Privacy policy

This policy explains how we collect and process personal data when you use oozh.ge and our services. Terms not defined here have the meaning given in the Terms and conditions.

1. Controller

The controller of your personal data is EMA PLUS SOLUTIONS SRL (registered office: Intrarea Gheorghe Simionescu No. 19, Office B26, Sector 1, Bucharest, Romania; Trade Register number J40/19757/2017; unique registration code 38540407).

For any question about personal data, contact us by phone at +40 31 780 80 80, by email at [email protected] or by post at: EMA PLUS SOLUTIONS SRL, Intrarea Gheorghe Simionescu No. 19, Office B26, Sector 1, Bucharest, Romania.

2. Which law applies

EMA PLUS SOLUTIONS SRL is a company established in the European Union, so we process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and Romanian law.

For users in Georgia, we also process data in accordance with the Law of Georgia on Personal Data Protection (the “Georgian Law”), to the extent that law applies. Under Article 34(6) of that Law, a company established in the European Union is not required to appoint a special representative in Georgia.

3. What data we process

a) Data you give us

When you book: passengers' first and last names, date of birth, gender, citizenship, travel document (passport or ID card) number and expiry date, contact email and phone number, and the airline loyalty programme number if you enter it;
booking and ticket data: booking code, ticket number, flight, dates, itinerary, price, additional services;
invoicing data, if you enter it;
when you create an account: first and last name, gender, email, phone number, password, the details of passengers you often travel with, your search and booking history;
when you subscribe to the newsletter: email, first and last name, and your travel interests if you share them;
when we help with a compensation or refund claim: ticket and flight data, a copy of the boarding pass and other information the claim needs;
when you write to us by email, chat or website forms: your contact details and the content of the correspondence.

b) Payment data

You enter your card data on Netopia's secure payment page. We do not receive or store the full card number or the CVV code; we receive the payment result and the data needed to identify the payment. If you pay by bank transfer, we receive from our bank the payer's name, the account number (IBAN), the amount and the payment reference.

c) Data we collect automatically

When you visit the website we collect your IP address, browser and device data, language settings, the location you connect from, the date and time of access, the pages you view and your actions on the website. We use cookies and similar technologies for this in accordance with the Cookie policy; functional, statistics and marketing cookies are used only with your consent.

d) Data about other people

If you give us other passengers' data when booking, make sure they know about it and have read this policy.

e) Health data

When you request special assistance, you may give us information about a health condition or disability. These are special categories of data: we process them only with your written consent and only to arrange the assistance (see “Rules for passengers with special needs”).

4. Purposes and legal bases

Purpose	Legal basis
Making the booking, issuing the ticket, additional services, booking-related messages (including schedule changes)	Concluding and performing the contract: GDPR Art. 6(1)(b); Georgian Law Art. 5(1)(b)
Taking payment and making refunds	Performing the contract: GDPR Art. 6(1)(b); Georgian Law Art. 5(1)(b)
Creating and managing your account	Your request and the contract: GDPR Art. 6(1)(b); Georgian Law Art. 5(1)(b) and (j)
Support, complaints and withdrawal notices	Performing the contract and legal obligations: GDPR Art. 6(1)(b) and (c); Georgian Law Art. 5(1)(b) and (c)
Card fraud prevention and website security	Legitimate interest: GDPR Art. 6(1)(f); Georgian Law Art. 5(1)(i)
Accounting, invoices, tax obligations, replies to requests from competent authorities	Legal obligation: GDPR Art. 6(1)(c); Georgian Law Art. 5(1)(c) and (d)
Newsletters and marketing offers	Consent: GDPR Art. 6(1)(a); Georgian Law Art. 5(1)(a) and Art. 12
Functional, statistics and marketing cookies (recent searches, support chat, website usage statistics, personalised advertising)	Consent: GDPR Art. 6(1)(a); Georgian Law Art. 5(1)(a)
Arranging special assistance (health data)	Written consent: GDPR Art. 9(2)(a); Georgian Law Art. 6(1)(a)
Establishing and defending legal claims and disputes	Legitimate interest: GDPR Art. 6(1)(f); Georgian Law Art. 5(1)(i)

Providing the data needed to issue the ticket is necessary: without it the airline cannot issue the ticket. Providing data based on consent is voluntary, and refusing does not affect your ability to buy a ticket.

