Privacy policy

Controller

AMREXO s. r. o., Perličková 12490/17, 821 06 Bratislava – Podunajské Biskupice, Slovakia, Company ID (IČO) 57338159. Contact for all privacy matters: [email protected].

What we process

• Account: e-mail address and, if you set one, a password (stored only as a salted hash). If you order without registering, we create an account for your e-mail so you can sign in later with a one-time e-mail link. If you sign in with Google, we receive only your verified e-mail address and a Google account identifier.
• Flight orders: passenger title, name, gender and date of birth, contact e-mail and phone, route and dates, the reservation details (PNR, airline, flights) and a payment reference.
• Hotel orders: guest names, the guest's nationality (hotels price rates by it), contact e-mail and phone, destination, dates and the reservation details.
• Appointment date (optional): the date your reservation must be valid.
• Saved travellers (optional): the details above plus nationality and, if you choose, a passport number and its expiry.
• Technical data: IP address, used briefly in memory to limit abuse, and standard server logs. When you choose a password, its first five hash characters are checked against the Have I Been Pwned breach list; the password itself never leaves our server.
• Visit statistics (if enabled): aggregated page views counted by our own Umami instance without cookies and without storing your IP address.

Passenger and guest details in orders and passport numbers are stored encrypted.

Why, and on what legal basis

• Creating, renewing and delivering reservations, and customer support — performance of the contract (Art. 6(1)(b) GDPR).
• Accounting and tax records — legal obligation (Art. 6(1)(c) GDPR).
• Protecting the service against fraud and bots — our legitimate interest (Art. 6(1)(f) GDPR).

Who receives the data

• Safeonward or Duffel Technology Ltd (United Kingdom) for flights, and for hotels RateHawk / Emerging Travel Group or Hotelbeds (HBX Group), together with the airline or hotel concerned, which may be located outside the EEA — the transfer is necessary to create the reservation you ordered (Art. 49(1)(b) GDPR).
• Stripe for card payments; where you pay in cryptocurrency, NOWPayments or Coinbase Commerce. We never see your card number.
• Cloudflare for network protection and the Turnstile anti-bot check.
• Google, only if you choose to sign in with Google.
• Brevo (Sendinblue, France) delivers itineraries and sign-in links. It adds a small invisible image to each message, so it records whether and when an e-mail was opened. We do not use that information and you can ignore it: most mail apps block these images by default, and blocking them does not affect your reservation in any way.
• Trustpilot A/S (Denmark) receives your e-mail address when your order closes, so that it can invite you to review us. It is sent your address, the booking reference and the route — never traveller names, dates of birth or the itinerary PDF. Writing a review is entirely your choice, and you can ask us at [email protected] to stop sending these invitations.
• Sentry (if enabled) for error reports, configured not to send IP addresses, cookies or form contents.
• Hetzner Online GmbH (Germany) for hosting and WebHouse (Slovakia) for e-mail.

How long we keep it

• Closed flight and hotel orders are deleted 365 days after they were created.
• Your account and saved travellers are kept until you ask us to delete them.
• Invoices and other accounting records are kept for 10 years as required by the Slovak Accounting Act (No. 431/2002 Coll.).

Cookies

We use only cookies necessary for the site to work: your sign-in session, your language choice and, for staff, the admin session. We do not use analytics or advertising cookies.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Write to [email protected]. You may also lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.