Check compensationCheck

Privacy policy

Effective from 10 November 2026. In line with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Hungarian data protection law, this page explains what personal data we process, why, and what rights you have.

By the EU261 Flight Delay editorial team Last reviewed: How we write our guides

In short: EU261 Flight Delay does not ask for or collect personal data from you. There is no registration and no claim form, and the compensation checker runs entirely in your browser and sends us nothing. What we do process: the technical server logs of our hosting provider, cookie-based analytics that only runs with your consent, our own cookieless visitor statistics, and the e-mails you send us. If you enter data on the AirHelp website, AirHelp is the controller of that data, not us.

1. The controller

WeOnline Kft.
Registered office: Szarvas köz 2., 2626 Nagymaros, Hungary
Company registration number: 13-09-233671 (Court of Registration of the Budapest Environs Regional Court)
Tax number: 32543395-2-13
E-mail: contact@eu261flightdelay.com

The controller is not required to appoint a data protection officer. For any data protection question you can reach us at the e-mail address above.

2. What we do not collect

EU261 Flight Delay is an information website. We do not run user accounts, a newsletter or a claim submission form, we do not handle compensation claims, and we never ask for boarding passes, identity documents or bank details.

The compensation checker does its calculations in your browser. Your answers only reach us if you ask us to send the result by e-mail (see section 3.5); otherwise we do not store them. We measure how far visitors get in the checker without names or answers (see section 3.2).

3. What data we process and why

3.1. Server logs (technical operation)

  • Data processed: the visitor's IP address, the address of the requested page, the time of the request, the browser type and version (user agent), the referring page and the response status code.
  • Purpose: operating the website securely and without errors, and detecting and preventing abuse (for example denial-of-service attacks).
  • Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR) in operating the service securely.
  • Processor: our hosting provider (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA), which stores the logs on its own infrastructure. Transfers to the United States are based on the EU–US Data Privacy Framework (under which Vercel has been certified since 2024) and the European Commission's standard contractual clauses (Decision (EU) 2021/914).
  • Retention: short, no more than 30 days; after that the logs are deleted or overwritten automatically.

3.2. Our own visitor statistics (without cookies)

  • Data processed: the address of the page viewed, the domain of the referring page and campaign parameters (utm_…), the screen size and the device class derived from it (mobile, tablet, desktop), the operating system and browser type, the country (the IP-based country code supplied by the hosting provider), active time on the page, scroll depth, where you clicked on the page (which element), use of buttons, partner links, the compensation checker and the complaint letter generator – without the data you type in – as well as any script errors and page loading speed.
  • What we do not record: we use no cookies or identifiers stored in your browser for this, we do not store your IP address, and we do not record the content of input fields (name, e-mail address, bank details and so on).
  • Identification: from the IP address and the browser's user agent string we create a one-way hash using a random value that changes every day. The IP address cannot be recovered from it, and the same visitor cannot be linked across different days; within one day it links the pages of a single visit.
  • Purpose: improving the website (which pages and features help, where visitors get stuck), fixing errors, and measuring from which of our pages visitors go on to our partner.
  • Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR). If your browser sends a "Do Not Track" or "Global Privacy Control" signal, the measurement does not run. You can also object by writing to the e-mail address above.
  • Processors: the hosting provider (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA) and the database provider (Neon, Inc.); the data is stored in the European Union (Frankfurt).
  • Retention: detailed click data for up to 180 days, other statistics for up to 400 days; after that they are deleted automatically.

In addition, we use Google Analytics 4 (Google Ireland Limited), only with your explicit consent and with Google Consent Mode; the details are in our cookie policy.

3.3. Session recording (only with consent)

  • What we record: if you allow it in the small bar that appears, we record how you use the site (mouse movement, scrolling, clicks and the visible page content) so that we can see where visitors get stuck. The content of input fields and the complaint letter preview are masked in your browser and are never included in the recording.
  • Legal basis: your consent (Article 6(1)(a) GDPR). We remember your choice in your browser's local storage (jk-replay); you can withdraw it at any time with the button below, without affecting the lawfulness of processing before the withdrawal.
  • Retention: no more than 30 days, after which recordings are deleted automatically.

3.4. Contacting us by e-mail

  • Data processed: your e-mail address, your name (if you give it), the content of your message and any other data you include in it.
  • Purpose: answering your question, comment or error report, and handling press and partnership enquiries.
  • Legal basis: your consent (Article 6(1)(a) GDPR), given by sending the message; for keeping the correspondence after we have replied, the controller's legitimate interest (Article 6(1)(f)) in being able to trace earlier correspondence and deal with possible claims.
  • Retention: one year from the last exchange of e-mails, after which we delete the correspondence, unless a longer period is needed to establish, exercise or defend legal claims.
  • Processor: the provider of the controller's e-mail system.