5. Direct marketing

We send you news and marketing offers by email or other electronic means only with your consent, which you give by ticking a separate box that is not pre-ticked. Consent is not a condition for buying a ticket.

You can withdraw your consent at any time, free of charge and as easily as you gave it: with the unsubscribe link in every marketing email or by email to [email protected]. We stop processing your data for direct marketing no later than 7 working days after receiving your request. We keep a record of the fact and date of your consent and of its withdrawal for as long as the direct marketing continues and for 1 year after it ends.

6. Recipients

Airlines and other carriers, international reservation systems and airport service providers, to issue the ticket and operate the flight; they process your data under their own responsibility;
Netopia (Romania), to process card payments;
the bank that holds our account, to receive bank transfers and make refunds;
processors acting on our instructions under a contract with us: hosting, IT, email delivery, chat, analytics and advertising service providers;
public authorities, courts and law enforcement bodies, in the cases provided by law;
banks, auditors and legal advisers, where necessary.

7. International transfers

We process your data in the European Union (Romania) and use processors operating in the European Union. When data is transferred from Georgia to the European Union, we comply with Article 37 of the Georgian Law; within the European Union the data is protected by the GDPR.

Airlines, reservation systems and some providers may be established outside the European Union and Georgia. We transfer data to such countries only where this is necessary to perform the contract you requested (for example, when the ticket is issued by an airline established outside the EU), or where appropriate safeguards exist, such as a European Commission adequacy decision or standard contractual clauses, and the requirements of applicable law are met.

8. Retention

Booking and payment data: for the duration of the contract, then for the period set by accounting and tax law and until the limitation period for legal claims expires;
account data: until the account is deleted; after deletion we keep only the data we are required by law to keep;
data used for direct marketing: until you withdraw consent; the record of the consent and its withdrawal: for 1 year after the marketing ends;
health data: until the end of the journey; then deleted unless needed for a claim related to the journey;
correspondence with support: for as long as needed to handle the request and any possible claims;
data collected through cookies: for the periods stated in the Cookie policy.

When the period ends, we delete, destroy or anonymise the data so that you can no longer be identified.

9. Your rights

You have the right to:

receive information about the processing of your data;
access your data and receive a copy;
have your data corrected, updated and completed;
have the processing stopped and your data erased or destroyed;
have your data blocked (restriction of processing);
have your data transferred to you or to another controller;
object to processing based on legitimate interest, and object to direct marketing at any time;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you;
withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it;
lodge a complaint about the processing with a supervisory authority or a court.

Send your request by email to [email protected]. We may ask for information needed to confirm your identity. We reply free of charge within 10 working days; in exceptional cases we may extend this by a further 10 working days and will tell you so.

You can lodge a complaint:

in Georgia, with the State Audit Office, which supervises personal data protection;
in Romania, with the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro);
with the supervisory authority of the EU country where you live or work.

10. Minors

We process the data of children that a parent or other legal representative enters in a booking in order to perform the contract. Consent-based processing (for example, a newsletter subscription) of the data of a person under 16 is allowed only with the consent of a parent or other legal representative. We process a minor's health data only with the written consent of a parent or other legal representative.

11. Security

We protect data with technical and organisational measures, including an encrypted connection (HTTPS), access restrictions and confidentiality obligations of our staff. Card payments are processed by Netopia with cardholder authentication (3-D Secure). No transmission of data over the internet can be guaranteed to be fully secure, but we take all reasonable measures to prevent unauthorised access, loss and disclosure.

12. Cookies

How we use cookies, their types and how to manage your consent are described in the Cookie policy.

13. Changes to this policy

When we update this policy, we publish the new version on oozh.ge. We inform you in advance of any significant change by email or on the website. If a change requires new consent, we ask for it separately.