Privacy Statement Yource B.V. / GmbH

Last updated: November 2026

We think protecting your privacy is important. For you and for us. This privacy statement applies to visitors and users of our websites, to everyone who is in contact with us and to all products and services of Yource B.V. and its affiliated companies and brands (including flight-delayed.com). In this statement you can read which personal data we process, why we do so, on what legal basis, with whom we share data, how long we keep it and what rights you have.

Who is responsible
The controller for the processing of your personal data is Yource B.V. Only if you have visited our German website flug-verspaetet.de is the controller Yource GmbH. 
Yource B.V., P.O. Box 3650, 1001 AL Amsterdam, the Netherlands
Yource GmbH, Rathausstraße 60, 21423 Winsen/Luhe, Germany
For all questions about privacy, you can contact our Data Protection Officer (DPO) at privacy@your-ce.com.

What data do we process?
To provide our services, we process the following personal data that you provide to us yourself:

• Name, address and place of residence;
• Email address and (mobile) phone number;
• Gender, date of birth and place of birth;
• Booking and flight details, including travel route, booking confirmation, ticket, invoice(s) and baggage tag;
• A copy of your identity card or passport;
• Bank account number and financial transaction data (always afterwards, and only if we proceed to a payout of your compensation and our invoicing);
• A signature.

We also process the following data, because the law, an airline, tour operator, reseller or court requires it, and sometimes because this information appears in documents you have provided:

• Your marital status;
• Dietary requirements stated on a travel contract or booking confirmation, including information that may reveal a religion, belief or health condition;
• Medical information, for example when a disruption to your journey is related to an illness or disability and this is or may be relevant to a claim.

Where this concerns special categories of personal data (such as data about health or religion, and a copy of your ID), we process it only because this is necessary and required for the establishment, exercise or substantiation of your legal claim (Art. 9(2)(f) GDPR). A copy of your ID, a power of attorney and travel documents are always required, as otherwise we cannot (and are not permitted to) assist you. They are required under a Communication from the European Commission to air passengers (17 March 2017) concerning the activities of CMCs (Claim Management Companies).

Data of fellow travellers
If you submit a claim for a booking that also includes fellow travellers or minors, we sometimes receive their data through you as a parent, guardian, partner, friend or family member. We process that data only to handle the claim. If you submit a claim on behalf of others as well, make sure they agree to this and point them to this privacy statement. 

If minors travelled with you and we have to enforce your claim through court proceedings, we will also have to request a so-called Machtiging Minderjarige (court authorisation for minors) from the court in the Netherlands. Without that authorisation, a claim cannot be pursued in the Netherlands when we act as authorised representative (under a power of attorney), unless you, your fellow travellers and any minors are officially not resident in the Netherlands.

Copy of identity document
If a copy of your identity document is needed, we strongly advise you to use a copy, app or scan that allows you to mask your national identification number and passport photo (for example the KopieID app of the Dutch government). This prevents identity fraud and protects your privacy. We delete the copy as soon as it is no longer needed for the purpose for which you provided it (after payout by us or a final judgment) and after the period in which you can hold us liable, for reasons we consider valid. All data we receive is very strongly secured and protected and is stored only on servers in Europe.

Overview per member state: Masking information on a copy of your ID
The table below gives the recommended instruction for consumers per member state. Please note: in Germany, France, Austria, Ireland and Hungary the national personal number does not appear on the ID card or passport; there, read this instruction as the document number/serial number or the MRZ to be masked. In Spain and Malta the personal number is the same as the document number, so "masking everything" would in practice make the copy unusable. In those countries, masking part of the number is sufficient.

General recommendation for all consumers in the countries listed: provide the copy in black and white and, if possible, add a watermark.

What we use your data for and on what legal basis
We process your personal data only for the following purposes and on the legal bases stated:

Where we rely on a legitimate interest, we have weighed that interest against your privacy interest. You can object to that processing; see “Your privacy rights” below. We only take decisions with legal effects for you based solely on automated processing where the total length of the delay is concerned. The flight and date you state you did or did not take are compared with the total length of the delay, based on data we purchase. If that delay is less than 3 hours, your claim is automatically rejected.

