Information Notice on the Processing of Personal Data (GDPR Agreement)

Last updated: 5 August 2026

1. General Information

This Agreement is issued in accordance with European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

This Agreement is designed to inform you about the processing of your personal data and your rights regarding such processing, in accordance with the General Data Protection Regulation (“GDPR”) and applicable Romanian law.

2. Airline

DOKIA AIR S.R.L.
No. ONRC (National Trade Register Office) J40/19269/2021
Unique registration code: 45180947
Bucharest Sector 1, Şos. BUCUREŞTI-PLOIEŞTI, Nr. 40, 2nd floor, Postal Code 13695

Dokia Air collects personal data that is necessary and mandatory for travel and for compliance with the security requirements regulated by the competent authorities for airlines.

This data is only collected with your consent.

This information notice forms an integral part of the service contract/offer to which you are a party and/or which you have accepted. By signing the contract and expressly accepting the offer, you consent to the collection and processing of personal data in accordance with this procedure.

3. Personal Data

Dokia Air processes the following personal data:

1. last and first name;
2. a copy of identity documents and/or passport or a travel document issued by the competent authorities for border crossing, according to the travel itinerary;
3. personal identification number, series and number of valid travel documents issued by the competent authorities;
4. contact details, such as: e-mail, telephone, physical or business address, if applicable, position within the employing entity;
5. bank account and other financial information necessary for the contractual relationship;
6. communications you send or forward to us through emails, chat services, telephone calls and social networks;
7. technical data (including IP address), collected through cookies, such as information about your visits to our website or applications developed by us or access to materials and communications we send to you electronically.

4. Information on the Collection and Processing of Personal Data

4.1. Types of data processing

“Processing” means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4.2. Principles of personal data processing

Dokia Air is committed to complying with the personal data protection principles (hereinafter the “Principles”) set out in the GDPR to ensure that all data are:

1. Collected for specified, explicit and legitimate purposes;
2. Adequate, relevant and limited in relation to the purposes for which they are processed;
3. Correct and up-to-date;
4. Processed fairly, legally and transparently;
5. Kept in a form which allows identification of data subjects for no longer than is necessary for the purposes of the processing;
6. Processed in accordance with the data subject’s rights, in a way that ensures adequate security of processing so that the data are intact, confidential and available.

4.3. Purpose and basis of data processing

Dokia Air collects and processes personal data for the following purposes:

1. Providing air transportation services (for the conclusion and performance of a contract to which the Customer or the data subject is a party, sending notifications/information about Dokia Air services). This activity includes the collection of information required for the contracting and execution of services, archiving both in physical and electronic format of documents, performing audit services, resolving disputes, investigations or any other petitions/complaints/requests to which Dokia Air is a party as a result of the provision of services;
2. Providing support services as requested by the Customer;
3. Compliance with legal obligations for airlines.
   This processing is legitimately based on the provisions of Article 6 para. 1 letter c) of the GDPR.
4. Marketing and customer relations.
   Your consent is used:
   • to give you a personalized service;
   • for submitting an offer when you log in to our website;
   • for customer service communications.
   We use your data to manage our relationship with you as a customer and to improve our services and your experience with us. This processing is legitimately based on Article 6 paragraph (1) sentence 1 letter a) of the GDPR.
   You have the right to refuse or object to commercial or direct marketing activities, including profiling for the purpose of such activities.
5. Improving and developing services.
   On the basis of the legitimate interest of the company, Dokia Air uses personal data:
   • for centralizing operations and maintaining an internal database on the Customer portfolio;
   • analyzing data on the history of our collaboration;
   • customer segmentation and profiling to determine your preferences;
   • to develop customer loyalty and retention programs.
   This processing is legitimately based on Article 6 paragraph (1) sentence 1 letter f) of the GDPR.

4.4. Recipients of information

In order to achieve the purposes mentioned above in paragraph 4.3, the recipients of personal data are:

1. authorities, institutions and legal persons with responsibilities in the field of air transport;
2. associated airlines;
3. judicial bodies;
4. processors, according to the law;
5. service providers, i.e. economic operators authorized in accordance with Article 28 of the GDPR.

