Download PDF document.
Personal data controller:
Smartwings, a.s., IČ (company ID): 256 63 135, registered office: Praha 6, K Letišti 1068/30, postal code: 160 08 (hereinafter referred to as the “Controller” or “SW CZ”)
and
Smartwings Slovakia, s.r.o.,
registered office Ivanská cesta 30/B, Bratislava 821 04
IČO (company ID): 47 880 627
(hereinafter referred to as “SW SK”)
and
Smartwings Poland Sp. z o.o.,
registered office ul. Gordona Bennetta 2B, Warszawa, 02-159, Poland
REGON: 142926546
(hereinafter referred to as “TVS PL”)
and
Smartwings Germany Gmbh,
registered office Theatinerstraße 23, c/o Baker&McKenzie, 80333 München
Numer der Firma: HRB 221461
(hereinafter referred to as “SW DE”)
(SW CZ, SW SK, SW PL and SW DE are hereinafter jointly referred to as “Joint Controllers” or “SW” and individually as “Each Controller”)
Contact e-mail of the Controller: This email address is being protected from spambots. You need JavaScript enabled to view it.
Data Protection Officer of the Controller SW CZ: This email address is being protected from spambots. You need JavaScript enabled to view it.
Contact details of the Data Protection Officer of SW CZ: This email address is being protected from spambots. You need JavaScript enabled to view it.
Other personal data controllers in Smartwings Group:
Smartwings Hungary Kft.,
registered office: Wesselényi u. 16/A, Budapest, 1077, Hungary
company numer: 01-09-693315
(hereinafter referred to as “SW HU”)
and
České aerolinie a.s.,
registered office: Evropská 846/176a, Vokovice, 160 00 Praha 6
IČO: 457 95 908
(hereinafter referred to as “ČSA”)
In Smartwings Group, SW HU and ČSA have reserved the right to issue and apply their own general principles for personal data processing. These Principles do not apply to them (except for informing the public about joint controlling of certain personal data). SW CZ, SW SK, SW PL and SW DE as well as SW HU and ČSA are Joint Controllers of certain personal data in accordance with Article 26 of GDPR.
These Principles describe the handling of your personal data and constitute a general basis and information source for the processing of your personal data. These Principles contain information for you about the intended purpose of processing, legal ground of processing, restriction of storage of collected personal data and about other important matters. The Principles also contain information about your rights, namely the rights:
If you do not like the way we process your personal data, you may contact us at the e-mail address This email address is being protected from spambots. You need JavaScript enabled to view it. or may lodge a complaint with the supervisory authority, which is:
for SW CZ: Úřad pro ochranu osobních údajů (www.uoou.cz)
for SW PL: Biuro Generalnego Inspektora Ochrony Danych Osobowych, web: http://www.giodo.gov.pl
for SW SK: Úrad na ochranu osobných údajov Slovenskej republiky, web: http://www.dataprotection.gov.sk
for SW HU: Nemzeti Adatvédelmi és Infotmációszabadság Hatóság , web: http://www.naih.hu/
for SW DE: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit , web: http://www.bfdi.bund.de
Unless explicitly set out otherwise below, these Principles apply to Each Controller (do not apply to SW HU and ČSA).
Your personal data are processed for the purpose of providing a transport service, in particular. If we provide a transport service to you, we will keep a part of your personal data on the grounds of your and our judicial protection in relation to your rights from the transport contract and rights to compensation for damage.
Your personal data may also be processed for the purpose of direct marketing of the Controller but only if you give voluntary consent to such processing, which may be withdrawn at any time. The Controller may also use your personal data in relation to direct marketing if the Controller has a legitimate interest to do so.
