank details — under no circumstances.
- You may withdraw your consent at any time by writing to privacy@cashmyflight.com or via the unsubscribe link in any mailing. Withdrawal takes effect going forward and is propagated to the partners that received the data.
Retention
Case files are kept for 7 years from the closure of the case; inquiries that did not become a case are kept for up to 24 months.
Your rights
Under Articles 15–21 GDPR you may request access, rectification, erasure, restriction of processing and data portability, and you may object to processing. Where processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with your local supervisory authority.