Privacy Policy
Information on the processing of personal data by BlueGo Solutions OÜ in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Estonian Isikuandmete kaitse seadus (IKS) (Personal Data Protection Act), and Directive 2002/58/EC (ePrivacy).
7.1. Data Controller
- Controller
- BlueGo Solutions OÜ — registrikood 17482859
- Registered address
- Tartu mnt 67/1-13b, 10115 Tallinn, Estonia
- Privacy contact email
- info@bluego.io · support@bluego.io
- Data Protection Officer (DPO)
- BlueGo Solutions OÜ is not required to appoint a DPO under Article 37 GDPR, as none of the conditions set out in paragraph 1 of that article are met. Privacy-related enquiries may be directed to the email addresses listed above.
7.2. Categories of data processed
BlueGo Solutions OÜ processes the following categories of data:
- Identification and contact data: first name, surname, email address, preferred language, country of residence.
- Customer account data: credentials (stored as cryptographic hashes), preferences, order history.
- Order data: order identifier, purchased products, amounts, display currency, billing currency (EUR), payment method used, payment tokens provided by Stripe (no card data is stored).
- Tax data: country of residence, VAT number where applicable (for VIES validation), VAT treatment applied.
- Flight Protection product data: flight number, airline, origin, destination, scheduled departure date and time.
- Loyalty programme data: BlueCoins balance, accrual batches, internal accounting entries.
- Technical and connection data: IP address, user agent, device type, browser language, date and time of access, server logs.
- Approximate IP-based geolocation data: country and region, obtained via the local MaxMind GeoLite2 database; the IP address is not stored for geolocation purposes nor disclosed to third parties for that purpose.
- Usage and behavioural data: pages visited, products viewed, Platform usage events (where there is a legal basis for doing so).
- Support data: content of communications with the support team, chatbot transcripts, where applicable.
7.3. Purposes of processing and legal bases
In accordance with Article 6(1) GDPR, the applicable legal bases are as follows:
| Purpose | Legal basis | Reference provision |
|---|---|---|
| Order processing and delivery of the eSIM or Flight Protection product | Performance of a contract | Art. 6(1)(b) GDPR |
| Management of the Customer account and the BlueCoins programme | Performance of a contract | Art. 6(1)(b) GDPR |
| Invoicing, accounting, and compliance with tax obligations | Legal obligation | Art. 6(1)(c) GDPR; Käibemaksuseadus (VAT Act); Raamatupidamise seadus (Accounting Act) |
| Fraud prevention (flight validation, coupon controls, payment controls) | Legitimate interest | Art. 6(1)(f) GDPR |
| Transactional communications (confirmations, invoices, notices) | Performance of a contract | Art. 6(1)(b) GDPR |
| Commercial email communications about similar products | Legitimate interest or consent | Art. 6(1)(f) GDPR / Art. 6(1)(a) GDPR; Art. 13(2) Directive 2002/58/EC |
| Marketing communications other than the above | Consent | Art. 6(1)(a) GDPR |
| Approximate IP-based geolocation to suggest currency | Legitimate interest | Art. 6(1)(f) GDPR (documented LIA) |
| Aggregated statistics and service improvement | Consent or legitimate interest | Art. 6(1)(a) or 6(1)(f) GDPR |
| Handling rights requests and legal security obligations | Legal obligation | Art. 6(1)(c) GDPR; Art. 32 GDPR |
7.4. Recipients and Data Processors
In order to provide its services, BlueGo Solutions OÜ discloses certain data to the following recipients, acting as data processors, joint controllers, or independent controllers, as applicable:
| Recipient | Purpose | Role | Location |
|---|---|---|---|
| Stripe Payments Europe Limited | Payment processing | Independent controller | Ireland (EU) / USA (DPF) |
| Third-party eSIM providers | Provisioning and activation of the purchased eSIM profile | Processor / Independent controller | EU / EEA and third countries with an adequacy decision or appropriate safeguards under Chapter V GDPR |
| AirHelp Germany GmbH | Provision of the Flight Protection product | Independent controller | Germany (EU) |
| aviationstack (apilayer Data Products GmbH) | Real-time flight status validation | Processor | EU |
| Hostinger International Ltd. | Hosting and domain | Processor | EU / EEA |