Please do not send us boarding passes, passport copies, bank details or other claim documents by e-mail: we do not handle claims, we do not need them, and we delete any such data we receive without delay.

3.5. Checker result by e-mail and reminders

This feature is currently switched off: the checker shows the result on screen and we do not collect names or e-mail addresses. If we switch it on, the following applies.

  • Data processed: first name, e-mail address, flight number (if you give it), the answers you gave in the checker (type of disruption, departure and arrival airport, delay band, month of the flight, number of passengers, whether the airline is based outside the EU), the estimated result, the date you filled it in, and whether you asked for reminders.
  • Purpose and legal basis – result e-mail: sending you the result and the claim link at your request; the legal basis is a service provided at your request (Article 6(1)(b) GDPR).
  • Purpose and legal basis – reminders: no more than 2 reminder e-mails (on the 3rd and 10th day), only if you ticked the separate box asking for them; the legal basis is your consent (Article 6(1)(a) GDPR; Section 6 of Hungarian Act XLVIII of 2008 on commercial advertising). You can withdraw your consent at any time with the unsubscribe link in the e-mails or by replying to them.
  • Retention: without reminder consent 30 days, with consent no more than 395 days from the date you filled in the checker; the system then deletes the data automatically. Once you unsubscribe, we send no further e-mails.
  • Processor: Brevo SAS (formerly Sendinblue), 106 boulevard Haussmann, 75008 Paris, France – sending the e-mails and storing the contact data on servers within the European Union. Our web server (the hosting provider) forwards the request.
  • We do not pass any data to AirHelp. The link in the e-mail takes you to the AirHelp website; if you submit a claim there, AirHelp is the controller of the data you enter (see section 4).

4. Third party: AirHelp

When you click one of the partner links on our website, you leave EU261 Flight Delay and go to the AirHelp website. All data you enter there (flight number, name, contact details, boarding pass, bank details) goes to AirHelp only; the controller of that data is AirHelp Germany GmbH (Berlin, Germany). We have no access to this data, and AirHelp does not share personal data with us: in the partner programme statistics we only see the number of claims and the amount of commission, without names.

AirHelp's own privacy policy explains how it processes your data; you can find it on the AirHelp website (via the "Privacy" link in the footer).

When you click a partner link, AirHelp's affiliate system (Post Affiliate Pro) sets a 30-day tracking cookie on AirHelp's own domain. It records the click and our site's identifier so that a later claim can be attributed to the partner programme. This cookie is not set on our domain, and AirHelp's cookie policy applies to it. Details are in our cookie policy.

5. Other recipients and transfers

Apart from the above, we do not disclose or sell personal data to third parties, and we only use it for marketing in the form of the reminders you specifically request under section 3.5. If an authority or court makes a request based on law, we disclose the data required by law. The website's fonts and code are served from our own server; we do not call any external font or content provider.

6. Your rights

Under Articles 15 to 22 GDPR you have the following rights regarding the personal data we process about you:

  • access: to be told whether we process your personal data and, if so, for what purpose, what data and for how long;
  • rectification: to have inaccurate data corrected and incomplete data completed;
  • erasure: if the data is no longer needed, you have withdrawn your consent, or the processing is unlawful;
  • restriction of processing: if you contest the accuracy of the data or the lawfulness of the processing;
  • data portability: to receive data processed by automated means on the basis of consent or a contract in a machine-readable format;
  • objection: to processing based on legitimate interest (server logs, visitor statistics, keeping correspondence), on grounds relating to your particular situation;
  • withdrawal of consent: at any time, without affecting the lawfulness of processing before the withdrawal.

You can send your request to contact@eu261flightdelay.com. We reply without undue delay and in any event within one month of receipt; for complex requests this period may be extended by two further months, in which case we will let you know. For log entries identified by IP address, we may ask you to show that the IP address belonged to you at the time in question.

7. Complaints and remedies

If you believe that the processing of your personal data infringes the GDPR, please tell us first so that we can put it right. You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority competent for us is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) – Hungarian National Authority for Data Protection and Freedom of Information
Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Web: naih.hu

You also have the right to an effective judicial remedy (Article 79 GDPR). Proceedings may be brought before the courts of the member state where we are established (Hungary) or of the member state where you have your habitual residence.

8. Data security

The website is only available over an encrypted (HTTPS) connection. Only the hosting provider and the controller's authorised staff have access to the server logs. Correspondence is kept in a password-protected e-mail account with restricted access.

9. Changes to this policy

We update this policy when the law or our processing changes. The version in force is always available on this page, with its effective date shown at the top. We will announce significant changes (for example a new processing purpose) clearly on the website.

Dated: 10 November 2026