The Client acknowledges that the Controllers collect the data, some of which are personal data, the Controllers need for the provision of a service and the collection of which is required from the Controllers by the national legislation in the field of civil aviation and PNR:
A) Identification, contact and descriptive personal data under the national legislation in the field of civil aviation:
B) Identification, contact and descriptive personal data that may be collected by the Controllers under the PNR Directive (some data overlap with the data required under the national legislation)
C) Sensitive and descriptive personal data in special cases
C1) The carrier takes care of the well-being and safety of passengers. Details are set out in the Rules of Transport or in Regulation (EC) No. 1107/2006 of the European Parliament and of the Council of 5 July 2006 concerning the rights of disabled persons and persons with reduced mobility when travelling by air. In this context the carrier may refuse to transport persons with health restrictions as defined in the transport terms and conditions and, in such cases, the air carrier shall process the following personal data (information about health restrictions) for a limited period of time:
C2) In the event of contracted transport of injured persons (assistance service) the Controllers may process data on the patient’s diagnosis (as part of securing the transport safety), identification data of the attending physician and the address of the hospital where the patient is treated.
The Client acknowledges that the Controllers may collect personal data that relate to the health of the data subject and that must be collected by the Controllers under Regulation (EC) No. 1107/2006 concerning the rights of disabled persons and persons with reduced mobility when travelling by air. These personal data, which are a special category of personal data, are collected by the Controllers, because such data are necessary for the fulfilment of a legal obligation and are covered by the exceptions from the prohibition of processing that are referred to in Article 9(2) of GDPR. The personal data stated under section C) are erased immediately after the aircraft landing at the target destination.
The Client acknowledges that the Controllers may process the IP address in the event of making a transport contract with a Controller by electronic means of distance communication (online), and your contact data may also be used by the Controllers for commercial communication if the legitimate interests of the Controllers override the Client’s interests.
Your personal data collected by the Controllers for the purpose of fulfilment of obligations under the national legislation on civil aviation and under the PNR Directive shall be destroyed by the Controllers within 24 hours from the aircraft landing, namely those stated in sections A) and B) of article 3 of these Principles, except for the personal data collected by the Controllers on the grounds referred to in the following sentences of this article.
The Controllers shall always keep the following personal data of yours:
on the legal grounds consisting in the legitimate interest in mutual judicial protection and the demonstration of compliance with regulations in the field of civil air transport (e.g. compensation for damage, denied boarding, aircraft safety and balancing, prevention of health risks and terrorist threats).
The Controllers shall also keep the following personal data of yours:
1) date of birth
but only for minors for the purpose of determining their eligibility to a separate seat
2) e-mail address
but only if the ticket is purchased directly from the Controller and is sent by the Controller to the e-mail address or if the e-mail address is used for communication with the data subject
3) banking details
in the event of exercise of passenger’s claims from the air transport within the scope of fulfilment of a legal obligation, or ordering supplementary services
Mutual judicial protection follows from regulations, such as Montreal Convention; Regulation (EC) No. 261/2004 of the European Parliament and of the Council of 11 February 2004 establishing common rules on compensation and assistance to passengers in the event of denied boarding and of cancellation or long delay of flights, or national law in relation to the rights to compensation for damage. These personal data will be kept by the Controllers for 6 years. Afterwards the Controllers will destroy all the personal data.
The Controllers will keep your personal data if you gave your voluntary consent to their processing, for 5 years unless you withdraw your consent earlier.
The Controllers will keep your personal data that are not stated in the preceding sentences of this article (e.g. the personal data you provided to the Controllers in connection with filing a claim for compensation for damage due to cancellation or delay of a flight) for 6 years, provided that they have a relevant purpose for their processing. The legal ground for personal data processing is based by the Controller on the legitimate interest consisting in judicial protection.
The Client acknowledges that the Controllers may transfer obtained personal data, including special categories of personal data, to a Partner of the company but only for a purpose defined in article 2 of these Principles.
Personal data controllers may transfer your personal data to a recipient in a third country, in particular to the airports in the countries of arrival or to the national authorities that fulfil the role of the national aviation authority, or to a Partner of the company in a third country, but only for a purpose defined in article 2 of these Principles.
Transfers of your personal data are subject to appropriate safeguards consisting in an adequacy decision of the Commission (if you fly to a country where adequate protection of personal data is guaranteed according to such a decision) or in international conventions. Other personal data transfers subject to appropriate safeguards are set out in Article 46 of GDPR, and we inform you about them at the contact e-mail addresses of the Controller referred to in the Introduction of these Principles.
Partners of the company mean in particular:
The Client acknowledges that the Controllers may transfer personal data to public authorities for purposes set out by legal regulations.
