Privacy policy

Flexairpark attaches the greatest importance to the protection of your personal data. The purpose of this policy is to inform you, in full transparency, about the data we collect, the purposes for which we process it and the rights available to you under the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the Belgian Act of 30 July 2018.

The data controller is Flexair Park SRL, Berkenlaan 1, 1831 Machelen, Belgium.

We collect only the data strictly necessary to provide the service. The categories concerned are set out below.

Identification data

Surname, first name, email address, telephone number, preferred language. For business customers (B2B): company name, VAT number, billing address.

Booking data

Licence plate, entry and exit dates and times, allocated car park, number of passengers, flight number (optional), and any notes left by the customer.

Payment data

Bank details are collected and processed exclusively by our provider Stripe Payments Europe Ltd in accordance with its own terms and with the PCI-DSS standard. No bank details are stored on Flexairpark servers. We keep only the internal payment reference (Stripe Payment Intent ID) for accounting reconciliation purposes.

Technical data

IP address (anonymised for statistics), browser type, pages visited, session identifiers. This data is collected through the cookies described in our cookie policy.

Your data is processed exclusively for the following purposes:

• Managing the booking and performing the service contract
• Collecting payment and issuing the invoice
• Communicating with the customer (confirmation, reminder the day before, changes, cancellation)
• Coordinating the return shuttle service
• After-sales service and handling of any disputes
• Complying with legal obligations (accounting, tax, GDPR)
• Improving our services (aggregated and anonymised statistics)

Processing is based on one of the following grounds:

• Performance of the contract: for all data required for the booking and the provision of the service.
• Legal obligation: for the retention of invoices and accounting data (7 years in Belgium).
• Legitimate interest: for the security of the service, fraud prevention and anonymised statistics.
• Your consent: for non-essential cookies and for any marketing communications (separate tick boxes during booking).

Retention periods vary according to the nature of the data and the applicable legal obligations:

• Confirmed bookings and invoices: 7 years from the date of service (Belgian accounting obligation).
• Cancelled bookings with no invoice: 2 years from the date of cancellation.
• Inactive customer accounts: automatic anonymisation after 3 years without a new booking.
• Technical logs and browsing data: 13 months maximum.

Once these periods have elapsed, the data is permanently anonymised or deleted.

Your data is never sold or transferred to third parties for commercial purposes. It is shared only with the processors strictly necessary to provide the service:

• Stripe (Ireland) — secure payment processing
• Supabase (EU — Ireland) — database and authentication hosting
• Vercel (United States) — website and application hosting
• Resend (EU — Ireland) — sending transactional emails (confirmations, reminders)
• Yuki (European Union) — Peppol electronic invoicing for B2B customers

Each of these providers offers an adequate level of protection (standard contractual clauses, or the successor to the Privacy Shield, for transfers outside the EU).

Under the GDPR, you have the following rights:

• Right of access: to obtain a copy of the data we hold about you.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): to request the deletion of your data, subject to legal retention obligations.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to the processing of your data on legitimate grounds.
• Right to restriction: to request the temporary suspension of a processing operation.
• Right to withdraw your consent at any time for processing based on it.

To exercise any of these rights, you can contact us by email at contact@flexairpark.com or by post at Berkenlaan 1, 1831 Machelen, Belgium.

Proof of identity may be requested in order to verify who you are. We undertake to respond to your request within one month of receiving it, in accordance with Article 12 of the GDPR.

No data protection officer has been appointed: the company does not meet the thresholds that would make this mandatory. For any question about your data, please write to contact@flexairpark.com.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Belgian Data Protection Authority:

Rue de la Presse 35, 1000 Brussels, Belgium
Telephone: +32 2 274 48 00
Website: dataprotectionauthority.be

This policy may be updated to reflect regulatory or technical developments. The date of the last update is shown at the top of the page. Substantial changes are notified in advance by email.