| Vercel Inc. | Frontend deployment (Next.js) | Processor | USA (DPF) / EU regions |
| Cloudflare, Inc. | CDN, edge proxy, and attack mitigation | Processor | USA (DPF) / global |
| Resend, Inc. | Transactional email delivery | Processor | USA (DPF) / EU |
| MaxMind, Inc. | Supply of the GeoLite2 database (local download; no IP transmission to MaxMind) | Data supplier | USA |
| Dalanta OÜ | Contact person and administrative services in Estonia | Processor | Estonia (EU) |
| Anthropic, PBC | Automated customer support (chatbot), when activated | Processor | USA (DPF) |
| Authorised accounting firm in Estonia | Accounting and tax compliance | Processor / Independent controller depending on function | Estonia (EU) |
| Competent authorities | Compliance with legal obligations | Recipients | EU / Estonia |
BlueGo Solutions OÜ enters into a data processing agreement with each processor in accordance with Article 28 GDPR. The list above is updated whenever a new provider is engaged or the relationship with an existing one ends.
7.5. International data transfers
Where certain processors are located outside the European Economic Area, transfers are based on the safeguards provided for in Chapter V GDPR, in particular:
- adequacy decisions adopted by the European Commission under Article 45 GDPR in respect of the country of destination, where available (for example, Commission Implementing Decision (EU) 2021/1772 on the adequate protection afforded by the United Kingdom);
- the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) for certified recipients; failing that, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented by any technical and contractual supplementary measures necessary following the corresponding Transfer Impact Assessment;
- for recipients located in other third countries, the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 with appropriate supplementary measures, or, where applicable, binding corporate rules approved under Article 47 GDPR.
A copy of the applicable safeguards may be requested by writing to info@bluego.io.
7.6. Retention periods
| Category | Period | Legal basis |
|---|---|---|
| Order and invoicing data | 7 years from the order date | Raamatupidamise seadus (Accounting Act) § 12; KMS |
| Active Customer account | While open + 3 years from closure | Defence against contractual claims |
| Consent log (record of acceptances) | 6 years from the order | Art. 7(1) GDPR and contractual limitation period |
| Support communications | 2 years from the last interaction | Legitimate interest and incident handling |
| Flight Protection product data | Up to 6 years from completion of the claim | Defence against claims; AirHelp sector rules |
| BlueCoins balance and transactions | While the account is active and 7 years thereafter | Accounting traceability |
| Analytics and advertising cookies | Lifetime of each cookie, maximum 13 months | EDPB guidelines |
| Consent-based marketing data | Until withdrawal of consent or 24 months without interaction | Art. 7 GDPR |
| IP geolocation data | Not stored (in-memory resolution) | LIA and data minimisation |
Once the retention periods have expired, the data will be deleted or irreversibly anonymised.
7.7. Data Subject rights
In accordance with Articles 15 to 22 GDPR, the Customer or User may exercise the following rights:
- Access to their personal data and information about the processing.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to erasure"), under the terms of Article 17 GDPR.
- Restriction of processing in the cases set out in Article 18 GDPR.
- Portability of the data provided, in a structured, commonly used and machine-readable format, in accordance with Article 20 GDPR.
- Objection to processing based on legitimate interest, including the sending of commercial communications.
- Not to be subject to automated individual decision-making, including profiling, which produces legal effects or similarly significantly affects the data subject, except in the cases provided for in Article 22 GDPR.
- Withdrawal of consent, at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.
Requests may be sent to info@bluego.io, expressly stating the right being exercised and providing the information necessary to verify the identity of the requester. BlueGo Solutions OÜ will respond within a maximum period of one (1) month, extendable by a further two (2) months in complex cases, with a reasoned notification to the Customer.
