Privacy Statement
Vluchtrecht.nl
A service of LeadStream B.V. · Version 1.0, 13 July 2026
In this privacy statement LeadStream B.V. (“we”, “us” or “our”) explains how we collect, use and share your personal data when you visit our website https://www.vluchtrecht.nl/ and use our service. This statement is intended to inform you about the processing of your personal data in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR). It is not an agreement, and your use of the website does not constitute acceptance of it. Where we rely on your consent for specific processing, such as non-essential cookies or marketing, we ask for that consent separately.
What data do we collect, and when?
We collect only the data needed for the stage your claim is at.
At intake, when you submit a claim
- Name
- Email address
- Phone number
- Flight details (flight number, date, route)
- Booking references
Only where needed at a later stage
- A copy of your passport or identity document, when the partner firm requires identity verification for your claim. When uploading an ID copy we instruct you to mask your citizen service number (BSN), your photo and other non-essential details, unless the partner firm confirms that a full copy is legally required.
We do not collect document numbers as a separate data field, and we do not collect bank details. When compensation is paid out, bank details are collected directly by the partner firm or the paying party, under their own privacy statement.
Additional safeguards for ID copies
ID copies are higher-risk data, and we apply stricter rules for them: they are used solely for identity verification and referral of your claim (purpose limitation); they are uploaded and stored via secure, encrypted channels; access is limited to staff who need them for your claim; they are never used for marketing or analytics; and they are deleted within a short, fixed period after verification and referral are completed, as set out in the retention table below.
How do we collect this data?
- Data you provide to us: the data you enter when you submit and progress your claim.
- Data we collect automatically: when you use our website, we collect certain data from your device via cookies and similar technologies, as described in our Cookie Policy and subject to your consent choices.
Where needed to assess your claim, we verify flight information (such as delay or cancellation status) via external flight data sources. These are operational databases of airlines and airports and commercial flight-status providers. We send them only objective flight data, such as the flight number and date. We do not share your personal data with these sources, and we do not buy or obtain personal data from data brokers, data marketplaces or similar parties.
Cookies and similar technologies
We use cookies for website analytics and, with your consent, for advertising. Non-essential cookies, including analytics and advertising cookies such as Google Ads and the Meta pixel, are only placed after you have given consent via the cookie banner on our website. You can change your preferences at any time via the banner. For the full list of cookies we use and their retention periods, please see our Cookie Policy.
Our website does not currently respond to ‘Do Not Track’ browser signals. We rely on the consent choices you make via our cookie banner.
For what purposes do we process your data, and on what legal basis?
Under the GDPR, every processing of your data must rest on a legal basis. The table below maps our purposes to the corresponding legal basis.
| Purpose | Legal basis |
|---|---|
| Assessing whether your claim is eligible and referral to our partner firm | Performance of a contract (Art. 6(1)(b) GDPR) |
| Contacting you about your claim | Performance of a contract (Art. 6(1)(b) GDPR) |
| Identity verification, where required | Performance of a contract (Art. 6(1)(b) GDPR) |
| Fraud prevention and security of our service | Legitimate interest (Art. 6(1)(f) GDPR) |
| Improving our service and analysing use in aggregated or pseudonymised form | Legitimate interest (Art. 6(1)(f) GDPR) |
| Sending marketing and promotional messages | Consent (Art. 6(1)(a) GDPR) |
| Placing non-essential cookies for analytics and advertising | Consent (Art. 6(1)(a) GDPR) |
| Keeping records and responding to lawful requests from authorities | Legal obligation (Art. 6(1)(c) GDPR) |
Where we rely on a legitimate interest, we have carried out a balancing test between our interests and your rights and freedoms, and you may object to that processing at any time (see Your rights below). Service analytics and marketing are kept separate: we do not use your claim-file data for marketing or advertising analytics. If you have given consent for marketing, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
How long do we keep your data?
We do not keep personal data longer than necessary for the purpose for which it was collected. The periods below apply per category.
| Data category | Retention period |
|---|---|
| Data forming part of our financial administration (including referral and invoicing data) | 7 years, under tax retention obligations |
| Intake data for claims referred to the partner firm | The duration of claim handling plus 2 years, for dispute handling and limitation periods |
| Intake data for ineligible, rejected or abandoned claims | 12 months after last activity, then deleted or anonymised |
| Copies of passport or identity document | Deleted within 30 days after identity verification and referral are completed, unless a longer period is legally required |
| Marketing data | Until you withdraw consent, or after 2 years of inactivity |
| Cookie and analytics identifiers | As set out in the Cookie Policy |
After a retention period ends we delete or anonymise the data. Where immediate deletion is not possible, for example in backup archives, we isolate the data securely from further processing until deletion is possible.