Your personal data come directly from you if you ordered tickets on our website or in another form (by e-mail, telephone, in writing).
Your personal data come from tour operators, travel agencies or other vendors from which you ordered the transport service.
Your personal data come from the “General Sales Agent” (GSA) of the Controller SW CZ, which is AIR WORLD SERVICE a.s., IČ: 274 36 578, registered office Milady Horákové 382/75, Praha. GSA could obtain personal data in a form similar to the one in which we obtained them.
I.Right to receive basic information about processing – we are obliged to provide you with such information at the time when personal data are collected if they are collected directly from you, and if they are not collected directly from you, then within one month from the collection of the personal data or at the moment of mutual communication if the personal data are used for the purposes of such communication, or at the latest when the personal data are first disclosed if we disclose them to a third party.
II. Right to access to personal data – at your request we are obliged to confirm to you whether we process your personal data and to inform you under GDPR e.g. about the purpose, time of processing, right to erasure, etc. We will also provide you with a copy of the personal data processed, provided that this will not infringe the rights and freedoms of third parties.
III. Right to rectification – if we have inaccurate personal data, we are obliged to rectify or complete them at your request.
IV. Right to erasure – at your request we are obliged to erase your personal data without undue delay in particular if:
Even if you request erasure, we are not obliged to erase personal data in particular on the following grounds:
V. Right to restriction of processing - we are obliged to restrict processing of your personal data if:
At the time when personal data processing is restricted, the Controller may only process such data by storing them, except for a situation when you give us your consent or for the establishment, exercise or defence of legal claims or for the protection of rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The Controller will inform you in advance if the restriction of processing is going to be lifted.
VI. Right to data portability - if we process personal data on the grounds of your consent or on the grounds of a concluded contract and the processing is fully automatic, you may require the Controller to:
VII. Right to object – if we process your personal data on the grounds of a legitimate interest or if we carry out profiling, you may object to such processing at any time. Then we will restrict the processing until everything has been clarified, and if we do not demonstrate compelling legitimate grounds for the processing afterwards, we will no longer process the data. If we use the data for direct marketing, we will stop processing your personal data without further notice after you object.
VIII. Right to protection by national authorities - you have the right to contact the supervisory authority for personal data protection, namely:
for SW CZ: Úřad pro ochranu osobních údajů (www.uoou.cz)
for SW PL: Biuro Generalnego Inspektora Ochrony Danych Osobowych, web: http://www.giodo.gov.pl
for SW SK: Úrad na ochranu osobných údajov Slovenskej republiky, web: http://www.dataprotection.gov.sk
for SW HU: Nemzeti Adatvédelmi és Infotmációszabadság Hatóság , web: http://www.naih.hu/
for SW DE: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit , web: http://www.bfdi.bund.de
In addition, you have the right to a judicial remedy (e.g. petition to initiate proceedings under Section 100 of the Slovak Personal Data Protection Act (zákon o ochrane osobných údajov)). You may lodge a complaint with a supervisory authority or bring an action before a court if you believe that your rights protected by GDPR were infringed in the consequence of processing by the Controllers.
You may exercise your rights against the Controller electronically, in particular, by sending an e-mail to the address: This email address is being protected from spambots. You need JavaScript enabled to view it., or by sending a letter to any address of the controllers referred to on the first page. If you contact us electronically, the Controller will also reply electronically because we like to save our forests. But you may ask us for a different manner of communication.
We will process your requests and will reply to them as soon as possible within the bounds of our capacities and possibilities, being required by GDPR to reply within 1 month from receipt of the request at the latest. This period may be extended by further two months where necessary, taking into account the complexity and number of the requests. However, we will inform you about any extension within one month from the receipt of the request, together with the reasons for the delay.
If we have doubts concerning your identity, we will ask you to provide us with additional information necessary to confirm your identity. The reason is the protection of your data, so that personal data are not given to a person who is not the person they pretend to be.
We handle requests free of charge, but there are certain exceptions:
Notification concerning the Joint Controllers:
SW SK, SW PL, SW DE, SW HU and ČSA are members of the group controlled by SW CZ. These companies have entered into a joint controller agreement concerning certain personal data in accordance with Article 26 of GDPR due to their mutual economic and organizational interconnection in SmartWings Group. For reasons consisting in the pre-flight preparation, flight planning, service provision and client service (e.g. information service, complaints, compensations) these companies share, to a necessary extent, some of the personal data provided or obtained.