Statistics, benchmarks and anonymous data
We use data from (closed) claim files to produce statistics, reports and analyses, for example about causes of delays, processing times, success rates and the quality of our services. Where possible, we first process that data so that it can no longer be traced back to you (anonymisation). Turning your personal data into anonymous data is itself also processing of personal data; we base it on our legitimate interest in analysing and improving our services (Art. 6(1)(f) GDPR).

Once data is truly anonymous, it no longer falls under the GDPR and we may use it without any time limit. We carefully assess and document whether data is truly anonymous according to the standards of the European supervisory authorities, and we reassess this periodically. Data that we have only pseudonymised – for example by replacing names with a code or by ‘hashing’ an email address – remains personal data, and this privacy statement continues to apply to it in full.

Use of Artificial Intelligence (AI)
We use AI systems to help you faster and better and to improve our services. For this we use AI services from Anthropic (Claude) and OpenAI (ChatGPT), in each case the business versions, and the AI translation service DeepL. Our own AI assistant “Kate”, whom you may come across in our chat, runs on this technology and has been set up and trained by us based on our many years of experience in claims handling.

AI for support questions
Through our own work and oversight, we have trained an AI agent based on our many years of experience. If you ask us a question – for example via the chat on our website, via WhatsApp or by email – an AI system may be used to recognise your question, prepare an answer or answer you directly. This certainly does not always happen. When you communicate with an AI assistant, we make this clear in the conversation itself. Our AI assistant is called Kate; as soon as Kate is talking to you, you will see this in the conversation. In doing so, the AI system may use the data from your question and, where needed to help you, data from your case file; we do not give the system more data than is needed to answer your question and than you have already provided for processing. Decisions about your claim – such as accepting, pursuing or rejecting it – are always taken by our staff; AI results serve at most as support in the preliminary stage. For example, AI can use our flight data to quickly see whether your claim meets the minimum conditions for a valid claim (a delay of at least 3 hours) and for continuing with a manual review. If the AI assistant cannot help you, you can always ask to speak to a member of staff. You can also reach us by phone. The legal basis for this processing is the performance of our contract with you and, if you are not (yet) a customer, our legitimate interest in efficient and good customer service (Art. 6(1)(b) and (f) GDPR).

AI for translations
We have many international staff members who are native speakers of most languages. Because we handle claims in several countries and languages, we sometimes use the translation service DeepL (DeepL SE, Cologne, Germany) and Claude to translate simple correspondence and explanations. DeepL acts as a processor under a data processing agreement, processes the texts within the European Union and does not use the texts we provide to train its models.

AI for research and analysis
We also use AI in the research and analyses we carry out to improve our services – for example analysing causes of delays, patterns around particular airports or airlines, processing times and the quality of our handling, and evaluating case law and claim outcomes. Where possible, we use aggregated or anonymised data for this, as described under “Statistics, benchmarks and anonymous data”. Insofar as personal data is nevertheless processed, this is based on our legitimate interest in analysing and improving our services (Art. 6(1)(f) GDPR) and subject to the safeguards set out below.

Our safeguards when using AI

• Our AI suppliers Anthropic, OpenAI and DeepL act as processors under a data processing agreement. Your data is not used to train these suppliers’ AI models; this is laid down in the contracts and excluded by default in the business services we use.
• Anthropic and OpenAI process data in the United States; DeepL processes data within the EU. Transfers to Anthropic and OpenAI are covered by the standard contractual clauses (SCCs) adopted by the European Commission, which form part of our agreements with them; see also “Transfers outside the EU”.
• We do not take decisions with legal effects for you based on automated processing; there is always human involvement.
• We only give the AI system the data needed for the purpose; copies of identity documents, powers of attorney, medical attachments etc. are never processed in it.
• Conversation and processing data is stored by our AI suppliers only briefly, in line with the retention periods agreed with them. We store conversations with our AI assistant Kate ourselves as part of your case file, for no longer than needed to handle your question or case and at the latest in line with the retention periods in this statement.
• Staff who work with AI systems are trained and bound by internal rules of use. For example, they are prohibited from using any AI agent or LLM of their own for work purposes. They may only work on laptops authorised, configured and provided by the employer. 