Dokia Air ensures through contractual regulations that these service providers process personal data in compliance with European data protection legislation to guarantee a high level of data protection (e.g. standard contractual clauses, existence of binding corporate rules, etc.) even if personal data are transferred to a country where a different level of data protection is commonly used and for which there is no adequacy decision of the EU Commission.

Notification regarding the processing of personal data called “API-PNR France system”

It provides the PNR and API data transmission for each flight from or to France to the “National Travel Data Agency (NTDA)”.

In accordance with Article L.232-7 paragraph III of the Internal Security Code and decree 2018-714 dated 03/08/2018, air carriers certified and connected to the API/PNR France information system have to inform concerned persons quoted in § II (namely the passengers) about the existing treatment of PNR/API data.

“In accordance with Article L 232-7 of the French Internal Security Code, please be informed that air carriers have to transmit reservation/checking and boarding data collected from their passengers (PNR/API) to the French national public services and competent authorities for the purposes and under conditions as defined in the Decree N° 2014-1095 dated 26/09/2014 and the modifying Decree N° 2018-714 dated 03/08/2018.”

4.5. Mandatory/Voluntary data provision

The provision of the following data is necessary for us to be able to enter into a contract with you or to contact you for the purposes indicated above:

1. last and first name;
2. a copy of identity documents and/or passport or a travel document issued by the competent authorities for border crossing, according to the travel itinerary;
3. personal identification number, series and number of valid travel documents issued by the competent authorities;
4. contact details, such as: e-mail, telephone, physical or business address, if applicable, position within the employing entity;
5. bank account and other financial information necessary for the contractual relationship.

Providing the following data is optional:

1. information you provide about your preferences;
2. information about your use of our website;
3. communications you send or forward to us through emails, chat services, calls and social networks;
4. information about your computer and your visits to and use of this website, including your IP address, geographical location, browser type, referrer, duration of visit and number of page views, whether you have opened emails from us, whether you have clicked on links in our emails.

You are under no obligation to provide us with all such personal data, and such data is not a legal or contractual requirement or a requirement necessary to enter into a contract. If you do not provide us with this personal data, this will have no further consequences for you.

4.6. Duration of data storage

Dokia Air stores your personal data until you request it to be deleted. You may at any time request that we erase certain information or close your account, and we will comply with such requests, subject to the retention of certain information, where required by applicable law or our legitimate interests.

When we no longer need your personal data, we will securely erase or destroy them. We will also consider whether and how we can minimize over time the amount of personal data we use and whether we can anonymize your personal data so that they are no longer associated with you or identify you, in which case we may use that information without notifying you later.

5. Your Rights

5.1. Exercising your rights

You can contact the company to exercise your rights under Regulation 2016/679 at the following contact details:

Dokia Air S.R.L., with registered office in Bucharest, Sector 1, Șos București – Ploiești, 2nd floor;
E-mail: [email protected]

In order to obtain official interpretations related to the exercise of your rights deriving from the personal data protection legislation, or to express your dissatisfaction with the manner in which Dokia Air S.R.L. ensures the processing of personal data, you may contact the National Supervisory Authority for Personal Data Processing at the following contact details:

• by post or courier to the address in Bucharest, Bd. General Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336;
• by e-mail to [email protected];
• by fax to 0318.059.602;
• by telephone to 0318.059.211.

Under the GDPR, these rights are:

1. The right to receive information about data processing and a copy of the processed data (right of access, Article 15 GDPR).
2. The right to request the rectification of inaccurate or incomplete data (right to rectification, Article 16 GDPR).
3. The right to request erasure of personal data (the right to be “forgotten”) and, where personal data has been made public, to have the information about the erasure request transmitted to other controllers (right of erasure, Article 17 GDPR).

