Handling your personal data responsibly matters to us. This privacy policy explains which personal data we process, why we need it, which service providers we use and which data protection rights you have.
Boardingoff is currently in a free trial phase. We help travellers discover suitable destinations and receive personalised travel suggestions. In doing so, we use digital technologies and artificial intelligence.
Personal data is processed in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the applicable provisions of the Austrian Telecommunications Act 2021 (TKG 2021).
● 01
Controller
The controller responsible for the processing of personal data is:
Sandro TafernerBoardingoff – private development and test project1020 ViennaAustria
You can contact us by email at any time with questions about data protection or to exercise your rights.
● 02
Which personal data do we process?
Depending on how you use Boardingoff, we process different data. This includes in particular:
Contact and communication data
Name
Email address
Phone number, if provided
Content of your messages and requests
Travel-related information
Preferred travel period
Preferred departure airport
Travel budget
Desired trip length
Destinations and travel interests
Number of travellers
Other travel preferences you choose to share
Technical and usage information
IP address
Browser and device information
Time and duration of website visits
Pages viewed
Cookie IDs and comparable online identifiers
Website interactions, where the relevant features are enabled
Interactions with our emails
We use this data exclusively for the purposes described in this privacy policy and on the basis of the applicable legal provisions.
● 03
Free travel research and personalised travel suggestions
As part of an early trial phase, Boardingoff offers free, personalised travel research.
When you submit a travel request, we use your information to research suitable destinations, flight connections, accommodation and travel options. In particular, we take into account your available dates, your budget and your personal travel preferences.
We then put together a selection of suitable travel suggestions, which you receive by email or, if you prefer, via WhatsApp.
Purposes of processing:
Receiving and handling your travel request
Researching and comparing travel options
Creating personalised travel suggestions
Communicating with you about follow-up questions
Sending you your travel recommendations
Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary to provide the free service you requested.
The data required for processing is needed so that we can handle your travel request meaningfully. Any additional information is voluntary.
The travel suggestions are non-binding. Any bookings are made independently with the respective travel providers.
● 04
Website hosting via Shopify
We use Shopify to operate our website and provide website features.
Service provider: Shopify International Limited, Ireland, and, where applicable, other Shopify group companies involved.
Shopify provides the technical platform on which our website runs. In the course of its use, technical access data, device information, cookie data and information submitted through website forms may in particular be processed.
Purposes of processing:
Technical provision of the website
Displaying website content
Providing forms
Managing website features
Ensuring security and stability
Legal bases: Art. 6(1)(f) GDPR for secure technical operation and Art. 6(1)(b) GDPR, insofar as the processing is necessary to provide a requested service.
Where Shopify processes personal data for its own purposes, the provider's privacy information also applies.
Personal data may also be processed with the involvement of service providers outside the European Economic Area.
We use https://instant.so to design our website and provide form features.
Service provider: Instant Commerce B.V., Netherlands.
instant.so enables us to create and manage landing pages and to embed forms on our website. When these features are used, technical access data and information entered into forms may be processed.
Purposes of processing:
Designing and displaying our website
Providing form features
Technical processing of form submissions
Ensuring functionality
Legal bases: Art. 6(1)(f) GDPR for the technically necessary provision of the website and Art. 6(1)(b) GDPR, insofar as form data is required to handle a requested travel service.
We use Supabase to store and manage travel requests.
Service provider: Supabase Pte. Ltd., Singapore.
In our Supabase database we store in particular:
Contact details
Individual travel requests
Travel preferences
Information on the handling of travel requests
Our database is operated in a European server region.
The selected database region applies primarily to where the data is stored. Depending on the services provided, processing by the provider or its sub-processors outside the European Union may nevertheless take place.
Purposes of processing:
Storing incoming travel requests
Managing and processing user data
Providing the information required for travel research
Ensuring technical functionality
Legal bases: Art. 6(1)(b) GDPR for handling your travel requests and Art. 6(1)(f) GDPR for the necessary technical safeguards.
Boardingoff uses AI technologies from OpenAI, in particular ChatGPT, to support travel research.
