Datenschutzerklärung für Partner

This Privacy Statement explains how Altitudes Group B.V., trading as "Tomo Flight Claim", a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands, registered with the Netherlands Chamber of Commerce (KVK) under number 93488432, with its registered office at Weezenhof 6745, 6536 BG Nijmegen, the Netherlands ("Tomo Flight Claim", "we", "us") processes personal data in the Tomo Partner Program: on this website (partners.tomoclaim.com), in the partner dashboard, and in our communication with partners and the people who work for them.

1. Who is responsible

1.1. Tomo Flight Claim is the data controller for the personal data described in this statement. For privacy matters, contact privacy@tomoclaim.com.

1.2. This statement does not cover the personal data of travellers whose claims we pursue. That processing is governed by the Tomo Flight Claim Privacy Policy, including for travellers who reach us through a partner link, a partner's branded subdomain or a draft-and-invite from the partner dashboard. Section 5 explains how responsibility is divided between the Partner and us for that data.

2. Data we process

2.1. Registration and account. Company name, partner type, the contact e-mail address, the full name of the registering person and a password. Passwords are stored only in hashed form; we cannot read them. We also record the status of your application (pending, active, suspended) and when the account was created.

2.2. Partner profile and payout details. Your logo, accent colour and custom domain (with the verification token used to prove you control it), and the details needed to pay commissions and issue statements: IBAN, VAT number, billing address and company registration number. The IBAN is stored encrypted and shown in the dashboard with the last four digits only.

2.3. Team members. The name, e-mail address and role of each person you add to your partner account. You are responsible for informing them that their details are processed under this statement.

2.4. Referrals and claims. Your referral codes and, for each referred claim, the flight details, claim status, compensation and commission amounts, and the names and signing status of the passengers — the information you need to track the claims you referred. Travellers' bank details and signatures are never shown to partners.

2.5. Communication. The e-mails we exchange with you about registration and approval, password resets, claim milestones and monthly commission statements.

2.6. Technical data. Your IP address, browser type and the requests you make, in server logs we keep for security and abuse prevention, and the session cookie described in section 8.

2.7. Website statistics. Aggregated, cookieless usage statistics (see section 8). Before anything is measured we strip tokens, claim identifiers and query parameters from the page address; the statistics contain no name, e-mail address, IBAN or customer domain.

3. Why we process it and on what legal basis

3.1. Running the partner programme — creating and approving your account, attributing referred claims to you, showing their progress in the dashboard, calculating and paying commissions and sending statements. Legal basis: performance of the Partner Agreement (GDPR art. 6(1)(b)).

3.2. Invoicing, accounting and tax — keeping the records of commissions paid that Dutch law requires us to retain. Legal basis: compliance with a legal obligation (art. 6(1)(c)).

3.3. Security, abuse prevention and improving the service — protecting accounts, detecting fraudulent referrals and understanding, in aggregate, how the site and dashboard are used. Legal basis: our legitimate interest in a secure and working service (art. 6(1)(f)); you may object as described in section 10.

3.4. Service messages — e-mails you need to use the programme (section 2.5). Legal basis: performance of the Partner Agreement. We do not use partner data for third-party marketing and do not sell it.

4. Where the data comes from

4.1. Most data comes from you: the registration form, the dashboard settings and the team members you add. Claim data comes from the travellers you refer and from the airlines, authorities and dispute bodies we deal with on their behalf. Technical data and statistics are generated by your use of the site.

5. Travellers' data: who is responsible for what

5.1. For any traveller data you collect before a referral — in your own systems, before the traveller reaches us — the Partner is the data controller and must have a lawful basis to share it with us (Partner Agreement, section 2.4).

5.2. From the moment a claim is submitted, Tomo Flight Claim is the data controller for the claim data, under the Tomo Flight Claim Privacy Policy.

5.3. The traveller data visible in the partner dashboard is made available to you solely to track the status of the claims you referred (Partner Agreement, section 7.3). You may not use it for any other purpose, and you must keep it confidential.

6. Who receives the data

6.1. We use the following processors, who act only on our instructions under data processing agreements:

• Amazon Web Services — hosting of our API and database, and e-mail delivery (Amazon SES).
• Netlify — hosting and delivery of this website and the partner dashboard.
• Plausible Analytics — privacy-friendly website statistics without cookies or personal identifiers.
• Our bank (bunq) — executing the SEPA transfers of your commissions.

6.2. Where a processor handles data outside the European Economic Area, we rely on the European Commission's standard contractual clauses or an adequacy decision. We do not share partner data with airlines or other third parties, and we do not sell personal data.

7. How long we keep it

7.1. Account, profile and team data: for the duration of the Partner Agreement. After termination, dashboard access is deactivated within 7 business days (Partner Agreement, section 8.5) and the data is deleted or anonymised within 12 months, unless a longer period is required by law.

7.2. Commission statements, invoices and payout records: 7 years after the end of the financial year in which they were created, as required by Dutch tax law (art. 52 Algemene wet inzake rijksbelastingen).

7.3. Claim data of referred travellers: as set out in the Tomo Flight Claim Privacy Policy (3 years after resolution of the claim).

7.4. Server logs: no longer than 90 days, unless a security incident requires us to keep specific entries longer.

8. Cookies, local storage and statistics

8.1. We set no advertising or tracking cookies and no third-party cookies, which is why this site shows no cookie banner. The only cookies are strictly necessary: session_id, which keeps you logged in to the dashboard (HttpOnly, removed when you log out or the session expires), and NEXT_LOCALE, which remembers the language you chose.

8.2. Your light/dark preference is stored in your browser's local storage only and never sent to us.

8.3. Website statistics are collected with Plausible Analytics, which sets no cookies and does not track visitors across sites. Each measurement is limited to the page (with identifiers removed), the language, the host and the outcome of an action, such as a successful or failed login — never who you are. Measurement is disabled on our staging environment and in automated tests.

9. How we protect it

9.1. All traffic to this site and to our API is encrypted (TLS, with HTTP Strict Transport Security). Sessions use HttpOnly cookies that scripts cannot read. IBANs are encrypted at rest, passwords are stored hashed, and our API never returns travellers' bank details or signatures to partner accounts. Access to partner data is limited to the roles in your own partner account and to our staff who need it to operate the programme.

10. Your rights

10.1. Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• request erasure of your data;
• restrict processing;
• receive your data in a portable format;
• object to processing based on our legitimate interests.

10.2. Most account and profile data can be changed directly in the dashboard settings. For everything else, e-mail privacy@tomoclaim.com; we respond within one month.

10.3. If you believe we process your personal data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your EU country of residence.

11. Changes to this statement

11.1. We may update this statement when the programme or the law changes. Material changes are announced to partners by e-mail at least 30 days before they take effect, in the same way as changes to the Partner Agreement.