Privacy policy
Updated on
Privacy policy
This policy describes how Indemniflight processes your personal data when you use its compensation claim service based on Regulation (EC) No 261/2004, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is:
Indemniflight SAS 52 rue Marcadet, 75018 Paris, France contact@indemniflight.com
For any question regarding your personal data: dpo@indemniflight.com.
2. Data collected, purposes and legal bases
We only collect the data necessary to handle your claim:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Building and handling your claim file (mandate) | Identity (surname, first name, date of birth), contact details, travel data (ticket, booking, flight), identity document, signed mandate | Performance of the contract (Art. 6(1)(b) GDPR) |
| Transferring your compensation to you | Bank details (RIB/IBAN) | Performance of the contract (Art. 6(1)(b) GDPR) |
| Customer support and claim follow-up | Identity, contact details, exchanges with our support team | Performance of the contract (Art. 6(1)(b) GDPR) |
| Transactional emails and reminders related to your claim | Identity, contact details, claim status | Performance of the contract and legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR) |
| Compliance with our legal obligations (accounting, fraud prevention) | Claim file data, bank details | Legal obligation (Art. 6(1)(c) GDPR) |
| Audience measurement and advertising | Browsing data (cookies, see section 6) | Consent required by regulation (see section 6 — Cookies and how to object) |
| Invitations to review our service | Identity, email address | Legitimate interest (Art. 6(1)(f) GDPR) |
We do not sell your personal data.
3. Recipients and processors
Your data is accessible to our authorised internal teams (customer service, legal department, finance department). It is also shared, strictly to the extent necessary, with the following providers and recipients:
| Provider / recipient | Role | Data concerned |
|---|---|---|
| Nextmap | Hosting of our systems (France) | All claim file data |
| Google Workspace (Drive) | Storage of your case documents (back office) | Case documents (ticket, ID, mandate) |
| Zendesk | Customer support tool | Identity, contact details, support exchanges |
| Brevo | Transactional emails and reminders | Identity, contact details, claim status |
| Google (Analytics, Tag Manager, Ads) | Audience measurement and advertising | Browsing data |
| MySendingBox | Postal mail delivery (airlines, customers) | Identity, address, content of letters |
| Zapier | Internal automations | Strictly necessary claim file data |
| Monday.com | Follow-up of claims in the litigation phase | Claim file data |
| iSahit | Assistance with building claim files | Claim file data and documents |
| Partner law firms | Court representation in the litigation phase (recipients) | Complete claim file |
| Trustpilot | Invitations to leave a review | Identity, email address |
The airlines concerned by your claim receive the data necessary to process your request (identity, travel data, mandate).
4. Transfers outside the European Union
Some of our providers (in particular Zendesk, Google, Zapier and Monday.com) may process data outside the European Union. Where this is the case, these transfers are governed by the standard contractual clauses adopted by the European Commission, or any other safeguard mechanism provided for by the GDPR.
5. Retention periods
- Your claim file data (identity, documents, mandate, bank details): for the duration of the mandate, then archived for the applicable statutory limitation periods.
- Prospect data (persons who have not signed a mandate): 3 years after your last contact with us.
- Cookies: up to 24 months (see section 6).
6. Cookies
The website uses the following tools, which set cookies or trackers:
- Google Analytics — audience measurement (site traffic statistics);
- Google Tag Manager — management of measurement tags;
- Google Ads — advertising conversion measurement.
These cookies have a maximum lifespan of 24 months (the _ga audience-measurement cookie). You can object to them at any time:
- by configuring your browser to block or delete cookies;
- by installing the Google Analytics opt-out browser add-on;
- by adjusting your Google ad settings.
7. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your personal data:
- right of access — obtain a copy of the data we hold about you;
- right to rectification — have inaccurate data corrected;
- right to erasure — request the deletion of your data, within the limits of our legal retention obligations;
- right to restriction of processing;
- right to object to processing based on our legitimate interest;
- right to data portability — receive your data in a structured, machine-readable format;
- right to set instructions regarding the fate of your data after your death (under French law).
To exercise these rights, contact us at dpo@indemniflight.com or from your Customer Area. We may ask for proof of identity if there is reasonable doubt about the identity of the requester.
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.
8. Contact
For any question regarding this policy or the processing of your personal data:
- by email: dpo@indemniflight.com
- by post: Indemniflight SAS, 52 rue Marcadet, 75018 Paris, France
Policy last updated on 11 July 2026.