Service provider: OpenAI Ireland Limited, Ireland, or the OpenAI entity responsible for the product used.
The AI helps us analyse travel information, compare travel options and prepare personalised recommendations. For this purpose we use in particular the following information:
Travel period
Budget
Preferred departure airports
Destinations
Travel interests
Other preferences relevant to the research
We do not transmit test users' names, email addresses or phone numbers to ChatGPT. We limit the information transmitted to the travel parameters required for the respective research.
Even data without direct identifiers may qualify as personal data under data protection law if it can still be linked to a specific person.
Purpose: Supporting the research, comparison and creation of personalised travel recommendations.
Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary for the travel research you requested.
Depending on the product used, different data protection and retention terms apply to processing by OpenAI.
AI-assisted travel suggestions are provided for information and to support your decisions. Boardingoff does not make any decisions based solely on automated processing on their basis that produce legal effects concerning you or similarly significantly affect you.
Email marketing, newsletter and tracking with Klaviyo
We use Klaviyo to manage email contacts, send messages and analyse website and email interactions.
Service provider: Klaviyo, Inc., USA.
The following data may be processed:
Name and email address
Sign-up information
Consent status
Time of subscription and unsubscription
Sending and delivery information
Email opens and clicks
Information about website visits
Usage behaviour and interactions with our website
Technical identifiers and cookie data
9.1 Newsletter and marketing emails
If you sign up for our newsletter or marketing information, we use your email address to send you information about Boardingoff, new features, travel inspiration and project news.
Sign-up uses a double opt-in process. After signing up, you receive a confirmation email. Only once you have confirmed your sign-up will you be added to the relevant mailing list.
We record your consent status and the sign-up information required as proof.
Legal basis: Art. 6(1)(a) GDPR (consent).
Signing up for the newsletter is voluntary and is not a requirement for the free travel research.
You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in our marketing emails.
9.2 Analysis of email interactions
We use Klaviyo features to evaluate interactions with the emails we send. In particular, information about email opens, clicked links and related usage activity may be recorded.
This information helps us assess the relevance of our communication and develop our content further.
Legal basis: Where the processing requires consent, it is based on Art. 6(1)(a) GDPR and the applicable rules on the protection of terminal equipment.
Consenting to receive the newsletter does not automatically equal consent to every form of personalised behavioural analysis.
9.3 Website tracking and behavioural analysis
Klaviyo may use cookies and similar technologies to record website interactions and recognise visitors where they can be matched. This may include in particular the __kla_id cookie.
Usage information may be linked to existing contact profiles, for example when a person fills out a sign-up form or opens a corresponding link from an email.
This information may be used to evaluate website visits and improve our communication.
Tracking technologies that are not strictly necessary are only used after prior valid consent.
Legal basis: Art. 6(1)(a) GDPR in conjunction with the applicable provisions of § 165(3) TKG 2021.
Klaviyo may process data with the involvement of other service providers outside the European Economic Area.
We communicate with test users by email and, on request, via WhatsApp.
Email communication
If you send us a message or request personalised travel research, we process your email address and the content of your message.
Purpose: Handling your request, communicating with you and sending travel suggestions.
Legal basis: Art. 6(1)(b) GDPR, insofar as the communication is necessary to provide the requested service. For general enquiries, Art. 6(1)(f) GDPR may apply.
WhatsApp
If you choose WhatsApp as your communication channel, we use your phone number to communicate with you and send you your travel suggestions.
Service provider: WhatsApp Ireland Limited, Ireland.
We currently use the regular WhatsApp application for communication. In the course of its use, phone numbers, message content and technical information may in particular be processed.
WhatsApp processes certain personal data under its own responsibility. Processing by Meta companies or other service providers outside the European Economic Area may take place.
Purpose: Individual communication and delivery of requested travel suggestions.
Legal basis: Art. 6(1)(b) GDPR, insofar as the communication is necessary to provide the service you requested.
Using WhatsApp is voluntary. You can communicate with us by email instead.
We do not use your phone number for additional marketing messages without an appropriate legal basis.