Do we share your data?
- With our partner firm: when your claim appears eligible, we share your personal data with our partner firm for referral and legal assessment of your claim. This sharing is necessary to deliver our service; if you do not want your data shared with the partner firm, we cannot deliver the service. The partner firm is an independent controller: it determines its own legal strategy and professional handling of your claim, and its further processing of your data is governed by its own engagement terms and privacy statement, which it provides to you before taking on your claim.
- With your consent: where you give consent, we may share your data with other third parties for the purposes described in the relevant consent request.
- To comply with legal obligations: we may disclose data where legally required, for example pursuant to a court order or a lawful request from a competent authority. Suspected fraudulent submissions may be shared with our partner firm and, where legally required or justified, with competent authorities.
- In connection with a business transfer: we may share your data in the context of a merger, acquisition, financing or sale of (part of) our business.
We do not sell your personal data, and we do not share it with third parties except as described in this statement.
Service providers and advertising partners
We use external service providers that help us operate our website and service. These include our hosting and cloud storage providers, our forms and secure document-upload provider, our email service provider and our security and IT providers. Where these parties process personal data on our behalf and according to our instructions, they act as processors, and processor agreements have been concluded with them as required by Article 28 GDPR.
We also use services of Google (Google Analytics, Google Ads, Google Tag Manager) for analytics and advertising, and of Meta Platforms (Meta pixel) for advertising and retargeting. For certain advertising and measurement processing, Google and Meta act as independent or joint controllers rather than as our processor, under their own terms and privacy statements. These tools are used only with your consent, given via our cookie banner. The Meta pixel is not placed on claim-flow pages from which information about your claim or uploaded documents could be inferred, and Google Analytics is configured in a privacy-friendly way, including IP anonymisation.
International transfers
Some of our service providers, including Google and Meta, may process personal data outside the European Economic Area, including in the United States. In that case the transfer is protected by an appropriate safeguard under Chapter V of the GDPR: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, where the provider is certified for it) or the European Commission’s standard contractual clauses, supplemented with additional measures where needed. You may contact us for more information about the safeguards applied.
Your rights
Under Articles 12 to 23 of the GDPR you have the following rights regarding your personal data:
- The right of access to the data we process about you and to a copy thereof;
- The right to rectification of inaccurate or incomplete data;
- The right to erasure (the right to be forgotten);
- The right to restriction of processing in certain circumstances;
- The right to object to processing, including processing based on legitimate interest;
- The right to data portability;
- The right to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- The right not to be subject to a solely automated decision with legal effects or similarly significant effects. Our preliminary check is always reviewed by a person before a claim is referred.
To exercise any of these rights, contact us using the details at the bottom of this statement. We respond within one month of receiving your request and may ask you to confirm your identity before we action it. For complex requests this period may be extended by two months; in that case we will inform you.
You also have the right to lodge a complaint with the supervisory authority: Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ The Hague, www.autoriteitpersoonsgegevens.nl.
Children and minors
Minors cannot submit a claim independently via our website. A parent or legal guardian may submit a claim on behalf of a minor; in that case the parent or guardian provides the minor’s data and is our contact point for the claim. If you believe a minor has provided data to us independently, please contact us; after verification we will remove the data from our records.
Security of your personal data
We take appropriate technical and organisational measures to protect your personal data, and we apply heightened measures for ID copies. These measures include encryption of data in transit, secure upload and storage, role-based access so only staff who need the data for your claim can access it, logging where appropriate, fixed deletion routines, confidentiality obligations for our staff and written data-protection arrangements with our service providers. No method of transmission or storage over the internet is fully secure, and we cannot guarantee absolute security, but we review our measures regularly.
Links to other websites
Our website may contain links to external websites or services not operated by us. We are not responsible for the privacy practices of those websites and recommend that you read their privacy statements before providing personal data.
Changes to this privacy statement
We may update this statement from time to time to reflect changes in law or in our practices. The applicable version is the version published on this page. We recommend that you review the statement regularly.
Contact
For questions about your privacy, or to exercise any of your rights, you can contact us via:
Controller: LeadStream B.V. Chamber of Commerce (KvK) number: 95798897 Le Mairekade 77, 1013 CB Amsterdam, the Netherlands Privacy contact: privacy@vluchtrecht.nl General contact: info@vluchtrecht.nl
We have not appointed a data protection officer (DPO), because we are not required to do so. Privacy matters are handled via the privacy contact address above.