Published on 15 February 2020
Smartwings, a.s.
Smartwings Slovakia, s.r.o. Smartwings Poland Sp. z o.o., Smartwings Germany Gmbh
I hereby grant Smartwings, a.s., with the registered office in Prague 6, K Letišti 1068/30, post code 160 08, Reg. No.: 256 63 135, registered in the Commercial Register maintained by the Municipal Court in Prague under the file code B 5332, as a personal data administrator (hereinafter referred to as "Smartwings company”),
my free and voluntary consent to the processing of personal data to the extent of: the email address and, if applicable, any further information that Smartwings has received about me, and will use it to better target its marketing activities according to my needs,
for the purpose of: addressing me with the Smartwings products and services offer, including information about products, services, events, contest, news and holiday wishes.
This consent is granted for the period of 5 years.
I further acknowledge that I can withdraw this consent electronically at any time at the address This email address is being protected from spambots. You need JavaScript enabled to view it. or in writing at the address of Smartwings registered office. I can withdraw my consent even before the expiration of the period for which it was granted. Revocation of the consent is without prejudice to the lawfulness of the processing of personal data prior to withdrawal of consent.
More information on the processing of personal data is provided in the appendix, which forms an integral part of this consent. General information on access to personal data protection is also available at the web site Processing of Personal Data.
By means of this document, we as your personal data administrator - Smartwings, a.s., with the registered office at Praha 6, K Letišti 1068/30, post code 160 08, Reg. No.: 256 63 135, registered in the Commercial Register maintained by the Municipal Court in Prague under the file code B 5332 - provide you the information about the processing of your personal data and your rights relating to the processing in question.
The data processing takes place within the scope of this activity:
Purpose of the data processing: Addressing you with the Smartwings products and services offer, including information about products, services, events, contest, news and holiday wishes.
Description of the data processing purpose: Your personal information is used for informing about Smartwings products, services, competitions, news subscriptions, advertisements, catalogue submissions, or holiday wishes. Some personal information is also used to target the above messages.
Permission to process data: We are entitled to the data processing by the consent to the processing of personal information you have given to us. If you have not given us your consent, we will not process your personal data for this reason.
The categories of personal information we process: Identification data, contact details, descriptive data, business profile, product technical data, business history, family and other persons‘ data, communications, interactions and profiles derived from these data, network identifiers.
Data processing and archiving period: 5 years from the granting of the consent.
Categories of processors or recipients to whom we may provide personal information: Marketing agencies, event agencies, media agencies, distribution network members, server operators, guest management agencies, infoline.
Your personal data may be provided on request to public authorities, in particular to the courts, the Police of the Czech Republic and other law enforcement agencies to the extent necessary and within the limits of the law.
Personal data source: Directly from you.
Transmission of personal data to third countries or to multinational companies:
Within the scope of the aforementioned data processing, your personal data will not be transferred to third countries or other multinational companies.
Automated decision-making based on personal information:
It does not take place within the scope of this data processing. Other Personal data information may be archived in the public interest and used for scientific, historical or statistical research purposes.
You have the following rights in terms of processing of your personal data:
You can use the following contacts to communicate with Smartwings on personal data protection: This email address is being protected from spambots. You need JavaScript enabled to view it.
If you have any questions regarding data protection, you can contact the Smartwings Data Protection Officer at the following email address This email address is being protected from spambots. You need JavaScript enabled to view it.
The main data controller is:
Smartwings, a.s., ID: 256 63 135, registered office: Praha, K Letišti 1068/30, postal code: 16008 (hereinafter referred to as “SW CZ”)
Contact details: This email address is being protected from spambots. You need JavaScript enabled to view it.
Data protection officer: This email address is being protected from spambots. You need JavaScript enabled to view it.
