Last updated: 28 October 2026
This notice explains how personal data are collected and used when you visit SkyExtras.com, purchase an airport lounge access pass, or contact our team. It is intended to provide information under the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws.
1. Data controller
SkyExtras.com / Young Digital
Klapczyka 48, 44-240 Żory, Poland
Privacy contact: info@skyextras.com
These identification details must be confirmed and completed before publishing. If a data-protection officer is legally appointed, add their contact details here.
2. Personal data we collect
Customers and booking contacts: name, email, billing contact/address information where entered, order reference, selected products, access date, payment status and transaction identifiers, order history and correspondence.
Passengers: title, first name, surname, assigned lounge and access date; optional flight number and additional information you or a supplier lawfully provide to complete the order. A customer placing an order for others should inform them that their details will be supplied to us and relevant access providers.
Access credentials: supplier pass code, pass images, passenger coverage, issuing and retrieval records, and limited security logs concerning pass delivery and access.
Technical and website usage data: IP address, device/browser data, page interactions, cookie and consent identifiers, error/security logs and analytics or advertising identifiers where legally permitted and your applicable consent choices allow.
Support enquiries: communications with our staff, including email or WhatsApp messages and supporting evidence for complaints.
We do not intentionally ask for passport numbers, full payment-card details, medical information, or other sensitive personal data during ordinary lounge pass checkout. Please do not send them unless specifically necessary and requested through an appropriate secure channel.
3. Why we process personal data and our legal bases
| Purpose | Legal basis under GDPR |
|---|---|
| Take payment, issue passes, validate passenger coverage and deliver access links | Performance of a contract (Art. 6(1)(b)); for accompanying passengers, legitimate interests where appropriate (Art. 6(1)(f)) |
| Customer support, complaints, fraud prevention, access-link security and service auditing | Legitimate interests (Art. 6(1)(f)) and/or contract performance |
| Tax, bookkeeping and compliance records | Legal obligation (Art. 6(1)(c)) |
| Optional marketing emails | Consent where required (Art. 6(1)(a)) or another lawful basis when valid under applicable marketing law |
| Non-essential analytics and advertising cookies/tags, including Google Ads measurement | Consent where required (Art. 6(1)(a)) and applicable electronic-communications rules |
Where we rely on legitimate interests, they include protecting customers’ issued credentials, preventing misuse, maintaining a reliable booking service and handling disputes. You may object where applicable.
4. Who receives your data
We disclose only the information reasonably needed to operate the service, including to:
- Lounge access suppliers and programs, potentially including DragonPass or other providers actually used for your order, and relevant airport lounge operators who validate the credential.
- Payment processing providers, such as WooPayments and the underlying payment service partners actually connected to our store. We generally receive payment status and transaction references rather than complete payment-card numbers.
- Website infrastructure and email providers, including our current web host, security/CDN provider (if enabled), transactional email provider, and relevant WordPress/WooCommerce processors.
- Analytics and advertising partners, such as Google Analytics and Google Ads, where deployed and in accordance with applicable consent and privacy settings.
- Professional advisers, public authorities or other recipients where necessary to comply with law or establish, exercise or defend legal claims.
We do not intentionally send passenger names, flight numbers or QR codes as normal Google Ads purchase-conversion parameters. We do not sell passengers’ details to advertisers.
5. International transfers
Some access providers, lounges, support channels, analytics services or service vendors may operate outside the European Economic Area. Where GDPR applies to a restricted international transfer, we use an appropriate legal transfer mechanism such as an adequacy decision or suitable contractual safeguards, and any additional measures required for the transfer. Contact us for information about safeguards relevant to your data.
6. How long data are kept
We keep information only for the period necessary for the relevant purpose and applicable legal obligations:
- Order, invoice and tax records: for the retention period required under applicable Polish accounting and tax rules.
- Booking, supplier issuance and complaint information: while needed to provide the service and for reasonable dispute, legal and audit periods.
- Customer communications and security records: for proportionate support/security retention periods.
- Marketing records: until consent is withdrawn or another legal basis ends, subject to necessary suppression records.
- Cookies: for the durations specified by our active cookie-consent tool and current cookie inventory.
A secure pass retrieval link becomes inaccessible 24 hours after the chosen access date ends in UK time, but the underlying order and private credential records are not necessarily deleted at that moment. [BEFORE PUBLISHING: document the actual deletion/retention schedule for private QR images, support tickets, server logs and backups.]
7. Guest QR links and security
Guest pass pages use an unguessable secret link. Anyone who obtains a valid link may be able to access its contents, so treat it like a password and do not forward or post it publicly. We can revoke and replace a guest link when necessary. The underlying QR images are stored separately from public website files and served through access checks. These safeguards reduce risk but cannot eliminate every online security risk.
8. Your rights
Subject to applicable conditions, you can request access to your personal data, correction, deletion, restriction, portability, or object to certain processing. Where processing is based on consent, you can withdraw that consent at any time without affecting processing already lawfully performed. You may also complain to a competent data protection authority, including the Polish President of the Personal Data Protection Office (UODO) where appropriate.
Send requests to info@skyextras.com. We may verify your identity before releasing information, especially where order records involve multiple travelers.
9. Cookies, Google Ads and consent
We use essential website and payment technology to operate the store. Non-essential analytics and advertising technologies are governed by the applicable consent banner and your choices. See our Cookie Policy. If enabled, Google Consent Mode communicates relevant consent signals to Google tags; it does not itself replace the need for a lawful consent interface.
10. Children’s data
The website is intended for purchasers with legal capacity. A purchaser may lawfully provide a child’s passenger details when needed to issue travel-related access, acting as a parent/guardian or with suitable authority. We do not knowingly use child passenger details for behavioral advertising or independent marketing.
11. Automated decisions
We may use automated security or anti-fraud controls, but we do not intend to make decisions about customers based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards. [CONFIRM THIS AGAINST THE LIVE PAYMENT/FRAUD TOOL CONFIGURATION BEFORE PUBLICATION.]
12. Changes and contact
We may update this notice when the site, providers or laws change. Material changes will be communicated where required. For privacy questions, contact info@skyextras.com.