Our website uses cookies and similar technologies. To manage cookie consent, we use the privacy and consent features of Shopify Customer Privacy.
We distinguish between strictly necessary technologies and those that serve in particular analytics, personalisation or marketing purposes.
Strictly necessary
May be used insofar as they are required to deliver our website securely or to enable features you have explicitly requested.
Analytics & marketing
May only be used once the required consent has been given.
This applies in particular to the relevant tracking features of Klaviyo and, where applicable, other integrated services.
You can manage your consent and withdraw it with effect for the future via the cookie and privacy settings available on our website.
Where personal data is processed, this is done on the applicable legal basis under Art. 6 GDPR.
● 12
Data sharing and recipients
We only share personal data if this is necessary to provide our services, if another valid legal basis exists or if we are legally obliged to do so.
The service providers we use include:
Shopify
Website platform and forms
instant.so
Page design and forms
Cloudflare
Technical infrastructure and security
Supabase
Storage and management of travel requests
OpenAI
AI support for travel research
Klaviyo
Email communication, marketing and usage analytics
WhatsApp
Communication at the user's request
Depending on the service and the specific processing operation, the respective providers act as processors or as independent controllers. Where required, cooperation is based on data processing agreements pursuant to Art. 28 GDPR.
Your contact details are not passed on to airlines, hotels or booking providers merely because we suggest their offers to you.
If you book independently through a third-party provider, that provider's privacy information applies.
● 13
International data transfers
Some of the service providers we use are based outside the European Economic Area or use sub-processors in third countries.
This applies in particular to possible processing in connection with Cloudflare, Supabase, OpenAI, Shopify, Klaviyo and WhatsApp.
Where personal data is transferred to third countries, the requirements of Art. 44 et seq. GDPR must be observed.
Depending on the provider and the specific transfer, adequacy decisions of the European Commission or appropriate safeguards such as EU Standard Contractual Clauses may be used.
You can request further information on the safeguards used for the respective transfers at [email protected].
● 14
Retention period
We only store personal data for as long as is necessary for the respective purpose or as long as another legal basis permits or requires storage.
The following criteria apply to the different data categories:
Travel requests and travel preferences
We store this data to carry out the requested travel research and for any necessary follow-up questions. Once processing is complete, we review whether further storage is necessary.
Newsletter data
We generally process your data until you unsubscribe or withdraw your consent. Records proving that consent was given or withdrawn may be kept for longer to the extent legally required.
Communication data
We only store messages for as long as is necessary to handle your request, for further communication or for legitimate legal purposes.
Technical access data
This data is processed in line with the necessary technical and security purposes and the service configurations actually used.
Cookie and tracking data
The retention period depends on the respective cookie, the tracking purpose and the technical settings used.
Personal data is deleted or anonymised as soon as the respective purpose of processing no longer applies and there is no other legal basis for storage.
● 15
Your rights under the GDPR
Subject to the statutory requirements, you have in particular the following rights:
Access Art. 15 GDPR
You can request information about which personal data we process about you.
Rectification Art. 16 GDPR
You can request the correction of inaccurate data.
Erasure Art. 17 GDPR
You can request the deletion of your data where the legal requirements are met.
Restriction Art. 18 GDPR
Under certain conditions, you can request that processing be restricted.
Data portability Art. 20 GDPR
Where the legal requirements are met, you can receive the data you provided in a structured, commonly used and machine-readable format.
Objection Art. 21 GDPR
You can object in particular to certain processing based on legitimate interests.
Withdrawal of consent Art. 7(3) GDPR
You can withdraw any consent you have given at any time with effect for the future.
To exercise your rights, simply send a message to: [email protected]
If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Austria, this is the:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)Barichgasse 40–421030 ViennaAustria
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and unlawful disclosure.
In doing so, we take into account in particular the nature of the data processed, the technical possibilities and the risks of the respective processing.
Despite these safeguards, absolute security cannot be guaranteed for data transmitted over the internet.
● 18
Changes to this privacy policy
Boardingoff is currently in its development and trial phase. Features, technical service providers and processing operations may therefore change.
We update this privacy policy whenever material data processing operations or legal requirements change.