Before we provide you with further necessary information, please be informed how you can refuse the use of cookies in your browser:
The use of cookies may be set through your internet browser. The default setting of most of browsers allows to accept these files automatically. Check the user help to your browser and follow the instructions describing how you can refuse the use of cookies or set the use of selected cookies only. If you want, you can set the browser to inform you if it is sending cookies. In the browser setting you can also manually erase, block or completely prohibit individual cookies or block or allow them only for some websites. Keep in mind, however, that the comfort of the buying process may be considerably reduced if the cookies are disabled.
SW CZ is a company established under the law of the Czech Republic, which established its Slovak subsidiary Smartwings Slovakia, s.r.o., registered office Ivanská cesta 30/B, Bratislava 821 04, registered office Ivanská cesta 30/B, Bratislava 821 04 (hereinafter referred to as “SW SK”), its Hungarian subsidiary Smartwings Hungary Kft., registered office Wesselényi u. 16/A, Budapest, 1077, Hungary (hereinafter referred to as “SW HU”), its Polish subsidiary Smartwings Poland Sp. z o.o., registered office ul. Gordona Bennetta 2B, Warszawa, 02-159, Poland (hereinafter referred to as “SW PL”) and its German subsidiary Smartwings Germany Gmbh, registered office Theatinerstraße 23, 80333 München, Gemany (hereinafter referred to as “SW DE”) (all of them hereinafter jointly referred to as “SW”).
All the above stated companies use their joint website www.smartwings.com – however, the important difference is that SW CZ provides services in the field of civil air transport directly to passengers in the form of regular transport, while SW SK, SW PL, SW HU and SW DE provide aviation services especially through travel agencies in the form of charter flights. Most of the visitors of the websites, i.e. data subjects according to GDPR, are likely to be the customers of SW CZ, so the main controller within this company group is SW CZ. Together with the other aforesaid companies, they are all joint controllers. Joint management of cookies is given by economic reasons – administrative streamlining.
In order to improve the services provided to you, our websites use cookies. Cookies are small text files saving information in your browser at the request of websites and are commonly used to distinguish individual users. Based on the contents, they can tell which pages you have visited, if you have anything in your cart or whether you have been logged in. However, the user is not identifiable from such information. This way, cookies help e.g.:
The cookies used on our website can be divided by the duration and by the purpose into two types. Short-term cookies, which are called “session cookies”, are used for the duration of your visit and are erased several minutes after you leave the website. Long-term cookies called “persistent cookies” stay saved in your device much longer, generally until you delete them.
In terms of the purpose fulfilled, the cookies are classified as:
Some cookies may collect information that is subsequently used by third parties and that e.g. directly support our advertising activities (third party cookies). However, you are not identifiable from such data.
Cookies are processed on the grounds of our legitimate interest associated with the enhancement of the quality of our web presentations, analytical purposes and personalization of advertising – this relates to SW CZ, SW SK, SW PL and SW DE. As far as the Hungarian legislation is concerned, we have received recommendation to process the cookies used for the personalization of advertising only with your consent. So if you are a visitor of our website, and the analysis shows that you are located in Hungary, we will process the concerned cookies only with your consent for the time until you withdraw your consent or prohibit the cookies in your browser. In any case, we will process the cookies only until you prohibit them in your browser.
We are the recipients. Some cookies may collect information that is subsequently used by third parties and that e.g. directly support our advertising activities (third party cookies). However, you are not identifiable from such data.
I. Right to obtain basic information about processing – We are obliged to provide you with such information when obtaining personal data if we have them directly from you, and if the data were not obtained directly from you, then at the latest within one month after obtaining the personal data, or at the moment of mutual communication if the personal data are used for the purposes of such communication, or at the latest at the time of the first disclosure if we are going to disclose the data to a third party.
II. Right to access to personal data – At your request, we are obliged to confirm to you whether we process your personal data and to inform you in accordance with GDPR e.g. about the purpose, period of processing, right to erasure, etc. We will also provide you with a copy of the personal data undergoing processing, provided that this does not result in adverse interference with the rights and freedoms of other persons.
III. Right to rectification – If we have inaccurate personal data, we are obliged to rectify or complete them at your request.
IV. Right to erasure – At your request, we are obliged to erasure personal data without undue delay especially if:
If you request erasure, we are not obliged to erase personal data where the following reasons, in particular, are concerned:
V. Right to restriction of processing – We are obliged to restrict the processing of your personal data if:
Where personal data processing has been restricted, SW may only process such data by storing them, except for the situation when you give us consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural person or legal entity, or on the grounds of important public interest of the Union or of a Member State.