If you have questions about our use of AI, or would like your question to be handled by a member of staff instead of an AI assistant, please contact us using the details at the end of this statement. Your usual privacy rights – including access and objection – apply in full to processing that involves AI.

Who do we share your data with?
We share personal data only insofar as necessary for the purposes described above, with the following categories of recipients:

• Airlines, tour operators and resellers and their representatives: the counterparty with whom we submit your claim.
• Legal partners: lawyers, litigation representatives, bailiffs, aviation economists and courts in the Netherlands and abroad, when a claim is pursued (through the courts).
• IT and hosting providers: our systems and data are hosted by Amazon Web Services EMEA SARL and Google Cloud EMEA Limited, in data centres within the European Economic Area. Both act as processors under a data processing agreement.
• Communication services: for our business email we use Google Workspace (Gmail) from Google Ireland Limited, as a processor under a data processing agreement. Email correspondence about your case may therefore pass through this service.
• Messaging services: for our customer communication via chat, SMS and WhatsApp we use Bird (MessageBird B.V., Amsterdam) as a processor. If you communicate with us via WhatsApp, WhatsApp/Meta also processes data about that messaging as an independent party, in accordance with its own privacy policy.
• Call centre: we use a call centre in South Africa for email support and for completing case files.
• AI service providers: for the AI applications described under “Use of Artificial Intelligence (AI)” we use Anthropic (Claude), OpenAI (ChatGPT) and DeepL (translations), in each case as a processor and in the business version. They do not use your data to train their AI models.
• Internal collaboration and planning tools: our staff and our legal team work with Slack (internal chat) and Asana (work and case planning). Personal data from your case file may appear in these tools insofar as this is necessary for handling your case. Both suppliers act as processors under a data processing agreement. This concerns communication between colleagues only, never with third parties. No non-employees are connected to these communication and planning tools, apart from two self-employed contractors with whom we have a data processing agreement: a legal expert and an aviation economics expert.
• Secure email: to send confidential documents securely (such as court documents and identity documents), our legal team uses Zivver (Zivver B.V., Amsterdam) as a processor; the content is sent encrypted. Zivver is a mandatory tool that must be used between and by law firms, lawyers and courts.
• Accountant and bookkeeping: our external accountant and our bookkeeping firm have access to invoices and payment details as part of the audit of our financial records; these may show your name and the amount paid out.
• Debt collection partners: if you do not pay an invoice for our services despite reminders, we may hand the claim over to a debt collection agency or bailiff. We then provide the data needed to collect the claim.
• Payment service providers and banks: to pay out compensation and process payments we use Adyen N.V. and Stripe (Stripe Payments Europe Ltd, Ireland), in addition to regular bank transfers. Payment service providers partly process your payment details as independent controllers, because they have their own legal obligations (such as anti-money laundering rules); see their own privacy policies for this.
• Advertising and analytics platforms: only with your consent do we share hashed identifiers and conversion data with Google and Meta for audience building, advertising and campaign measurement, and do we use Google Analytics 4 and Hotjar for web statistics and session recordings; see the section Marketing and our cookie policy.
• Review platform: Trustpilot, for sending review invitations (name, email address and claim number) and hosting public reviews.
• Premium partners: Stripe for the payment of Premium subscriptions and Collinson for providing lounge access; see the section Premium.

With parties that act as processors for us, we conclude a data processing agreement in accordance with Art. 28 GDPR and require appropriate security. Parties such as courts, bailiffs, the counterparty and our accountant are independent controllers for their own (statutory) tasks.

