Privacy Policy
Last updated: 29 September 2026
1. Data Controller
The controller responsible for processing personal data on this website is:
essential.aero GmbH
Neuer Wall 80
20354 Hamburg
Germany
Email: fly@essential.aero
Phone: +49 40 334 604 290
2. General Information on Data Processing
Protecting your personal data is important to us. We process personal data in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).
Personal data means any information relating to an identified or identifiable individual.
3. Purposes and Legal Bases for Processing
We process personal data for the following purposes:
a) Website Operation and IT Security
- • Data processed: IP address, date and time, browser information
- • Legal basis: Article 6(1)(f) GDPR
- • Legitimate interest: ensuring the stable and secure operation of the website
b) Contact Inquiries
- • Data processed: name, email address, phone number, and the travel and inquiry details you provide
- • Legal basis:
- - Article 6(1)(b) GDPR (steps taken before entering into a contract)
- - Article 6(1)(f) GDPR for other inquiries; our legitimate interest is responding to your message
c) Contract Performance
- • Data processed: customer details and billing information
- • Legal basis: Article 6(1)(b) GDPR
d) Usage Analytics
We use Google Analytics only with your consent. Further details are provided in Section 6.
4. Hosting
We use the following external providers for hosting and domain management:
- • Vercel (website delivery)
- • Host Europe (domain management)
The server-side application is configured for Frankfurt. Vercel also uses a global content delivery network. Information about data processing is available in the Vercel Privacy Policy.
Legal basis: Article 6(1)(f) GDPR
5. Cookies and Consent Management
We use cookies and similar technologies. When you select a language, the essential_language cookie remembers your choice for up to one year. It is used only to provide the language you requested and does not enable analytics or advertising.
We use Cookiebot by Usercentrics A/S to manage and document your consent. Cookiebot stores your choices in the “CookieConsent” cookie and records consent together with a timestamp and technical evidence. You can change your choices at any time through the Cookiebot settings widget. Further information: Cookiebot Privacy Policy.
The “Statistics” category controls Google Analytics and Vercel Speed Insights. Google reCAPTCHA requires consent to the “Preferences” category and is then loaded when you click the relevant button in the contact form. Without these permissions, the respective services remain disabled. Necessary consent management enables us to meet our obligations to demonstrate consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR); the storage required for this is based on Section 25(2), point 2, TDDDG.
Withdrawal of consent:
You can withdraw your consent at any time through the cookie settings, with effect for the future.
Legal basis:
Section 25 TDDDG and Article 6(1)(a) GDPR
6. Integrated Services
Vercel Speed Insights
With your consent, we use Vercel Speed Insights to measure the technical performance of our website (Article 6(1)(a) GDPR and, where information on your device is accessed, Section 25(1) TDDDG). Performance metrics and the path of the page visited are sent to Vercel. URL parameters and fragments are removed before transmission. These measurements do not capture entries in our contact form.
Google Analytics
Provider: Google Ireland Limited
- • Purpose: analysis of website usage
- • Data: pages visited, usage events, and browser and device information; Google also receives your IP address when a connection is established
- • Legal basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG
Google Analytics is loaded only after you give consent. Without consent, this integration does not send Analytics requests to Google. Cookiebot manages your choices, which you can change through the Cookiebot settings widget. When you withdraw consent, Analytics is disabled and the page reloads.
Contact Form and EmailJS
When you submit the form, your browser sends the contact and travel details you entered, your message, and the reCAPTCHA verification token to EmailJS Pte. Ltd. EmailJS forwards your inquiry to us through our connected email service, Microsoft Outlook. Technical connection data is also processed.
We process this information to respond to your inquiry. Article 6(1)(b) GDPR applies to contract-related inquiries. For other messages, Article 6(1)(f) GDPR applies on the basis of our legitimate interest in answering your inquiry.
EmailJS identifies the United States as its server location and standard contractual clauses as safeguards for European data transfers. Further information: EmailJS Privacy Policy and Microsoft Privacy Statement.
Google reCAPTCHA
We use Google reCAPTCHA to prevent automated inquiries. The check starts only when you select “Load security check” in the form. This establishes a connection to Google, which processes information including your IP address, browser and device information, and interactions to distinguish human users from automated access. Google also sets the “_GRECAPTCHA” cookie for this purpose. Data may be processed in the United States.
You give consent for this security check through the “Preferences” category in Cookiebot (Article 6(1)(a) GDPR and Section 25(1) TDDDG). Alternatively, you can contact us by email or phone without activating the check. You can withdraw this permission through the Cookiebot settings widget. If the check has already loaded, the page reloads to stop it. Any unsent form entries will be lost. We cannot delete cookies on Google domains. You can choose not to activate the check on future visits to the form; you can also send a withdrawal request to fly@essential.aero. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
Information about how the service works and processes data: Google reCAPTCHA. This check is separate from your decision about Google Analytics.
Locally Hosted Fonts
The fonts used on this website are delivered together with the website. The website does not load font files from Google Fonts servers.
External Links and WhatsApp
Our links to WhatsApp and social networks open the services of the respective providers. When you use these links, the provider processes data in accordance with its own privacy notice. You can contact us by email or phone instead.
7. Sharing Personal Data
We share personal data only:
- • with processors in accordance with Article 28 GDPR
- • where required by law
- • to fulfil contractual obligations
8. International Data Transfers
The services listed above may process data outside the EU or the EEA, particularly in the United States. Such transfers are subject to the requirements of Articles 44 et seq. GDPR. Relevant safeguards may include:
- • EU standard contractual clauses (SCCs) and supplementary safeguards where appropriate
- • an adequacy decision; for US recipients, in particular the EU–US Data Privacy Framework where the specific recipient is certified under that framework
9. Retention Periods
We retain personal data only for as long as necessary for the relevant purposes:
- • Contract and billing data: for the performance of the contract and subsequently in accordance with the statutory retention requirements applicable to the type of record
- • Contact inquiries: until the inquiry has been fully handled; beyond that, only where statutory retention obligations or the establishment, exercise or defence of legal claims require it
- • Tracking data: in accordance with the settings of the respective tools
10. Your Rights
You have the following rights:
- • Access (Article 15 GDPR)
- • Rectification (Article 16 GDPR)
- • Erasure (Article 17 GDPR)
- • Restriction of processing (Article 18 GDPR)
- • Data portability (Article 20 GDPR)
- • Objection (Article 21 GDPR)
- • Withdrawal of consent (Article 7 GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority.
11. Requirement to Provide Data
Providing personal data may be necessary:
- • to perform a contract
- • to respond to inquiries
Without this data, we may be unable to provide certain services.
12. Automated Decision-Making and Profiling
We do not carry out automated decision-making within the meaning of Article 22 GDPR.
13. Data Security
We use appropriate technical and organisational measures to protect your data, including:
- • SSL/TLS encryption
- • Access restrictions
14. Personal Data Breaches
Where required by law, we notify the competent supervisory authority of a personal data breach without undue delay and within 72 hours.
15. Updates to This Privacy Policy
We may update this Privacy Policy.
The current version is available on our website.