SW will inform you beforehand if the restriction of processing is lifted.
VI. Right to data portability – If we process personal data on the basis of consent or a contract, and the processing is carried out fully automatically, you can request SW to:
VII. Right to object – If we process your personal data on the grounds of a legitimate interest or carry out profiling (for the definition of profiling see art. 9), you may object to such processing at any time. We will restrict the processing until everything is clarified, and if we do not demonstrate compelling legitimate grounds for the processing, we will no longer process the personal data. If we use the data for direct marketing purposes, we will no longer process them without further notice after you lodge your objection.
VIII. Right to protection by national authorities – You have the right to lodge a complaint with the supervisory authority for personal data protection, which is: For SW CZ: Úřad pro ochranu osobních údajů, registered office Pplk. Sochora 27 170 00 Praha 7, website: https://www.uoou.cz/, telephone: fixed landline: +420 234 665 111 (telephone exchange). In addition, you have the right to judicial redress. You may lodge a complaint to the supervisory authority and an action to a court if you believe that your rights protected by GDPR were infringed in the consequence of the processing by SW.
For SW PL: Biuro Generalnego Inspektora Ochrony Danych Osobowych, website: http://www.giodo.gov.pl
For SW SK: Úrad na ochranu osobných údajov Slovenskej republiky, website: http://www.dataprotection.gov.sk
For SW HU: Nemzeti Adatvédelmi és Infotmációszabadság Hatóság, website: http://www.naih.hu/
For SW DE: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, website: http://www.bfdi.bund.de
You may exercise your rights against SW electronically, in particular, by sending an e-mail to the address This email address is being protected from spambots. You need JavaScript enabled to view it. or a letter to the address Na bojišti 1473/18, Nové Město, 120 00 Praha 2, or a letter to the registered offices of the companies SW SK, SW HU and SW DE. If you contact us electronically, SW will also reply electronically. However, you may also request a different method of communication.
We will handle your requests and reply to them as soon as possible, depending on our capacities and capabilities; according to GDPR we are obliged to reply at the latest within 1 month from the receipt of the request. This period may be extended by further two months where necessary, taking into account the complexity and number of requests. However, we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.
If we have any doubts concerning you, we will ask you to provide us with further information necessary to confirm your identity. This is done in order to protect your personal data, i.e. to prevent transfer of personal data to a person who is not who they say they are.
We handle requests free of charge, but there are certain exceptions:
Terms of use of published content on instagram.com/smartwings.official
The administrator of personal data and data administrator, particularly in the form of digital photographs is Smartwings, a.s., reg. ID no. 256 63 135, having its principal office at K Letišti 1068/30, Prague 6, ZIP: 16008, Czech Republic. (hereinafter referred to as the “SW”). To review the privacy policy, including all information about your rights, visit smartwings.com.
Instagram.com privacy policy can be found at facebook.com/help/instagram or help.instagram.com.
Content that we share with your permission is understood as any of the photos or moving images, as well as your Instagram name, surname or username, or other metadata associated with the pictures and moving images (such as information shared with a public circle of users, or tagged users, location notifications, hashtags, etc.).
If your content is chosen to be shared, your approval will be required by using the comment below the image or by sending a message. This consent is valid until your withdrawal.
Content will always be shared with the author's username.
Following this consent, you acknowledge that you are of an age that allows you to grant such permission under the legislation of your country. You agree that we may reproduce, distribute, exhibit and communicate it to the public. We may publicly display photos on any Smartwings social media account or digital platforms (including the Web) for any purpose, including marketing and promotion purposes, for an unlimited time, territory, and quantity. At the same time, consent is a written non-exclusive license to the content and is confirmed by your simple electronic signature, which is your username.
You comprehend that we will not pay you for the use of your content, nor do we have any obligation to use your content. You agree that your content is legal, in your possession and that you have all the rights to share it with us. If your content consists of any content created or owned by someone else, you must have permission to share it with us under these terms. If this is not the case, you are liable for any legal claims or costs incurred.