7.8. Complaint to the supervisory authority
The Customer has the right to lodge a complaint with the competent supervisory authority. The controller's lead supervisory authority is:
Andmekaitse Inspektsioon (AKI) — Tatari 39, 10134 Tallinn, Estonia — info@aki.ee — aki.ee.
In addition, a Customer residing in another Member State may address the supervisory authority of their place of residence or place of work, in accordance with Article 77 GDPR.
7.9. Data security
BlueGo Solutions OÜ implements appropriate technical and organisational measures in accordance with Article 32 GDPR, including, among others: encryption in transit (TLS) and at rest, role-based access controls, environment segregation, secrets management in secure vaults, administrator activity logging, periodic backups, and incident response procedures. In the event of a security breach posing a risk to the rights and freedoms of the Customer, BlueGo Solutions OÜ will notify the AKI within seventy-two (72) hours, in accordance with Article 33 GDPR, and will notify the Customer where the risk is high, in accordance with Article 34 GDPR.
7.10. Processing of minors' data
The Platform is not intended for persons under 18 years of age. In the case of information society services offered directly to children, Estonia has set the minimum age at which a minor may validly give consent at 13 years, in accordance with Article 8 GDPR and § 8 of the IKS (Personal Data Protection Act). Below that age, consent must be given or authorised by the holders of parental responsibility or legal representatives.
Cookie Policy
Information on the use of cookies and similar technologies (local storage, device identifiers) on bluego.io, in accordance with Article 5(3) of Directive 2002/58/EC (ePrivacy), the GDPR, and § 1031 of the Elektroonilise side seadus (ESS) (Electronic Communications Act).
8.1. What are cookies
Cookies are small text files that a website downloads onto the User's device to store information about browsing activity. They include cookies in the strict sense as well as other similar technologies (local storage, session storage, device identifiers, tracking tags).
8.2. Categories of cookies used
| Category | Purpose | Legal basis | Maximum duration |
|---|---|---|---|
| Strictly necessary | Enable core functions: session, cart, language, security, load balancing | Art. 5(3) Directive 2002/58/EC — exemption | Session / 12 months |
| Preference | Remember User settings, including the bluego_currency cookie that stores the chosen display currency | Consent | 12 months |
| Measurement / statistics | Enable aggregated usage measurement, error identification, and performance improvement | Consent | 13 months (EDPB recommendation) |
| Marketing / advertising | Content personalisation and advertising campaigns | Consent | 13 months |
8.3. Consent mechanism
On first access, and whenever the cookies used are modified, BlueGo Solutions OÜ will display a banner allowing the User, on equal terms, to: (i) accept all cookies; (ii) reject all non-necessary cookies; (iii) customise their choice by category. Consent is not required for strictly necessary cookies.
Consent is recorded as a positive, affirmative, granular and revocable act, in accordance with Article 4(11) and Article 7 GDPR, as well as the Guidelines 05/2020 on consent of the European Data Protection Board.
8.4. Withdrawal of consent
The User may withdraw consent at any time by accessing the cookie management panel available in the footer of the Site. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
8.5. Third-party cookies
Certain features of the Site may involve the downloading of cookies by third parties (for example, Stripe for the secure display of the payment form, statistical measurement providers). The presence and characteristics of each third-party cookie are detailed in the cookie management panel on the Site. Each third party is responsible for the processing of data collected through its own cookie, in accordance with its own privacy policy.
8.6. How to disable cookies in the browser
Additionally, the User may configure their browser to block or delete cookies. The main browsers provide instructions on their respective help pages (Chrome, Firefox, Safari, Edge). Blocking strictly necessary cookies may affect the functioning of the Site.
Version 1.0 · May 2026
BlueGo Solutions OÜ — Registrikood 17482859 — EE102989498 — Tartu mnt 67/1-13b, 10115 Tallinn, Estonia.