Transfers outside the EU
We store your data primarily within the European Economic Area (EEA). Some of our service providers are part of US groups or process data (partly) outside the EEA. For example, Amazon Web Services, Slack (Salesforce), Asana and Stripe are part of US groups, our AI suppliers Anthropic and OpenAI process data in the United States, and we use a service provider in South Africa for support. Meta and Google (including Google Analytics) also process data in the United States; the safeguards mentioned above apply to this. Our Premium partner Collinson processes data in the United Kingdom, which is covered by an adequacy decision of the European Commission.

In those cases we ensure appropriate safeguards: transfers take place on the basis of the EU-US Data Privacy Framework (the adequacy decision of the European Commission) to recipients certified under it, and/or on the basis of the standard contractual clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional measures such as encryption. You can request a copy of the safeguards used, or where to find them, using our contact details.

When we submit a claim against an airline outside the EEA, or when legal steps outside the EEA are needed, your data may also end up outside the EEA. That transfer is then necessary for the establishment, exercise or defence of your legal claim (Art. 49(1)(e) GDPR). This is unavoidable; otherwise you would not be able to claim anything.

Marketing, newsletter and cookies
We offer a newsletter to inform interested people about our services and activities. Your email address is only added to the mailing list with your explicit consent, and every newsletter contains an unsubscribe link.

Only if you have given your consent via our cookie banner do we use hashed identifiers (such as an encrypted version of your email address) to build audiences via advertising platforms/search engines such as Google and to show, or specifically exclude, advertisements. 

Audience building via Google and Meta. With your consent, we share hashed (so encrypted) identifiers with Google and with Meta (Facebook/Instagram) to build audiences, show or specifically exclude advertisements, and measure the effectiveness of campaigns. For this we provide Google with your email address and phone number in hashed form (SHA-256). In line with Meta’s procedures, Meta is also provided with your name, place of residence and postcode in hashed form. To measure conversions, Meta also receives the value and currency of a claim (€250, €400 or €600). Hashing means that the data is converted into an encrypted code; it remains personal data, so this sharing only takes place on the basis of your consent, which you can withdraw at any time via the cookie settings.

Web statistics and session recordings. With your consent, we use Google Analytics 4 to measure how our websites are used (such as page views, click, scroll and search behaviour and downloads) and we process those statistics in internal reports. In addition, also with your consent, we use Hotjar to record sessions on our website: this shows us how visitors navigate through pages, while input fields containing personal data are masked. We also see the country, device type, screen size, browser and operating system. We use this information to improve our websites.

Reviews via Trustpilot. After we have handled your claim, we may invite you via Trustpilot to leave a review. For this we provide your name, email address and claim number to Trustpilot, which acts as a processor for the invitation; Trustpilot is an independent controller for the review platform itself. We do this on the basis of our legitimate interest in understanding how satisfied customers are with our services; if you do not want to receive such invitations, let us know or use the unsubscribe option in the invitation. If you post a public review, we may quote it – with the name under which you posted it – in our communications, for example on our website or in advertisements.

A hashed identifier is a pseudonym and remains personal data. You can withdraw your consent at any time, as easily as you gave it, via the cookie settings on our website. For full information about the cookies and similar technologies we use, please see our cookie policy [www.flight-delayed.com/cookies].

Premium
If you take out a Premium subscription with us, we process your name, contact details, address, language preference and payment details to manage and invoice that subscription. Payment is handled by our payment service provider Stripe. If your Premium subscription includes lounge access, we share your name, email address, phone number and the relevant flight details (flight number, route and date) with our partner Collinson, which provides the lounge access. Collinson is based in the United Kingdom; that country is covered by an adequacy decision of the European Commission, so your data enjoys the same level of protection there as in any EU member state.

What are cookies and why do we use them?
Placing a cookie is a technique for collecting and using information. Thanks to a cookie, a website administrator can see which pages are visited (often), which articles are (more) interesting to readers, how often our site is visited and so on. This provides information to adapt the site where necessary, make it more attractive and fix errors. Advertisers on our website can also see, after you have clicked on an external link, that they were visited, and use this to adjust their advertisements or show them on other sites you visit.

How long do we keep your data?