   The “right to be forgotten” is the right of the Customer to obtain from our company the erasure of personal data from the website without undue delay, and we, as controllers, are obliged to comply with the request if one of the following reasons exists:

   • the data are no longer necessary for the purposes for which they were collected or processed;
   • the Customer withdraws the consent on the basis of which the processing takes place;
   • when the Customer objects to the processing of his or her data;
   • when there is uncertainty about the lawfulness of the processing of personal data;
   • if there is a legal obligation that we as a controller will comply with;
   • if the personal data belong to children under the age of 16 and their parents or persons exercising parental rights withdraw their consent.

   The situations where we are not obliged to comply with the Customer’s request to erase personal data are:

   • exercising the right to free expression and information;
   • compliance with a legal obligation;
   • reasons of public interest in the field of public health;
   • archiving purposes in the public interest, scientific or historical research or for statistical purposes;
   • establishing, exercising or defending a right in court.
4. The right to request restriction of data processing (right to restriction of processing, Article 18 GDPR). You can request restriction of processing if you contest the accuracy of the data, as well as in other cases provided by law. This right is available to you when:
   • you challenge the accuracy of your personal data we process;
   • the processing of your personal data is unlawful;
   • we do not need your personal data for the purpose of the processing, but you request that we retain them for the establishment, exercise or defense of a legal claim;
   • you object to the processing of your personal data, for as long as we verify the existence of our legitimate interest in processing your data.
5. The right to receive personal data relating to the data subject in a structured, commonly used and machine-readable format and to request the transmission of these data to another controller (right to data portability, Article 20 GDPR).
6. The right to object to data processing with the intention to cease processing. You can object, in particular, to data processing that is based on our legitimate interest (right to object, Article 21 GDPR).
7. The right to withdraw at any time a consent given in order to stop data processing that is based on your consent. Withdrawal will not affect the lawfulness of processing based on consent given prior to withdrawal (right to withdraw consent, Article 7 GDPR).
8. The right to lodge a complaint to a supervisory authority if you consider that data processing is a breach of the GDPR (right to lodge a complaint to a supervisory authority, Article 77 GDPR).
9. Additional rights related to automated decisions: you can ask for and obtain human intervention in the processing, you can express your own point of view on the processing and you can challenge the decision.

If you have any questions regarding the processing of your personal data, or if you wish to make any request to us, as well as to exercise any of your rights regarding the processing of your personal data, please contact us at:

• E-mail: [email protected]
• Telephone: +40 790 740 486
• Office: in Bucharest, Sector 1, Șos București – Ploiești, 2nd floor.

5.2. Security of data processing and storage

Dokia Air S.R.L. has adopted technical and organizational data processing measures, updated in accordance with GDPR requirements, in order to protect your personal data against any unauthorized access, improper use or transmission, unauthorized modification, destruction or accidental loss. All our employees and collaborators, as well as any third parties acting on our behalf and for us, are obliged to respect the confidentiality of your information and the GDPR requirements in accordance with the provisions of this Policy.

Some of your personal data may be transferred to third parties and you express your express consent to do so, as well as in situations where there is a legal obligation for Dokia Air S.R.L. to do so.

We make sure that our contractual partners who have access to the personal data we process impose contractual obligations on them in accordance with the legal provisions, and that we verify their compliance with the obligations they have undertaken. They will process the personal data on our behalf and for us, only in accordance with the instructions received from us and only in compliance with the security and confidentiality requirements within the limits imposed.

In order to fulfill the purposes mentioned above, it is possible that Dokia Air S.R.L. may transfer some or all categories of personal data outside Romania or the EU/EEA. The EEA consists of the countries of the European Union, Switzerland, Iceland, Liechtenstein and Norway. This type of data transfer may occur if our servers (i.e. where we store the data) or our suppliers and service providers are based outside the EEA.

Before we transfer personal data from the European Economic Area (EEA), we will ensure that there are adequate safeguards to be used, including signing a Data Transfer Agreement in accordance with the requirements of the European Union and, if necessary, we will obtain the authorization of the competent Data Protection Authority. The entity receiving personal data must comply with the personal data processing principles set out in the Cross-Border Data Transfer Procedure.