Privacy notice

What we collect, why, where it is kept, and how to get it removed. Short version: only what you type into a form, kept in the EU, never sold.

Last updated 1 August 2026

Who is responsible

Publishing Office SRL is the data controller for personal data collected through emptylegslist.com. Contact us about anything on this page through the contact form.

What we collect

Nothing at all, if you just browse

Browsing the flight list sets no cookies and loads no analytics or advertising scripts. See the cookies and local storage notice for the three things stored in your own browser.

Quote requests

The route, date, passenger count and aircraft you ask about, plus your name, email address, phone number if you give one, any extras you tick and any notes you write. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in operating an enquiry service.

Route alerts

Your email address and the route you asked to be told about. Legal basis: your consent, given when you subscribe. Every alert email carries an unsubscribe link.

Full list access

If you unlock the full list, the contact details you enter at that point, together with the exact consent wording shown to you and the time you accepted it. Legal basis: your consent.

Contact messages

Your name if you give one, your email address, your subject line, your message, and the browser user agent string of the request. Legal basis: our legitimate interest in answering you.

Server logs

Our hosting provider records standard request logs, including IP addresses, for security and to keep the service running. Legal basis: legitimate interest.

What we do with it

• Answer you, and pass a quote request to charter operators covering that route so they can quote you directly.
• Send the alerts you subscribed to.
• Keep the service working and defend it against abuse.

We do not sell personal data, we do not share it with advertisers, and we do not use it for profiling or automated decisions.

Who else sees it

• Charter operators receive the contents of a quote request when it concerns a route they fly. That is the point of the request. They then become independent controllers of what you sent them, under their own privacy terms.
• Supabase hosts our database. The project runs in the EU (Frankfurt, eu-central-1).
• Vercel hosts and serves the site.
• Resend delivers our transactional email.

Each of these acts as a processor on our instructions. Some are US companies with EU infrastructure, so a transfer outside the EEA can occur; where it does, it relies on the European Commission's standard contractual clauses.

How long we keep it

• Quote requests and contact messages: up to 24 months from the last exchange with you, then deleted.
• Alert subscriptions: until you unsubscribe or ask us to delete them.
• Full list access records: up to 24 months.
• Server logs: as long as our providers retain them, which is short.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interest, and withdraw consent at any time where consent is the basis. Withdrawing consent does not affect what was lawful before.

Write to us through the contact form and we will act within one month. We do not charge for this. If you are unhappy with how we handle it, you can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

Security

Data is transmitted over HTTPS and stored in a database that is not readable with the public key our website uses. Form submissions go through a server-side function; the tables holding your details are not exposed to the browser. No system is perfectly secure, but no personal data from our forms is readable from the public site.

Children

This site is not aimed at children and we do not knowingly collect their data.

Changes

If we change this notice we update the date at the top. Material changes will be flagged on the site.