Privacy notice
This notice explains which personal data KitClaim processes, for what purpose, on which legal basis and for how long. In short: the flight check runs in your browser, we set no cookies, payments go through Stripe, emails through Mailjet, and your case data is used solely to produce your kit and remind you of deadlines. KitClaim is operated from Germany, so the GDPR applies to everyone who uses it; UK and Canadian users have equivalent rights under the UK GDPR and PIPEDA.
1. Controller
WU Socialmedia GbR
Bonländer Hauptstraße 34
70794 Aichtal
Germany
Email: [email protected]
2. Hosting and connection data
The website, its logic and the database run on Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA; EU establishment Cloudflare Germany GmbH, Munich) using Cloudflare Pages, Workers and D1. When you visit, Cloudflare processes technically necessary connection data (IP address, time, requested address, browser identifier, country of origin) to serve the page, block attacks and diagnose errors. We ourselves do not store your IP address. A data processing agreement is in place with Cloudflare; transfers to the USA are covered by the EU standard contractual clauses and Cloudflare’s certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, fast operation).
3. Flight check
Your inputs in the check (airports, airline, date, optional flight number, type of disruption, status of your claim, reason given by the airline) are evaluated in your browser. To measure and improve the service we send an event with these inputs and the result to our server and store it together with a random session identifier, the page path, the referring page, campaign parameters from the address bar (UTM) and the country Cloudflare derives from your IP address. This record contains no name, email or IP address. Legal basis: Art. 6(1)(f) GDPR. You may object (contact below); because the event cannot be linked to a person, individual events cannot be identified and deleted afterwards.
The session identifier and UTM parameters are kept in your browser’s sessionStorage and deleted when you close the tab. Your choice in the notice banner (section 8) is kept in localStorage. We set no cookies. Legal basis for this storage: § 25(2) no. 2 TDDDG (German implementation of the ePrivacy rules) where strictly necessary for the service you requested, otherwise Art. 6(1)(f) GDPR.
4. Ordering and producing your kit
When you order a kit we process the email address from the Stripe checkout and the details you enter in the kit after payment for the letter: name, postal address, optional phone, booking reference, flight data, number and names of co-passengers, times, date of your first claim, the airline’s reference, optionally the airline’s rejection text and optionally your bank details for the airline’s payout. From this we generate your letter, form text, evidence pack, airline guide and escalation plan and keep them available under a personal link. We also store the calculated assessment, the evidence retrieved, order time, price, currency, language, the country derived from your IP address and the campaign parameters of your visit. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Evidence from third-party sources. For the evidence pack we automatically query: weather reports (METAR) for your flight day from the archive of Iowa State University (Iowa Environmental Mesonet, USA), air traffic control data from Eurocontrol (held as a copy in our database, no external request) and, if you entered a flight number, flight status data from AeroDataBox (api.aerodatabox.com). Only airport code, date and flight number are transmitted, no personal data.
Payment. Payment is processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe receives your email address, the amount, the order reference and the payment details you enter directly with Stripe. We receive no card data, only the payment status, payment method type and a transaction reference. Stripe is independently responsible for fraud prevention and payment processing; see stripe.com/privacy. Legal basis: Art. 6(1)(b) GDPR.
5. Emails: kit link, deadline reminders, replies
After purchase we email you the access link to your kit. If you update the status of your claim in the kit (“letter sent”, “rejected” etc.), we send up to three reminders: when the kit has not been sent after three days, when the 14-day deadline from your letter expires, and when the ADR scheme or regulator becomes competent. These reminders are part of the service (Art. 6(1)(b) GDPR); you can stop them at any time via the link in every email or by messaging us. Marketing to existing customers is sent only within the limits of § 7(3) UWG (German unfair competition law) and always with an unsubscribe option.
Emails are sent by Mailjet SAS (4 rue Jules Lefebvre, 75009 Paris, France, part of the Sinch group) as our processor. Mailjet processes recipient address, subject, content and delivery logs; we have disabled open and click tracking. If you reply to one of our emails we process your message to handle your request (Art. 6(1)(b) or (f) GDPR).
6. Retention
| Data | Period |
|---|---|
| Anonymous flight-check events | 24 months |
| Orders with case data and kit | 3 years from purchase (kit access, money-back guarantee, limitation periods). On request we delete case data earlier once you have saved your kit. |
| Abandoned orders without payment | 30 days |
| Invoice and payment records | up to 10 years (German tax and commercial law), mostly held by Stripe |
| Email delivery logs at Mailjet | Mailjet’s standard periods, at most 12 months |
| Correspondence | until resolved, at most 3 years |
7. Recipients and international transfers
Recipients are the service providers named above: Cloudflare (hosting), Stripe (payment), Mailjet (email) and the data sources Iowa State University and AeroDataBox (flight data only, no personal data). We do not pass anything to airlines, ADR bodies or other third parties; you send the documents yourself. Where data reaches the USA (Cloudflare, Iowa State University) this relies on Art. 46(2)(c) GDPR (standard contractual clauses) or Art. 45 GDPR (EU-US Data Privacy Framework where the provider is certified). Only we can access order data, through a password-protected admin area.
8. Marketing services only with consent
We may use advertising pixels from Reddit (Reddit, Inc., USA / Reddit Ireland Ltd.) or Google Analytics (Google Ireland Ltd.) to measure the effect of ads. Such services load only if you agree in the notice banner; they then set cookies and transmit usage data to the provider, including to the USA. If no banner is shown, no such service is active. Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). To withdraw: delete the site data for kitclaim.com in your browser and the banner will appear again.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future. An email to [email protected] is enough for any request. You may also lodge a complaint with a data protection authority, for example the authority of the German state where we are established or the authority where you live (in the UK the ICO, in Canada the OPC).
10. Obligation to provide data, automated decisions
The flight check requires no personal data. For the letter we need at least your name and address, otherwise it contains placeholders. The success estimate is an automated evaluation of your inputs against fixed rules; it is for your information only and has no legal effect on you (not a decision within the meaning of Art. 22 GDPR).
11. Changes
We update this notice when the service or the law changes. The version published here applies.
Last updated: 31 October 2026