Bombardier Global XRS
Bombardier Challenger 300
Pilatus PC-12 NGX
Last updated: 18 August 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Goldeck-Flug Gesellschaft m.b.H.
Viktor-Lang-Straße 14a
2700 Wiener Neustadt
Austria
E‑mail: office@goldeckflug.com
Company Register No.: FN 91475y | VAT ID: ATU 26422403
2. General Information on Data Processing
Protecting your personal data is important to us. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), the Telecommunications Act 2021 (TKG 2021) and other applicable data protection provisions.
Personal data is information relating to an identified or identifiable natural person. This includes, for example, your name, contact details, IP address and details of a specific charter request.
3. Legal Bases
Depending on the processing activity, we rely in particular on the following legal bases:
- Art. 6(1)(a) GDPR – consent, for example for non-essential analytics and marketing technologies.
- Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures, in particular for contact and charter requests.
- Art. 6(1)© GDPR – compliance with a legal obligation.
- Art. 6(1)(f) GDPR – legitimate interests, such as IT security, prevention of misuse and the secure operation of our website, provided these are not overridden by the interests of the data subject.
4. Visiting the Website and Server Log Files
When you visit our website, the web server or hosting provider may process technically required data. This can include, in particular, your IP address, the date and time of access, the page or file accessed, the referrer URL, browser type and version, and operating system.
This processing is carried out in particular to provide and stabilise the website, for error analysis, and to detect and defend against abusive or security-relevant access. The legal basis is generally Art. 6(1)(f) GDPR. Log data is stored only for as long as necessary for these purposes or as required by law.
5. Cookies and Consent Management
Our website may use cookies and similar technologies. Technically necessary technologies may be used insofar as they are strictly required for a service you have expressly requested. For technologies that are not technically necessary, in particular for analytics, marketing or remarketing purposes, we obtain your consent before they are used.
You can change or withdraw your choices at any time, with effect for the future, via the privacy settings provided on the website. Merely continuing to browse the website does not constitute consent.
The legal basis for processing requiring consent is Art. 6(1)(a) GDPR; access to, or storage of, information on end devices is additionally subject to Section 165(3) of the Telecommunications Act 2021 (TKG 2021).
6. Contacting Us
If you contact us via a contact form, by e‑mail or in any other way, we process the information you provide in order to handle your request and any follow-up questions. Depending on the content of your request, this may include your name, e‑mail address, phone number, company and message.
Where your request is aimed at entering into or performing a contract, processing is based on Art. 6(1)(b) GDPR. In other cases, processing may be based on our legitimate interest in handling inquiries pursuant to Art. 6(1)(f) GDPR.
7. Charter Requests and FL3XX
We use the software and API services of FL3XX GmbH, Kolingasse 11/3, 1090 Vienna, Austria, to process and manage charter requests.
If you submit a charter request via our website, the data you enter in the form is transmitted to FL3XX via a server-side interface and processed there on our behalf. This may include, in particular, the following data:
- First and last name
- E‑mail address and phone number
- Company, if provided
- Country, city and postal code
- Message, aircraft preferences or remarks you enter
- Departure and destination airports
- Requested departure and, where applicable, return times
- Number of passengers and, for multiple destinations, the individual flight legs
The purpose of this processing is to handle your request, to prepare and manage a possible flight offer, and to carry out pre-contractual measures. The legal basis is Art. 6(1)(b) GDPR.
Under FL3XX’s published Data Processing Agreement, the respective FL3XX customer is the controller and FL3XX acts as processor. Processing by FL3XX therefore takes place within the framework of the contractual and data protection arrangements in place for the operator.
Simply viewing empty-leg offers displayed on our website is handled server-side. Insofar as no personal data of a website visitor is transmitted to FL3XX in the process, this does not result in any additional transfer of personal data to FL3XX.
8. Protection Against Automated Requests – Google reCAPTCHA
Google reCAPTCHA may be used to protect forms against automated input and misuse. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Technical information such as IP address, browser and device information, and interaction data may be processed to determine whether an input was made by a human or in an automated manner.
The specific legal basis and consent mechanism depend on the technical configuration used. Where use is based on consent, Art. 6(1)(a) GDPR applies; where a consent-free, technically necessary security measure is permissible, Art. 6(1)(f) GDPR may apply instead.
9. Newsletter
If you subscribe to our newsletter, we process in particular your e‑mail address and, where applicable, further voluntary information in order to send you the requested newsletter. Processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in the newsletter.
Where an external newsletter service provider is used, it is engaged only within the framework of the necessary data protection agreements.
10. Google Analytics
Where you have given your consent via our consent management tool, we may use Google Analytics for statistical analysis of the use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
This may involve processing online identifiers, information about the device and browser used, pages visited, interactions, approximate location information, and technical usage data. This is used exclusively following your consent under Art. 6(1)(a) GDPR and, where applicable, Section 165(3) TKG 2021.
You can withdraw your consent at any time via the privacy settings.
11. Google Ads and Conversion Tracking
Where you have given your consent, we may use Google Ads services to measure the success of our advertising and deliver more targeted ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
This may involve processing cookies or similar technologies as well as online identifiers, information on ad interactions, device and browser data, and usage information. Processing takes place only with your consent under Art. 6(1)(a) GDPR and, where applicable, Section 165(3) TKG 2021. You can withdraw your consent at any time via the privacy settings.
12. Meta Pixel
Where you have given your consent, the Meta Pixel may be used on our website. For users in the European Economic Area, the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
The Meta Pixel may process information about page views, interactions, online identifiers, device and browser information, and, where applicable, further event data. It is used in particular to measure the performance of advertisements and, where activated, to build audiences for advertising purposes.
It is used only with your consent under Art. 6(1)(a) GDPR and, where applicable, Section 165(3) TKG 2021. Consent can be withdrawn at any time via the privacy settings.
13. Recipients and Processors
We only disclose personal data where this is necessary to perform a contract or handle a request, where there is a legal obligation, where you have given your consent, or where another legal basis applies. Recipients may include, in particular, hosting and IT service providers, FL3XX, communications and newsletter service providers, and – subject to consent – analytics and marketing providers.
Where service providers process personal data on our behalf, they are engaged as processors in accordance with legal requirements.
14. Transfers to Third Countries
Certain services may involve the processing of personal data outside the European Economic Area. In such cases, we ensure that the legal requirements for the transfer are met, for example through an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.
15. Retention Period
We generally store personal data only for as long as necessary for the respective processing purpose. Data may also be stored where statutory retention, documentation or limitation periods apply. Data processed exclusively on the basis of consent will generally no longer be processed for that purpose after consent is withdrawn, unless another legal basis requires further storage.
For charter and business inquiries, the retention period depends in particular on whether the inquiry results in a contractual relationship and on the statutory retention periods applicable to the related business records.
16. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or destruction. These measures are regularly reviewed and adjusted, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing.
17. Your Rights
Subject to the applicable legal requirements, you have in particular the following rights:
- Right of access to the personal data we process about you (Art. 15 GDPR)
- Right to rectification of inaccurate data (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
- Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, you can contact us using the contact details provided above.
18. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria.
19. Changes to this Privacy Policy
We may amend this privacy policy if our website, the services we use, or the applicable legal requirements change. The version published on our website at any given time shall apply.