• Case data: during the handling of your claim and then for 2 years after the case file is closed, in connection with any claims about our services. If proceedings are ongoing or threatened, we keep the case file for as long as necessary for that purpose.
• Financial data: we keep invoices, payment details and the related customer data for 7 years under the tax retention obligation.
• Copy of identity document: we delete it as soon as the purpose for which you provided it has been fulfilled, and at the latest when the case file is closed, unless court proceedings or a possible appeal require us to keep it longer.
• Newsletter: until you unsubscribe or withdraw your consent.
• Job application data: no later than 5 years after the end of the application procedure, or – at your request – for a maximum of 1 year.
  
  

If you exercise your statutory right to cancel the agreement within 14 days, we will erase your personal data, except for data we must keep under a legal obligation or for reasons we consider valid, which we will then explain. At the end of a retention period, we erase your data or anonymise it as described under “Statistics, benchmarks and anonymous data”. Permanent deletion from backups follows a fixed cycle and may therefore take a limited amount of extra time; backups are encrypted and are not used for any other purpose.


IP address and log files
When you open a website, servers automatically record the data your browser sends. These so-called server log files may contain data such as your web request, IP address, browser type, browser language, the date and time of the visit and one or more cookies by which your browser can be recognised. This data is used to generate statistics and/or analyse browsing behaviour and to optimise the website. The IP address is usually stored to guarantee the security of the network and to check for any infringement of intellectual property rights and/or any other breach of the law. Personal data or IP addresses may be requested by bodies such as Stichting BREIN (the Dutch anti-piracy foundation), the FIOD (the Dutch fiscal investigation service) or the Public Prosecution Service. However, we will never hand them over voluntarily, but only when a formal demand is presented or underlies the request.

How do we secure your data?
We have taken appropriate technical and organisational measures to protect your personal data against loss and unlawful use, including:

• Encrypted connections (TLS/SSL) for our websites and for the transmission and synchronisation of data;
• Encrypted storage and encrypted backups within the EEA;
• Access to personal data limited to authorised staff based on their role;
• A duty of confidentiality for staff and third parties we engage;
• A strict password policy, under which passwords are stored only as salted one-way hashes;
• Regular training of staff on privacy and information security.

We require similar measures from parties that process personal data on our behalf. For more information about our security, you can contact us using the details at the end of this statement.

Your privacy rights
You have the following rights:

• The right of access to the personal data we process about you;
• The right to rectification or completion of inaccurate or incomplete data;
• The right to erasure of your data;
• The right to restriction of processing;
• The right to portability of data you have provided to us yourself (data portability);
• The right to object to processing that we base on a legitimate interest; you can always object to the use of your data for direct marketing, without giving reasons;
• The right to withdraw consent you have given at any time; this does not affect the lawfulness of processing before the withdrawal.

We will respond to your request substantively without undue delay and at the latest within one month. For complex or numerous requests, we may extend that period by two months (Art. 12 GDPR); we will then let you know within the first month, together with the reason for the extension. To make sure a request comes from you, we may ask you to prove your identity; we will never ask for more data than necessary.

You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority of the country where you live or work.

Under 16?
We do not want to process personal data of persons under the age of 16 without the consent of a parent or legal guardian. If we find that this has happened, we will delete that data or contact you to obtain that consent after all.

Third-party websites & social media
This privacy statement does not apply to third-party websites linked to from our website, including social media. We are not responsible for how these third parties handle your personal data and we recommend that you read their privacy and cookie policies before using their websites. Our company has social media accounts and welcomes likes from visitors who want to stay informed about news, offers etc.

Changes
We may amend this privacy statement, for example in the event of changes to our services or to laws and regulations. The current version is always available on our website, stating the date of the last change. In the event of significant changes – for example if (part of) our business is transferred – we will inform you actively.

Contact
For questions, requests, complaints or suggestions about this privacy statement or your personal data, you can always contact us:

Yource B.V.   –   P.O. Box 3650, 1001 AL Amsterdam, the Netherlands   –   privacy@your-ce.com